Legislative Decree No. 179 of 7 October 2026, published in the Official Gazette No. 234 of 8 October 2026 and applicable from 23 October 2026, adds – after the rules of Legislative Decree 160/2026 – new rules to the Italian regulatory framework on AI (Law 132/2025 and delegated decrees).
Who supervises and how. The decree assigns AgID the task of evaluating, designating and monitoring the bodies that, in the cases provided for by the AI Act, verify the compliance of AI systems. ACN , on the other hand, entrusts market supervision: checking compliance with the rules applicable to AI systems and intervening in the event of violations. For high-risk systems used in their respective financial areas, supervision is the responsibility of the Bank of Italy, CONSOB and IVASS; the powers of the Privacy Guarantor on AI and biometrics in high-risk systems remain unaffected. The text regulates control powers, corrective measures and complaints: a company that develops or uses AI will therefore have to identify the competent authority based on the system and sector, prepare verifiable documentation and know who will handle a possible dispute. Complaints submitted to the wrong authority will be automatically forwarded to the competent authority. In certain cases in the financial sector, customer disputes relating to infringements of the AI Act may be dealt with by existing out-of-court resolution bodies, within the limits of their competence.
Personnel decisions: effective human control. Article 41 is among the provisions with the greatest immediate impact for employers. If an AI system intervenes in the processes relating to the establishment, modification or termination of the relationship, including performance evaluations and disciplinary decisions, the final decision cannot be based solely on automated processing: it must be taken by a person exercising effective and autonomous power. The employee's consent does not remove this constraint. The decree excludes from this specific provision the search and selection of candidates, even when a person does not access the next phase; however, the other relevant rules, including those of the GDPR, remain applicable. Before processing, the employer must comply with the information obligations referred to in Article 41. Upon request, the worker can obtain, with the intervention of a person, a comprehensible justification for the decision, indicating the possible weight of the AI and the main parameters considered. Decisions taken in violation of the prohibition of paragraph 1 are null and void, including dismissal. In practice, a mere formal approval of the output of the system does not offer the guarantee of autonomous human judgment: it is necessary to organize and be able to reconstruct the decision-making process.
Health and safety. Article 42 requires the use of AI that affects the organisation of work, production rhythms, methods of performance or safety-relevant decisions to be assessed, as part of the risk assessment provided for by Legislative Decree 81/2008. Employers must also inform and train workers on specific risks and prevention and protection measures. For example, before introducing tools that assign tasks, change rhythms or assist operational decisions, it will be appropriate to involve HR and safety functions in the assessment of concrete effects on work.
Penalties and management of disputes. Article 23 provides for differentiated ceilings: up to €35 million or, if higher, 7% of annual worldwide turnover for practices prohibited by the AI Act; up to €15 million or 3% for violations of the European obligations listed in the provision; up to €7.5 million or 1% for inaccurate, incomplete or misleading information provided to authorities or notified bodies. There is a specific range, up to 1 million or 0.5%, for violations of Articles 27 and 86 of the AI Act. For SMEs, micro-enterprises and innovative start-ups, the determination criterion referred to in Article 99(6) of the Regulation applies. These amounts are ceilings, not automatic sanctions: the verification must be carried out on the provision infringed, its date of application and the circumstances of the case.
Experimentation and protection of technological assets. The decree establishes an Italian regulatory experimentation space for AI (so-called regulatory sandbox), jointly managed by AgID and ACN, with a focus on access by SMEs and start-ups. However, the operating procedures and admission criteria require further measures: the establishment of the space is not yet equivalent to the opening of applications. On the industrial property front, Article 52 clarifies that data, algorithms, model architectures and training methods can only fall under the protection of trade secrets if they meet the ordinary requirements of secrecy, economic value deriving from secrecy and reasonable protection measures. For AI developers, this makes it particularly important to document accesses, confidentiality agreements and technical protection measures.
Companies can start by reconnaissance of the AI systems used in HR processes, in activities that affect safety and in regulated services; for each, it is advisable to record the purpose, the role of the company, the supplier, the potentially competent authority, the expected human intervention and the documentation available. It is a concrete basis for adapting procedures and contracts without assuming that all systems fall under the same obligations or deadlines.
