EveryAILaw.comLaw on Artificial Intelligence
Obligations Covered
Timeline
| Milestone | Date | Notes |
|---|---|---|
| Final Senate approval | Sep 17, 2025 | Passed by Italian Parliament |
| Law No. 132/2025 promulgated | Sep 23, 2025 | Signed into law |
| Published in Gazzetta Ufficiale No. 223 | Sep 25, 2025 | Official gazette publication |
| Law enters into force | Oct 10, 2025 | 15 days after publication |
| Ministry of Health decree on health data processing | by 2026-02-07 | Art. 9 requires the decree within 120 days of entry into force; overdue and unissued as of 2026-08-15 |
| Implementing decrees preliminarily approved | Jun 10, 2026 | Council of Ministers preliminary examination; not yet published in Gazzetta Ufficiale |
Related Regulations and Standards
Related instruments are selected from shared compliance obligations and jurisdiction coverage.
Healthcare AI — Human Oversight #
Italy is the first EU member state to legislate sector-specific AI rules beyond the EU AI Act. For healthcare AI, the law establishes a hard prohibition on AI making autonomous clinical decisions — physicians retain ultimate authority regardless of AI recommendation quality. Any healthcare organisation deploying diagnostic or treatment AI in Italy must build physician-override workflows into every clinical AI deployment.
Requirements
| Requirement | Details |
|---|---|
| Physician authority | AI systems cannot replace human clinical judgment or make fully automated clinical decisions; physicians retain ultimate decision-making authority |
| Patient notification | Data subjects have the right to be informed that AI technologies are being used (Art. 7, comma 3). The Act grants a right to be informed of AI use; it does not require disclosure of decision logic or of expected benefits |
| Support role only | AI may support prevention, diagnosis, and treatment but must be positioned as a decision-support tool, not a decision-maker |
| AGENAS platform | National Agency for Regional Health Services (AGENAS) develops a national AI platform to assist medical staff; outputs are non-binding suggestions |
Sources: Squire Patton Boggs — Italian Law No. 132/2025 (first EU national AI law) Cleary IP Tech Insights — Italy adopts first national AI law in Europe Pharma Phorum — What US healthcare companies need to know about Italy's AI law Law No. 132/2025 — full text (PDF, Procura Generale Perugia / giustizia.it)
Employment AI — Transparency and Disclosure #
Italy extends AI transparency duties into employment and child contexts that sit beyond the EU AI Act's direct scope. Employers using AI in recruitment or performance evaluation must disclose AI involvement to workers — creating a specific notification duty for HR technology deployments. The parental consent requirement for under-14s applies to any AI-powered product or service used by children, including education platforms, apps, and consumer AI.
Requirements
| Requirement | Details |
|---|---|
| Worker notification | Employers must disclose to workers when AI is used in recruitment, performance evaluation, or other employment processes |
| AI decision logic disclosure | Employers must explain the logic of AI decision-making where AI is involved in employment decisions |
| Minors consent | Children under 14 require verifiable parental consent before using any AI-powered product or service |
Employment AI — Non-Discrimination #
Requirements
| Requirement | Details |
|---|---|
| Non-discrimination | AI systems used in employment must not discriminate; discriminatory AI applications in recruitment or evaluation are prohibited |
| Data protection compliance | Employers must comply with data protection principles to prevent bias in AI employment systems |
| Human oversight in employment | Employers must ensure human oversight of AI-assisted employment decisions |
Health Data for AI Research #
Italy's secondary-use pathway for health data is a sleeper provision with global reach: any organisation conducting AI research using Italian patient data — including non-Italian researchers accessing Italian health datasets — must satisfy both the GDPR and a 30-day Garante notification before processing. This covers clinical AI model training, drug discovery AI, and public health AI research.
Requirements
| Requirement | Details |
|---|---|
| Secondary use permitted | Anonymized or pseudonymized health data may be used for AI research without new patient consent, serving significant public interest |
| Garante notification | 30-day advance notification to the Italian Data Protection Authority (Garante) required before commencing AI research using health data |
| GDPR compliance | All health data processing for AI research must comply with GDPR requirements |
| Anonymization standards | Data must be properly anonymized or pseudonymized before secondary use for AI research |
Cite this regulation
Permalink: https://everyailaw.com/regulation/it-ai-law/
JSON: https://everyailaw.com/api/v1/regulations.json
Attribution: EveryAILaw, PAICE.work PBC. “Law on Artificial Intelligence”, EveryAILaw.com, Aug 15, 2026. https://everyailaw.com/regulation/it-ai-law/
Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.