Law on Artificial Intelligence

Jurisdiction:
Italy
enforcing
Effective:
Oct 10, 2025
Authority:
Agency for Digital Italy
Official text

Obligations Covered

Human Oversight Transparency & Disclosure Bias & Discrimination Prevention Data Governance

Timeline

MilestoneDateNotes
Final Senate approvalSep 17, 2025Passed by Italian Parliament
Law No. 132/2025 promulgatedSep 23, 2025Signed into law
Published in Gazzetta Ufficiale No. 223Sep 25, 2025Official gazette publication
Law enters into forceOct 10, 202515 days after publication
Ministry of Health decree on health data processingby 2026-02-07Art. 9 requires the decree within 120 days of entry into force. A 2026-08-20 search of Gazzetta Ufficiale, Ministry of Health acts, and Presidency of the Council materials located no published implementing decree keyed to Art. 9 or Law 132/2025
Implementing decrees preliminarily approvedJun 10, 2026Council of Ministers preliminary examination; a 2026-08-20 search located no corresponding final decree in Gazzetta Ufficiale

Related Regulations and Standards

Related instruments are selected from shared compliance obligations and jurisdiction coverage.

Healthcare AI — Human Oversight

Copy link to this provision

Obligation:
Human Oversight
enforcing
Effective:
Oct 10, 2025
Risk tier:
high
Scope:
Use of AI systems in healthcare for prevention, diagnosis, care, or therapeutic choice; the clinical decision remains with medical professionals (Art. 7(5))
high-impactcross-domain
Article 7 treats healthcare AI as support in prevention, diagnosis, care, and therapeutic choice while reserving the clinical decision to medical professionals. It separately gives the interested person a right to be informed of AI use and requires healthcare AI systems and their data to be reliable, periodically verified, and updated. Penalties qualification: This entry does not assign a provision-specific penalty to the Article 7 requirements. Applicable oversight and sanctions depend on the competent authority and the relevant national and EU framework. Institutional context (not a private requirement): Article 10 inserts Article 12-bis into Decree-Law 179/2012. It assigns AGENAS the design, implementation, operation, and ownership of a national healthcare AI platform. The platform supplies non-binding suggestions to healthcare professionals and doctors and access support to users. These are statutory functions of AGENAS and the platform, not requirements imposed on the private deployers described in the Article 7 provision above.

Requirements

RequirementDetails
Physician authorityFor prevention, diagnosis, care, and therapeutic choice, the decision remains with medical professionals (Art. 7(5))
Patient notificationData subjects have the right to be informed that AI technologies are being used (Art. 7, comma 3). The Act grants a right to be informed of AI use; it does not require disclosure of decision logic or of expected benefits
Support role onlyHealthcare AI systems constitute support in prevention, diagnosis, care, and therapeutic choice (Art. 7(5))
Reliability and updatingHealthcare AI systems and the data they use must be reliable, periodically verified, and updated to minimize errors and improve patient safety (Art. 7(6))

Employment AI — Transparency and Disclosure

Copy link to this provision

Obligation:
Transparency
enforcing
Effective:
Oct 10, 2025
Risk tier:
high
Scope:
Employers and principals using AI in the workplace; the incorporated information duties apply to the fully automated decision or monitoring systems and employment effects listed in Art. 1-bis D.Lgs. 152/1997. Separately, under-14 access to AI technologies and consequent personal-data processing require parental-responsibility consent (Arts. 11(2), 4(4))
high-impactcross-domain
Article 11 requires employers and principals to inform workers of workplace AI use in the cases and modalities of Article 1-bis of Legislative Decree 152/1997. That incorporated provision covers fully automated decision or monitoring systems producing indications relevant to specified employment decisions and conditions. Article 4(4) separately ties under-14 access to AI technologies and consequent personal-data processing to parental-responsibility consent. Penalties qualification: This entry does not assign a provision-specific penalty to Article 11. Applicable consequences depend on the incorporated employment-law duties and the competent national and EU enforcement frameworks.

Requirements

RequirementDetails
Worker notificationEmployers and principals must inform workers of AI use in the cases and modalities of Art. 1-bis D.Lgs. 152/1997, which covers fully automated decision or monitoring systems producing indications relevant to hiring, management, termination, task assignment, surveillance, evaluation, performance, or contractual obligations
Covered-system informationFor systems covered by Art. 1-bis D.Lgs. 152/1997, required information includes affected employment aspects, purposes, logic and functioning, data categories and principal parameters, control and correction measures, responsible quality-management personnel, and accuracy, robustness, cybersecurity and potentially discriminatory metric impacts
Industrial and commercial secret exceptionThe incorporated Art. 1-bis information duties do not apply to systems protected by industrial and commercial secrecy (Art. 1-bis(8))
Minors consentAccess to AI technologies by children under 14 and consequent personal-data processing require consent from the person exercising parental responsibility (Art. 4(4))

Employment AI — Non-Discrimination

Copy link to this provision

Obligation:
Bias Prevention
enforcing
Effective:
Oct 10, 2025
Risk tier:
high
Scope:
Employers and principals using AI to organize or manage employment relationships in Italy (Art. 11)
Penalties qualification: This entry does not assign a provision-specific penalty to Article 11. Applicable consequences depend on the competent employment, data-protection, national AI, and EU enforcement frameworks.

Requirements

RequirementDetails
Non-discriminationAI used to organize or manage an employment relationship must preserve workers' inviolable rights without discrimination based on sex, age, ethnic origin, religious belief, sexual orientation, political opinion, or personal, social, and economic conditions (Art. 11(3))
Dignity and data privacyWorkplace AI use must be safe, reliable, and transparent; it must not conflict with human dignity or violate personal-data privacy (Art. 11(2))

Health Data for AI Research

Copy link to this provision

Obligation:
Data Governance
enforcing
Effective:
Oct 10, 2025
Risk tier:
all
Scope:
Public actors, private nonprofit actors, IRCCS, and private health-sector actors participating in research projects with a public or private nonprofit actor or IRCCS, for the health and related research purposes listed in Art. 8(1)
sleepercross-domain
Article 8 establishes a health-research pathway for specified public, nonprofit, IRCCS, and participating private health-sector actors. For those actors and purposes, secondary use under paragraph 2 is limited to personal data lacking direct identifiers, preserves the information duty, and carries an exception where identity is unavoidable or necessary to protect health. Processing under paragraphs 1 and 2 must be communicated to the Garante and may begin after 30 days if the Garante has not blocked it. Penalties qualification: Article 8(6) preserves the Garante's inspection, prohibition, and sanctioning powers. This entry does not assign a fixed penalty ceiling or infringement category to Article 8 conduct. Institutional context (not a private requirement): Article 8(4) permits AGENAS, after consulting the Garante and considering international standards and the state of the art, to establish and update guidelines for anonymization procedures and synthetic data. The provision grants an institutional power; it does not itself impose a universal anonymization standard on every researcher.

Requirements

RequirementDetails
Eligible actors and purposesArt. 8(1) declares processing by its listed public, nonprofit, IRCCS, and participating private health-sector actors to be of significant public interest when conducted for the provision's listed health and related AI-research purposes
Secondary use permittedFor the same purposes and actors, secondary use of personal data lacking direct identifiers is authorized without further consent where consent was initially required by law, subject to the information duty and the exception where identity is unavoidable or necessary to protect health (Art. 8(2))
Garante communication and standstillProcessing under Art. 8(1) and (2) must be communicated to the Garante with the information listed in Art. 8(5), and may begin after 30 days if it has not been blocked
Data-subject informationThe information duty remains applicable; Art. 8(2) permits a general notice on the controller's website, while Art. 8(3) requires notice under GDPR Article 13 for processing to anonymize, pseudonymize, or synthesize data
GDPR qualificationArticle 8 expressly operates within GDPR Article 9 and the Italian data-protection code; the applicable basis and safeguards depend on the actor and processing described in the provision
Cite this regulation

Permalink: https://everyailaw.com/regulation/it-ai-law/

JSON: https://everyailaw.com/api/v1/regulations.json

Attribution: EveryAILaw, PAICE.work PBC. “Law on Artificial Intelligence”, EveryAILaw.com, Aug 15, 2026. https://everyailaw.com/regulation/it-ai-law/

Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.