Law on Artificial Intelligence
Obligations Covered
Timeline
| Milestone | Date | Notes |
|---|---|---|
| Final Senate approval | Sep 17, 2025 | Passed by Italian Parliament |
| Law No. 132/2025 promulgated | Sep 23, 2025 | Signed into law |
| Published in Gazzetta Ufficiale No. 223 | Sep 25, 2025 | Official gazette publication |
| Law enters into force | Oct 10, 2025 | 15 days after publication |
| Ministry of Health decree on health data processing | by 2026-02-07 | Art. 9 requires the decree within 120 days of entry into force. A 2026-08-20 search of Gazzetta Ufficiale, Ministry of Health acts, and Presidency of the Council materials located no published implementing decree keyed to Art. 9 or Law 132/2025 |
| Implementing decrees preliminarily approved | Jun 10, 2026 | Council of Ministers preliminary examination; a 2026-08-20 search located no corresponding final decree in Gazzetta Ufficiale |
Related Regulations and Standards
Related instruments are selected from shared compliance obligations and jurisdiction coverage.
Healthcare AI — Human Oversight
Article 7 treats healthcare AI as support in prevention, diagnosis, care, and therapeutic choice while reserving the clinical decision to medical professionals. It separately gives the interested person a right to be informed of AI use and requires healthcare AI systems and their data to be reliable, periodically verified, and updated.
Penalties qualification: This entry does not assign a provision-specific penalty to the Article 7 requirements. Applicable oversight and sanctions depend on the competent authority and the relevant national and EU framework.
Institutional context (not a private requirement): Article 10 inserts Article 12-bis into Decree-Law 179/2012. It assigns AGENAS the design, implementation, operation, and ownership of a national healthcare AI platform. The platform supplies non-binding suggestions to healthcare professionals and doctors and access support to users. These are statutory functions of AGENAS and the platform, not requirements imposed on the private deployers described in the Article 7 provision above.
Requirements
| Requirement | Details |
|---|---|
| Physician authority | For prevention, diagnosis, care, and therapeutic choice, the decision remains with medical professionals (Art. 7(5)) |
| Patient notification | Data subjects have the right to be informed that AI technologies are being used (Art. 7, comma 3). The Act grants a right to be informed of AI use; it does not require disclosure of decision logic or of expected benefits |
| Support role only | Healthcare AI systems constitute support in prevention, diagnosis, care, and therapeutic choice (Art. 7(5)) |
| Reliability and updating | Healthcare AI systems and the data they use must be reliable, periodically verified, and updated to minimize errors and improve patient safety (Art. 7(6)) |
Sources: Law No. 132/2025, official Gazette act Law No. 132/2025, Normattiva consolidated act Squire Patton Boggs — Italian Law No. 132/2025 (first EU national AI law) Cleary IP Tech Insights — Italy adopts first national AI law in Europe Pharma Phorum — What US healthcare companies need to know about Italy's AI law Law No. 132/2025 — full text (PDF, Procura Generale Perugia / giustizia.it)
Employment AI — Transparency and Disclosure
Article 11 requires employers and principals to inform workers of workplace AI use in the cases and modalities of Article 1-bis of Legislative Decree 152/1997. That incorporated provision covers fully automated decision or monitoring systems producing indications relevant to specified employment decisions and conditions. Article 4(4) separately ties under-14 access to AI technologies and consequent personal-data processing to parental-responsibility consent.
Penalties qualification: This entry does not assign a provision-specific penalty to Article 11. Applicable consequences depend on the incorporated employment-law duties and the competent national and EU enforcement frameworks.
Requirements
| Requirement | Details |
|---|---|
| Worker notification | Employers and principals must inform workers of AI use in the cases and modalities of Art. 1-bis D.Lgs. 152/1997, which covers fully automated decision or monitoring systems producing indications relevant to hiring, management, termination, task assignment, surveillance, evaluation, performance, or contractual obligations |
| Covered-system information | For systems covered by Art. 1-bis D.Lgs. 152/1997, required information includes affected employment aspects, purposes, logic and functioning, data categories and principal parameters, control and correction measures, responsible quality-management personnel, and accuracy, robustness, cybersecurity and potentially discriminatory metric impacts |
| Industrial and commercial secret exception | The incorporated Art. 1-bis information duties do not apply to systems protected by industrial and commercial secrecy (Art. 1-bis(8)) |
| Minors consent | Access to AI technologies by children under 14 and consequent personal-data processing require consent from the person exercising parental responsibility (Art. 4(4)) |
Employment AI — Non-Discrimination
Penalties qualification: This entry does not assign a provision-specific penalty to Article 11. Applicable consequences depend on the competent employment, data-protection, national AI, and EU enforcement frameworks.
Requirements
| Requirement | Details |
|---|---|
| Non-discrimination | AI used to organize or manage an employment relationship must preserve workers' inviolable rights without discrimination based on sex, age, ethnic origin, religious belief, sexual orientation, political opinion, or personal, social, and economic conditions (Art. 11(3)) |
| Dignity and data privacy | Workplace AI use must be safe, reliable, and transparent; it must not conflict with human dignity or violate personal-data privacy (Art. 11(2)) |
Health Data for AI Research
Article 8 establishes a health-research pathway for specified public, nonprofit, IRCCS, and participating private health-sector actors. For those actors and purposes, secondary use under paragraph 2 is limited to personal data lacking direct identifiers, preserves the information duty, and carries an exception where identity is unavoidable or necessary to protect health. Processing under paragraphs 1 and 2 must be communicated to the Garante and may begin after 30 days if the Garante has not blocked it.
Penalties qualification: Article 8(6) preserves the Garante's inspection, prohibition, and sanctioning powers. This entry does not assign a fixed penalty ceiling or infringement category to Article 8 conduct.
Institutional context (not a private requirement): Article 8(4) permits AGENAS, after consulting the Garante and considering international standards and the state of the art, to establish and update guidelines for anonymization procedures and synthetic data. The provision grants an institutional power; it does not itself impose a universal anonymization standard on every researcher.
Requirements
| Requirement | Details |
|---|---|
| Eligible actors and purposes | Art. 8(1) declares processing by its listed public, nonprofit, IRCCS, and participating private health-sector actors to be of significant public interest when conducted for the provision's listed health and related AI-research purposes |
| Secondary use permitted | For the same purposes and actors, secondary use of personal data lacking direct identifiers is authorized without further consent where consent was initially required by law, subject to the information duty and the exception where identity is unavoidable or necessary to protect health (Art. 8(2)) |
| Garante communication and standstill | Processing under Art. 8(1) and (2) must be communicated to the Garante with the information listed in Art. 8(5), and may begin after 30 days if it has not been blocked |
| Data-subject information | The information duty remains applicable; Art. 8(2) permits a general notice on the controller's website, while Art. 8(3) requires notice under GDPR Article 13 for processing to anonymize, pseudonymize, or synthesize data |
| GDPR qualification | Article 8 expressly operates within GDPR Article 9 and the Italian data-protection code; the applicable basis and safeguards depend on the actor and processing described in the provision |
Cite this regulation
Permalink: https://everyailaw.com/regulation/it-ai-law/
JSON: https://everyailaw.com/api/v1/regulations.json
Attribution: EveryAILaw, PAICE.work PBC. “Law on Artificial Intelligence”, EveryAILaw.com, Aug 15, 2026. https://everyailaw.com/regulation/it-ai-law/
Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.