Italy: technology regulation at a glance

Framework: EU Regulation 2023/1114 (MiCAR), fully applicable from 30 December 2024, implemented in Italian law by Legislative Decree No. 129 of 5 September 2024 ('Decreto MiCAR'). Competent authorities: CONSOB (conduct, transparency, market integrity, investor protection) and Banca d'Italia (prudential supervision, AML, stability). AML registration via OAM (Organismo Agenti e Mediatori) for legacy VASPs in transitional regime. Crypto taxation under the 2025 Budget Law (Legge n. 207/2024) as amended by the 2026 Budget Law.

Crypto-assets are legal in Italy and fully regulated under the EU MiCA Regulation, which became fully applicable on 30 December 2024 and was implemented domestically by Legislative Decree 129/2024. CONSOB and Banca d'Italia share supervisory powers over CASPs and stablecoin (ART/EMT) issuers, with a transitional regime allowing legacy OAM-registered VASPs to continue operating until 30 June 2026, after which a CASP authorization under MiCAR is mandatory. Tax treatment was tightened by the 2025 Budget Law, raising the capital-gains rate on crypto to 33% from 1 January 2026 (with a 26% carve-out for MiCAR-compliant euro stablecoins), alongside DAC8 reporting obligations.

Framework: EU AI Act (Regulation (EU) 2024/1689) + Italian Law No. 132 of 23 September 2025 ('Disposizioni e deleghe al Governo in materia di intelligenza artificiale'), in force since 10 October 2025; national competent authorities: AgID (notifying authority) and ACN (market surveillance), with Garante per la protezione dei dati personali for data protection aspects.

Italy applies the EU AI Act as the baseline risk-based framework and became the first EU Member State to adopt a dedicated national AI law — Law No. 132/2025, in force since 10 October 2025 — which complements (rather than duplicates) the EU regulation by setting principles and sector-specific rules for healthcare, labour, public administration, justice, research, intellectual professions and protection of minors. Italy has designated AgID as the notifying authority and the Agenzia per la Cybersicurezza Nazionale (ACN) as the market surveillance authority and single point of contact with the EU, while the Garante Privacy retains GDPR powers over AI processing personal data. The law also delegates the Government to adopt implementing decrees and introduces criminal-law amendments, including a new offence for malicious deepfakes.

Framework: EU General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR) directly applicable, as supplemented nationally by the Italian Personal Data Protection Code (Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018). Supervised by the Garante per la protezione dei dati personali.

Italy has a comprehensive, in-force personal data protection regime built on the directly applicable GDPR together with the national Privacy Code (Legislative Decree 196/2003, substantially rewritten by Legislative Decree 101/2018 to align with the GDPR). The Garante per la protezione dei dati personali — an independent authority established in 1997 — is the GDPR Article 51 supervisory authority and is one of the most active data-protection regulators in the EU, with powers extending to administrative fines up to €20 million or 4% of worldwide turnover and additional criminal penalties for the most serious infringements.

Framework: Banca d'Italia is the competent authority for payment services and e-money under the Italian Banking Act (TUB, Legislative Decree 385/1993) and Legislative Decree 11/2010, with PSD2 (Directive EU 2015/2366) transposed by Legislative Decree 218/2017 (in force 13 Jan 2018). Supervisory requirements are set out in Banca d'Italia's 'Supervisory Provisions for Payment Institutions and Electronic Money Institutions' of 23 July 2019.

Italy operates a mature, EU-aligned licensing regime for digital payments and fintech, with Banca d'Italia authorising and supervising payment institutions (PIs) and electronic money institutions (EMIs/IMELs). The regime fully implements PSD2 (open banking, strong customer authentication, access-to-account via licensed TPPs), the E-Money Directive, and the EU Instant Payments Regulation (2024/886), with PSD3/PSR negotiations ongoing and BNPL being drawn into supervised consumer credit via the EU CCD2 from November 2026.

Framework: Interministerial Decree of 29 February 2024 (Gazzetta Ufficiale, 4 April 2024) implementing Article 27-quater of Legislative Decree No. 286/1998 (Immigration Code); administered by the Ministry of Foreign Affairs (MAECI), Ministry of the Interior, and Ministry of Labour via Italian consulates and Questure (immigration offices).

Italy operates a dedicated Digital Nomad / Remote Worker Visa (national long-stay Type D) in force since April 2024, targeted at highly qualified non-EU professionals who work remotely for foreign employers or clients. The regime sits outside the Decreto Flussi quotas and requires no Nulla Osta, with consulates applying harmonised criteria on income, qualifications, insurance, and housing. In parallel, Italy also offers an Investor Visa (Golden Visa) and an Elective Residence Visa for passive-income retirees, providing multiple residency pathways.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065) in force since 17 Feb 2024, implemented nationally by Decree-Law No. 123/2023 (converted into Law No. 159/2023, the 'Caivano Decree') designating AGCOM as Italy's Digital Services Coordinator; complemented by AGCOM Resolution No. 96/25/CONS on age verification and Law No. 93/2023 (Piracy Shield) on live-content blocking.

Italy regulates online content and safety through the directly applicable EU Digital Services Act, with AGCOM designated as the national Digital Services Coordinator and empowered to receive complaints, appoint trusted flaggers and impose DSA fines (up to 6% of global turnover). On top of the DSA, Italy has layered national rules — including a mandatory double-blind age-verification regime for adult/age-restricted platforms (fully applicable from 12 November 2025) and the AGCOM-run 'Piracy Shield' live-blocking system. The EU Terrorist Content Online Regulation (2021/784) also applies directly.

Framework: Legislative Decree 138/2024 (transposing EU NIS2 Directive 2022/2555) and Law 90/2024 (national cybersecurity law), supervised by the Agenzia per la Cybersicurezza Nazionale (ACN) which also hosts CSIRT Italia; sectoral layers include DORA for financial entities (Banca d'Italia, CONSOB, IVASS) and GDPR enforcement by the Garante.

Italy operates a comprehensive, in-force cybersecurity regime. NIS2 was transposed through Legislative Decree 138/2024 (published 1 October 2024, entered into force 16 October 2024), making the National Cybersecurity Agency (ACN) the single competent authority and point of contact, with CSIRT Italia handling incident notifications. This is layered with Law 90/2024 on the National Cybersecurity Perimeter (public administrations and critical operators), sector regimes such as DORA for finance, and GDPR Article 33 breach notification duties.

Framework: Italian Civil Code (Art. 2463 et seq. for SRL; Art. 2463-bis for simplified SRL/SRLS), Companies Register (Registro delle Imprese) at the Chamber of Commerce, Single Business Communication (ComUnica) via impresainungiorno.gov.it; EU freedom of establishment for EU/EEA nationals and reciprocity principle for non-EU nationals

Italy has a well-defined but notarially mediated company-formation regime: the standard vehicle (SRL) requires a notarial public deed, a 25% paid-in capital deposit on a €10,000 nominal (100% if single-member), and filing with the Registro delle Imprese via ComUnica. EU/EEA citizens enjoy full freedom of establishment with no residency or local-director requirement, whereas non-EU founders must satisfy the Italian reciprocity principle and generally hold a valid residence permit or qualifying visa, making the process straightforward but not frictionless.