Skip to content
World Watch

AI regulation in Italy: laws & policy (2026)

AI in Italy: comprehensive law.

Italy applies the EU AI Act as the baseline risk-based framework and became the first EU Member State to adopt a dedicated national AI law — Law No. 132/2025, in force since 10 October 2025 — which complements (rather than duplicates) the EU regulation by setting principles and sector-specific rules for healthcare, labour, public administration, justice, research, intellectual professions and protection of minors. Italy has designated AgID as the notifying authority and the Agenzia per la Cybersicurezza Nazionale (ACN) as the market surveillance authority and single point of contact with the EU, while the Garante Privacy retains GDPR powers over AI processing personal data. The law also delegates the Government to adopt implementing decrees and introduces criminal-law amendments, including a new offence for malicious deepfakes.

Last verified Official sources first · MethodologyCompare Italy with other countriesAlso in italiano

Legal framework

EU AI Act (Regulation (EU) 2024/1689) + Italian Law No. 132 of 23 September 2025 ('Disposizioni e deleghe al Governo in materia di intelligenza artificiale'), in force since 10 October 2025; national competent authorities: AgID (notifying authority) and ACN (market surveillance), with Garante per la protezione dei dati personali for data protection aspects.

The EU AI Act in Italy

In Italy, artificial intelligence is governed by the EU AI Act, the first comprehensive AI law, which applies directly as an EU regulation.

Framework
the EU AI Act (Regulation (EU) 2024/1689)
Approach
risk-based: unacceptable-risk AI is banned, high-risk AI faces strict duties, limited-risk AI has transparency rules
General-purpose AI
transparency duties for all GPAI models; systemic-risk models add safety and evaluation obligations
Timeline
phased: prohibitions from Feb 2025, GPAI rules from Aug 2025, most high-risk obligations from Aug 2026
Maximum fine
€35 million or 7% of global annual turnover for prohibited-AI breaches
Oversight
national market-surveillance authorities, coordinated by the EU AI Office

The AI Act is an EU regulation applied directly in Italy; national market-surveillance authorities handle enforcement.

Key points: artificial intelligence in Italy

  1. EU AI Act baseline

    As an EU Member State, Italy applies Regulation (EU) 2024/1689 (AI Act), with its risk-based tiering (prohibited, high-risk, limited/minimal) and GPAI obligations rolling in through 2026-2027. Italian Law 132/2025 explicitly aligns with and supplements the EU framework.

    eur-lex.europa.eu nortonrosefulbright.com

  2. National Law No. 132/2025

    Published in Gazzetta Ufficiale No. 223 of 25 September 2025 and in force since 10 October 2025, the 28-article law sets principles (human-centric, transparency, non-discrimination, cybersecurity) and sector rules for healthcare, labour, public administration, justice, research, and intellectual professions, plus a legislative delegation to the Government for further decrees.

    gazzettaufficiale.it giurisprudenzapenale.com

  3. Competent authorities (AgID & ACN)

    AgID (Agenzia per l'Italia Digitale) is designated as the notifying authority (promotion, notification, accreditation of conformity-assessment bodies); ACN (Agenzia per la Cybersicurezza Nazionale) is the market-surveillance authority with inspection and sanctioning powers, and single national contact point under Article 70 of the AI Act. Bank of Italy, CONSOB and IVASS supervise AI in financial-sector use cases.

    insideprivacy.com squirepattonboggs.com

  4. Criminal law & deepfakes

    The law amends the Penal Code: it introduces a new Article 612-quater criminalising the illicit dissemination of AI-generated or altered audio/visual deepfakes causing unjust harm (1-5 years imprisonment) and adds a general aggravating circumstance for crimes committed with AI assistance.

    giurisprudenzapenale.com nortonrosefulbright.com

  5. Sector rules: health, work, minors

    AI in healthcare must preserve the physician's final decision and inform patients; secondary use of pseudonymised data for research is enabled with safeguards. Employers must inform workers of AI used in the workplace. Minors under 14 require parental consent to use AI services; the law also addresses AI in intellectual professions and in public administration.

    securiti.ai hoganlovells.com

  6. Garante Privacy & GDPR interface

    The Italian Data Protection Authority (Garante per la protezione dei dati personali) retains its full GDPR powers over AI systems processing personal data, has issued opinions on draft AI implementing legislation, and has actively enforced against AI providers (e.g. ChatGPT, DeepSeek), requiring legal bases for training data, DPIAs and transparency.

    garanteprivacy.it dataguidance.com

  7. National AI Strategy 2024-2026

    Italy's Strategy for Artificial Intelligence 2024-2026, coordinated by AgID and the Department for Digital Transformation, structures non-binding policy actions across four pillars — Research, Public Administration, Businesses and Education — complementing the binding EU/national rules.

    agid.gov.it oecd.ai

The EU AI Act in Italy: FAQ

Does the EU AI Act apply in Italy?

Yes. As an EU member, Italy is covered by the EU AI Act (Regulation (EU) 2024/1689), which applies directly.

What does the EU AI Act regulate in Italy?

It uses a risk-based approach: unacceptable-risk AI is banned, high-risk AI faces strict obligations, and general-purpose AI models carry transparency duties.

When does the EU AI Act take effect in Italy?

It is phased: prohibitions applied from February 2025, general-purpose-AI rules from August 2025, and most high-risk obligations from August 2026.

What are the penalties under the EU AI Act in Italy?

Up to €35 million or 7% of global annual turnover for breaching the prohibited-AI rules, with lower tiers for other breaches.

Timeline of decisions

  1. Law · official
    Italy enacts Law No. 132/2025, the EU's first national AI law

    Parliament gave final approval to Italy's national AI law (in force 10 October 2025), making Italy the first EU member state to legislate domestically alongside the EU AI Act, with sector rules for healthcare, the workplace, justice, copyright and minors, and designating AgID and the cybersecurity agency (ACN) as national competent authorities.

    Government of Italy (programmagoverno.gov.it)

  2. Enforcement · official
    Garante fines Replika maker €5 million over chatbot privacy failures

    The Italian DPA fined Luka Inc., developer of the 'Replika' companion chatbot, €5 million for lacking a legal basis for processing and inadequate age verification, following its 2023 block of the service.

    EDPB

  3. Enforcement
    Garante blocks DeepSeek for Italian users

    The Italian DPA imposed an urgent, definitive limitation on processing of Italian users' data by China's DeepSeek after the companies' responses on data collection and legal bases were deemed insufficient, prompting parallel probes across the EU.

    Bird & Bird (reporting Garante decision)

  4. Enforcement · official
    Garante fines OpenAI €15 million over ChatGPT

    Concluding its investigation, the Italian DPA fined OpenAI €15 million for lacking a legal basis to train ChatGPT on personal data, transparency failures and weak age verification, the first GDPR fine targeting a generative-AI service, and ordered a six-month public information campaign.

    Garante per la protezione dei dati personali

  5. Law · official
    EU AI Act enters into force (applies in Italy)

    Regulation (EU) 2024/1689 (the AI Act) entered into force, establishing the EU-wide risk-based framework directly applicable in Italy and setting the baseline that Italy's later national law complements.

    EUR-Lex

  6. Guidance · official
    Italy publishes the National AI Strategy 2024-2026

    AgID released the updated Italian Strategy for Artificial Intelligence 2024-2026, refreshing the national framework on research, public administration, business adoption and skills ahead of national legislation.

    AgID

  7. Law
    Council of Ministers approves the national AI bill

    The Italian government approved a draft AI law (later presented to the Senate on 20 May 2024) intended to complement the EU AI Act, covering public administration, healthcare, the judiciary, professions, data protection and copyright, the bill that became Law 132/2025.

    Portolano Cavallo (reporting Council of Ministers)

  8. Decision · official
    Garante lifts ChatGPT ban after OpenAI compliance

    After OpenAI added a privacy disclosure, an age-verification option and a training-data opt-out, the Italian DPA suspended its temporary limitation, restoring ChatGPT access in Italy roughly one month after the block.

    Garante per la protezione dei dati personali

  9. Enforcement · official
    Garante temporarily blocks ChatGPT

    The Italian DPA ordered an immediate temporary limitation on OpenAI's processing of Italian users' data, citing no legal basis for mass training-data collection, lack of transparency, inaccurate outputs and no age checks, the world's first regulatory block of ChatGPT.

    Garante per la protezione dei dati personali

  10. Enforcement
    Garante blocks the Replika AI chatbot

    The Italian DPA issued an urgent order halting Replika's processing of Italian users' data over risks to minors and vulnerable users and absent age verification, Italy's first enforcement action against a generative-AI chatbot, foreshadowing the ChatGPT case.

    TechCrunch (reporting Garante order)

  11. Guidance · official
    Italy adopts the Strategic Programme on AI 2022-2024

    Italy's ministries and the digital-transition office launched the National Strategic Programme for Artificial Intelligence, the foundational policy framework for AI research, public-sector adoption, talent and infrastructure that preceded binding regulation.

    Italian Government (innovazione.gov.it)

Sources

  1. eur-lex.europa.eu/eli/reg/2024/1689/oj
  2. gazzettaufficiale.it/eli/gu/2025/09/25/223/sg/pdf
  3. giurisprudenzapenale.com/2025/09/26/intelligenza-artificiale-pubblicata-in-gazzetta-ufficiale-
  4. nortonrosefulbright.com/en/knowledge/publications/9bfedfea/italy-enacts-law-no-132-2025-on-ar
  5. squirepattonboggs.com/en/insights/publications/2025/10/italian-law-no-132-2025-the-first-do
  6. insideprivacy.com/artificial-intelligence/italy-adopts-artificial-intelligence-law/
  7. hoganlovells.com/en/publications/initial-reflections-on-law-13225-italys-approach-to-a
  8. securiti.ai/italy-ai-law-guide/
  9. agid.gov.it/sites/agid/files/2024-07/Strategia_Italiana_per_lIntelligenza_Artific
  10. oecd.ai/en/dashboards/national/italy
  11. garanteprivacy.it/home/docweb/-/docweb-display/docweb/10190719
  12. dataguidance.com/jurisdictions/italy

Next for Italy: Data & PrivacyComprehensive law

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 6 Oct 2026. Methodology & how to cite · State of Technology Regulation 2026