Italy - National AI Law (132/2025)

Overview

Legge 23 September 2025, n.132 "Disposizioni e deleghe al Governo in materia di intelligenza artificiale" is the national statute establishing Italy's domestic framework for artificial intelligence. Published in the Gazzetta Ufficiale - Legge 23 settembre 2025, n. 132, the law enters into force on 10 October 2025 and is explicitly designed to operate in conformity with the European AI Act (Regulation (EU) 2024/1689). It codifies principles (anthropocentrism, transparency, proportionality, security, non‑discrimination), delegates implementing powers to the Government and sets up a governance architecture led by the Presidency of the Council with technical roles for AgID and the National Cybersecurity Agency (ACN). The law covers sectoral rules (healthcare, labour, public administration, finance), conformity assessment, market surveillance, penal offences for misuse of AI (including a new deepfake offence), and provisions on data, copyright and user protection. For an authoritative summary by the designated promotion agency, see AgID - AI.

Definitions

The law adopts and references the AI-related definitions used by EU Regulation 2024/1689 and clarifies national-specific terms. Key defined concepts include: "system of artificial intelligence" (broadly covering models, algorithms, software and associated data pipelines); "provider" (natural or legal person who develops and places an AI system on the market or puts it into service); "user" and "professional user" (entities deploying or employing AI in the course of economic activity); "high-risk AI systems" (as per EU lists and national extensions); "deployment" and "use"; and procedural terms such as "notification", "conformity assessment" and "market surveillance". The law also defines unlawful dissemination of AI-generated or altered content for penal purposes and clarifies terms for criminal imputability connected to AI-driven processes.

Governance and Institutional Framework

Article 19–21 create a layered governance architecture. The Presidency of the Council (structure for innovation and digital transition) prepares and updates the national AI strategy, to be approved biennially by the interministerial committee. The Act designates the Agenzia per l'Italia Digitale (AgID) and the Agenzia per la Cybersicurezza Nazionale (ACN) as the national authorities for AI (Art. 20). AgID is tasked with promotion, innovation facilitation, notification management and accreditation of conformity-assessment bodies. ACN is designated as the market surveillance and inspection authority, with powers for cybersecurity oversight, inspections and sanctions. Sectoral supervisors (Banca d'Italia, CONSOB, IVASS) retain market oversight powers for financial/insurance sectors. A coordinating committee of director generals from AgID, ACN and the Presidency of the Council ensures operational alignment; a wider ministerial committee ensures policy direction (including defence, research, health, and economy ministries). The law also mandates collaboration with the Data Protection Authority and the Communications Authority where their competences intersect.

Key Focus Areas

The statute addresses multiple substantive domains: (1) fundamental rights and non-discrimination – requiring impact assessments and safeguards where AI affects rights; (2) data governance and privacy – alignment with GDPR and specific obligations for datasets used to train models deployed in Italy; (3) safety, testing and conformity – mandatory risk assessment, documentation and technical testing for high‑risk systems, with accreditation of conformity assessors carried out under AgID supervision; (4) transparency and disclosure – obligations to label synthetic content and to inform users when AI supports decision‑making, especially in healthcare and employment; (5) employment and workplace use – specific provisions require information to workers about AI use and protections limiting surveillance and unjustified automated profiling; (6) public administration and procurement – guidelines and rules for experimentation and procurement emphasizing interoperability, accessibility and auditability; (7) copyright and creative works – rules clarifying attribution, authorship and rights where AI substantially contributes to creative outputs; (8) market and financial integrity – adjustments to market abuse provisions where AI is used to influence markets; and (9) criminal law – introduction of Art. 612‑quater (illicit dissemination of AI‑generated or altered content) and directives to clarify criminal/administrative liability linked to safety omissions.

Implementation Framework

The Act delegates to the Government a program of implementing decrees to define: the lists and thresholds of high‑risk systems appropriate for Italy; detailed procedures for notification and conformity assessment; accreditation criteria for conformity assessors; sanctions and fines scales; procedural rules for inspections; sectoral rules for healthcare platforms and financial services; and funding and incentive schemes for research and SMEs. It requires the Presidency of the Council to publish a biennial national AI strategy and funds targeted initiatives (including experimentation sandboxes and competency programs). AgID and ACN must coordinate issuance of technical guidelines and linee guida, and create joint testbeds for compliance testing. The delegated measures will also specify registration and record‑keeping formats, and the interplay with national cybersecurity obligations and the NIS2 regime.

Monitoring and Evaluation

The law sets monitoring duties: AgID and ACN must produce annual monitoring reports on strategy implementation, market compliance and risks; results are transmitted to Parliament. The statute provides for metrics and monitoring targets (adoption projects, research investments, cybersecurity incidents) and requires the Presidency to evaluate socio‑economic impacts. It mandates sample audits, systematic market surveillance on high‑risk systems and a public register (to be implemented) of certain AI systems placed on the market or put into service. The Act links monitoring outputs to funding, research incentives and updates to the national strategy.

Penalties, Liability, and Appeals

The law establishes a mixed sanctioning regime. Administrative fines, corrective measures (recall, suspension, withdrawal) and public remediation orders will be available for regulatory breaches and are to be quantified in forthcoming delegated decrees. On the criminal side, Art. 612‑quater c.p. criminalises the illicit dissemination of images, video or audio falsified or altered by AI causing unjust damage, punishable with imprisonment (1–5 years) and initiated by complaint or ex officio in specified situations. The Act also mandates legislative clarification on imputability for crimes/administrative offences committed via AI, and contemplates liability for omission or failure to adopt safety measures where such omissions create concrete danger to life, public safety or national security. Affected parties retain administrative and judicial appeal routes; procedural details for sanctions and appeal bodies will be specified in implementing measures.

Relationship to Other Instruments

The statute is explicitly designed to be consistent with and complementary to: Regulation (EU) 2024/1689 (AI Act), GDPR (Regulation (EU) 2016/679), NIS2 and other sectoral EU rules, the Italian Data Protection Code and existing sectoral legislation for health, finance and labour. It modifies or interacts with the Civil Code, the Penal Code, the Testo Unico della Finanza and public procurement rules where necessary. The law also references existing national strategies (Italian AI Strategy and AgID guidance) and creates a path for delegated acts to coordinate domestic regulatory instruments.

International Alignment

While implementing a national approach, Legge n.132/2025 seeks alignment with EU harmonisation under the AI Act and with international standards on AI safety, cybersecurity and human rights. The law designates national contact points (AgID as notification authority and ACN as market surveillance and single contact point to EU institutions) to ensure coordination with EU bodies and cross‑border enforcement. It encourages participation in international testbeds, standards bodies and research cooperation, and foresees adaptation of national lists of high‑risk systems to EU delegated acts and globally recognised standards.

Implementation Timeline

Sources and References