Source: Global Law Experts

Italian businesses face converging regulatory deadlines from Law 132/2025, the EU AI Act and the NIS2 Directive, with Law 132/2025 in force from 10 October 2025 and EU high‑risk AI obligations becoming applicable on 2 August 2026. Updated Italian data‑centre rules published in February 2026 further affect hosting and localisation choices. The guide frames these overlaps as an immediate boardroom priority and presents a structured compliance playbook for CTOs, general counsel and compliance officers focused on governance, contracts, vendor flows and practical timelines. It stresses that organisations should pursue parallel workstreams rather than a single sprint during the critical implementation window before 2 August 2026, and notes industry expectations that completing five immediate actions before Q3 2026 materially improves regulatory positioning.

The playbook assigns specific owners, deliverables and deadlines: the board/CEO must appoint an AI governance lead immediately; the CTO/data‑science lead must create a living register of AI systems within 30 days; the DPO must complete DPIAs for high‑risk systems within 60 days; the CISO must deliver a NIS2 gap analysis within 45 days and update incident‑response playbooks to meet reporting timelines (early warning within 24 hours, full notification within 72 hours). General counsel/procurement should amend IT and service agreements with AI warranties, NIS2 security schedules and audit rights by 2 August 2026 for high‑risk vendors. The summary explains that Law 132/2025 imposes sectoral governance, mandatory human oversight, transparency duties and workplace protections beyond the EU AI Act and recommends treating EU conformity assessments as the foundation while overlaying a Law 132/2025 gap analysis and maintaining documentation that satisfies both regimes.