Source: Il Sole 24 Ore (Norme & Tributi Plus Diritto)

The Italian Data Protection Authority (Garante) approved the draft legislative decree implementing the EU AI Act while attaching observations that seek stronger protections for high‑risk AI systems and for the use of biometric data, with particular focus on law‑enforcement activity. The Authority issued two favourable opinions but asked for reinforcement of safeguards in the national governance framework and for a clearer role in supervisory and conformity assessment procedures for high‑risk AI applications.

The decree assigns the Garante the role of market supervisory authority for high‑risk AI in sectors that affect fundamental rights (justice, law enforcement, immigration, border management and democratic processes), and introduces rules for the financial and insurance sectors while promoting digital literacy and AI training in education and professional paths. The Garante requested powers to adopt guidelines, recommendations and best practices, clarification on the application of sanctions under the Privacy Code, involvement in the Italian AI experimentation space, extension of the ban on exclusively automated decisions to certain employment evaluations, strengthened guarantees on the quality of biometric databases, an express prohibition on the use of databases obtained via indiscriminate scraping (including in the new article 359‑ter of the criminal procedure code), clearer rules on human supervision in AI systems, defined responsibilities in research and experimentation, and adequate financial resources to discharge its expanded functions.