Source: Formiche

The decree implementing AI-based facial recognition in Italy is presented as a tightly regulated framework rather than an opening to mass surveillance, according to Antonio Teti of the University “G. D’Annunzio”. Remote biometric identification in real time is nationally treated as a high-risk, generally prohibited use and the Italian text does not expand the limited exceptions foreseen by the European AI Act; those exceptions are strictly taxative and include prevention of imminent terrorist attacks, protection of life and physical safety, or searches for missing persons and victims of very serious crimes such as kidnapping, trafficking and sexual exploitation. The system requires a motivated request from investigative leadership and a prior judicial authorization that must specify purpose, geographic area, duration, persons sought and the reasons justifying the measure.

The decree sets concrete procedural and temporal safeguards: authorizations are limited to fifteen days and renewable only by a new motivated act; emergency activations must be promptly submitted for judicial validation or lose legal basis; retrospective biometric use is confined to matching previously acquired images against persons already indicated by investigative elements; biometric data collected for specific security events are retained for seven days and permanent biometric archives fed by indiscriminate web scraping are expressly prohibited. The pieces implementing Law n.132/2025 are framed as consistent with the AI Act, the GDPR and constitutional guarantees, emphasize that AI tools serve as support to human decision-making, and establish multilayered authorizations, responsibilities and judicial controls to balance public security and fundamental rights.