Source: IAPP

Italy has established a comprehensive national AI regulatory architecture grounded in Law No. 132, which entered into force in October 2025, and supported by implementing decrees. Legislative Decree No. 160 of 9 Sept. 2026 is highlighted as a key implementing measure that regulates police use of AI, introduces statutory criminal sanctions, expands corporate administrative liability and creates specialized civil litigation mechanisms; that decree is set to enter into force by 30 Sept. 2026. Italy is presented as one of the first member states to operationalize the EU AI Act through a complete domestic framework covering principles, sector-specific rules, governance models and public investment strategies for AI systems.

The framework assigns criminal and organizational significance to AI governance and requires firms to ensure technological security, adequate controls, human supervision and risk management. Article 17 introduces new evidentiary rules strengthening accountability, obliging companies to demonstrate concretely that safeguards are functioning via comprehensive, up-to-date documentation readily producible in disputes. The piece credits Giovanna Fragala (Senior Legal Counsel, Privacy and AI) as a contributor and situates Italy’s measures within the broader process of member states implementing the EU AI Act.