Who will police AI in Italy

From 23 October, AI has a supervisor

On 23 October legislative decree 179 of 2026, published in Italy's Official Gazette on 8 October, comes into force. Its 54 articles bring Italian law into line with the European regulation on artificial intelligence, the AI Act, "with regard to the powers of the national authorities".¹ From this date someone in Italy can inspect an AI system, ask for documents, order it off the market and fine those who break the rules.

The decree completes a process that began a year ago. Law 132 of 2025, in force since 10 October 2025, chose the two authorities, the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN), and left the details to the government.² A first decree, number 160 of 2026, in force since 30 September, dealt with policing and with civil and criminal liability. It added article 437-bis to the criminal code: one to five years in prison for anyone who fails to adopt the security or human oversight measures required for high-risk systems, when this puts people's lives or safety in danger. The company can be held liable for the same offence too, with fines and bans on its activities.³

Who does what

The Italian model splits the work. AgID is the notifying authority: it assesses, designates and monitors the bodies that certify high-risk systems before they reach the market. ACN is the market surveillance authority and the single point of contact with the European Commission and other member states. It carries out inspections, without notice when a system is being tested in real-world conditions, receives complaints, takes the measures set out in the regulation and imposes fines.¹ Sector authorities keep their role alongside them, as article 74 of the AI Act provides.⁴

Who supervises AI in Italy from 23 October 2026

Authority	Role	Over what
ACN	Market surveillance, single point of contact, complaints and fines	All AI systems not assigned to others, from chatbots to image generators; register of high-risk systems in critical infrastructure
AgID	Notifying authority	The bodies that certify high-risk systems as compliant
Bank of Italy, CONSOB, IVASS	Market surveillance in their own sector	High-risk systems used by banks, intermediaries and insurers, for example to decide who gets a loan
Garante privacy	Market surveillance in limited areas	Biometrics and other high-risk systems used by police, border control, justice and democratic processes
Product authorities	Supervision together with ACN	AI inside products already regulated, such as machinery, toys and medical devices

For a marketing or communications company, in practice, the authority to deal with will almost always be ACN: a virtual assistant that does not say it is AI, a video with a recreated face that is not disclosed, a campaign that uses manipulative techniques. If a bank uses the same software to decide on a loan, the Bank of Italy handles it. The Garante keeps all its powers under data protection law, and AGCOM those of digital services coordinator. A coordination committee at the Prime Minister's office holds the system together.¹

Knowing whom to deal with matters. In 2025, 16.4% of Italian companies with at least ten employees used at least one AI technology, double the year before. Among those that had considered it without adopting it, 47.3% cited unclear legal consequences as an obstacle.⁵

Below the two top tiers of fines there is one of up to 7.5 million or 1% of turnover for giving false information to the authorities, and one added by Italy, up to one million or 0.5%, for failing to carry out a fundamental rights impact assessment or to explain a decision to the person it affects. For small and medium-sized companies the lower of the two amounts applies. In minor cases the authority can simply order the breach to be fixed or publicly declare the violation. Every fine is published on the authority's website, and for a brand that may hurt more than the amount.¹

Postponed does not mean relaxed

In July the European Union passed the AI Omnibus, Regulation 2026/1744, in force since 27 July. It moved to 2 December 2027 the rules on the high-risk systems listed in Annex III, such as those used to select staff or assess credit, and to 2 August 2028 those on AI inside products that are already regulated.⁶ Many read it as a pause in the AI Act. The calendar says otherwise.

AI Act dates after the Omnibus, and Italy's

1. Feb 2025The bans apply, such as manipulation and social scoring, along with the duty to train people in AI.⁶
2. Aug 2025Obligations begin for general-purpose models, the ones behind the most widely used assistants.⁶
3. Oct 2025Law 132/2025 comes into force and chooses AgID and ACN.²
4. Aug 2026The transparency duties apply: virtual assistants must be recognisable, deepfakes disclosed.⁶
5. Sep 2026Decree 160/2026 comes into force, on offences and civil liability.³
6. Oct 2026Decree 179/2026 comes into force, on authorities, fines and work.¹
7. Dec 2026Marking becomes mandatory for generators already on the market too. Apps that create non-consensual intimate images are banned.⁷
8. Dec 2027Rules on the high-risk systems in Annex III, from staffing to credit.⁶

Two bans in force since February 2025 closely concern anyone in advertising: no subliminal or manipulative techniques that materially distort people's behaviour, no systems that exploit vulnerabilities linked to age, disability or economic situation.⁴ The transparency duties have applied since 2 August 2026. Anyone who publishes a deepfake must disclose it. For evidently artistic, satirical or fictional works it is enough to flag it in a way that does not spoil the work. Text generated with AI to inform the public on matters of public interest must be disclosed, unless it has been through human review and someone holds editorial responsibility for it.⁴ How to label it is set out in a voluntary Commission code published on 10 June.⁸ The Omnibus granted extra time, until 2 December 2026, only for the automatic marking of content from generators already on sale:⁷ I wrote about how these watermarks work in a piece on SynthID.

Then there are the Italian rules, which do not wait for Brussels. From 23 October, under article 41 of decree 179, decisions on hiring, contract changes, dismissals, disciplinary measures and performance appraisals cannot be taken by an automated system alone. The final word belongs to a person "who exercises real and autonomous power", and the worker's consent does not change the rule. A dismissal decided in breach of it is void. Workers can ask for an understandable explanation, given by a person, of how much weight AI carried. There is one broad exception, though: screening candidates is excluded, even when an algorithm turns someone down.¹

Decree 160 has already changed the rules on damages. If harm arises from a breach of an AI Act obligation, the causal link is presumed, and it is up to the company to prove otherwise. A judge can order it to hand over logs and technical documentation, and if it does not, can treat the claimant's account of the facts as proven. A certificate of conformity is not enough to rule out liability.³ Anyone waiting until December 2027 to deal with this has done the sums wrong.

A cybersecurity agency to police AI

The choice of ACN has been debated from the start. In March 2024 the president of the Garante privacy, Pasquale Stanzione, wrote to Parliament and the government that the data protection authority had the "competence and independence" needed to apply the European regulation.⁹ A few months later the European Data Protection Board recommended that member states give data protection authorities at least the most sensitive high-risk systems, and consider them for the others too.¹⁰ The AI Act requires authorities to act "independently, impartially and without bias" and to have adequate technical, financial and human resources.⁴

ACN, by contrast, is part of the administration that answers to the Prime Minister, who appoints its director general. Damiano Fuschi, professor of public law at the University of Milan, considers the choice "fully legitimate" under EU law, which asks only for functional independence for these authorities. But he points out that AgID and ACN lack the usual safeguards of independent authorities, such as a collegial board or a non-renewable term, and that they combine promoting AI with policing it. His summary: "compliance does not mean adequacy".¹¹

On some points the government listened to the Garante, which in its opinion of 14 July asked to be able to issue guidelines, to take part in sandbox projects with personal data and to protect workers in appraisals too: all of this is in the final text. The Garante also wrote that its resources were not enough for the new tasks.¹² But the clause that closes the decree stayed: the administrations involved work "without new or greater burdens on public finances".¹ At the end of 2025 ACN employed 422 people and has a staffing plan that can grow to 669, mainly to handle the European directive on network security, NIS2.¹³

Other countries have taken different routes. Spain created an agency devoted solely to AI in 2023, AESIA, based in A Coruña, which also reports to a ministry.¹⁴ In Germany the role has belonged since 29 July to the Bundesnetzagentur, the network regulator, which leaves finance to BaFin.¹⁵ In France the Senate passed a text in February that splits supervision among some fifteen bodies, with a central role for the CNIL, the independent data protection authority, and then sent it to the National Assembly.¹⁶ The government had shifted the weight onto the CNIL after the Council of State warned that the earlier scheme risked double penalties.¹⁷

What I think

I think choosing ACN has its logic. An AI system is software, and some of the most serious risks are security risks: tampered models, poisoned data, agents that follow instructions hidden in a web page. ACN has technical staff, already inspects companies under NIS2 and knows them. One main point of contact is simpler than a system split across fifteen bodies.

In my sector, though, the most serious risks of AI concern people more than servers: an advert that preys on the vulnerability of whoever sees it, a voice or a face recreated without consent, generated text passed off as journalism, an algorithm that decides who gets to see a job offer. These are questions of rights. On these I would have preferred a supervisor that does not depend on the government of the day, not least because public administrations are among the users of AI. The decree leaves the most sensitive cases to the Garante, and that is good. For everything else ACN will have to show through its actions an independence that the law does not guarantee.

What worries me most is resources. The European regulation calls for staff with an in-depth understanding of these technologies, the decree adds not a single euro for supervision, and the agency is still growing to cope with its network security duties. The first year will tell us a lot: how long it takes to get the rules on complaints and inspections that the decree leaves to later measures, and whether the annual report to Parliament will also count AI checks and fines.

What to do now in a company

The questions an authority or a judge will ask are already clear, and four things can be done straight away.

1. InventoryEvery AI tool in useVirtual assistants, text and image generators, advertising platforms, HR software: for each, who supplies it, who uses it and for what.
2. DiscloseDeepfakes and generated textClear labels on realistic voices, faces and scenes made with AI. Ask suppliers how they will mark content by 2 December.
3. DecideA person for every employment decisionHiring, appraisals, disciplinary measures and dismissals are signed by a person who can change the outcome. Staff are told beforehand.
4. DocumentContracts, logs and checksKeep a record of how each system is used and checked. If harm occurs, a judge can ask for it.

One new duty concerns health and safety at work: article 42 of the decree requires AI that changes the pace, organisation or way of working to be assessed in the risk assessment document required by health and safety law, and workers to be trained on the specific risks.¹

The first contact to note down is ACN. The decree requires it to publish on its website how to reach it as the single point of contact, and anyone who believes an AI system breaks the rules can file a complaint with it, which the agency must handle under a procedure set by its director general.¹