Share This Article
Italian AI Act enforcement now has a complete institutional machine behind it, because the second implementing law that Italy published on 8 October 2026 in the Italian Official Journal designates the authorities that will inspect and sanction, fixes the level of the fines, opens a national regulatory sandbox and restricts the use of artificial intelligence in decisions affecting employees.
The new law follows the first implementing law by less than a month, and the two measures together place Italy among the first Member States to have finished the work, which means that companies selling into Italy, or employing people there, will meet an authority holding inspection powers well before they meet an authority publishing guidance.
The obligations themselves come from the EU AI Act, a good part of which has already applied since 2 August 2026, so the new law adds no new duties for businesses and instead supplies the apparatus that turns those duties into proceedings, which is the part companies tend to discover late.
1. Why the new law reaches businesses established outside Italy
Nothing in the new law turns on where a company keeps its registered office, since the obligations follow the product and the use rather than the corporate structure. A provider that places an artificial intelligence system on the Italian market, a distributor or an importer that brings it in, and a deployer that runs it on Italian employees or Italian customers all fall within the reach of the Italian authorities, and in practice the authorities will often deal with a European subsidiary, or with an authorised representative, while the decisions that created the exposure were taken in California or in Singapore.
Groups that have treated the AI Act as a project owned by their European headquarters should therefore expect the file to be opened locally, and should expect the local entity to be asked for documents that only the parent company holds, which is a conversation worth having internally before an authority forces it.
2. Italian AI Act enforcement: the authorities, and what they can actually do
Four authorities share the work, each of them with powers that already exist in other areas of Italian regulation and that have now been extended to artificial intelligence.
• The National Cybersecurity Agency (ACN) is the general market surveillance authority and the single point of contact with the EU institutions, so it supervises and inspects, remotely or on site and without prior notice, including while a system undergoes testing in real world conditions, it opens proceedings following serious incident reports, complaints, referrals from other authorities or on its own initiative, it keeps the national registration of high-risk systems used in critical infrastructure, and it may call on the financial police for support.
• The Agency for Digital Italy (AgID) is the notifying authority, which means that it assesses, designates and monitors the bodies that certify conformity, runs periodic and extraordinary audits, restricts, suspends or withdraws a designation after hearing the body concerned, and fines those bodies.
• Bank of Italy, CONSOB and IVASS supervise the financial institutions already under their oversight, exercising the AI Act powers inside that existing relationship, including unannounced inspections of testing in real world conditions, and applying their own sanctioning procedures.
• The Data Protection Authority acts as a market surveillance authority only in the limited cases the AI Act reserves to it, where it issues guidelines and recommendations and imposes fines under the procedure of the Italian privacy rules, while retaining every one of its ordinary powers.
A committee inside the Presidency of the Council of Ministers coordinates these authorities, and the division of roles confirms the architecture that Italy had already sketched in its own artificial intelligence law of September 2025, which matters less for daily compliance than the two features of this architecture that carry genuine risk for an international business.
The first of them is the identity of the enforcer, because Italy gave the central role to its cybersecurity agency rather than to a newly created artificial intelligence regulator, and that agency already holds a considerable amount of information about the larger companies operating in the country, since the same body runs the Italian implementation of the NIS2 cybersecurity rules, receives incident notifications and keeps the register of suppliers that essential and important entities have to file. A company that registered on that portal for cybersecurity purposes has already introduced itself to the authority that now supervises its artificial intelligence as well, and the two files sit with the same people, who will notice if the two stories do not match.
The second is the unannounced inspection, the so-called dawn raids, which quietly redefines what preparation means, because documentation that exists in draft, that lives in a shared drive nobody maintains, or that sits in the head of one engineer who happens to be on holiday, will not survive a visit that nobody scheduled. Many of our clients have adopted global AI compliance frameworks that however sometimes do not take into account what is done at the local level and do not provide the local business with the documents necessary to defend against regulatory challenges in case of an inspection at their offices started with no prior notice.
3. The fines, including a band that exists only in Italy
The authorities apply the levels that the AI Act itself sets, with one addition of Italian origin, and the maximum fines run as follows.
• EUR 35 million, or 7% of total worldwide annual turnover where that is higher, for using an artificial intelligence practice that the AI Act prohibits outright.
• EUR 15 million, or 3%, for breaching the obligations of providers, authorised representatives, importers, distributors, deployers and notified bodies, the transparency duties, the duty to report serious incidents, and the procedure covering systems that the provider has classified as not high-risk.
• EUR 7.5 million, or 1%, for supplying incorrect, incomplete or misleading information to a notified body or to a national authority.
• EUR 1 million, or 0.5%, for failing to carry out the fundamental rights impact assessment, or for failing to honour an individual’s right to an explanation of a decision.
Small and medium-sized enterprises, innovative start-ups included, face the lower of the two figures in each band, in line with the AI Act, and the second band is the one that captures the transparency duties, which many companies still treat as a labelling exercise rather than as a sanctioned obligation.
That last band is an Italian addition, and it is the one likely to produce the earliest cases, because the fundamental rights impact assessment and the right to an explanation are the two obligations companies most often leave undone, partly because neither produces a certificate, a technical file or a CE marking, and so neither attracts engineering attention or budget. A deployer can hold a complete set of product documentation and still sit squarely inside this band.
Italy also punishes without charging money, since it took up the option the AI Act offers in that respect. Where an infringement carries minor harmfulness, an authority may order the company to bring the conduct to an end, specifying the measures and the deadline, or, where the conduct has already stopped, order the publication of a statement naming both the infringement and the person responsible.
Every penalty decision appears on the authority’s website in any event, and for a consumer brand or a listed group that publication frequently costs more than the fine itself since it triggers major reputational damages, which is why the handling of the proceeding, rather than the arithmetic of the exposure, is the part worth managing carefully from the first letter onwards. And in case of fines, companies shall be fast in appealing against them to obtain the interim order of suspension of the publication.
4. Artificial intelligence in employment decisions, where the sanction is not a fine
Article 41 of the new law is the provision most likely to generate litigation, and it is the costliest corner of the new regime for any international group running a global human resources platform over an Italian workforce. An employer using artificial intelligence must ensure that the final decision on hiring, on changing or on ending an employment relationship, including disciplinary measures and performance reviews, never rests on automated processing alone, and the law reserves that final decision to a natural person exercising real and independent authority, so a manager who signs off a recommendation without the power, the time or the information to depart from it will not meet the standard. The consent of the worker creates no exception, which removes the technique that many groups rely on in other jurisdictions.
Candidate sourcing and screening fall outside the prohibition, even where the screening keeps a candidate out of the later stages of a selection process, and that carve-out matters a great deal to recruitment technology.
What makes the provision expensive is the consequence rather than the obligation itself. A dismissal served in breach is void, as is any other decision the employer takes in breach, and voidness in Italian employment law opens the route to reinstatement and to back pay rather than to a capped severance figure, so one mishandled termination can cost a multiple of the administrative fine for the same conduct. The employer must also inform workers before the processing begins, must give a worker who asks an intelligible explanation of the decision, delivered through a human being and covering how far the system shaped the outcome and which main parameters it weighed, and must bring artificial intelligence that affects work organisation and safety into the workplace risk assessment, with the information and training that go with it.
5. Financial services, where enforcement runs through the existing supervisors
Supervised banks, investment firms and insurers answer to Bank of Italy, CONSOB or IVASS rather than to the general market surveillance authority, which folds AI Act compliance into a supervisory relationship that already exists, that already involves inspections, and that already has a settled tone. The quieter development lies in a different direction, because Italy allowed the existing out-of-court dispute resolution bodies to decide complaints about AI Act breaches committed by participating institutions, which hands customers a fast and inexpensive channel that produces reasoned decisions, and channels of that kind historically generate volume rather than isolated claims. An institution using artificial intelligence in credit scoring, in pricing or in claims handling should therefore model a stream of individual complaints alongside the regulatory exposure, and should check whether its policy wordings and its reserves contemplate that stream at all.
6. The sandbox, and the protection the law gives back
The new law sets up a national regulatory sandbox, run jointly by the digital agency and the cybersecurity agency, in which providers and prospective providers develop and test systems under supervision, with priority for smaller companies and start-ups, and with the data protection authority taking part in projects that involve personal data. For a company planning a contested use case in Italy, the sandbox is the one part of the new law that opens a door rather than closing one, because it produces a documented conversation with the regulator before launch instead of after a complaint.
The law also states expressly that data, algorithms and training methods can qualify for protection as trade secrets, which helps on two fronts, first in protecting a model against a departing employee or a supplier who wants to reuse it, and second in framing exactly what a company is prepared to disclose when an authority, a claimant or an opposing expert asks to see the inner workings of a system that failed.
7. Preparing for Italian AI Act enforcement: what to do now
-
Map every artificial intelligence system used in Italy or sold into Italy, and record the role the company plays for each one, because obligations and fines diverge sharply between a provider and a deployer, and many groups have never written that role down anywhere.
-
Complete the compliance assessments in relation to each use case relating to AI systems, and build a process capable of answering an explanation request within a sensible time, since these two obligations carry their own band of fines and are the ones most often missing altogether.
-
Rebuild the inspection file so that it survives a visit nobody announced, which means current technical documentation, retained logs, risk management records, and a named internal owner who can be reached on the day.
-
Review every human resources process that artificial intelligence touches, and confirm in particular that the person taking the final decision holds genuine authority and receives enough information to overrule the system.
-
Align the artificial intelligence response plan with the cybersecurity response plan, because the same authority now holds both files, and any inconsistency between them will be visible from the inside.
-
Consider the sandbox before launching a contested use case in Italy, rather than after the first complaint has arrived.
8. How Italian AI Act enforcement will play out
The new regime has moved from a question of institutional design to a question of practice, and the sequence Italy followed with data protection, and then with cybersecurity, suggests what comes next, namely an early group of inspections aimed at visible companies, followed by published decisions that set the market’s expectations for everybody else. Companies that treat the coming months as a period for drafting policies will meet the authorities holding policies, while companies that treat them as the months before a first inspection will meet the authorities holding evidence, and the distance between those two positions is usually decided long before anyone from the authority arrives.
Authors: Giulio Coraggio and Josaphat Manzoni