Legislative Decree No. 179 (the “Decree”) was published in the Official Gazette on October 8, 2026. It is the second decree implementing law 132/2025 (the “Italian AI Law”), Italy’s own AI legislation that works alongside Regulation (EU) 2024/1689 (the “AI Act”), the EU’s AI regulation. The Decree sets out who is responsible for supervising AI in Italy, introduces a protected testing environment for AI systems (a so-called regulatory sandbox), lays down rules on the use of AI in education, employment, public administration and healthcare, and strengthens trade-secret protection for AI-related technology.

Responsibility for supervising compliance is split between several authorities, each for its own area. The National Cybersecurity Agency (ACN) acts as the main supervisory authority. The Bank of Italy, CONSOB and IVASS oversee AI in the banking, financial and insurance sectors. The Italian Data Protection Authority oversees AI used in particularly sensitive areas, such as biometrics, law enforcement, immigration, asylum, border control, the administration of justice and democratic processes. The Agency for Digital Italy (AGID) is instead responsible for certifying the bodies that check whether AI systems comply with the rules (the so-called notified bodies).

As for sanctions, these authorities can impose the fines and other measures set out in the AI Act, within the limits set by EU law and following the procedures and safeguards provided under Italian law.

The Decree adopts the same tiered system of fines already set out in the AI Act, with amounts that vary depending on how serious the breach is: up to EUR 35 million, or up to 7% of the worldwide annual turnover if higher, for using prohibited AI practices; up to EUR 15 million, or up to 3% of the worldwide annual turnover if higher, for breaching several other obligations under the AI Act; up to EUR 7.5 million, or up to 1% of the worldwide annual turnover if higher, for giving inaccurate, incomplete or misleading information to the competent authorities; and up to EUR 1 million, or up to 0.5% of the worldwide annual turnover if higher, for breaching certain other, less central obligations. For less serious breaches, the certifying authority (AgID) and the market surveillance authorities (ACN, Bank of Italy, CONSOB, IVASS or the Italian Data Protection Authority) may, instead of imposing a fine, issue injunctions and order the breach to stop or make the breach public.

Also, all national market surveillance authorities handle complaints in accordance with their own procedures and must, on their own initiative, forward any complaint submitted to the wrong authority to the authority that has jurisdiction.

In the banking, financial and insurance sectors, complaints about AI Act breaches by financial institutions can also be brought before the existing alternative dispute resolution (“ADR”) schemes in those sectors, within the limits of their powers.

The coexistence of such a number of different market surveillance authorities, whose decisions are subject to the judicial review of different courts (i.e. administrative tribunals for ACN and IVASS, ordinary courts of first instance for AgID and the Italian Data Protection Authority, courts of appeal for the Bank of Italy and Consob) will certainly be challenging in terms of coordination and consistency of the enforcement of the same set of rules.

The Decree also sets up the Italian AI regulatory sandbox, supervised directly by ACN and AgID. The sandbox is meant to help providers, including SMEs and start-ups, to develop, test and validate AI systems in a controlled environment before bringing them to market, while giving the authorities practical evidence to inform how the rules are applied going forward. A joint coordination committee sets overall priorities and consults stakeholders, regions and autonomous provinces, while a joint operational group run by AgID and ACN handles the day-to-day admission, monitoring and evaluation of participating projects, drawing on universities and research centres where specific technical assessments are needed. The Decree also allows further sandboxes to be set up for dual-use AI systems, for AI used in the judiciary, and at regional or local level, with coordination mechanisms linking them to the main national sandbox; AI systems for the financial sector may also be tested through this sandbox alongside the existing FinTech one, with the financial authorities joining the relevant sessions. The competent authorities must report annually on the sandbox’s results, including a final report once it winds down, feeding into possible future regulatory adjustments.

This new AI sandbox may, in substance overlap with and replace the FinTech regulatory sandbox, which has been running since 2021 under the oversight of the Comitato Fintech at the Ministry of Economy and Finance, with Bank of Italy, CONSOB and IVASS supervising the projects admitted, whose take-up has so far been modest: in fact, only 20 projects have been admitted out of 71 applications submitted since 2021, due to structural hurdles in the sandbox’s functioning, such as a complex application process, uncertain procedural timelines and overly restrictive eligibility criteria.

An important part of the Decree deals with the use and oversight of AI in education, the professions, employment, healthcare and public administration. Schools, universities, institutions of advanced artistic, musical and performing arts education (AFAM) and ITS Academy bodies will need to promote AI literacy and training in science and technology subjects. The Ministry of Education must update national curricula and guidelines accordingly and launch a teacher-training plan that also covers the risks of social media and AI use by minors.

Within the employment relationship more specifically, the Decree pays particular attention to the use of AI in decision-making processes affecting employees. Article 41 (“Worker protection in decision-making processes assisted by artificial intelligence systems”) provides that, without prejudice to Article 22 GDPR, where an employer uses AI systems in decision-making processes concerning the employment relationship, it must ensure that final decisions on the establishment, modification or termination of the relationship – including disciplinary measures and performance evaluations – are not based solely on automated processing, in accordance with Article 11 of the Italian AI Law; the final decision must, in any event, rest with a natural person exercising genuine and autonomous decision-making power. The Decree clarifies that recruitment and candidate-selection activities do not fall within the notion of final decisions on the establishment of the relationship, even where they result in a candidate’s exclusion from subsequent stages of the selection process, and the worker’s consent does not constitute an exception to this prohibition. The use of such systems must respect the worker’s dignity and privacy and the principle of non-discrimination; before processing begins, the employer must comply with specific information obligations provided for by Italian labour law and the worker has the right to obtain, on request and through the intervention of a natural person, an intelligible explanation of the decision concerning them, including any impact of AI systems on the decision-making process and the main parameters which have been taken into account – without prejudice to the further rights of the data subject under Articles 13, 15 and 22 GDPR. Any dismissal, as well as any other decision, adopted in breach of these provisions is null and void.

The Decree pairs this individual protection with a preventive, workplace-safety dimension: the Ministry of Labour coordinates measures to ensure that introducing and using AI systems at work respects health and safety principles. Where AI systems affect how work is organised, production pace, how tasks are carried out, or safety-related decisions, their use must be assessed as part of the risk assessment every company is required to evaluate and manage. Employers must also give workers adequate information and training on the specific risks of using AI and on the prevention measures in place, while the Ministry of Labour promotes the responsible use of AI as a tool for preventing workplace accidents and occupational illness, together with the National Labour Inspectorate.

The Decree also provides for: (i) mandatory AI training for judicial staff, delivered by the Scuola superiore della magistratura for judges and by the Ministry of Justice for other staff; (ii) a requirement for professional bodies to include AI literacy and legal and ethical content in initial and ongoing training, updating their rules within six months of the Decree taking effect; (iii) the ability for public administrations and accredited employment service providers to use AI for career guidance, matching labour supply and demand, assessing skills and supporting people back into work, always with human oversight, transparency and protection of workers’ and users’ rights; (iv) the possibility that a professional’s use of AI affects how their fair compensation is calculated, based on the risk level of the AI system used; and (v) a requirement to include AI literacy and training in continuing medical education and in healthcare management training, with detailed requirements to be set within six months of the Decree taking effect.

Finally, of particular interest to businesses that develop or use AI systems is the extension of trade-secret protection to the data, algorithms and mathematical methods used to train AI systems. The Decree clarifies that “algorithms and mathematical methods” include model architectures, optimisation functions, training procedures and configurations, and any other technical element used to develop AI systems. Disputes on this topic remain the responsibility of the specialised business courts in Italy.

Overall, the Decree is a central building block in Italy’s AI governance framework: it completes the supervisory, inspection and sanctioning toolkit available to AgID, ACN, the Data Protection Authority and the financial sector authorities to enforce the AI Act domestically, sets out a broad framework for using AI in education, the professions, employment services and healthcare, and introduces targeted safeguards – most notably for workers – together with trade-secret protection for the data and algorithms behind AI training.