Italy's Legislative Decree No. 179 of 7 October 2026 took effect on 23 October, and the full text was published in the Official Gazette, issue No. 234, on 8 October. The 54-article decree puts the EU AI Act into operation at national level in Italy: who supervises, what the fines are, and what boundaries employers must respect when using AI to manage people now have a domestic set of rules to answer to. The scope needs stating first: it applies only in Italy, not as a uniform EU rule, and comparable EU-level obligations will apply much later.
Start with the right authority
Article 4 makes the Agency for Digital Italy (AgID) the notifying authority, responsible for assessing, designating, notifying and monitoring conformity assessment bodies; Article 5 makes the National Cybersecurity Agency (ACN) the market surveillance authority for AI systems, and Article 6 makes it the single point of contact with the EU, also in charge of national registration of the high-risk systems listed in Annex III, point 2. High-risk uses in banking, financial intermediation and insurance fall to the Bank of Italy, CONSOB and IVASS respectively, within their own remits; the data protection authority acts as market surveillance authority only within the limits set by Article 74(8) of the EU Act. The decree also provides for an interministerial coordination committee and agreements between authorities: where positions differ, the word of the authority responsible for the case counts, not a generic appeal to "EU requirements".
Employers should change two things first
Article 41 governs personnel decisions directly: when an employer uses AI systems to support decision-making, the final decision on the establishment, modification or termination of an employment relationship, including disciplinary measures and performance evaluations, cannot rest solely on automated processing. The final decision must stay with a natural person exercising effective and autonomous decision-making power. An employee's consent is no exception; but searching for and screening candidates does not count as a final decision, even if the system keeps a candidate out of a later round. Before processing begins, the employer must meet the information duties in Article 1-bis of Legislative Decree No. 152 of 1997, and the worker is entitled, through a natural person, to an intelligible explanation of the AI's influence and the main parameters; a dismissal made in breach of this rule is void, and so are other decisions made in breach of it.
Article 42 governs safety assessment: AI systems that affect the organisation of work, production pace, the way work is performed or safety-relevant decision-making processes must be assessed together in the risk assessment document (DVR) under Article 28 of Legislative Decree No. 81 of 2008, and employers must also inform and train workers on the specific risks and the prevention and protection measures. The boundary is this: Article 42 does not treat every AI tool as a standalone risk; it covers only systems with the effects described above.
Fines come in four tiers, and the cost to employers is not only fines
Article 23 sets four maximum fine tiers (except where the conduct is a criminal offence): up to 35 million euros or 7% of worldwide annual turnover, whichever is higher, for the prohibited practices in Article 5 of the EU Act; up to 15 million euros or 3% for the obligations of providers, importers, distributors and deployers; up to 7.5 million euros or 1% for supplying incorrect, incomplete or misleading information to notified bodies or authorities; and up to 1 million euros or 0.5% for the obligations in Articles 27 and 86. Fines are imposed by AgID and the market surveillance authorities within their respective remits. Employers should watch another line too: the consequence under Article 41 is that the decision is void, and a later human signature cannot rescue a dismissal that has already been held void.
Two more points: read them before acting
Article 26 establishes the Italian AI regulatory sandbox, under the direct supervision of the national AI authorities, so that companies can experiment in a controlled setting and regulators can learn from the experiments; SMEs and start-ups are singled out in particular. But the sandbox's operating rules still await later joint instruments, and the experimentation channel cannot be walked into today. Article 52 brings training data, algorithms and mathematical methods that meet the conditions within the scope of trade-secret protection. The training chapter also sets a timetable: the criteria for teacher training must be set by ministerial decree within 90 days of entry into force. Entry into force is only the starting point: before the sandbox rules, registration procedures and teacher-training criteria arrive, keeping decision records, the information procedure and DVR updates in good order matters more than waiting for the detailed rules.
