Legislative Decree No. 179 of 7 October 2026 (the “Decree”) entered into force on 23 October 2026. In implementation of the delegation under Article 24 of Law No. 132 of 23 September 2025 (the “Italian AI Law”), it continues the process of adapting national legislation to Regulation (EU) 2024/1689 on artificial intelligence (the “AI Act”). It is the second legislative decree implementing the Italian AI Law, following Legislative Decree No. 160 of 9 September 2026, which addresses law-enforcement activities and liability matters (for further details, see our dedicated article here). Among other matters, the Decree governs the powers and coordination of the national authorities, supervision and the sanctions regime, AI “regulatory sandboxes”, the use of artificial intelligence systems in education and training, employment, professional activities, healthcare and the public administration, and the protection of data, algorithms and mathematical methods as trade secrets.
National AI authorities
The Decree first defines Italy’s national AI governance framework by specifying the roles and powers of the various parties involved, including the “national authorities for artificial intelligence” – AgID and ACN – already designated under Article 20 of the Italian AI Law. Article 4 of the Decree designates AgID as the “national notifying authority” for conformity assessment bodies under the AI Act: it is responsible for the procedures for the assessment, designation and notification of such bodies, as well as for monitoring notified bodies. Alongside AgID, Article 5 of the Decree identifies the following as “national market surveillance authorities”: (i) ACN; (ii) the Bank of Italy, CONSOB and IVASS, within their respective remits, for high-risk AI systems used in the provision of credit and banking and financial services, investment services, and insurance, reinsurance and insurance distribution activities; and (iii) the Italian Data Protection Authority (the “Italian DPA”), solely for the purposes of Article 74(8) AI Act.
In this context, the Decree promotes agreements, memoranda of understanding and cooperation mechanisms among national, local and sectoral authorities, introducing forms of operational and information-sharing coordination. The Coordination Committee established within the Presidency of the Council of Ministers, already provided for under the Italian AI Law, is confirmed as the central forum for unified policy direction and coordination, with the participation, where relevant, of the financial-sector authorities and without prejudice to the powers of the Italian DPA and AGCOM.
Supervision, complaints and sanctions
As regards regulatory controls, the Decree sets out the supervisory powers of the competent authorities in accordance with the AI Act: on-site or remote inspections, including without prior notice; requests for information from providers, including prospective providers; and checks on the conduct of real-world testing of high-risk AI systems.
The Decree also governs the handling of complaints concerning alleged infringements of the AI Act, which must be dealt with under each authority’s procedures and in accordance with the right to be heard. Where a complaint is submitted to an authority that lacks jurisdiction, that authority must refer it of its own motion to the competent authority and inform the complainant.
As regards sanctions, unless the conduct constitutes a criminal offence, the Decree aligns with and supplements the thresholds under the AI Act by providing for: (i) administrative fines of up to EUR 35 million or 7% of worldwide turnover for infringements of the prohibitions on prohibited AI practices; (ii) fines of up to EUR 15 million or 3% of worldwide turnover for failure to comply with operators’ obligations and transparency requirements; (iii) fines of up to EUR 7.5 million or 1% of worldwide turnover for supplying notified bodies or competent authorities, in response to a request, with incorrect, incomplete or misleading information; and (iv) fines of up to EUR 1 million or 0.5% of worldwide turnover for infringements of Articles 27 and 86 AI Act (fundamental rights impact assessment and right to an explanation). For undertakings, the maximum fine is the higher of the fixed amount and the percentage of total worldwide annual turnover for the preceding financial year, without prejudice to the more favourable rules for SMEs, microenterprises and innovative start-ups. In line with the AI Act, SMEs, microenterprises and innovative start-ups are subject to the less onerous of the fixed amount and the percentage-based amount, rather than the higher amount. The Decree also provides that the proceeds of fines imposed by ACN and AgID are to be allocated as a matter of priority to the activities of those authorities, with the aim of strengthening their operational capacity by matching resources to the complexity of their new supervisory tasks.
The “Italian AI regulatory sandbox”
One of the most significant and innovative aspects of the Decree is the establishment of the “Italian AI Regulatory Sandbox”, a regulated and supervised environment intended to support the development, training, testing and validation of innovative AI systems in a controlled setting in which solutions may be tested and evidence gathered to inform future regulatory choices (the “Sandbox”). The Sandbox is directly supervised by AgID and ACN and is operated by a Joint Operations Group composed of an equal number of representatives and established by a joint decree of the Directors General of AgID and ACN. Strategic management and testing priorities are determined by the Coordination Committee, which may involve universities, research centres and, where personal data are processed, the Italian DPA on a project-by-project basis.
The access and operating arrangements and the admission criteria are to be established by subsequent joint decrees of AgID and ACN.
The Decree provides that providers and prospective providers of AI systems may be admitted to the Sandbox, with priority access for SMEs and start-ups. Regulations issued by the President of the Council of Ministers may also establish sandboxes dedicated to dual-use AI systems (for civilian and military use) and sandboxes for models and systems applicable to judicial activities. The Decree also permits the creation of additional regulatory sandboxes at regional or local level, or jointly with the authorities of other Member States, subject to coordination mechanisms ensuring that information flows to the national Sandbox and that the results are incorporated into the annual reports required under Article 57(16) AI Act.
AI in education and training, employment, professional activities, healthcare and the public administration
In line with the “human-centric” approach of the Italian AI Law, the Decree devotes an entire chapter – Chapter III – to the use of AI in education and training, professional activities, employment, healthcare and the public administration:
- Education: the Decree promotes AI training activities by educational institutions in line with the guidelines on digital civic education, updating curricula and STEM guidelines to include technical and critical skills relating to the use of AI systems. It also provides for specific measures for the training of students, teachers and educational staff.
- Employment: the Decree gives practical effect to the principle of effective human oversight by requiring an employer using AI systems to ensure that final decisions on the establishment, amendment or termination of the employment relationship — including disciplinary measures and performance assessments — are never taken solely on the basis of automated processing, failing which they are null and void; the employee’s consent does not constitute an exception to this prohibition. On request and with the involvement of a natural person, the employee may also obtain intelligible reasons for the decision, indicating the role played by AI and the principal parameters taken into account. The exclusion of candidate search and selection activities from the scope of this provision does not affect the application of the GDPR, in particular Article 22 on decisions based solely on automated processing, or the relevant provisions of the AI Act. As regards occupational health and safety, the Decree requires the introduction of AI systems to be considered as part of the risk assessment under Legislative Decree No. 81/2008.
- Professional activities, including unregulated and healthcare professions: the Decree provides for AI literacy and training programmes on the use of AI systems as part of initial and continuing professional development, including continuing medical education programmes. Within six months, the national councils of professional associations and boards must update their training regulations to include the technical, legal and ethical aspects of, and responsibilities associated with, the use of AI systems.
- Public administration and employment services: the Decree assigns the Minister for Public Administration responsibility for coordinating AI training for public-sector employees and makes the use of AI in employment services subject to human oversight, transparency of decisions and protection of the rights of service users and workers.
Data, algorithms and mathematical methods
Finally, in coordination with the Italian AI Law, the Decree amends the Italian Industrial Property Code to expressly include, among business information and technical and industrial know-how eligible for protection as trade secrets, data, algorithms and mathematical methods used to train AI systems, including the related technical and computational elements, provided that they satisfy the requirements for trade-secret protection: (i) they are secret, in that they are not generally known or readily accessible; (ii) they have commercial value because they are secret; and (iii) reasonable steps have been taken to keep them secret.
This approach strengthens the protection of investment in AI research and development — an objective already central to the Italian AI Law. Trade-secret protection remains conditional on satisfaction of the above requirements and does not, in itself, confer any right to use third-party data or content for training purposes.
Conclusions
Together with the Italian AI Law and Legislative Decree No. 160/2026, Legislative Decree No. 179/2026 marks a further step in Italy’s adaptation of its national legal framework to the AI Act, with significant implications for businesses, public administrations, financial intermediaries and professionals.
Those developing or using AI systems should prioritise systematically identifying systems under development, in use or undergoing testing and classifying them under the AI Act, coordinating that mapping exercise with DPIAs and records of processing activities, cybersecurity obligations under NIS 2, the Data Act and other sector-specific digital legislation.
As regards internal governance, businesses and public administrations should:
- identify the competent authority by reference to the systems used and the relevant sector;
- establish procedures for handling inspections and information requests from supervisory authorities, including those made without prior notice;
- update policies, notices and contracts to reflect the new obligations, including liability, risk allocation, access to documentation and trade secrets relating to model training.
In managing employment relationships, employers using AI must ensure that final decisions are not based solely on automated processing, establish procedures providing for effective human involvement, and incorporate AI into the risk assessment under Legislative Decree No. 81/2008, supported by ad hoc training programmes.
The opportunities for AI research and development are particularly significant: the Italian legal framework does not sacrifice innovation to regulation, including through the Italian AI Regulatory Sandbox, which provides a controlled environment for testing AI systems. Participation requires preparation of the documentation prescribed for admission to and conduct of the testing, in compliance with the applicable data-protection and security rules.
The potential classification of data, algorithms and mathematical methods as trade secrets requires stronger security measures and access controls, as well as contractual provisions consistent with any such classification, without overlooking transparency and documentation obligations towards authorities, customers and users.
In summary, the Decree goes beyond technical compliance with the AI Act and provides a structured framework for integrating AI into a governance ecosystem comprising organisation, training, supervision, testing and protection of intangible assets. Adaptation may deliver a competitive and reputational advantage in an increasingly regulated market that is attentive – including outside the EU – to the ethical and accountability implications of AI, taking account not only of the risks but, above all, of the benefits offered by this technology.
