On September 17, 2025, the Senate approved, without modifications, the bill n. 1146-b titled «Provisions and Delegations to the Government on Artificial Intelligence,» concluding a parliamentary process that began on May 20, 2024 (for more information on the parliamentary process, please refer to our dedicated article by clicking here). The measure was published in the Official Gazette no. 223 on September 25, 2025, and will come into effect, after the vacatio legis period, starting from October 10, 2025 (hereinafter, the “AI Law”).

The AI Law introduces a national regulatory framework, the first on artificial intelligence at the European level, which coordinates with Regulation (EU) 2024/1689 on artificial intelligence (hereinafter, the “AI Act”), outlining principles, national governance, priority sectors, measures on data and copyright, as well as delegations to the Government for the adoption of implementing decrees.

Coordination with the AI Act

Regarding the first draft of the bill presented to the Senate on May 20, 2024, the European Commission had identified misalignments and discrepancies with the European provisions, highlighted in Opinion C (2024) 7814 of November 5, 2024. The Parliament took these observations into account and reflected them in the AI Law, with the aim of avoiding contradictions that could lead to the disapplication of national regulations: the goal is to introduce a regulatory framework that, while respecting the principles of the AI Act, takes into account the specificities of the Italian legal system and the needs of the national productive fabric.

In fact, the AI Law explicitly states in Article 1, paragraph 2, that its provisions shall be interpreted and applied in accordance with the AI Act, with a particularly significant approach: Italy is the first country in the European Union to adopt an organic national law on artificial intelligence, in the implementation and integration of the AI Act itself.

Fundamental principles: an anthropocentric approach

The AI Law, as stated in Article 1, aims to establish principles for the research, experimentation, development, and application of artificial intelligence systems and models, promoting an «anthropocentric approach» focused on safeguarding the centrality of the human being and human oversight in decision-making processes involving artificial intelligence systems. Article 3 of the AI Law implements the objectives and scope outlined in Article 1, stating that the research, experimentation, development, adoption, application, and use of artificial intelligence systems and models must be carried out in compliance with the fundamental rights and freedoms established by the Constitution, European Union law, and the principles of transparency, proportionality, security, personal data protection, confidentiality, accuracy, non-discrimination, gender equality, and sustainability.

In implementing this anthropocentric approach, the AI Law further specifies that the use of artificial intelligence must not in any way undermine human autonomy and decision-making power, nor hinder the democratic functioning of institutional and political life. Special attention is given to people with disabilities, ensuring they have full access to artificial intelligence systems on an equal basis and without discrimination.

Sectorial regulation

The AI Law also pursues a sectoral approach, dedicating specific provisions to the areas considered high-risk by the AI Act:
– healthcare and disability: the use of artificial intelligence in the healthcare sector aims to improve disease prevention, diagnosis, and treatment. The AI Law establishes that AI systems cannot select or condition access to healthcare services based on discriminatory criteria, acting solely as a tool to support medical professionals, who always retain the final decision;

– labor and regulated professions: artificial intelligence must be used to improve working conditions, productivity, and the psycho-physical protection of workers, through safe, reliable, and transparent use. To this end, an Observatory has been established at the Ministry of Labor. Regarding intellectual professions, AI is a tool to support activities, as long as the intellectual work of the human remains predominant;

– public administration and judicial activity: the use of artificial intelligence in Public Administration is aimed at increasing efficiency, reducing procedural times, and improving services, with AI being used purely as a tool to support public officials. Similarly, in judicial activity, governed by Article 15 of the AI Law, any decision on the interpretation and application of the law, the evaluation of facts, and the adoption of measures is always reserved for the judge. Notably, Article 17 amends Article 9 of the Civil Procedure Code, assigning exclusive jurisdiction to the court for cases concerning the functioning of an artificial intelligence system.

This regulatory choice responds to the need to provide clear and contextualized rules for sectors with significant impacts on fundamental rights and social organization.

Personal data and copyright

Article 4 of the AI Law comprehensively addresses the regulation of personal data protection, referring to and integrating the principles and provisions already established by the current national and European regulations, particularly Regulation (EU) No. 2016/679 (GDPR). It reaffirms the applicability of the principles of lawfulness, fairness, and transparency (already established by the GDPR) regarding the processing of personal data, as well as the requirement that information about processing be provided in clear and understandable language to ensure full awareness of risks and the right to object. The AI Law also addresses the processing of data related to minors: in accordance with Article 2-quinquies of Legislative Decree No. 196/2003 and amendments, consent from the person exercising parental responsibility is required for minors under the age of fourteen, while minors who have reached the age of fourteen may independently provide their consent.

Additionally, Article 8 addresses data processing in the context of scientific and healthcare research: in this context, the processing of data for the development of artificial intelligence systems is expressly recognized as being of significant public interest, in implementation of constitutional principles and the GDPR. When the data is devoid of identifying elements, processing is authorized without the need for consent (where applicable), but it remains mandatory to provide appropriate privacy notices to the individuals concerned.

The AI Law also emphasizes cybersecurity, an essential element for the development of artificial intelligence, entrusting the National Cybersecurity Agency (ACN) with the task of promoting and developing initiatives to enhance artificial intelligence as a resource for strengthening national cybersecurity.

The AI Law also addresses the issue of copyright, a topic of ongoing debate that presents significant challenges for legislators. It provides for the protection of works created with the aid of artificial intelligence tools, but only if these works are not the exclusive result of artificial intelligence and reflect the «intellectual work of the author.» Furthermore, to counter the dangerous and growing spread of deepfakes and limit the damage caused by their misuse, a new independent offense is introduced (Article 612-quater of the Penal Code) for the «Illegal dissemination of content generated or altered with artificial intelligence systems,» punishable by imprisonment from one to five years.

Governance and competent authorities

The AI Law establishes a structured governance framework. The Presidency of the Council of Ministers will prepare a national strategy for artificial intelligence, approved biennially by the Interministerial Committee for Digital Transition (CITD) and subject to annual oversight by Parliament, with the aim of coordinating public policies on artificial intelligence while promoting technological innovation in respect of fundamental rights.

The Agency for Digital Italy (AgID) is designated as the authority responsible for promoting innovation and the development of artificial intelligence, with tasks including notification, evaluation, accreditation, and monitoring of entities responsible for ensuring compliance; the National Cybersecurity Agency (ACN) is designated as the supervisory authority. The specific competences of the Bank of Italy, Consob, and IVASS for their respective market supervision sectors remain unchanged, as do those of the Italian Data Protection Authority.

A particularly significant aspect for businesses is the activation, by the AI Law, of an investment program worth 1 billion euros, aimed at accelerating competitiveness and supporting the development of innovative startups and SMEs.

Operational recommendations

The imminent entry into force of the AI Law (from October 10, 2025) requires companies to take immediate action to comply. In particular, businesses and public administrations will need to conduct an audit and mapping of the artificial intelligence systems currently in use (evaluating the legal basis for their use, transparency levels, and the risks associated with their functioning), aligning with the requirements of the AI Law and adopting appropriate measures, also in view of inspections and checks by the competent authorities.

Regarding internal governance, the adoption of specific policies and procedures is recommended, as well as the establishment of dedicated ethics committees and strengthening the dialogue between different corporate functions: DPO, human resources, compliance, and technical functions must work together to ensure an integrated approach to risk management. Equally crucial will be the review and integration of contracts with artificial intelligence technology providers and cloud platforms (e.g., regarding warranties, security, liability regimes, and remedies), also in light of the new provisions on digital sovereignty and transparency requirements.

Particular attention must be paid to age verification mechanisms for services aimed at minors, and in cases where the user is under fourteen, robust systems for collecting informed consent from parents must be implemented.

Finally, organizations will need to prepare detailed documentation of decision-making processes involving artificial intelligence systems, ensuring standards of transparency and accountability that will be subject to the forthcoming delegated decrees.

Timeline and concluding considerations

The AI Law sets specific timelines for the adoption of implementing measures from its entry into force:
– within 90 days, the Ministry of Labor must adopt a decree defining the composition, functioning, and tasks of the Observatory on the adoption of artificial intelligence systems in the world of work;
– within 120 days, the Ministry of Health must adopt a decree to regulate the processing of personal data for research and experimentation purposes using artificial intelligence systems, in consultation with the Data Protection Authority and other sector operators;
– within 12 months, the Government must adopt one or more legislative decrees on three matters: regulation of artificial intelligence system training (to define a regulatory framework on the use of data, algorithms, and mathematical methods); alignment with the AI Act; and regulation of offenses, including the introduction of new criminal offenses and the definition of criteria for assigning liability.

The AI Law represents a fundamental step for Italy, providing a regulatory framework aimed at balancing innovation with the need for security and protection of rights. Given the regulations already in force, particularly the AI Act and the GDPR, it will be essential to adopt an integrated approach that considers the mutual obligations set forth, while ensuring continuous cooperation between the various competent authorities.
In particular, the new regulation represents a strategic opportunity for Italy, which has managed to precede other European countries, positioning itself as a leader in the European landscape of the sector.