On September 17, 2025, the Senate approved, without amendments, Bill No. 1146-b titled «Provisions and Delegations to the Government on Artificial Intelligence,» completing a parliamentary process that began on May 20, 2024 (for more information on the parliamentary process, we invite you to consult our dedicated article, click here). The measure was published in Official Gazette No. 223 on September 25, 2025, and will come into effect, after the statutory waiting period, starting from October 10, 2025 (hereinafter, the «AI Law«).

The AI Law introduces a national regulatory framework, the first on artificial intelligence at the European level, which coordinates with Regulation (EU) 2024/1689 on Artificial Intelligence (hereinafter, «AI Act«), outlining principles, national governance, priority sectors, data and copyright measures, as well as delegations to the Government for the adoption of implementing decrees.

Coordination with the AI Act

Regarding the first draft of the bill presented to the Senate on May 20, 2024, the European Commission identified misalignments and contradictions with European provisions, as noted in opinion C (2024) 7814 of November 5, 2024. The Parliament incorporated these observations and reflected them in the AI Law, aiming to avoid contradictions that could have led to the non-application of national regulations: the goal pursued is to introduce a regulatory framework that, while respecting the principles of the AI Act, takes into account the specificities of the Italian legal system and the needs of the national production fabric.

In fact, the AI Law explicitly states in Article 1, paragraph 2, that its provisions are interpreted and applied in accordance with the AI Act, with a particularly significant approach: Italy is the first country in the European Union to adopt an organic national law on artificial intelligence, in implementation and integration of the AI Act itself.

Fundamental principles: a human-centered approach

The AI Law, as stated in Article 1, aims to establish principles for the research, experimentation, development, and application of artificial intelligence systems and models, promoting a «human-centered approach» aimed at safeguarding the centrality of the human being and human oversight in decision-making processes involving artificial intelligence systems. Article 3 of the AI Law concretizes the goals and scope outlined in Article 1, establishing that the research, experimentation, development, adoption, application, and use of artificial intelligence systems and models must be carried out in compliance with fundamental rights and freedoms provided by the Constitution, European Union law, and the principles of transparency, proportionality, security, data protection, confidentiality, accuracy, non-discrimination, gender equality, and sustainability.

The AI Law, in implementing this human-centered approach, further specifies that the use of artificial intelligence must not in any way undermine human autonomy and decision-making power, nor obstruct the democratic functioning of institutional and political life. Special attention is given to persons with disabilities, ensuring them full access to artificial intelligence systems on the basis of equality and without discrimination.

Sectoral regulation

The AI Law also pursues a sectoral approach, dedicating specific provisions to areas considered high-risk by the AI Act:
– healthcare and disability: the use of artificial intelligence in healthcare is aimed at improving disease prevention, diagnosis, and treatment. The AI Law establishes that artificial intelligence systems cannot select or condition access to healthcare services based on discriminatory criteria, acting solely as a support tool for medical professionals, who always retain the final decision;

– labor and regulated professions: artificial intelligence must be used to improve working conditions, productivity, and the physical and mental well-being of workers through safe, reliable, and transparent use. To this end, an Observatory has been established at the ministry of Labor. Regarding intellectual professions, artificial intelligence serves as a tool to support activities, provided that human intellectual work remains predominant;

– public administration and judicial activities: the use of artificial intelligence in public administration aims to increase efficiency, reduce procedural times, and improve services, with its use remaining merely instrumental and supportive to civil servants. Similarly, in judicial activities, governed by Article 15 of the AI Law, any decision on the interpretation and application of the law, the evaluation of facts, and the adoption of measures remains solely within the jurisdiction of the judge. Notably, Article 17 amends Article 9 of the Italian Civil Procedure Code, granting the court exclusive jurisdiction over cases involving the operation of an artificial intelligence system.

This regulatory choice addresses the need to provide precise and contextualized rules for sectors that have significant impacts on fundamental rights and social organization.

Personal data and copyright

Article 4 of the AI Law comprehensively addresses the regulation of personal data protection, referring to and integrating the principles and provisions already established by current national and European regulations, particularly by EU Regulation No. 2016/679 (GDPR). The applicability of the principles of lawfulness, fairness, and transparency (already enshrined in the GDPR) in relation to personal data processing is reiterated, as well as the need for information about processing to be provided in clear and understandable language to ensure full awareness of risks and the right to object. The AI Law also addresses the processing of data related to minors: in accordance with Article 2-quinquies of Legislative Decree No. 196/2003 and its amendments, consent from the holder of parental responsibility is required for minors under the age of fourteen, while minors who have reached the age of fourteen can give their consent autonomously.

Additionally, Article 8 is significant in the field of scientific and healthcare research: in this context, data processing for the development of artificial intelligence systems is expressly qualified as being of significant public interest, in compliance with constitutional principles and the GDPR. Where the data is devoid of identifiable elements, processing is authorized without the need for consent (where applicable), although providing adequate privacy information to the data subjects remains mandatory.

The AI Law also highlights cybersecurity, an essential element for the development of artificial intelligence, assigning the National Cybersecurity Agency (ACN) the task of promoting and developing initiatives aimed at leveraging artificial intelligence as a resource to strengthen national cybersecurity.

The AI Law also tackles the issue of copyright, a subject of ongoing debate that presents considerable challenges for legislators. It provides protection for works created with the aid of artificial intelligence tools, but only if they are not the exclusive result of artificial intelligence and reflect the «intellectual work of the author.» Furthermore, to counter the dangerous and growing spread of deepfakes and limit the damage caused by the improper use of such technologies, a separate offense is introduced (Article 612-quater of the Criminal Code) for «Illicit dissemination of content generated or altered with artificial intelligence systems«, punishable by imprisonment from one to five years.

Governance and competent authorities

The AI Law establishes a structured governance framework. The Prime Minister’s Office must develop a national strategy for artificial intelligence, to be approved biennially by the Interministerial Committee for Digital Transition (CITD) and subject to annual review by Parliament, with the aim of coordinating public policies on artificial intelligence while promoting technological innovation in compliance with fundamental rights.

The Agency for Digital Italy (AgID) is designated as the authority responsible for promoting innovation and the development of artificial intelligence, with duties related to notification, evaluation, accreditation, and monitoring of entities tasked with verifying compliance. The National Cybersecurity Agency (ACN) is designated as the supervisory authority. The specific competencies of the Bank of Italy, CONSOB, and IVASS for their respective market supervision sectors, as well as those of the Data Protection Authority, remain unchanged.

A particularly relevant aspect for businesses is the activation, by the AI Law, of an investment program worth 1 billion euros, aimed at accelerating competitiveness and supporting the development of startups and innovative SMEs.

Operational recommendations

The imminent entry into force of the AI Law (from October 10, 2025) requires companies to take immediate action to comply. In particular, companies and public administrations must conduct an audit and map the artificial intelligence systems currently in use (assessing the legal basis for their use, transparency levels, and associated risks), aligning with the provisions of the AI Law and adopting appropriate measures, including for inspections and audits by the competent authorities.

In terms of internal governance, it is recommended to adopt specific policies and procedures, as well as establish dedicated ethical committees and strengthen dialogue between different business functions: DPO, human resources, compliance, and technical functions must work in synergy to ensure an integrated approach to risk management. Equally crucial will be the review and integration of contracts with suppliers of artificial intelligence technologies and cloud platforms (e.g., in terms of guarantees, security, liability regimes, and remedies), also in light of new provisions on digital sovereignty and transparency requirements.

Particular attention must be paid to age verification mechanisms for services targeted at minors, including the implementation of robust systems for collecting informed consent from parents when the user is under fourteen years old.

Finally, organizations must prepare detailed documentation of decision-making processes involving artificial intelligence systems, ensuring transparency and accountability standards, which will be addressed by the forthcoming delegated decrees.

Timeline and concluding considerations

The AI Law establishes specific timelines for the adoption of implementing measures from its entry into force:

– within 90 days, the Ministry of Labor must adopt a decree defining the composition, operation, and tasks of the Observatory on the adoption of artificial intelligence systems in the world of work;
– within 120 days, the Ministry of Health must adopt a decree regulating the processing of personal data for research and experimentation purposes using artificial intelligence systems, after consulting the Data Protection Authority and other sector operators;
– within 12 months, the Government must adopt one or more legislative decrees on three areas: regulation on the training of artificial intelligence systems (to define a regulatory framework on the use of data, algorithms, and mathematical methods); alignment with the AI Act; and regulation of offenses, with the introduction of new criminal offenses and the definition of criteria for assigning liability.

The AI Law represents a fundamental step for Italy, providing a regulatory framework aimed at balancing innovation with the need for security and the protection of rights. Considering the regulations already in force, particularly the AI Act and the GDPR, it will be essential to adopt an integrated approach that takes into account the mutual obligations foreseen, while ensuring continuous cooperation between the different competent supervisory authorities.
In particular, the new regulation represents a strategic opportunity for Italy, which has managed to stay ahead of other European countries, positioning itself prominently in the European landscape of the sector.