Italy's AI decree published in the Official Gazette, in force from 23 October: authorities, penalties and a sandbox for businesses

Legislative Decree no. 179 of 7 October 2026 has been published in the Gazzetta Ufficiale, Italy's Official Gazette (General Series no. 234), and will enter into force on 23 October 2026. According to its official title, the text aligns national legislation with Regulation (EU) 2024/1689, known as the AI Act, specifying the powers of national authorities and the use of AI in training.

The details of the measures and the article numbers below come from analyses by Ingenio and Lavorosì; for now, only the decree's front page is available in the Gazette.

AgID is designated as the national notifying authority: it handles the designation, monitoring and possible suspension or withdrawal of conformity assessment bodies (Arts. 4 and 13). ACN, the National Cybersecurity Agency, takes on the role of market surveillance authority and single point of contact with EU institutions; for real-world testing, it can carry out inspections even without prior notice (Art. 15(2), according to Ingenio). The Bank of Italy, CONSOB and IVASS supervise high-risk systems in their respective sectors, while the Italian Data Protection Authority (Garante privacy) retains the powers assigned to it by the AI Act.

The penalties are steep: up to €35 million or 7% of global annual turnover for practices prohibited under Article 5 of the AI Act; up to €15 million or 3% for other obligations; and up to €7.5 million or 1% for supplying incorrect information to authorities (Art. 23). For minor violations, non-monetary measures are provided, such as an order to end the infringement or a public statement (Art. 22).

The decree establishes the "Italian AI Space" (Spazio italiano per l'IA), a regulatory sandbox run jointly by AgID and ACN, with priority for SMEs and start-ups and no automatic admission (Art. 26). In employment, final decisions on hiring, changing or terminating an employment relationship cannot be based solely on automated processing; they must be taken by a natural person with decision-making authority (Art. 41). In addition, AI systems that affect how work is organised must be included in the workplace safety risk assessment, with an obligation to inform and train workers (Art. 42).

Specific training is planned for civil servants, professional bodies, healthcare professionals and teachers; according to Lavorosì, a training plan for teachers is to be launched within 90 days, with funding of up to €100 million (Arts. 36–37).