Italy approves the decrees aligning national law with the AI Act: rules on policing, work and governance

On Tuesday 4 August 2026, at 6:04 p.m., Italy's Council of Ministers gave final approval to two legislative decrees aligning national law with Regulation (EU) 2024/1689, the AI Act. The measure implements the delegation granted by Law no. 132 of 23 September 2025 and closes a process that began with the preliminary review of 10 June, once the opinions of the parliamentary committees, the Unified Conference and the data protection authority (Garante) had been collected. The official press release (no. 185) places the session on 4 August, although some secondary sources date the approval to 5 August, the day the release was circulated; at the time of checking, the texts had not yet been published in the Official Gazette.

The first decree sets limits on the use of artificial intelligence in policing and establishes the principle of human responsibility: decisions with adverse legal effects cannot rest on automation alone. The text allows real-time biometric identification “in exceptional cases, for limited periods and subject to prior authorisation by a judicial authority”, but prohibits building biometric databases through the “mass, untargeted collection of information from the web”. It also inserts Article 437-bis into the Criminal Code, punishing the failure to adopt security measures on high-risk systems as well as their unlawful alteration.

The second decree deals with governance and the workplace. AgID and ACN are designated as the notifying authority and the market surveillance authority respectively, while the data protection authority is given specific powers over systems used in law enforcement, border management and justice. On employment, decisions on hiring, role changes, dismissals and disciplinary measures cannot be “taken solely on the basis of automated processing”; a dismissal made in breach of that ban is void. The decree also allocates 100 million euros to teacher training and digital literacy for public-sector staff, with continuing training for judges and healthcare workers as well.

The measure introduces regulatory sandboxes with preferential access for SMEs and start-ups, but defers penalties until the European obligations take effect, in line with Regulation (EU) 2026/1744. Changes from the preliminary drafts include the involvement of the Regions and autonomous Provinces, and clarifications on video surveillance and biometric data processing and on the Garante's powers in law enforcement, migration and asylum, and border management. The legal framework is now settled, but what happens in practice depends on the publication of the full texts and on the European timetable.

— Olya