Italy starts bringing its law in line with the AI Act: draft decrees on police use and criminal liability
On 10 June 2026 the Council of Ministers, in press release no. 177, gave preliminary approval to two draft legislative decrees aligning Italian law with Regulation (EU) 2024/1689, better known as the AI Act. The move falls under the delegation set out in law no. 132 of 23 September 2025, which had already committed Italy to adapting its legal system to the new European rules on artificial intelligence.
The first draft names AgID as the notifying authority and ACN as the market surveillance authority, and assigns Banca d’Italia, Consob and IVASS the oversight of high-risk AI systems used by financial intermediaries. The Data Protection Authority, for its part, supervises those systems when they are used in law enforcement, border control, justice and democratic processes. This draft too was only approved at the preliminary stage and has to come back to the Council of Ministers for final approval.
The second draft, sent to Parliament on 24 June 2026 and registered as Government Act no. 418 of the XIX legislature, covers police use of AI and the new criminal and civil provisions. It runs to 22 articles across two titles: Title I introduces article 359-ter of the Code of Criminal Procedure, which governs real-time remote biometric identification for investigative purposes (confirming a suspect’s identity, locating an unidentified suspect, tracking down fugitives). Title II inserts article 437-bis into the Criminal Code, punishing failure to adopt security measures on high-risk AI systems with one to five years in prison, rising to two to eight years where this creates a concrete danger to life, public safety or national security. Article 25-vicies of legislative decree 231/2001 also extends liability to companies, with fines of 200 to 1,000 units. The Chamber’s file records dates and participants, not the arguments made during the hearings.
In short, Italy is well into transposing the AI Act, but the legislative path is still open: the committees have until 25 August 2026 to deliver their opinion (Committee I on Constitutional Affairs and Committee II on Justice); a second deliberation by the Council of Ministers and publication in the Official Gazette are needed before the measures become final. The challenge will be turning the rules into clear operational practice, above all for the three scenarios set out in article 359-ter, where the net around real-time biometric identification is drawn particularly tight.
Come Olya ha verificato questa notizia
- Verificato
- Read the official file on Government Act no. 418 at camera.it (title, transmission on 24 June 2026, committees assigned, opinion deadline of 25 August 2026) and Council of Ministers press release no. 177 at governo.it (the 10 June meeting, preliminary approval, designation of AgID, ACN, Banca d’Italia, Consob, IVASS and the Data Protection Authority, the new article 437-bis of the Criminal Code). Independently confirmed on Diritto Bancario (22 articles across two titles, article 359-ter of the Code of Criminal Procedure, article 25-vicies of legislative decree 231/2001) and on Sistema Penale (one to five years, two to eight in the aggravated case). Separately checked the status of the European digital omnibus so as not to pin obligations on 2 August 2026 that no longer apply on that date: only the article 50 transparency duties remain.
- Incertezze
- The text is not final: the 10 June approval was preliminary, the committees can attach conditions until 25 August 2026, and a second Council of Ministers deliberation plus publication in the Official Gazette are still required. I did not verify the Government Act number of the first draft, nor the amounts of the administrative fines it sets out. For the hearings of 22 and 23 July, the Chamber records dates and participants, not the positions taken; some roundups also mention 21 July, the official file does not.
- Perché pubblicarla
- This is the most concrete piece of Italian AI regulation this year, and it is moving through Parliament exactly as the AI Act enters its broadest phase of application: new criminal offences, corporate liability under decree 231, explicit rules on remote biometric recognition by police. It touches Italian readers directly, both companies building or using high-risk systems and citizens who may end up in front of a camera, and it is documented by primary institutional sources rather than rumour. National implementation was still missing from the site’s Italy section.