Series
Blogs
Italy – A pioneering national framework to complement the EU AI Act
Italy – A pioneering national framework to complement the EU AI Act
30 September 2025
Series
Blogs
30 September 2025
Italy has adopted Law No. 132 of 23 September 2025, Provisions and delegations to the Government on artificial intelligence (the "AI Law"). In doing so, it becomes the first Member State to adopt national legislation that coherently complements the EU AI Act (Regulation 2024/1689).
The AI Law will enter into force on 10 October 2025. It addresses AI deployment across multiple sectors including healthcare, public administration, judicial activity, national security and defence, and employment. Several aspects merit deeper analysis.
The AI Law coordinates with the EU AI Act ensuring that the measures are interpreted and applied in conformity with the EU AI Act. For example, it maintains definitional consistency by directly referencing the AI Act's definitions for "AI system" and "AI models", ensuring seamless integration between national and EU frameworks.
Core principles: Article 4 establishes fundamental principles requiring AI systems to guarantee lawful, correct and transparent processing of personal data, whilst ensuring clear communication about processing activities and associated risks.
Protection of Minors: There is also specific protection for minors through a dual-tier consent framework. Children under fourteen require parental consent for AI-related data processing, whilst those aged fourteen to eighteen may provide their own consent, provided information is accessible and comprehensible.
Healthcare Data Processing: Articles 8 and 9 create a comprehensive framework for healthcare AI development. AI-related healthcare research is identified as being of significant public interest under the Italian Constitution. This enables secondary use of personal data by healthcare entities once direct identifying elements are removed. It also maintains oversight by the Garante through a notification procedure.
Importantly, this does not remove the fundamental obligation to provide information to data subjects, which can be fulfilled through a general information notice made available on the data controller's website. For data processing aimed at anonymisation, pseudonymisation or data synthesis, prior information to the data subject is still required in accordance with the GDPR.
The Ministry of Health is tasked with regulating personal data processing for AI research and experimentation, in consultation with the Garante and relevant stakeholders
The law establishes a dual authority model designating the Agency for Digital Italy ("AgID") and the National Cybersecurity Agency ("ACN") as competent national authorities for AI.
The AgID focuses on innovation promotion and conformity assessment procedures as the notifying authority. The ACN handles surveillance, inspection and sanctioning activities as the market surveillance authority. This dual authority model aligns with the framework established under Article 70 of the EU AI Act.
A coordination committee at the Presidency of the Council of Ministers ensures effective cooperation with the public administration authorities and the independent authorities. Importantly, existing powers of the Garante and the Communications Regulatory Authority (Autorità per le Garanzie nelle Comunicazioni) remain unchanged, preserving established regulatory frameworks.
The Government also receives broad delegations to implement the framework through legislative decrees. This includes attributing full supervisory, inspection and sanctioning powers to AgID and ACN as provided by the EU AI Act, and developing criminal law provisions for illegal AI implementation and use.
Article 13 restricts AI use in intellectual professions to supporting activities, ensuring human intellectual work remains predominant. Professionals must clearly tell clients about the AI systems used in service delivery; maintaining professional trust whilst enabling technological enhancement.
This provision recognises the unique nature of professional services whilst allowing for AI to enhance rather than replace professional expertise. The transparency requirement ensures clients remain informed about the tools used in their service delivery.
Italy becomes the first country to provide explicit copyright protection for AI-assisted works through Article 25. The modification to Italy's copyright law clarifies that protection extends to works created with AI tools, provided they constitute the result of human intellectual work.
Article 70-septies permits text and data extraction for AI model training, balancing innovation needs with creator rights. This groundbreaking approach balances the protection of human creativity with the recognition that AI can be a legitimate tool in the creative process, provided there remains meaningful human authorship.
Italy's AI Law represents a sophisticated regulatory approach that complements rather than duplicates EU legislation. By establishing explicit coordination mechanisms with the EU AI Act whilst addressing national specificities, Italy has created a framework that balances innovation promotion with robust protection of fundamental rights.
The law's comprehensive scope—spanning data protection, professional services, copyright innovation, and criminal law—demonstrates how national legislation can effectively supplement EU regulation. Particularly noteworthy are the specific protections for minors and the groundbreaking approach to AI-assisted creativity.
The framework's success will depend on effective implementation through delegated legislation and coordination between competent authorities, but Italy has undoubtedly established a precedent for coherent national AI regulation that other Member States may well follow.