Italy’s AI law: what changes for companies and professionals

01 What Law 132/2025 provides, and what it does not

Law no. 132 of 23 September 2025, “Provisions and delegations to the Government on artificial intelligence”, was published in the Gazzetta Ufficiale no. 223 of 25 September 2025 and has been in force since 10 October 2025. It has 28 articles in six chapters: principles, rules for individual sectors (work and the professions among them), national strategy and authorities, user protection and copyright, criminal provisions, financial and final provisions.

It is a law of principles and delegations, not a second AI Act. It says so itself: its provisions are to be interpreted and applied in accordance with the European regulation on artificial intelligence (article 1), and the law “produces no new obligations” compared with the regulation for AI systems and models (article 3, paragraph 5).

The sentence about “new obligations” deserves a careful reading. It speaks of obligations for systems and models: how AI software is designed, documented and placed on the market. That matter stays European. The Italian law acts instead on some of the people who use those systems: professionals toward their clients, with a new obligation, and employers toward their staff, by pointing to an obligation that has existed since 2022. These two points, plus the decrees of autumn 2026, are what changes things for a company or a practice.

02 What professionals must do: the notice to the client

Article 13 covers the intellectual professions: lawyers, accountants, labor consultants, engineers and architects, to name the most common. It says two things.

1. AI is for support, not for the professional service itself. Its use is limited to “instrumental and support activities”, with the professional’s intellectual work prevailing. In practice: AI can search, summarize, prepare a first draft; the opinion and the assessment remain the professional’s.
2. The client must be told. Information on the AI systems used must be given to the client “in clear, simple and comprehensive language”, to protect the relationship of trust.

The law does not say in what form, and the professional bodies moved quickly. The National Council of Accountants (CNDCEC) published a model clause for engagement letters on 9 October 2025. It then amended its code of ethics: since 21 November 2025 an accountant must disclose the systems used, mentioning them in the documents they produce too, must check sources and data, and must make sure the tools have adequate security and confidentiality and comply with data protection rules (article 21, paragraphs 8 to 10). The same code forbids using AI in a way that replaces the professional’s assessment of facts and rules. The National Bar Council (CNF) sent the bar associations a template notice on 13 October 2025, to be used “if deemed useful”.

Article 13 sets no penalty of its own. Its weight comes from professional ethics, where the bodies are writing it in, and from the relationship with the client, which is exactly what the rule protects. Training is coming too: Legislative Decree 179/2026 requires the professional bodies to include AI in initial and continuing education, information duties toward clients included, and gives the national councils six months from its entry into force to update their rules (article 47).

If you are the client of a practice, the practical consequence is simple: since October 2025 you have the right to know whether and how your lawyer, accountant or labor consultant uses AI on your documents. Ask, and ask with which tools: it is a question about your data as well as about the quality of the work.

What it means in daily work, profession by profession: AI in law firms and AI for accountants and labor consultants.

03 What changes for employers: inform, and leave the decision to a person

Article 11 sets principles (AI at work must be safe, reliable and transparent, and may not harm dignity or privacy) and one obligation: the employer must inform workers of the use of AI “in the cases and in the manner” of article 1-bis of Legislative Decree 152/1997, added in 2022 by the so-called transparency decree.

That reference sets the boundary. Article 1-bis covers “fully automated” decision-making or monitoring systems used to hire, manage or end an employment relationship, to assign tasks, or to monitor and evaluate performance. An employee who uses a chatbot to write an email does not trigger it. Software that assigns shifts automatically, or that scores call-center calls, does.

In those cases the information must be given before the work starts, in a structured and readable format, and covers the system’s purposes and logic, the categories of data and parameters used, the control measures and the level of accuracy. It also goes to the workers’ union representatives, and a worker can ask for more information, with a written answer within thirty days.

Legislative Decree 179/2026, in force from 23 October 2026, adds the sharpest rule (article 41). When AI plays a part in hiring, changing or ending an employment relationship, in disciplinary measures or in performance evaluations, the final decision belongs to a person “who exercises effective and autonomous power”, and the employee’s consent is not an exception. The worker can ask for an understandable explanation, given by a person, of whether and how much AI weighed. A dismissal made in breach of this rule is void, and so are the other decisions taken the same way.

Two clarifications. Searching for and screening candidates does not count as a final decision, even when it rules someone out: there the general rules apply, meaning the GDPR, the bans on discrimination and, from 2 December 2027, the European rules on high-risk systems, which include those used to select staff. And if AI affects work organization, pace of work or safety-relevant decisions, it must be covered by the risk assessment required by Legislative Decree 81/2008, with information and training for workers (article 42).

One limit has applied since 2 February 2025: the AI Act prohibits systems that infer people’s emotions in the workplace, except for medical or safety reasons. In May 2026 the Italian data protection authority (the Garante) sent a formal warning to a start-up offering a Slack and Teams add-on that estimated employees’ stress from their chats, recalling that very ban.

04 Who enforces, and what violations cost

Law 132 designates two national AI authorities (article 20). AgID, the Agency for Digital Italy, is the notifying authority: it accredits and monitors the bodies that check whether systems conform. ACN, the National Cybersecurity Agency, is the market surveillance authority, with inspection and sanctioning powers, and the single point of contact with the European institutions. The Bank of Italy, Consob and IVASS remain the market surveillance authorities for the financial sector; the data protection authority and AGCOM keep their powers.

Legislative Decree 179/2026 gives these authorities their tools and sets the fines, with the same ceilings as the AI Act (article 23):

Worldwide annual turnover of the previous financial year. For SMEs and start-ups the lower of the two values applies (AI Act, article 99, paragraph 6). Source: Legislative Decree no. 179 of 7 October 2026, article 23.

For minor violations the authorities may choose an order to comply or a public statement instead of a fine; whoever ignores the order pays the fine increased by up to a third (article 22). One absence matters: the AI literacy obligation in article 4 of the AI Act appears neither in the European list of article 99 nor in the Italian one. We explained it in You are already an AI deployer, now updated with the October texts.

05 The delegations to the Government: where they stand in October 2026

The law gave the Government two delegations to exercise within twelve months of its entry into force, that is by 10 October 2026: one on the use of data, algorithms and mathematical methods to train AI systems (article 16), the other to align Italian law with the AI Act and to regulate unlawful uses of AI (article 24).

The Council of Ministers examined the drafts on 10 June 2026 and gave final approval on 4 August, after the opinions of the parliamentary committees, of the Unified Conference and of the data protection authority. The result is two decrees:

• Legislative Decree no. 160 of 9 September 2026 (Gazzetta Ufficiale no. 214 of 15 September 2026, in force since 30 September): AI in police work, criminal provisions, and tools to claim compensation for damage caused by AI systems.
• Legislative Decree no. 179 of 7 October 2026 (Gazzetta Ufficiale no. 234 of 8 October 2026, in force from 23 October): powers of the authorities, fines, regulatory sandboxes, AI in education and training, the professions, work, healthcare and public administration, and a chapter on company information about data, algorithms and mathematical methods.

Not everything is settled. A decree of the Prime Minister will set how ACN exercises its supervisory powers (article 15 of Decree 179), and the authorities’ first guidance will come in the months ahead. The law itself has meanwhile been amended in two places that do not touch the obligations of companies and professionals: the make-up of the coordination committee and the funding for training.

06 Deepfakes, offenses and copyright: the context

The criminal part makes headlines but rarely touches the ordinary life of a company. The law created the offense of unlawfully spreading content generated or altered with AI (article 612-quater of the Criminal Code): whoever causes unjust harm by spreading, without consent, falsified images, video or voices capable of deceiving people about their authenticity faces one to five years in prison. It added an aggravating circumstance for offenses committed with AI when it serves as an insidious means, hinders defense or worsens the consequences. Decree 160/2026 then added the offense of failing to adopt security measures in high-risk AI systems (article 437-bis of the Criminal Code).

Closer to everyday work is copyright (article 25). Italian copyright law now protects works of “human” creativity, and those made with the help of AI only when they are the result of the author’s intellectual work. A text or an image produced by AI without a creative contribution of yours may not be protected as your work.

07 The AI Act calendar after the Digital Omnibus

The Italian law has to be read next to the European regulation, whose own calendar (article 113) changed this summer. Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, proposed by the Commission on 19 November 2025, approved by the European Parliament on 16 June 2026 and by the Council on 29 June, was published in the Official Journal on 24 July and has been in force since 27 July 2026. It is no longer a proposal.

After 2027: on 2 August 2028 the rules reach high-risk systems built into regulated products (Annex I), and 2 August 2030 is the deadline for high-risk systems already used by public authorities. Sources: articles 111 and 113 of Regulation (EU) 2024/1689, consolidated text of 27 July 2026; Law 132/2025; Legislative Decree 179/2026.

What the Omnibus changed for companies that use AI: it rewrote article 4, which now asks them to take measures “to support the development” of their staff’s AI literacy without requiring any specific level to be guaranteed; it pushed the high-risk rules back; from 2 December 2026 it bans systems that generate realistic intimate or sexually explicit depictions of identifiable people without their consent, and systems that generate child sexual abuse material; and it extended some SME protections to small mid-cap companies, starting with the fine ceilings.

What is still only proposed. On the same 19 November 2025 the Commission presented a second “Digital Omnibus” on data rules, the GDPR included: as of 10 October 2026 it has not been adopted and is still before the European Parliament’s committees. A proposal of 16 December 2025 on medical devices, which would move them to another section of Annex I of the AI Act, has not been adopted either. Until they appear in the Official Journal, proposals change nothing.

08 What to do this quarter

For a company of fifty people, the list is short and almost entirely organizational:

1. Map how AI is used, with no consequences for anyone. Who uses which tool, for what, with what data. You need it for article 4 of the AI Act, which since 2 February 2025 asks you to support the AI literacy of the people who use AI on your behalf, and for everything else on this list.
2. Separate work tools from systems that decide about people. If software decides or monitors automatically (shifts, evaluations, CV screening), prepare the article 1-bis notice for staff and unions before using it, and from 23 October make sure every final decision is taken by a person, with a record of who took it.
3. Update the risk assessment document if AI affects work organization, pace or safety.
4. Write one page of rules: which data never goes into outside tools (customer data, colleagues’ personal data, drawings, price lists) and which tools are approved. Before approving one, ask the vendor the right questions: you will find them in GDPR and generative AI: the questions to ask a vendor.
5. Train people on your own cases, and keep a record. The European Commission makes clear that no certificate is needed, and that you can keep an internal record of training and other initiatives.
6. If you publish realistic images, video or audio generated or altered by AI (so-called deepfakes, in advertising too), say so: article 50 has required it since 2 August 2026. For clearly artistic, satirical or fictional work, a disclosure that does not spoil it is enough.
7. Check your advisers’ notices: your lawyer, accountant and labor consultant must tell you if they use AI on your documents.

For a professional practice:

1. Put the notice in the engagement letter. Use your national council’s clause (accountants) or the CNF template (lawyers) and adapt it to the tools you actually use: name the systems, what you use them for and what you do not.
2. Mention it in your documents when AI contributed. For accountants it is already a rule of their code of ethics.
3. Keep AI within support work: research, summaries, first drafts. The opinion and the signature stay yours, and the sources must be checked.
4. Choose tools with written guarantees on client data: professional secrecy and the GDPR together. The accountants’ code explicitly asks you to make sure the tools have adequate security and confidentiality.
5. Plan the training: Decree 179/2026 makes it part of continuing education, and the professional bodies have six months from 23 October 2026 to update their rules.
6. The practice is a deployer too: article 4 of the AI Act covers your employees and collaborators.

If you are looking for the company route for AI, it is what we built ekory for: Ekos, AI agents that answer from your documents citing the document and page, with explicit permissions on who sees what, and your data stored in Europe. How we handle data is on our Security page.

09 Note on sources

This article is not legal advice. It describes what the texts in force or published on 10 October 2026 say. Deciding on your own case needs a professional who knows your organization.

• Texts read at the source on 10 October 2026: Law 132/2025, Legislative Decrees 160/2026 and 179/2026 and article 1-bis of Legislative Decree 152/1997 on Normattiva; Regulation (EU) 2024/1689 in the consolidated text of 27 July 2026 and Regulation (EU) 2026/1744 on EUR-Lex; the Omnibus procedure on the European Parliament’s website.
• Quotations from Italian texts are our translations; the Italian version of this article quotes the official wording.
• Decree 179/2026 was published two days before this article and enters into force on 23 October: the first applications and the authorities’ guidance will follow in the coming months.
• Professional bodies: the CNDCEC model clause (press release no. 119 of 9 October 2025) and its code of ethics as amended on 20 November 2025; the CNF communication of 13 October 2025.
• The Garante case on the Slack and Teams add-on is in its press release of 28 May 2026.

Questions and answers

Sources

1. Law no. 132 of 23 September 2025, Provisions and delegations to the Government on artificial intelligence, Normattiva, text in force.
2. Legislative Decree no. 179 of 7 October 2026, Gazzetta Ufficiale no. 234 of 8 October 2026.
3. Legislative Decree no. 160 of 9 September 2026, Gazzetta Ufficiale no. 214 of 15 September 2026.
4. Legislative Decree no. 152 of 26 May 1997, article 1-bis, Normattiva.
5. Regulation (EU) 2024/1689 (AI Act), consolidated text of 27 July 2026, EUR-Lex.
6. Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal of the European Union, 24 July 2026.
7. Digital Omnibus on AI, Legislative Train Schedule, European Parliament, 2026.
8. Digital Omnibus (data rules), procedure 2025/0360(COD), European Parliament Legislative Observatory.
9. AI Literacy, Questions & Answers, European Commission, updated 27 July 2026.
10. Model clause on informing clients about AI, CNDCEC, press release no. 119, 9 October 2025.
11. Code of ethics of the accounting profession, article 21, CNDCEC, amended 20 November 2025.
12. Notice on the use of AI tools under article 13 of Law 132/2025, Consiglio Nazionale Forense, 13 October 2025.
13. Warning to a start-up over an AI add-on that estimates employees’ stress, Garante per la protezione dei dati personali, 28 May 2026.