What happened
Italy published Legislative Decree 179 of 7 October 2026 in Gazzetta Ufficiale n. 234 of 8 October 2026 (in force 23 October 2026), implementing the EU AI Act (Reg. (EU) 2024/1689)'s national-enforcement architecture. ACN (national cybersecurity agency) is market-surveillance authority and single point of contact (Art. 70 AI Act); AgID is notifying authority for conformity-assessment bodies; Bank of Italy, CONSOB and IVASS supervise high-risk AI in banking, securities and insurance. It sets sanctions up to EUR 35m or 7% of worldwide turnover (Art. 5 prohibited practices) and EUR 15m/3% for other breaches, with non-pecuniary remedies and publication of sanction decisions. Art. 41 bars final decisions on hiring, termination, discipline or performance evaluation resting solely on automated processing (worker consent cannot cure; violating dismissals are null). Art. 42 folds AI impacts on work organisation and safety into D.lgs. 81/2008 risk assessments; Art. 52 extends trade-secret protection to training data, model architectures and optimisation functions.
Why it matters
Any entity placing on the market or deploying AI in Italy now faces multiple designated competent authorities (ACN plus sectoral financial supervisors plus the Garante) with inspection powers including unannounced on-site visits, plus a hard human-in-the-loop requirement for employment decisions and criminal exposure via companion D.Lgs. 160/2026. It is a concrete instance of EU member-state operationalisation of AI Act enforcement and carries reputational risk because sanction decisions are published without delay.
Action needed
Map all AI systems touching HR decisions and ensure a human with effective, autonomous decision power issues final decisions; update workplace risk assessments for AI under D.lgs. 81/2008; document trade-secret protection measures for models/datasets; prepare for publication of sanction decisions and interim-relief appeals. Effective 23 October 2026; professional-body training rules adapt within 6 months; equitable-compensation parameters within 12 months.