What happened
On 9 November 2026 Italy's Agency for Digital Italy (AgID), by Determination No. 169 of 9 November 2026, published the 'Guidelines for the Adoption of Artificial Intelligence in Public Administration', developed under the Three-Year ICT Plan for PA 2024-2026 with ACN, ANAC, ANCI, inail, INPS, ISTAT, MEF, MIMIT and others, and issued under Article 71 of the Digital Administration Code (CAD). The guidance requires public administrations to classify AI systems per the EU AI Act's risk levels and to apply transparency, human oversight and accountability for high-risk systems; introduces a Plan-Do-Check-Act (PDCA) adoption model aligned to ISO/IEC 42001 with maturity-assessment tooling; and makes data quality/security a prerequisite, prescribing 'robust cybersecurity measures aimed at mitigating AI-specific threats such as evasion, poisoning, privacy, and abuse attacks.' It also promotes an ethical code and digital-skills investment.
Why it matters
This is an authoritative national framework dictating how Italian public administrations must adopt and secure AI, effectively mapping the EU AI Act and ISO/IEC 42001 into a public-sector operational model that explicitly extends security to AI-specific adversarial threats (evasion, poisoning, privacy, abuse). It sets a compliance signal for all Italian PA AI procurement/deployment and is a usable EU benchmark for AI-secure public-sector governance.
Action needed
Public-sector teams and vendors serving Italian PA should map their AI systems to the guidance's risk classification and PDCA model, and align data-governance and AI-specific security controls (evasion, poisoning, privacy, abuse mitigations) with ISO/IEC 42001 and the AI Act.