What happened
Italy's Legislative Decree 179/2026, published in the Official Gazette on October 8, 2026, takes effect on October 23, 2026. This decree completes Italy's transposition of the EU (Regulation 2024/1689) by defining the national enforcement architecture. It designates the Agency for Digital Italy (AgID) as the notifying authority and the National Cybersecurity Agency (ACN) as the market surveillance authority and single point of contact with the European Commission. The decree establishes a penalty regime where fines for the most serious prohibitions can reach 35 million euros or 7% of worldwide annual turnover, whichever is higher for large companies. It also creates the Italian regulatory sandbox for AI, mandates specific training for professionals and teachers, and restricts the use of automated processing for final employment decisions.
Legislative Decree 179/2026, published in the Official Gazette (Gazzetta Ufficiale) no. 234 on October 8, 2026, takes effect on October 23, 2026. This decree is the second of two implementing decrees for Law 132/2025, following Decree 160/2026 which addressed policing and criminal liability. Decree 179 specifically addresses the administrative machinery for AI supervision, sanctioning procedures, and workforce training requirements.
The decree designates AgID as the notifying authority, responsible for assessing and designating certification bodies, and ACN as the market surveillance authority and the single point of contact with Brussels. Sector-specific regulators, including the Bank of Italy, Consob, and Ivass, retain oversight over high-risk AI systems in their respective domains. A Coordination Committee at the Presidency of the Council of Ministers is established to ensure coherence among these bodies.
The penalty framework sets fines up to 35 million euros or 7% of worldwide annual turnover for the most serious violations. For large companies, the higher of the fixed amount or the percentage of turnover applies. For SMEs, microenterprises, and innovative startups, the lower of the two values applies, in line with Article 99, paragraph 6, of the . Minor violations may result in orders to stop the infringement or public statements, with financial penalties for non-compliance.
The decree establishes the Italian regulatory sandbox for AI, managed by a joint Operating Group of AgID and ACN. Access is prioritized for SMEs and startups, with dedicated spaces planned for dual-use and justice applications. However, the Operating Group does not yet exist, as the joint decrees defining its composition and operation have no set deadline in the text.
Labor provisions in Article 41 prohibit final decisions on hiring, changing, or ending employment relationships from resting solely on automated processing. A natural person with real and autonomous power must make the definitive decision, and worker consent does not lift this ban. Violations render the dismissal or decision void. Article 42 requires risk assessments and training for AI systems affecting production rhythms or safety. Articles 47 and 49 mandate AI training for professionals and introduce a 'fair pay' modulation based on the risk class of AI systems used, with criteria to be defined by October 2027.
Source details: pasqualepillitteri.it ↗
Why it matters
This decree provides the operational legal framework for enforcing the EU within Italy, a major EU member state. By assigning clear supervisory roles to AgID and ACN and setting specific financial penalties, it creates tangible compliance risks for AI developers and deployers operating in the Italian market. The decree also introduces specific labor protections, prohibiting automated final decisions on hiring or dismissal, which impacts HR practices across Italian companies. Additionally, the establishment of a regulatory sandbox offers a structured pathway for SMEs and startups to test AI systems with regulatory oversight, potentially accelerating innovation while ensuring safety.
The decree operationalizes the EU in Italy by filling the gap in national enforcement mechanisms. Prior to this, while the penalties chapter of the AI Act applied since August 2025, Italy lacked specific rules on who imposes sanctions and through what procedure. This clarity is crucial for legal compliance and risk management for companies operating in Italy.
The financial penalties are significant, with the 35 million euro or 7% turnover ceiling creating substantial financial exposure for non-compliance. This aligns Italy with the broader EU enforcement landscape but adds specific national procedural details that companies must navigate.
The labor provisions have direct practical implications for HR departments. The ban on automated final decisions for hiring and dismissal requires companies to review their AI-assisted recruitment and performance management processes to ensure human oversight is genuine and documented. This could slow down some AI-driven HR workflows but enhances worker protections.
The regulatory sandbox provides a valuable tool for innovation, particularly for smaller entities that may lack resources to navigate complex regulatory requirements independently. By offering a controlled environment for testing with regulatory oversight, it may encourage the development of compliant AI solutions in the Italian market.
The 'fair pay' modulation for professionals introduces a new variable into professional service pricing. While the direction (upward or downward) and criteria are not yet defined, the requirement to consider the risk class of AI systems used in client work will likely influence contract negotiations and fee structures in legal, medical, and other regulated professions.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').Why can ethical evaluation not be reduced to one model score?
What to watch next
Monitor the issuance of implementing decrees required to operationalize the regulatory sandbox and define the composition of the joint Operating Group. Watch for updates on the 'fair pay' modulation criteria for professionals using AI, which are due by October 2027. Track how AgID and ACN coordinate with sector-specific regulators like the Bank of Italy and Consob in enforcing high-risk AI system requirements. Observe early enforcement actions or public statements from the authorities regarding compliance with the new penalty structures.
The issuance of the joint decrees by the directors general of AgID and ACN to define the composition and operation of the sandbox Operating Group is critical. Without this, the sandbox cannot function, leaving a gap in the support structure for AI developers.
The adoption of decrees defining the parameters for regulated professions and the 'fair pay' modulation criteria, due by October 23, 2027, will determine how AI use impacts professional fees. This is a key area for legal and professional services firms to monitor.
Early interactions between AgID, ACN, and sector regulators will reveal how coordination works in practice. Disputes or overlaps in jurisdiction could create compliance challenges for companies using AI in banking, insurance, or securities.
The launch of the teacher training plan, funded with up to 100 million euros, and the subsequent decree on AI training for teachers, will indicate Italy's approach to integrating AI into education. This has long-term implications for the workforce's AI literacy.
Enforcement actions or public statements from AgID and ACN regarding compliance with the new penalty structures will provide insight into the strictness of Italian AI regulation. Early cases may set precedents for how the law is interpreted and applied.