Italy's artificial intelligence law. Five things the European regulation doesn't say.

Italy had its own AI law before the AI Act became applicable, and it went almost unnoticed. It covers work, the professions, children's data and copyright, and it creates a criminal offence that didn't exist before.

This piece belongs to the guide on AI Act obligations for businesses and SMEs and looks at the Italian side on its own. It's written for people running a business, and it stops where a lawyer's work begins.

What it is, what it adds, and why it isn't a transposition

Law no. 132 of 23 September 2025 is entitled Provisions and delegated powers to the Government on artificial intelligence. It was published in Gazzetta Ufficiale no. 223 of 25 September 2025, Italy's official journal, and came into force on 10 October 2025, fifteen days later.

A European regulation isn't transposed; it applies directly. That's why Law 132/2025 doesn't translate the AI Act: it sets principles alongside it and empowers the Government to connect it with Italian law. Article 1 says so openly, stating that its provisions are to be interpreted and applied in line with Regulation (EU) 2024/1689.

The definitions come from there too. Article 2 refers to Article 3 of the European regulation for AI system and AI model, and adds that the European definitions apply to anything it doesn't cover. If you're looking for the meaning of deployer, you'll find it in the AI and automation glossary, not in this law.

Set side by side, the differences are easier to see. The AI Act regulates the product and the role of the business that puts it into circulation; the Italian law goes into relationships: work, client, author, victim.

Area	What the Italian law says	Relationship with the AI Act
WorkArticles 11 and 12	Tell workers when AI is used, with a cross-reference to Legislative Decree 152 of 1997. Safe, transparent, non-discriminatory use. An Observatory at the Ministry of Labour.	An Italian addition. The AI Act doesn't impose a general duty to inform employees.
ProfessionsArticle 13	AI only for supporting tasks, with the intellectual work taking precedence. Clients told which systems are used, in plain language.	An Italian addition. Nothing corresponds to it in the European regulation.
CopyrightArticle 25	Works of the human intellect. Works made with the help of AI protected only if they are the result of the author's intellectual work.	An Italian addition, on a subject the AI Act only touches in passing.
Criminal lawArticle 26	New Article 612-quater, general aggravating circumstance 11-decies, heavier penalty for fraud under Article 294.	An Italian addition. The AI Act provides for administrative fines, not criminal offences.
AuthoritiesArticle 20	AgID and ACN designated as the national authorities for AI, with the Bank of Italy, CONSOB and IVASS remaining market surveillance authorities in their own sectors.	Implementation: the regulation asks Member States to designate them, and the Italian law does so.

Work: informing staff, and it isn't an internal memo

Article 11 says the employer or contracting business must inform workers that artificial intelligence is being used, in the cases and in the ways set out in Article 1-bis of Legislative Decree no. 152 of 26 May 1997. That cross-reference is what gives it weight, because it points to an information regime that already exists and already carries penalties.

The same article sets four conditions on the use of AI in employment: it must be safe, reliable and transparent; it can't conflict with human dignity; it can't breach the confidentiality of personal data; and it must protect workers' rights without discrimination on grounds of sex, age, origin, belief, orientation, opinions or personal circumstances.

Article 12 sets up an Observatory at the Ministry of Labour on the adoption of AI at work, tasked with drawing up a strategy, monitoring the impact on the labour market and promoting training for workers and employers. It ties in with the AI literacy obligation in Article 4 of the AI Act, which has applied since 2 February 2025.

The intellectual professions have to tell the client

Article 13 covers accountants, lawyers, consultants, architects and anyone else in an intellectual profession. It says AI systems may be used only for supporting and ancillary tasks, with the intellectual work that is the subject of the service taking precedence.

The second part is the practical one, and almost nobody applies it: to protect the relationship of trust, information about the AI systems the professional uses must be given to the client in clear, simple and complete language. It's a duty to inform, not an option.

For a business buying professional services, the practical reading is simple: you can ask your adviser which tools they use on your documents, and Italian law says they have to tell you.

Personal data, and a line about under-fourteens

Article 4 requires the use of AI systems to ensure lawful, fair and transparent processing of personal data, compatible with the purposes for which the data was collected, in line with EU law. The full relationship between the two sets of rules is covered on the page about the AI Act and the GDPR.

The same article requires information about processing to be given in clear and simple language, so that people can understand the risks and exercise their right to object. It's a demand for readability, and it puts pressure on privacy notices written not to be read.

Then there's the line on minors, which concerns anyone with a young audience or a service open to the public: access to AI technologies by children under fourteen, and the data processing that goes with it, requires the consent of the person with parental responsibility.

Copyright law now says “human”

Article 25 amends Law 633/1941 by changing a single word, and it changes a lot. In Article 1, protection moves from “works of the intellect” to “works of the human intellect”.

The provision adds that protection also covers works created with the help of artificial intelligence tools, provided they are the result of the author's intellectual work. The person's creative contribution becomes the condition for protection, and content produced entirely by the machine doesn't get it.

For a business producing catalogues, copy or images with generative tools, the consequence is real: anything that comes out without a creative contribution you can document may not legally be yours, and so can't be defended if someone copies it.

The same article adds Article 70-septies on text and data mining from material to which there is lawful access, referring to the rules in Articles 70-ter and 70-quater. It concerns people training models far more than people using them.

The new offence, and the aggravating circumstance that applies to everyone

Article 26 amends the Criminal Code in three places. The best known is the new Article 612-quater, which punishes with one to five years' imprisonment anyone who causes unjust harm to a person by spreading falsified content about them.

Causing unjust harm to a person by handing over, publishing or otherwise spreading, without their consent, images, videos or voices falsified or altered using artificial intelligence systems and capable of misleading people about whether they are genuine.
Criminal Code, Article 612-quater, introduced by Law 132/2025 (faithful paraphrase)

The offence is prosecuted on the victim's complaint, and ex officio when it's connected to another offence prosecuted ex officio. The threshold is unjust harm and the content's ability to mislead people about whether it's genuine.

The other two changes matter just as much. Article 61 of the Criminal Code gains the general aggravating circumstance 11-decies, for anyone who commits an offence using AI systems as an insidious means, or in a way that hinders defence or worsens the consequences. Under Article 294, on deception, the penalty rises to two to six years' imprisonment when the deception is carried out with AI systems.

Who enforces it, and the piece still missing

Article 20 designates AgID and ACN as the national authorities for artificial intelligence. AgID handles notification, assessment, accreditation and monitoring of the bodies that check systems' conformity. ACN handles supervision, including inspections and penalties, cybersecurity aspects included.

The Bank of Italy, CONSOB and IVASS keep their powers as market surveillance authorities, under Article 74(6) of the European regulation. Businesses in those sectors look there before AgID and ACN.

The missing piece is implementation. Article 24 empowers the Government to adopt one or more legislative decrees bringing national law into line with the regulation, within twelve months of the law coming into force (by 10 October 2026), giving the authorities in Article 20 all the supervisory, inspection and enforcement powers the AI Act provides for.

Until those decrees arrive, Italy's penalty framework for the AI Act is incomplete, while the European obligations already apply in full. The regulation's penalties remain those in Article 99, up to €15 million or 3% of worldwide annual turnover for the band that includes transparency, with the lower of the two figures applying to SMEs.

What an SME has to do in practice

The work this law adds for an ordinary business comes down to four moves, and none of them calls for a project. If you already have a list of the systems in use, one is done.

One: tell your staff. If an AI system comes into a process that affects people's work, they must be told beforehand, in the ways set out in Legislative Decree 152 of 1997. Two: ask your advisers. Your consultant has to tell you which systems they use on your documents.

Three: look at the content you publish. Anything that comes out of a generative tool without a creative contribution you can document may not be protected by copyright, and synthetic voices or faces of real people are in territory where a criminal offence now exists.

Four: keep the human checkpoint. On every automated process that touches a customer, money or an outgoing message, a person approves before it goes out. Replies drawing on information the owner has already approved can go out on their own, saying they come from a system, as Article 50 requires from 2 August 2026. The full scope is in our AI principles, and the systems we actually use are on the AI transparency page.

Questions and answers

This article is a practical overview, not legal advice. For specific situations, and in particular on employment relationships and criminal law, the answer has to come from a professional who looks at your business.