Legislative Decree no. 179 of 7 October 2026, published in Official Gazette no. 234 on 8 October, aligns Italian law with Regulation (EU) 2024/1689, the AI Act. It enters into force on 23 October 2026. It has 54 articles in five chapters: general provisions, powers of the national authorities, AI in education, the professions, work, healthcare and public administration, protection of business information, data and algorithms, and final provisions.
For businesses the point is not only what the decree prohibits, but who supervises, with what powers and with what penalties. Here is what matters.
1. Who oversees what
- AgID is the notifying authority: it deals with the bodies that assess the conformity of AI systems.
- ACN (the National Cybersecurity Agency) carries out market surveillance and is the single point of contact with the EU institutions. It has inspection powers, including unannounced checks when testing in real-world conditions, and manages the national registration of certain high-risk systems.
- Banca d’Italia, CONSOB and IVASS supervise high-risk systems in banking, finance and insurance.
- The Data Protection Authority (Garante) acts in the cases set out in Article 74(8) of the AI Act, and a Coordination Committee at the Presidency of the Council of Ministers links the authorities.
Proceedings can start from serious incidents, complaints, reports from other authorities or on the authority’s own initiative. Citizens can also file complaints.
2. Penalties: what is at stake
The decree sets maximum amounts by type of breach. The higher of the amount and the percentage of worldwide annual turnover applies:
- up to €35 million or 7% for prohibited practices;
- up to €15 million or 3% for breaches of the other obligations;
- up to €7.5 million or 1% for incorrect or misleading information;
- up to €1 million or 0.5% for breaches of Articles 27 and 86 of the AI Act.
For SMEs, micro-enterprises and innovative start-ups the decree refers to Article 99(6) of the AI Act, which for SMEs sets the lower of the amount and the percentage. Besides fines, non-monetary measures are provided, such as an order to cease the conduct and a public statement (increased by one third in case of non-compliance), and the decisions will be published.
3. Work, training and sandboxes
The decree is not only a control system. It directly affects how organisations work:
- Employment decisions: they cannot rely solely on an automated system. A natural person with real decision-making power is required, the worker’s consent is not an exception, and the worker has the right to an intelligible explanation. Dismissals and decisions taken in breach are void.
- Health and safety at work: AI enters the risk assessment, with information and training obligations.
- Professions and training: professional bodies must integrate AI into their programmes, adapting within 6 months; continuing medical education and fair pay modulated by risk class are also covered. For schools, Article 36 is optional: institutions “may” promote training activities, so no mandatory course is created.
- Sandboxes: regulated testing environments supervised by AgID and ACN, with priority to SMEs and start-ups under criteria to be set by decree, plus possible regional and local sandboxes.
- Trade secrets: protection extends to data, algorithms and mathematical methods used to train AI, when the conditions set by the decree are met.
One useful caveat: training, attendance certificates and certification of skills are different things and should not be confused.
4. What to do now
Many operational rules depend on implementing decrees and regulations that have yet to be adopted, with deadlines ranging from 90 days to 12 months. In the meantime it makes sense to build a set-up you can demonstrate, distinguishing case by case the AI Act obligations from those of the national law, depending on your role in the chain (developer or user):
- an inventory of the AI systems used or developed in the company;
- a check that no system falls within the prohibited practices;
- responsibilities and risk assessment, with documented controls;
- monitoring and incident management across the whole life cycle of the system;
- training for people who use AI, and updated notices and risk assessments.
Voluntary standards such as ISO/IEC 42001 (AI management system) and ISO/IEC 23894 (risk management) can support this path without replacing legal requirements. Where eligible, subsidised finance can cover part of the compliance costs, in particular for cybersecurity and digitalisation.
Compliance will be measured by the ability to show how AI is governed within the organisation.
Request a consultation or write to us at info@fingreentech.com: with FinGreenTech you can map your AI systems, set up governance and assess the incentives available.
Source: Legislative Decree no. 179 of 7 October 2026, Official Gazette no. 234 of 8 October 2026.
Transparency note. This article was drafted with the support of artificial intelligence tools and reviewed by the FinGreenTech Team, which is editorially responsible for it.
