Italy’s AI Decree 179/2026: what changes for businesses

From 23 October 2026, under Italy’s AI Decree 179/2026, Italian authorities can check how companies use artificial intelligence and sanction those that break the rules. The main point of reference is the National Cybersecurity Agency (ACN). The change also affects companies that do not develop AI but use it, such as an assistant bought from a vendor or a vision system on a production line: if a request comes in, the company must be able to explain how that system was chosen, configured and monitored.

The decree brings Italian law into line with the European AI Act. The heaviest EU obligations, those for high-risk systems, will apply between 2027 and 2028, but some rules take effect immediately, especially for companies that use AI to manage their staff.

Who oversees AI in companies?

For most companies, the authority to deal with is the ACN, which supervises AI systems and acts as Italy’s point of contact with the European Union. The Bank of Italy, CONSOB and IVASS cover high-risk systems used by banks, financial intermediaries and insurers, while the Italian Data Protection Authority steps in for specific cases. When AI is built into machinery or another product already regulated at EU level, the ACN works together with the authorities for that sector.

What determines which authority is responsible is the way the system is used, more than the company’s sector. A manufacturer may have an AI system built into a machine and an assistant that drafts documents for the purchasing department: these are two different uses, with different rules and different checks. As Francesco Capparelli notes in Agenda Digitale, the fact that the same company pays for both is not enough to treat them in the same way.

When can a check take place?

An ACN check can be triggered by a serious incident, by a complaint, by a report from another authority or on the Agency’s own initiative, even when nobody has raised an issue or suffered any harm.

In the day-to-day life of a company, a complaint is the most likely trigger. A customer disputes the answer given by an AI assistant, an employee asks why the system flagged their work as anomalous. These complaints usually reach customer service or HR, who do not always know who really understands how the system works. It pays to decide in advance who they should be passed on to: if they are closed as a simple malfunction, the very information needed to reconstruct what happened is lost.

What does a company that uses AI risk?

Fines can reach 35 million euros or 7% of worldwide turnover, but they do not all apply straight away, because they follow the AI Act timeline. Obligations for high-risk systems, such as those used to select staff, apply from 2 December 2027; for AI built into machinery and other regulated products, from 2 August 2028. Based on the AI Act timeline, the table shows which fines apply straight away.

As a rule, the higher of the fixed amount and the percentage of turnover applies; for SMEs and innovative start-ups, the lower one applies instead. Transparency obligations include, for example, informing people that they are interacting with an AI system.

For companies that use AI without developing it, the most concrete risk concerns the information they give to authorities. If a request comes in and the company answers by repeating the vendor’s commercial assurances, or by quoting a test run on an earlier version of the system without saying so, it risks providing incorrect or misleading information: from 23 October, this is a violation that can be fined. Answers should be prepared jointly by the people who know the system and those who handle legal matters.

There is a reputational cost too. For less serious violations, the authority may simply ask the company to fix the problem within a deadline, but fines are normally published on the authority’s website, where customers, suppliers and competitors can see them.

What changes now for companies that use AI with their employees?

This is the part that applies from 23 October to every employer, with any AI system, without waiting for the EU deadlines:

• Decisions about staff: hiring, changes of role, dismissals, disciplinary measures and performance reviews cannot be decided by the system alone. The final say belongs to a person with real decision-making power; otherwise, the decision is void.
• Transparency towards workers: before using the system, the company must inform its employees, and anyone affected by a decision can ask a person to explain it, including how much weight the AI carried and which factors it considered.
• Health and safety: systems that affect the pace, organisation or methods of work, or decisions relevant to safety, must be included in the risk assessment, and workers must be informed and trained. If a system sets the pace of a line in a plant, it must be assessed like any other risk.

Candidate search and screening are excluded from the human final-say rule, even when the system rejects someone, but GDPR rules on automated decision-making still apply, as will, from December 2027, the EU obligations for systems used in recruitment.

Do you need an audit trail?

The decree does not require every company to keep a record of what its AI systems do: the AI Act requires this only for high-risk systems, and only from the 2027 and 2028 deadlines. Two laws, however, already make it very useful. Since 30 September, Italian Legislative Decree 160/2026 has allowed anyone who believes they have been harmed by any AI system to ask a court for its logs, and Decree 179 penalises incorrect information given to authorities. A company that cannot reconstruct who made a decision, with which version of the system and under what human oversight is exposed both in court and before the authorities. We covered this in our article on audit trails and Legislative Decree 160/2026.

How can a company prepare?

The delay to the EU obligations does not put everything else on hold: privacy rules, employment law and contracts already apply. Preparing does not mean filling in a new form, but being able to reconstruct, for every significant use of AI, what was decided, by whom and with which version of the system. Five points are a good place to start:

• Map of uses: for each system, what it is actually used for, whether the company developed it or only uses it, and which authority is responsible. In some cases, substantially modifying a purchased system or using it for a different purpose shifts the vendor’s responsibilities onto the company.
• Updates under control: who approves an update or a change of model, and where it is recorded. An automatically accepted update can introduce features that were never assessed, while the documentation still describes the previous version.
• Vendor contracts: what information the vendor provides, for which version, within what timeframe and with what protection for both parties’ know-how. It is better to settle this when signing than to find out during a request from an authority.
• Real human oversight: whoever supervises the system must have the time, information and authority to depart from its output. An approval signature proves little if the screen does not show why the system produced that result.
• Complaints and shutdown: who receives a complaint, who they pass it on to, who can stop the system and how processes continue in the meantime.

Evidence also needs to be kept in proportion. Holding on to every prompt sent to the system and every piece of personal data for years, for fear of a check, creates new risks, starting with privacy. What needs to be kept is whatever documents how the system works and what was decided, with defined access rights and records that nobody can alter afterwards.

Frequently asked questions

When does Italy’s AI Decree 179/2026 come into force?

The decree comes into force on 23 October 2026. From that date, the ACN and the other authorities can check and sanction the use of AI. The EU obligations for high-risk systems come later: from 2 December 2027 for uses such as staff selection, and from 2 August 2028 for AI built into machinery and other regulated products.

What fines does Italy’s AI Decree 179/2026 provide for?

Fines can reach 35 million euros or 7% of worldwide turnover for prohibited uses of AI. For companies that use AI, the most immediate risk is incorrect or misleading information given to authorities, which can be fined from 23 October up to 7.5 million euros or 1% of turnover. For SMEs, the lower amount applies.

Does a company using AI software from a vendor have obligations?

Yes. A company that uses an AI system in its own processes has responsibilities separate from the vendor’s. It must be able to explain how it uses the system, who checks its outputs and which version it runs, and it must answer authorities accurately: repeating the vendor’s commercial assurances without checking them can lead to a fine.

What changes for companies that use AI to manage staff?

From 23 October, hiring, dismissals, disciplinary measures and performance reviews cannot be decided by an AI system alone: a person with real decision-making power must have the final say, otherwise the decision is void. Workers must be informed in advance and can ask for an explanation of decisions that affect them.

How do you design an AI system that stands up to scrutiny?

Every check under the decree comes down to the same questions: who made a decision, based on what data and with which version of the system. These are questions to address at the design stage. In the custom projects we work on, traceability and version control are built into the architecture from the start, because retrofitting them onto a system already in production leaves gaps, and those gaps surface exactly when someone asks for a decision to be accounted for.

The same applies to our products. Aidia Control, our computer vision-based quality control system, includes a digital audit trail and is GMP compliant. AVA can be installed on-premise or on a European private cloud: data and records stay within the company’s perimeter, and switching language models is an internal choice to be approved and documented, not an update decided by the vendor.

No platform relieves a company of the responsibilities the decree assigns to it. A well-designed architecture, however, makes it possible to show, with dates, versions and names, how those responsibilities were exercised.

If you are taking stock of the AI systems you use and want to find out what information is missing, let’s talk.

Sources

• Official Journal of the Italian Republic (2026). “Legislative Decree No. 179 of 7 October 2026” (in Italian) - gazzettaufficiale.it
• Official Journal of the Italian Republic (2026). “Legislative Decree No. 160 of 9 September 2026” (in Italian) - gazzettaufficiale.it
• European Union (2024). “Regulation (EU) 2024/1689” (AI Act) - eur-lex.europa.eu
• Francesco Capparelli, Agenda Digitale (12 October 2026). “Decreto AI 179/2026: come preparare l’impresa ai controlli” (in Italian) - agendadigitale.eu
• Filippo Bagni and Andrea Benvenuti, Altalex (13 October 2026). “Il D.Lgs. 179/2026 attuativo dell’AI Act: poteri delle autorità, sanzioni e spazi di sperimentazione” (in Italian) - altalex.com