Italy’s AI decree 179/2026: what applies now and what still needs implementing rules

Decree 179, in force since 23 October, names the Italian authorities that supervise AI and sets the fines. Its rules on AI-assisted decisions about staff apply now; some procedures of AgID and ACN depend on later acts.

By Fulvio Domenico Marchetti, OneSynergy · 7 min read

An Italian company that uses an AI system to score staff performance now has to make sure that a person with real authority takes the final decision. If the employee asks, the company must explain, through a person, how the system influenced the outcome and which main parameters it considered. A dismissal or other decision taken in breach of that rule is void. These provisions come from Article 41 of Legislative Decree No. 179 of 7 October 2026, which entered into force on 23 October.

The decree implements the delegation in Article 24 of Law 132/2025. It follows Legislative Decree No. 160 of 9 September 2026 (Official Gazette No. 214, in force since 30 September), which covers criminal and civil liability, including amendments to the Criminal Code and to Legislative Decree 231/2001 on corporate liability, and the use of AI by the police. Decree 179 sets up the supervisory system and the administrative fines, and adds rules on AI at work, in training and in the protection of trade secrets on data and algorithms.

Who supervises what

The AI Act lets each member state choose its authorities. Decree 179 names six bodies and involves the sectoral authorities for regulated products.

• AgID is the notifying authority (Article 4). It assesses, designates and monitors the bodies that certify high-risk systems.
• ACN, the National Cybersecurity Agency, is the general market surveillance authority (Article 5) and the single point of contact under Article 70 of the AI Act (Article 6). It also keeps the national register of high-risk systems used in critical infrastructure, those listed in point 2 of Annex III (Article 14).
• The Bank of Italy, CONSOB and IVASS supervise high-risk systems used in lending and other banking services, investment services and insurance respectively (Article 5).
• The Data Protection Authority keeps the role that Article 74(8) of the AI Act gives it.

For AI built into products covered by EU harmonisation legislation, such as machinery or medical devices, ACN carries out supervision jointly with the sectoral market surveillance authorities (Article 8).

A bank using a credit scoring model therefore deals with the Bank of Italy, and a software house selling a recruitment tool deals with ACN. A company with several systems may face more than one supervisor, and the first useful piece of work is a list that pairs each system with its authority.

Fines, and the measures that come before them

Article 23 sets the maximum administrative fines. In each tier the higher of the two amounts applies, based on worldwide annual turnover in the previous financial year.

Infringement	Maximum fine
Prohibited practices (Article 5 AI Act)	€35 million or 7% of turnover
Obligations of providers, authorised representatives, importers, distributors, deployers and notified bodies, including transparency (Article 50) and serious incident reporting (Article 73)	€15 million or 3%
Inaccurate, incomplete or misleading information given to notified bodies or authorities	€7.5 million or 1%
Fundamental rights impact assessment (Article 27) and right to explanation (Article 86)	€1 million or 0.5%

For SMEs, micro-enterprises and innovative start-ups, the lower of the two amounts applies (Article 23(7)). Each fine applies “unless the act constitutes a criminal offence”: where the same conduct is a crime under any law, the administrative fine does not apply. For minor infringements, Article 22 allows the authorities to order the company to remedy the breach within a deadline instead of fining it or, once the infringement has stopped, to issue a public statement naming the infringement and the party responsible. A company that ignores such an order can be fined up to a third more than the original amount, within the same ceilings. Fines themselves are published, in summary form, on the authority’s website (Article 24(4)).

What employers must do from 23 October

When an employer uses AI in decisions about the employment relationship, the final decision on hiring, changes to the relationship, disciplinary measures, performance reviews and termination must not rest solely on automated processing. It is reserved to a person with “effective and autonomous” power. The worker’s consent does not lift the rule.

Searching for and selecting candidates does not count as a “final decision”, even when a candidate is excluded from the next stage. Screening tools stay subject to the GDPR and, as high-risk systems under point 4 of Annex III, to the AI Act, and the point where screening ends and the hiring decision begins is the part to document.

Dismissals and other decisions taken in breach of this rule are void (Article 41(4)). Before processing starts, the employer must give the information required by Article 1-bis of Legislative Decree 152/1997. On request, the worker is entitled to an intelligible explanation, given by a person, that indicates how the AI system influenced the decision and the main parameters it used.

Article 42 brings AI into health and safety at work. AI systems that affect work organisation, production pace, how tasks are carried out or decisions relevant to safety must be assessed in the risk assessment under Article 28 of Legislative Decree 81/2008, and workers must be informed and trained on the specific risks.

What still depends on implementing acts

Several parts of the decree name the authority and leave the procedure to a later act:

• the procedures for ACN’s supervisory and inspection powers will be set by a regulation adopted by decree of the President of the Council of Ministers (Article 15(3));
• AgID and ACN will set their sanction procedures and deadlines by regulation (Article 24); the Bank of Italy, CONSOB, IVASS and the Data Protection Authority apply their existing procedures;
• the arrangements for the national registration of critical infrastructure systems will be set by decree of ACN’s Director General, in agreement with AgID (Article 14(2));
• access to the Italian AI sandbox, run jointly by AgID and ACN, will be regulated by a joint decree of their Directors General (Article 26).

The powers have existed since 23 October, and these acts will define how ACN and AgID exercise them. Companies can use the interval to prepare their documentation.

Training and the sandbox

Chapter III (Articles 36 to 51) deals with AI in education and training, the professions, work, healthcare and public administration. Article 37 earmarks up to €100 million from the “PN Scuola e Competenze 2021-2027” programme for a training plan for teachers on the use of social media and digital platforms, together with educational activities for students.

Article 26 creates the Italian AI sandbox required by Article 57 of the AI Act. It is meant to support innovation and faster market access, with priority for SMEs and start-ups under Article 62 of the AI Act, according to criteria still to be set.

What to assess now

For employers and HR directors:

1. List every step in hiring, performance management, discipline and termination where an AI system contributes, and record who takes the final decision and on what information.
2. Update the information given to staff under Article 1-bis of Decree 152/1997 and prepare a procedure to answer requests for an explanation.
3. Add AI systems to the workplace risk assessment and plan the related training.

For providers and deployers of high-risk systems:

4. Map each system to its supervisor and keep the technical documentation and oversight records ready to send, since incomplete information to an authority is a separate infringement.

For banks, investment firms and insurers:

5. Follow the implementing provisions that the Bank of Italy, CONSOB and IVASS may adopt under Article 17(3).

For SMEs and start-ups:

6. Check whether the lower fine criterion applies, and follow the sandbox decree if you develop AI systems.

This article describes the decree for planning purposes. Applying it to a specific case requires legal advice.

Sources

1. Legislative Decree 7 October 2026, No. 179, Official Gazette, General Series No. 234 of 8 October 2026, full text (gazzettaufficiale.it) and Normattiva, ELI /eli/id/2026/10/08/26G00200. Read on 26 October 2026.
2. Legislative Decree 9 September 2026, No. 160, Official Gazette No. 214 of 15 September 2026.
3. Law 23 September 2025, No. 132, Article 24.
4. Regulation (EU) 2024/1689 (AI Act), Articles 5, 27, 50, 57, 62, 74 and 86.
5. Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689, EUR-Lex. Read on 26 October 2026.

Related reading

• The EU AI Omnibus deal: what the May 7 agreement means for your AI compliance timeline
• 100 days out: the EU AI Act compliance window for enterprise deployers
• Before Dublin: five questions the European AI Innovation Month must answer on governance

Fulvio Domenico Marchetti is an independent advisor based in Turin. Under the OneSynergy brand he works on AI governance and EU innovation funding with companies, research centres and public bodies. OneSynergy’s AI Act work is strategic and operational, alongside the client’s legal team. Contact

OneSynergy is a network of professionals who work under a common brand. It is not a company: each member is a fully independent professional and acts on their own behalf.