Italy’s first law on artificial intelligence: a historic turning point for Europe

September 17, 2025, will go down in Italian legislative history as the day our country took a giant leap toward the digital future. With 77 votes in favor, 55 against, and two abstentions, the Senate definitively approved the first national framework law on Artificial Intelligence, making Italy the first country in the European Union with a national regulatory framework fully aligned with the European AI Act.

The bill S. 1146-B, entitled ‘Provisions and delegated powers to the Government on artificial intelligence’, is now awaiting publication in the Official Gazette to come into force 15 days after publication. It is not just a piece of legislation, but a real declaration of intent: Italy wants to be a leader in the artificial intelligence revolution, doing so in a responsible, safe, and respectful manner about fundamental rights.

A Complex but Determined Parliamentary Process

The parliamentary process for this law tells a story of determination and strategic vision. The bill began its journey in April 2024, when the Council of Ministers, chaired by Giorgia Meloni, approved it on the proposal of Justice Minister Carlo Nordio. Classified as related to the budget maneuver pursuant to Article 126-bis of the Regulations, the measure underwent three parliamentary readings before receiving final approval.

The Senate approved it at first reading on March 20, 2025. It then passed to the Chamber of Deputies, which amended it on June 25, 2025, and finally returned it to the Senate for final approval. This bicameral process was not an obstacle, but allowed for the refinement of the text to take into account the observations of both branches of Parliament.

The Chamber’s Amendments: A More Balanced Text

The amendments made by the Chamber of Deputies strengthened several aspects of the measure. In Article 3, the limit of “non-pollution” of democratic debate by unlawful interference was added, enhancing the protection of state sovereignty and the fundamental rights of citizens. Article 4 clarified the rules on parental consent for minors, bringing it fully into line with the GDPR and the Italian Privacy Code.

Article 5 now includes specific references to robotics and the national productive fabric, which is primarily composed of micro-enterprises and SMEs. Article 6 no longer consists of the provision on national servers. In contrast, Article 8 no longer requires prior approval by ethics committees for the processing of health data, simplifying procedures for scientific research.

The Problem of Investment in AI

One of the critical issues that emerged from the parliamentary debate concerns Italy’s significant lag in investment in artificial intelligence. CNEL data show that only 4.7% of Italian companies with more than 10 employees currently invest in AI, with 27.7% of investments concentrated in large companies with more than 250 employees. For the near future, only 19.5% of companies intend to invest in AI in the next two years, a percentage that drops to 16.9% for companies with up to 50 employees.

These figures reveal a country that is significantly lagging in terms of competitiveness and risks missing out on the opportunities offered by the technological revolution. The problem is severe considering that only 25.9% of Italian companies invest in technological and digital training, with 70% of these concentrated in large companies. Looking ahead, 44.3% of companies will invest in training, but 81.5% of these will be companies with more than 250 employees.

An Innovative Regulatory Architecture

The law is structured in 28 articles divided into six thematic chapters, each dedicated to a specific aspect of artificial intelligence regulation. This architecture reflects the legislator’s desire to comprehensively and systematically address a technology that now permeates all aspects of social and economic life.

Alignment with the European AI Act: A Strategic Choice

One of the most significant features of the Italian law is its perfect alignment with European Regulation (EU) 2024/1689, known as the AI Act, approved by the European Parliament on June 13, 2024. Article 1, paragraph 2, explicitly states that “the provisions of this law shall be interpreted and applied in accordance with Regulation (EU) 2024/1689, “while Article 3, paragraph 5, specifies that” this law does not create new obligations beyond those provided for in Regulation (EU) 2024/1689.”

This choice is not merely formal but represents a European harmonization strategy that positions Italy as the first EU country with a national regulatory framework that is fully compatible with European legislation. The AI Act, which will gradually enter into force between 2025 and 2027, establishes a risk classification system for AI systems and imposes proportionate obligations on suppliers and users. The Italian law anticipates and facilitates this process, immediately creating the structures and procedures necessary for the implementation of the European regulation.

The relationship between national and European legislation is particularly evident in Articles 20 and 24. Article 20 designates AgID and ACN as national authorities for artificial intelligence “without prejudice to the role of the Bank of Italy, CONSOB, and IVASS as market supervisory authorities pursuant to and in accordance with Article 74(6) of Regulation (EU) 2024/1689.” Article 24, which contains the broadest delegation of powers to the government, has the specific objective of “adapting national legislation to Regulation (EU) 2024/1689.”

The Italian approach is distinguished by its complementary rather than overlapping nature with European legislation. While the AI Act focuses on technical requirements and obligations for high-risk systems, Italian law provides a framework of principles, institutions, and procedures that facilitates the practical application of European regulations in the national context. This strategy of “regulatory anticipation” allows Italian companies and institutions to prepare adequately for the entry into force of the AI Act, reducing compliance costs and maximizing competitive benefits.

Chapter I: Fundamental Principles

The first chapter establishes principles and objectives, placing the anthropocentric dimension of artificial intelligence at the center. Article 1 clearly defines the scope of the law, which includes the research, testing, development, adoption, and application of AI systems and models. The legislator has been explicit: the goal is to promote the “correct, transparent, and responsible use, in an anthropocentric dimension” of artificial intelligence.

Article 3 represents the philosophical core of Italian law. The general principles are not mere rhetorical statements, but binding operational criteria. The research and development of AI systems must be carried out in compliance with fundamental constitutional rights, EU law, and the principles of transparency, proportionality, security, personal data protection, confidentiality, accuracy, non-discrimination, gender equality, and sustainability.

Particularly significant is paragraph 3 of Article 3, which requires that AI systems be developed and applied “with respect for human autonomy and decision-making power.” The law expressly requires that “human oversight and intervention” be ensured. This principle of human oversight becomes a binding legal obligation for all entities that develop or use AI systems.

Paragraph 4 introduces a provision of particular constitutional significance: the use of AI systems must not prejudice “the democratic conduct of institutional and political life.” The final version reinforces this provision by adding the protection of “the freedom of democratic debate from unlawful interference,” and the protection of “the interests of state sovereignty,” and “the fundamental rights of every citizen recognized by national and European law.”

Data Protection and Protection of Minors

Article 4 deals specifically with the protection of personal data and information. The legislator has paid particular attention to minors. For those under 14, the consent of those exercising parental responsibility is always required, both for access to AI technologies and for the subsequent processing of personal data. Minors between the ages of 14 and 18 may give their consent independently, provided that the information is “easily accessible and understandable.”

The final version specifies that parental consent must comply with the provisions of the GDPR 2016/679 and Legislative Decree 196/2003, thereby eliminating any possible interpretative doubts regarding the applicable legislation.

Economic Development and Technological Sovereignty

Article 5 outlines an economic development strategy that aims to make Italy a European leader in AI. The state and public authorities must promote the use of AI as a tool to improve human-machine interaction in productive sectors, increase productivity, and launch new economic activities.

The final version has enriched this provision with specific references to robotics and support for the national productive fabric, “consisting mainly of micro, small, and medium-sized enterprises.” This change reflects the unique structure of the Italian economy and the need not to leave smaller businesses behind in the digital transition.

Of particular interest is letter d) of paragraph 1, which directs public administration e-procurement platforms to give preference to “solutions that guarantee the localisation and processing of strategic data at data centres located in the national territory”. This provision introduces an element of digital sovereignty that balances openness to the global market with the need to maintain control over the most sensitive data.

Security and Defense: A Delicate Balance

Article 6 addresses one of the most sensitive issues: the relationship between artificial intelligence and national security. The legislator has opted for a selective exclusion approach, excluding from the scope of the law activities carried out for national security purposes by intelligence agencies, ACN cybersecurity activities, military operations by the Armed Forces, and police activities related to national security.

However, this exclusion does not mean regulatory anarchy. These sectors must also respect fundamental rights and constitutional freedoms, and paragraph 3 provides for the adoption of specific regulations to define how the principles of the law apply to these particular activities.

Chapter II: Sectoral Applications

The Healthcare Revolution: Research and Treatment in the Age of AI

The healthcare sector is the most innovative and complex area covered by the law. Article 7 establishes the general principles for the use of AI in healthcare, clarifying that AI must contribute to the improvement of the healthcare system, the prevention, diagnosis, and treatment of diseases, while always respecting individual rights and data protection.

Paragraph 2 introduces an essential prohibition on discrimination: AI systems cannot “select and condition access to healthcare services according to discriminatory criteria.” Paragraph 3 establishes the patient’s right to be informed about the use of AI technologies. In contrast, paragraph 5 specifies that AI is always and only “a support in the processes of prevention, diagnosis, treatment, and therapeutic choice,” leaving the final decision to the physician.

Scientific Research: A New Paradigm

Article 8 is the most revolutionary provision of the entire law. It declares the processing of personal data, including sensitive data, carried out for scientific research and experimentation in the development of AI systems in the healthcare sector to be of “significant public interest.” This declaration is based on Articles 32 and 33 of the Constitution (right to health and freedom of scientific research) and Article 9, paragraph 2, letter g), of the GDPR.

The legitimate subjects are clearly identified: public and private non-profit entities, scientific hospitals and research institutes (IRCCS), and private entities operating in the healthcare sector in the context of research projects involving public entities, private non-profit entities, or IRCCS.

Paragraph 2 introduces a significant derogation from the principle of informed consent: the secondary use of personal data without direct identifying elements, even if it belongs to sensitive categories, is always authorized “without further consent of the data subject where initially provided for by law.” This provision revolutionizes the traditional paradigm of biomedical research, allowing the use of enormous amounts of data already collected for therapeutic purposes.

Paragraph 3 goes further, allowing “the processing for anonymization, pseudonymization, or synthesis of personal data,” including sensitive data, subject to simple notification to the data subject. AGENAS may establish and update guidelines for these procedures, taking into account international standards.

The control procedure requires notification to the Privacy Guarantor with all the information required by the GDPR. Thirty days after notification, processing may begin if the Guarantor has not issued a blocking order.

The National Health AI Platform

Article 10 introduces one of the most ambitious innovations: the establishment of a national health artificial intelligence platform. By inserting a new Article 12-bis into Decree-Law 179/2012, the law provides that the Minister of Health, in consultation with the Authority for Technological Innovation and Cybersecurity, shall regulate AI solutions to support the healthcare system.

The platform, whose design, implementation, and ownership are assigned to AGENAS as the “National Agency for Digital Health,” will provide non-binding support services to healthcare professionals for the care of the population, to doctors in daily clinical practice, and to users for access to the healthcare services of Community Houses.

The World of Work: Dignity and Innovation

Articles 11 and 12 regulate the impact of AI on the world of work with an approach that balances innovation and the protection of rights. Article 11 establishes that AI must be used to “improve working conditions, protect the physical and mental integrity of workers, and increase the quality of work performance and productivity.”

Paragraph 2 introduces mandatory principles: the use of AI in the workplace must be “safe, reliable, and transparent”. It cannot take place “in conflict with human dignity” or violate the confidentiality of personal data. The employer is required to inform the worker of the use of AI in accordance with the procedures set out in Article 1-bis of Legislative Decree 152/1997.

Article 12 establishes a specialized observatory at the Ministry of Labor on the adoption of AI systems in the workplace. This body has strategic tasks: to define a strategy for the use of AI in the workplace, monitor its impact on the labor market, identify the sectors most affected, and promote training for workers and employers.

Intellectual Professions: AI as a Tool, Not a Substitute

Article 13 regulates the use of AI in intellectual professions with a clear philosophy: artificial intelligence can only be used for “activities that are instrumental and supportive of professional activity” and always “with the intellectual work that is the subject of the service prevailing.”

Paragraph 2 introduces a specific transparency requirement: to ensure the relationship of trust between professional and client, information relating to the AI systems used must be communicated to the recipient of the service “in clear, simple, and comprehensive language.”

Intelligent Public Administration

Article 14 outlines an ambitious vision for the modernization of the PA through AI. Public administrations must use artificial intelligence to “increase the efficiency of their activities, reduce the time required to complete procedures, and increase the quality and quantity of services provided to citizens and businesses.”

Its use must always ensure “the knowability of its functioning and the traceability of its use.” Paragraph 2 establishes a fundamental principle: AI can only be used “in an instrumental and supportive role to administrative activities,” always “with respect for the autonomy and decision-making power of the person who remains solely responsible for measures and procedures.”

Justice and AI: Inviolable Constitutional Guarantees

Article 15 addresses one of the most sensitive issues: the use of AI in judicial activities. Paragraph 1 establishes an absolute and binding principle: in cases where AI systems are used in judicial activities, “all decisions on the interpretation and application of the law, the assessment of facts and evidence, and the adoption of measures are always reserved to the judge.”

Paragraph 2 allows the use of AI for the organization of justice services, the simplification of judicial work, and ancillary administrative activities, but always under human control and responsibility. Paragraph 3 introduces a preventive control procedure: until the European AI Act is fully implemented, experimentation in judicial offices must be authorized by the Ministry of Justice, after consultation with the competent national authorities.

Paragraph 4 provides for a significant investment in training for magistrates and administrative staff, with specific educational activities on AI that include digital training, skills acquisition, and awareness of benefits and risks.

Chapter III: National Strategy and Governance

Legislative Delegations: A Complex Regulatory Project

Articles 16 and 24 grant the Government broad powers to complete the regulatory framework. Article 16 concerns explicitly the regulation of “data, algorithms, and mathematical methods for training artificial intelligence systems.” The final version specifies that this regulation must not create “additional obligations, in the areas subject to Regulation (EU) 2024/1689, beyond what is already established therein.”

The guiding principles and criteria provide for the identification of cases in which it is necessary to establish a legal regime, instruments of compensation and injunctive relief, a system of penalties for violations, and the assignment of related disputes to specialized business sections.

The Delegation for Adaptation to the AI Act

Article 24 contains the broadest delegation, aimed at adapting national legislation to the European regulation. The guiding principles and criteria are highly detailed and cover all aspects of the implementation of the AI Act, from the attribution of powers to national authorities to changes in banking and financial legislation, from training courses to specific disciplines for police activities.

Multi-Level Governance of Innovation

Article 19 establishes a multi-level AI governance system. The national strategy is prepared by the Presidency of the Council responsible for technological innovation, in agreement with national authorities and after consultation with various relevant ministries. The plan must be approved at least every two years by the CITD (Interministerial Committee for Digital Transition).

Paragraphs 6, 7, and 8, added by the Chamber of Deputies, establish a new Coordination Committee chaired by the Prime Minister, which coordinates the actions of national public or private entities and bodies subject to supervision or recipients of public funding operating in the field of digital innovation and AI.

National Authorities: A Sophisticated Dual System

Article 20 defines the AI governance system, designating AgID and ACN as the competent national authorities. AgID assumes the role of innovation promotion authority, responsible for notification, evaluation, accreditation, and monitoring procedures. ACN becomes the market supervisory authority, with inspection and sanctioning powers, and the single point of contact with EU institutions.

Paragraph 1, letter c), provides that AgID and ACN shall jointly manage “experimental spaces aimed at creating AI systems that comply with the regulations.” These regulatory sandboxes are essential tools for enabling innovation in a controlled environment.

Strategic Investments: One Billion for AI

Article 23 authorizes investments of up to €1 billion in the venture capital of companies operating in the fields of AI, cybersecurity, and quantum technologies. These investments use the structure of the Venture Capital Support Fund established in 2018, benefiting innovative SMEs and non-SMEs with “high development potential” to promote their development as “national technology champions.”

Chapter IV: User Protection and Intellectual Property

Article 25 addresses the complex issue of copyright protection for works created with the aid of AI. The amendments to Law 633/1941 specify that “human” intellectual works are protected “even when created with the aid of artificial intelligence tools, provided that they are the result of the author’s intellectual work.”

This wording recognizes that AI can be a creative tool, but firmly maintains that the intellectual authorship of the work belongs to the human being. The new Article 70-septies regulates the extraction of text and data from works available on the internet for the training of AI models, ensuring that this activity is carried out in compliance with the rights of authors.

Chapter V: New Criminal Offenses

General Aggravating Circumstances and Specific Offenses

Article 26 introduces a specific set of penalties for offenses committed using AI systems. The most general change is the addition of the aggravating circumstance provided for in the new paragraph 11-decies of Article 61 of the Criminal Code for offenses committed “through the use of artificial intelligence systems, when these, due to their nature or manner of use, have constituted an insidious means, or when their use has in any case hindered public or private defense, or aggravated the consequences of the offense.”

The New Crime of Deepfakes

The most significant change is the introduction of Article 612-quater of the Criminal Code, which punishes with imprisonment of one to five years anyone who causes “unjust damage to a person by transferring, publishing, or otherwise disseminating, without their consent, images, videos, or voices that have been falsified or altered through the use of artificial intelligence systems and are likely to mislead as to their authenticity.”

The new offense covers deepfakes and other forms of digital manipulation. It is punishable upon complaint by the offended person, but proceedings are initiated ex officio when committed against minors, incapacitated persons, or public authorities due to the functions they perform. This provision is an absolute novelty in the European and international landscape, constituting a timely legislative response to the scandals involving the illegal creation of pornographic content.

The data highlight the urgency of this measure: with the advent of generative artificial intelligence techniques, cases of fake pornography have increased by 500%, with 99% of victims being women. The introduction of this criminal offense is an essential step in protecting people’s dignity in the digital age.

Aggravating Circumstances for Specific Crimes

The article also introduces specific aggravating circumstances: Article 294 of the Criminal Code (false testimony) now provides for imprisonment of two to six years if the deception is carried out using AI systems. Similarly, Article 2637 of the Civil Code (false information to the market) and Article 185 of the TUF (insider trading) provide for increased penalties when crimes are committed using AI.

Financial Sustainability and Coordination

Invariance and Sustainability Clause

Article 27 establishes the financial invariance clause: the implementation of the law, except for Article 21, must not result in new or increased burdens on public finances. The only exception is Article 21, which authorizes €300,000 per year for 2025 and 2026 for experimental projects by the Ministry of Foreign Affairs.

Coordination with Existing Legislation

Article 28 contains coordination provisions that clarify the relationship between the new law and existing legislation. The amendment to Article 7 of Decree-Law 82/2021 extends the possibilities for ACN collaboration with private entities, distinguishing between European entities (always permitted) and non-European entities (permitted for NATO countries or countries with specific agreements, subject to authorization by the Prime Minister).

Future Prospects and Implementation Challenges

The Implementing Decrees: A Year of Intense Work

The entry into force of the law, scheduled for 15 days after its publication in the Official Gazette, will mark the beginning of an intense year of work for the government. Legislative powers must be exercised within 12 months, with procedures that require opinions from Parliament, the Unified Conference, and the Privacy Guarantor.

The decrees will have to cover complex technical areas: from the regulation of algorithms to the full implementation of the AI Act, from new criminal offenses to the regulation of health data. The risk of delays is real, considering the technical complexity and the need to balance innovation and protection.

Italy as a European Laboratory

With this law, Italy is positioning itself as a European laboratory for responsible innovation in AI. As Undersecretary Butti stated: “Italy is the first EU country with a national framework fully aligned with the AI Act. Invest in Italy. You will find reliable governance, transparent rules, and an ecosystem ready to support concrete projects.”

This ambition will require effective implementation and substantial investment in training and skills development. Success will depend on the ability to translate the principles of the law into operational practices that truly foster innovation without compromising fundamental rights.

Conclusions

The Italian AI law is not just a piece of legislation: it is a bet on the future of the country, on its ability to govern technological innovation while upholding constitutional principles and democratic values. The success of this bet will depend on the quality of implementation and the ability of all stakeholders—institutions, businesses, citizens—to seize the opportunities offered by this new regulatory framework.

In an increasingly digital world, Italy has chosen not to undergo technological changes passively, but to actively govern them, striking a balance between innovation and protection, competitiveness and security, efficiency and transparency. There is still a long way to go. Still, the first step has been taken with determination and strategic vision, laying the foundations for making our country a responsible protagonist in the era of artificial intelligence.

The law positions Italy as a European hub for responsible innovation, creating the basis for anthropocentric, secure, and competitive AI development. With its imminent entry into force and the start of the implementation process, the most delicate phase now begins: transforming this regulatory vision into an operational reality that makes Italy a reference model for the entire European continent.

Hashtag correlati

#ArtificialIntelligenceItaly #AILawItaly #ItalianAIAct #HumanCentricAI #ResponsibleInnovation #AIRegulation #ItalianParliament #DigitalSovereignty #HealthcareAI #AIandWork #AIinJustice #DigitalGovernment #DeepfakeLaw #DigitalRights #AIPrivacy #AIAct #EuropeanAI #DigitalEU #TechRegulation #AIGovernance #LegalTech #HealthTech #GovTech #FutureOfWork #DigitalTransformation #Industry40 #AI2025 #DigitalFuture #InnovativeItaly #TechNews #DigitalRights #ItalianTech #StartupAI #VentureCapitalItaly #RegulatorySandbox #ScientificResearch #AIethics #TechPolicy #DataProtection #CyberSecurity #AICompliance #PublicAdministration #ItalyInnovation #EUTech #AIStrategy #TechLeadership