If you saw headlines last week claiming that Italy had introduced “AI fines of up to 7% of turnover”, they were only half right. Legislative Decree no. 179 of 7 October 2026, published in the Italian Official Journal on 8 October and in force since 23 October 2026, does not invent new bans: those were already written in Brussels in the EU AI Act. What it does is more practical. It decides who in Italy will knock on the door of a company that misuses artificial intelligence, with what powers and what penalties, and it adds a few Italian rules on employment that go further than the EU text.
If you run a business in Italy, work for an Italian company or simply follow how EU member states are implementing the AI Act, here is what matters, separating what already applies from what still depends on implementing acts.
Where the decree comes from
The AI Act leaves each member state to designate its own authorities and set its own penalties. Italy did this in two steps: first with Law 132/2025, Europe’s first national AI law, which delegated the details to the government; then with implementing decrees. Decree 179/2026 is the second of these, after Decree 160/2026, which dealt mainly with the use of AI by police forces.
Who enforces: ACN, AgID and sector regulators
- ACN, the National Cybersecurity Agency, is the market surveillance authority and Italy’s single point of contact with the EU. In practice it can request documents, carry out inspections and take measures against non-compliant systems.
- AgID, the Agency for Digital Italy, is the notifying authority: it assesses and supervises the bodies that certify high-risk AI systems. It will also write the regulation on how sanctions procedures work.
- The Bank of Italy, CONSOB and IVASS stay in charge when high-risk systems are used by banks, investment firms and insurers, for example credit-scoring models or algorithms that price insurance policies.
- The Garante, Italy’s data protection authority, acts as a market surveillance authority only in the specific cases set out in Article 74(8) of the AI Act, not as a general AI regulator, as some had expected.
A coordination committee at the Prime Minister’s Office is supposed to stop these bodies from passing the buck to one another.
The fines: the real numbers
- up to €35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited practices such as social scoring or manipulation that exploits people’s vulnerabilities;
- up to €15 million or 3% for breaches of the other obligations of providers and deployers;
- up to €7.5 million for supplying incorrect information to the authorities.
There is also a much lower, purely national band: up to €1 million or 0.5% of turnover for failing to carry out a fundamental rights impact assessment or ignoring a person’s right to an explanation of an AI-assisted decision. Minor breaches can be handled with non-monetary measures.
Two details that often get lost. First, these are maximum amounts, not automatic fines. Second, the government press release that announced the decree mentioned lower ceilings and a clause postponing the sanctions. Neither appears in the text published in the Official Journal, so articles based on the press release are out of date.
Employment: an algorithm cannot fire you
This is where Italy goes beyond the AI Act. Article 41 states that final decisions on hiring, changing or ending an employment relationship, including disciplinary measures and performance reviews, cannot be based solely on automated processing. Human involvement must be real, not a signature at the bottom of a report.
- Employee consent is not enough. A company cannot get around the rule by having staff sign a waiver.
- Decisions taken in breach are void, dismissals included. That is a far heavier consequence than a fine.
- Recruitment screening is excluded from the notion of “final decision”. Software can still pre-screen CVs, but the choice of whom to hire must stay with a person.
The decree also requires AI-related risks to be included in the company’s occupational risk assessment (Article 42), alongside traditional health and safety risks.
Training: deadlines already set
- by 21 January 2027: a teacher training plan and a Ministry of Education decree on AI training for teachers;
- by 23 April 2027: professional bodies must add AI courses, with a minimum number of hours, to continuing education, and part of healthcare workers’ mandatory credits will be dedicated to AI;
- by 23 October 2027: parameters to adjust professional fees according to the risk class of the AI system used.
What to do now if you run a company in Italy
- Take an inventory. List every tool with AI features you use, including those hidden inside management software, CRMs and HR platforms. Many companies don’t know they have them.
- Find where AI touches people. Recruitment, performance reviews, shift planning and credit decisions are where the heaviest obligations apply and where decisions can now be declared void.
- Write down who decides. For every process in which a system suggests something, record who checks it and how much real room they have to change it. If you can’t show human oversight during an inspection, as far as the regulator is concerned it doesn’t exist.
Several pieces are still missing: AgID’s regulation on sanctions procedures, the decrees on the AI regulatory sandbox run by AgID and ACN (with priority for SMEs and start-ups) and the decree on supervision costs. We will cover them when they are published. For the EU background, see our explainer on the AI Act (in Italian: AI Act europeo: cosa cambia).
Sources: Gazzetta Ufficiale no. 234, 8 October 2026; NicFab, overview of Decree 179/2026; TGWEBAI.