A year ago, on 25 September 2025, Law No. 132 of 23 September 2025 was published in the Italian Official Gazette: Italy's first artificial intelligence law, in force since 10 October 2025. The question SMEs ask us most often is simple: do I have to do anything beyond the AI Act? The short answer: for AI systems as such, no; but for how you use them with employees, clients, minors and content, yes, and some of these rules already apply today.
The principle: no extra obligations on AI, new rules on context
The law is to be interpreted and applied in line with Regulation (EU) 2024/1689 (Art. 1) and expressly states that it creates no new obligations compared with the AI Act for AI systems and models (Art. 3(5)). Anyone looking for a second list of technical requirements will not find one.
What the law does is regulate the areas the European regulation leaves to Member States: employment, the professions, healthcare, public administration, copyright and criminal law. That is where the concrete obligations for an Italian company lie.
What already applies to companies
| Area | What it provides | Provision |
|---|---|---|
| Employment | The employer or principal must inform workers about AI use, in the cases and manner of Art. 1-bis of Legislative Decree 152/1997; AI must not violate dignity or privacy, nor discriminate | Art. 11 |
| Intellectual professions | AI only for instrumental and supporting activities, with the professional's intellectual work prevailing; the client must be informed about the systems used in clear, simple and comprehensive language | Art. 13 |
| Minors | Under 14, access to AI and the related data processing require parental consent; from 14 to 18 the minor may consent if the information is easily understandable | Art. 4(4) |
| Data information | Notices on AI-related processing must be written in clear and simple language, making risks and the right to object understandable | Art. 4(3) |
| Healthcare | Patients have the right to be informed about the use of AI; the decision always rests with the doctor | Art. 7 |
| Copyright | Protection covers works of human creativity, including those created with the help of AI, provided they result from the author's intellectual effort; text and data mining is allowed only within the limits of Arts. 70-ter and 70-quater | Art. 25 |
| Litigation | Cases concerning the operation of an AI system fall under the jurisdiction of the tribunale (ordinary court) | Art. 17 |
Two practical notes. On employment, the information duty refers to a rule that has existed since 2022: what is new is that the law now expressly links it to AI. The Ministry of Labour guidelines adopted by Ministerial Decree 180/2025 point in the same direction. On professionals, informing the client is not a courtesy: it is the condition the law sets to preserve the relationship of trust.
The new crimes: deepfakes, aggravating circumstance and markets
Art. 26 amends the Criminal Code and some special laws:
- Art. 612-quater of the Criminal Code — anyone who causes unjust harm by disseminating, without consent, images, videos or voices falsified or altered with AI and capable of misleading as to their authenticity faces one to five years' imprisonment (on complaint, except for cases prosecuted ex officio);
- a general aggravating circumstance (Art. 61, No. 11-decies) when AI was an insidious means, obstructed defence or worsened the consequences of the crime;
- market rigging (Art. 2637 of the Civil Code) and market manipulation (Art. 185 of the Consolidated Law on Finance) committed with AI: two to seven years' imprisonment (under the Consolidated Law also a fine from €25,000 to €6 million);
- copyright: reproducing or extracting text and data in breach of the text and data mining rules, including through AI, becomes a criminal offence (Art. 171(1)(a-ter), Law 633/1941).
For companies the key point is the link with Legislative Decree 231/2001: Legislative Decree 160/2026 added the deepfake offence to the predicate offences for corporate liability (new Art. 25-vicies). Anyone producing marketing or communication content with AI therefore needs rules on consent, verification and the use of faces and voices.
Authorities and implementing decrees: where things stand
Art. 20 designates the national AI authorities: AgID as the notifying authority and ACN as the market surveillance authority and single point of contact with the EU, without prejudice to the powers of the Bank of Italy, CONSOB and IVASS for the financial sector and those of the Italian Data Protection Authority (Garante).
Art. 24 delegates the Government to align Italian law with the AI Act within twelve months. The status as of 24 September 2026:
- Legislative Decree No. 160 of 9 September 2026 — civil and criminal liability and AI for police forces; Official Gazette No. 214 of 15 September 2026, applies from 30 September 2026. Among other things, it creates the crime of failing to adopt security measures in high-risk systems (Art. 437-bis of the Criminal Code) and a presumed causal link in damage claims.
- Decree on authorities, supervision, training, work and professions — given final approval by the Council of Ministers on 4 August 2026, not yet published in the Official Gazette as of this article's date. According to what was announced on approval, it prohibits decisions on hiring, changing and terminating employment from being taken solely by automated processing.
The Art. 16 delegation on the data and algorithms used to train AI systems also remains open.
What to do now: a six-point checklist
- AI systems inventory noting, for each one, who is affected: employees, clients, patients, minors.
- Worker information for every system that decides or monitors (Art. 11 and Art. 1-bis of Legislative Decree 152/1997), before it is put into use.
- AI clause in professional engagements and an internal rule on what may be delegated to the tool (Art. 13).
- Age verification and parental consent if AI-based services may reach under-14s (Art. 4).
- Policy on generated content: consent for faces and voices, checks before publication, attention to rights over the data used (Arts. 25 and 26).
- Update of the Decree 231 model with the new AI-related predicate offences.
Where to start
Law 132/2025 does not demand new technical requirements; it shifts the focus to how AI enters relationships with people: who must be informed, who decides, who is accountable. An independent gap assessment compares your company's real use of AI with the AI Act, Italian law and the implementing decrees, and returns a plan ordered by priority. With Legislative Decree 160/2026 already applicable and the second decree on its way, now is the right time to do it.