Legislative Decree no. 179 of 7 October 2026, published in Italy's Official Gazette no. 234 of 8 October 2026 and in force since 23 October 2026, is the second implementing decree of Law 132/2025 on artificial intelligence. After Legislative Decree 160/2026 on liability, it answers three practical questions: who enforces the AI Act (Regulation EU 2024/1689) in Italy, what it costs to breach it, and what changes for businesses that use AI in staff decisions.
What the decree does, in short
The text has 54 articles in three blocks that matter to a business:
- Authorities and powers (Arts. 4–18): who supervises, who handles complaints, who inspects.
- Penalties (Arts. 19–25): amounts, criteria, the SME rule, publication.
- Work, training and the professions (Arts. 36–51), plus the national sandbox (Arts. 26–31) and trade-secret protection for training data and algorithms (Art. 52).
For most businesses there are no new obligations beyond the AI Act, but it is now clear who will enforce them. The exceptions are employment and risk assessment, covered below.
Who supervises: the Italian authorities
| Authority | Role (Decree 179/2026) |
|---|---|
| ACN – National Cybersecurity Agency | Market surveillance authority and single point of contact (Arts. 5–6); national registration of high-risk systems for critical infrastructure (Art. 14) |
| AgID – Agency for Digital Italy | Notifying authority: designates and monitors conformity assessment bodies (Arts. 4 and 13) |
| Bank of Italy, CONSOB, IVASS | Supervision of high-risk systems used in lending, financial and insurance services (Art. 5) |
| Italian Data Protection Authority (Garante) | Market surveillance authority only for the cases in Art. 74(8) AI Act (Art. 5) |
ACN may carry out inspections without prior notice, remotely or on site, of real-world testing (Art. 15). Complaints under Art. 85 AI Act go to the competent authority; if they reach the wrong one, it forwards them on its own motion (Art. 18).
Penalties: the amounts and the SME rule
Article 23 adopts the AI Act caps, "unless the conduct constitutes a criminal offence":
| Infringement | Maximum |
|---|---|
| Prohibited practices (Art. 5 AI Act) | €35 million or 7% of worldwide annual turnover |
| Obligations of providers, representatives, importers, distributors, deployers (Art. 26), transparency (Art. 50), serious-incident reporting (Art. 73) | €15 million or 3% |
| Incorrect, incomplete or misleading information to authorities and notified bodies | €7.5 million or 1% |
| Fundamental rights impact assessment (Art. 27) and right to explanation (Art. 86) | €1 million or 0.5% |
For large companies the higher of the fixed amount and the percentage applies. For SMEs, micro-enterprises and innovative start-ups, Art. 23(7) refers to Art. 99(6) AI Act: the lower one applies.
Two details matter as much as the amounts:
- Non-financial measures (Art. 22): for minor infringements the authority may order the infringement to be remedied within a deadline or, if it has ended, publish a statement naming the breach and the party responsible. Failing to comply with the order triggers the fine, increased by up to one third.
- Publication (Art. 24(4)): sanction decisions are published in summary on the authority's website. The reputational cost comes on top of the fine.
Employment: the final decision stays with a person
This is the part that affects most businesses. Article 41 provides that, when an employer uses AI systems, final decisions on hiring, changing or ending employment, disciplinary measures and performance reviews cannot be based solely on automated processing. The final decision belongs to a natural person "who exercises effective and autonomous power".
- The worker's consent does not make an automated decision lawful.
- Before processing starts, the employer must provide the information notice required by Art. 1-bis of Legislative Decree 152/1997.
- The worker may request an intelligible explanation, given by a person, stating the weight of AI and the main parameters considered.
- A dismissal made in breach is void; so are the other decisions.
Searching for and screening candidates is excluded from this rule, even when it rules someone out; Art. 22 GDPR and the AI Act still apply, and the AI Act classes recruitment systems as high-risk.
Article 42 adds an operational duty: AI that affects work organisation, pace of work, how tasks are performed or safety-relevant decisions must be assessed in the risk assessment document (Art. 28 of Legislative Decree 81/2008), and workers must be informed and trained on those specific risks.
Sandbox, training and trade secrets
- Sandbox (Arts. 26–28): the decree sets up the Italian AI regulatory sandbox, run by AgID and ACN, with priority for SMEs and start-ups. Access arrangements and admission criteria will come through joint decrees of the two agencies' directors general: before planning an application, check their websites to see whether they have been adopted.
- Professions (Art. 47): within six months of entry into force, professional bodies must add AI literacy courses to continuing education, covering technical, legal and ethical aspects.
- Trade secrets (Art. 52): the Industrial Property Code now expressly covers data, algorithms and mathematical methods used for training, including model architectures and training procedures, where they are secret, have commercial value and are protected by reasonable measures.
What to do now: a five-point checklist
- Map the AI used on staff: rostering, appraisals, productivity monitoring, discipline. For each use, record who makes the final decision and with what real authority.
- Update the risk assessment document for systems that affect pace and methods of work, and plan training on those risks.
- Review the worker information notice (Art. 1-bis Legislative Decree 152/1997) and set up a procedure for giving explanations on request.
- Identify your authority: ACN in most cases; the Bank of Italy, CONSOB or IVASS if you are a financial intermediary.
- Protect your training data with documented confidentiality measures if you want to be able to defend it as a trade secret.
Where to start
With Decree 179/2026, the AI Act now has Italian authorities with inspection powers and published sanctions. An independent gap assessment tells you where you stand against these obligations, starting with employment and the risk assessment, and what to fix before an authority asks.