What changes from 23 October
Legislative Decree No. 179 of 7 October 2026, published in the Official Gazette on 8 October, entered into force on 23 October 2026 and defines Italy's framework for implementing the European AI Act. According to AI4Business's reconstruction, the measure implements Law 132/2025 and EU Regulation 2024/1689 and assigns national authorities the powers to monitor application of AI rules, coordinate supervision and act on violations. The affected constituency is broad: technology companies, financial operators, public administrations, schools and organizations that develop or use AI systems.
The most significant point for operators is that the decree does not create a single authority but distributes functions. AgID becomes the national notifying authority, with competences over procedures concerning bodies that assess the conformity of systems; ACN exercises the general market surveillance functions, including inspection and sanctioning activities, and is the single point of contact with the European institutions. The distinction separates conformity assessment from surveillance of systems placed on the market or used, with an obligation for the two agencies to cooperate with other administrations and avoid overlaps.
Finance and businesses: compliance within existing controls
The decree maintains a specific framework for the financial sector. Article 5 assigns Banca d'Italia supervision of high-risk AI systems used in banking and financial services within its remit; Consob retains responsibility for high-risk systems used in investment services under its supervision; IVASS maintains its functions on insurance, reinsurance and product distribution. The text also recognizes the competences of the Garante per la protezione dei dati personali in the cases provided for by the European regulation. For banks, intermediaries and insurers, application of the AI Act therefore fits into existing control systems, combining European requirements and sectoral provisions.
On the sanctions front, the decree organizes supervisory powers, procedures and cooperation among administrations, providing for administrative sanctions, warnings and non-pecuniary measures in the manner defined by the decree itself and by the European regulation. AI4Business stresses that for companies it becomes essential to identify the systems used, verify their regulatory classification, retain the required documentation and define internal responsibilities. The national entry into force, the source specifies, does not change the European timetable for application of the various provisions of the AI Act, which remains governed by EU rules.
Sandbox, training and employment: the rules are there, the implementing measures are not
Article 26 establishes the Italian Artificial Intelligence Sandbox, jointly managed by AgID and ACN: companies will be able to develop and test innovative systems in a controlled environment, with particular attention to SMEs and startups. However, operating methods, admission criteria and access priorities will be defined by subsequent measures, so the establishment of the sandbox is not equivalent to the immediate opening of applications. On education, Articles 36 and 38 allow schools to promote AI educational activities and govern the training of teachers and students; the Ministry of Education and Merit must adopt within ninety days a decree on the criteria and methods for teacher training. Article 40 entrusts the competent minister with coordination of training policies and the definition of minimum skills for public employees.
On employment, Article 41 reserves final decisions on hiring, dismissals, disciplinary measures and performance evaluations to a natural person with effective autonomy, excluding that they can be entrusted exclusively to automated processing. The lawyer Ugo Ettore Di Stefano, senior partner at Lexellent, cited by the source, indicates some operational implications: worker consent does not function as an exemption, violation renders the decision void, including dismissal, and it is necessary to map HR processes, formalize the role and traceability of the human decision-maker, make disclosures before the start and transfer obligations into contracts with suppliers in order to respond to requests for reasons. Di Stefano also notes that Article 42 brings AI into the risk assessment document and that data, algorithms and training configurations are protectable as trade secrets only with adequate protection measures; the decree, he adds, must be read together with Legislative Decree 160/2026, which inserted the new Article 437-bis of the Criminal Code, a provision whose content is not described in the available material.
