What happened

Italy's AI law now has its enforcement machinery. Legislative Decree No. 179 of 7 October 2026 was published in the Gazzetta Ufficiale (General Series No. 234) on 8 October 2026 and enters into force on 23 October 2026. Its 54 articles adapt Italian law to the EU AI Act, Regulation (EU) 2024/1689: they name the authorities that will supervise AI systems in Italy, give them inspection and sanctioning powers, set the fines, and add rules on AI training in schools, universities, the public administration and the professions.

The decree completes a two-stage process. The first stage was Law No. 132 of 23 September 2025, Italy's national AI law, in force since 10 October 2025. Its Article 24 delegated the Government to adapt national law to the AI Act within twelve months. The Council of Ministers gave final approval on 4 August 2026.

For readers outside Italy, one provision stands out: Article 41 bars employers from taking final decisions on hiring, changing or ending employment, including discipline and performance appraisal, solely on the basis of automated processing. A dismissal made in breach of that rule is void.

Who enforces Italy's AI law?

Article 70 of the AI Act requires each member state to designate at least one notifying authority and one market surveillance authority. The decree allocates the powers:

  • AgID (Agency for Digital Italy) is the notifying authority (Article 4). It designates and monitors the conformity assessment bodies that certify high-risk systems, and can restrict, suspend or withdraw their designation (Article 13).
  • ACN (National Cybersecurity Agency) is the general market surveillance authority and single point of contact (Articles 5 and 6). It holds the AI Act's inspection powers (Article 15), may inspect real-world testing without notice, and can open proceedings after a serious-incident report, a complaint that is not manifestly unfounded, a referral or on its own initiative (Article 16).
  • Banca d'Italia, CONSOB and IVASS supervise high-risk AI systems used in banking and lending, investment services and insurance respectively (Articles 5(1)(b) and 17).
  • The Garante (the Italian data protection authority) acts as a market surveillance authority only within Article 74(8) of the AI Act: biometric systems in so far as they are used for law enforcement, border management, justice and democracy, and the Annex III systems for law enforcement, migration, asylum and border control, and the administration of justice and democratic processes (Article 5(1)(c)).

Complaints under Article 85 of the AI Act go to the competent authority, and one sent to the wrong authority is forwarded automatically (Article 18).

How much are the fines under Italy's AI law?

Article 23 sets the fines, following the ceilings in Article 99 of the AI Act. Each tier applies unless the conduct is a crime, and the turnover percentage applies where higher.

  • Prohibited practices (AI Act Article 5): up to €35 million or 7% of total worldwide annual turnover.
  • Operator and notified-body obligations: up to €15 million or 3%. The Italian list covers AI Act Articles 16, 22, 23, 24, 25, 26, 31, 33(1), (3) and (4), 34, 50, 73 and 80. It goes beyond Article 99(4) of the Regulation, which does not list Articles 25 (value-chain responsibilities), 73 (serious-incident reporting) or 80 (systems the provider classified as not high-risk).
  • Incorrect, incomplete or misleading information to notified bodies or authorities: up to €7.5 million or 1%.
  • A national fourth tier: up to €1 million or 0.5% for breaches of Article 27 (fundamental rights impact assessment) and Article 86 (right to an explanation of individual decisions), which Article 99 does not price separately.

Authorities weigh the Article 99(7) factors and whether the obligation breached is substantive or formal. For SMEs and start-ups the lower amount applies. For minor breaches, Article 22 offers an alternative: an order to stop, or a public statement naming the breach and the person responsible; ignoring the order brings a fine increased by up to a third. Sanction decisions will be published on the authority's website (Article 24(4)), and the early reduced-payment option in Article 16 of Italy's general penalties law (Law 689/1981) is excluded.

Article 41: no dismissal by algorithm alone

Article 41 binds any employer using an AI system, as the AI Act defines it, in decisions about the employment relationship, whether or not the system is high-risk.

  • Final decisions on establishing, modifying or terminating the relationship, "including disciplinary measures and performance appraisals", may not be adopted solely on the basis of automated processing.
  • The final decision is reserved to a natural person exercising "effective and autonomous" power.
  • The worker's consent is not an exception to the ban.
  • Before processing starts, the employer must give the notice already required by Article 1-bis of Legislative Decree 152/1997 on automated systems. On request, the worker is entitled to an intelligible explanation, delivered through a human, of the decision, the influence of AI on it and the main parameters considered.
  • A dismissal in breach of the rule is void (nullo), as are other decisions taken in breach of it.

There is one significant carve-out: searching for and screening candidates is not a final decision on establishing the relationship, "even when they result in non-admission to the subsequent stages". Automated CV filtering therefore falls outside Article 41, though GDPR Article 22 and the AI Act's high-risk regime for Annex III employment uses still apply. Article 42 adds AI to the workplace health and safety risk assessment.

Why it matters: the decree read against the AI Act and the GDPR

The penalty article shows that a member state can do more than copy Article 99: Italy has widened the middle tier and attached a fine to the right to an explanation.

Article 41 goes further than GDPR Article 22, which the decree expressly preserves. Article 22 lets controllers rely on contract, law or explicit consent; Italy removes consent as an exit in employment. It also changes the remedy. Under the GDPR the typical consequence is a regulatory fine, as in the Dutch authority's €824.99 million fine on Uber over automated driver deactivations. Italy instead unwinds the decision itself. Article 88 GDPR expressly allows more specific national rules on employee data.

Nullity is the heaviest consequence in Italian dismissal law. Legislative Decree 23/2015 governs the dismissal of blue-collar, white-collar and middle-management employees hired on open-ended contracts since 7 March 2015. Under its Article 2, a court that declares a dismissal void in a case of nullity provided by law orders reinstatement and compensation for the period out of work of at least five months' pay; the worker may instead opt for an indemnity of fifteen months' pay. Since the Constitutional Court's judgment No. 22 of 2024 the nullity no longer has to be "expressly" provided for, but Article 41(4) is express in any event. Italian labour courts already scrutinise algorithmic management, as the Bologna tribunal's Deliveroo ruling showed.

Two questions remain open. Article 41 speaks only of the "employer", whereas Law 132/2025 also addresses the committente (the client of a self-employed worker), so its reach over platform workers classified as self-employed is unclear. And "effective and autonomous" will need case law. The AI Act, unlike the GDPR, also has no one-stop shop for AI systems: subject to the AI Office's powers over general-purpose AI, market surveillance is national, so a group established elsewhere in the EU will still answer to ACN for systems on the Italian market. Under the GDPR, by contrast, a Rome court annulled the Garante's €15 million ChatGPT fine because competence had passed to the Irish authority.

How Türkiye and Korea compare

Türkiye. Article 11(1)(g) of Law No. 6698 (KVKK) gives data subjects the right to object to an adverse result arising from analysis of their data "exclusively through automated systems". It is a right to object, not a prohibition, and it does not void the decision. Under Labour Act No. 4857, Article 19 requires written notice stating the reason clearly and precisely, and bars dismissal for conduct or performance without first hearing the employee's defence. Article 18 requires a valid reason for employees with at least six months' service in workplaces with thirty or more employees, and Article 21 provides for reinstatement after an invalid termination or, if the employer does not reinstate, compensation of four to eight months' wages. On consent, KVKK has moved in Italy's direction: its 2026 principle decision on biometric attendance systems treats employee consent as an inadequate basis.

Korea. Article 37-2 of the Personal Information Protection Act (see our PIPA automated decisions guide) lets a data subject refuse a fully automated decision that significantly affects their rights or obligations, and demand an explanation. The right to refuse does not apply where the decision rests on consent, a legal provision or a contract (Article 15(1)(1), (2) and (4)), which will cover most employment decisions, but the explanation right remains. Italy's rule runs the other way: consent does not lift the ban. Korea's Labor Standards Act requires just cause for dismissal (Article 23) and makes written notice of the reasons a condition of validity (Article 27). California has moved in a similar direction: SB 947, signed on 30 September 2026 and covered in our report on California's new workplace AI laws, bars employers from relying solely on an automated decision system to discipline or dismiss a worker.

What companies operating in Italy should consider

Turkish and Korean groups with staff in Italy should assume that Italian mandatory employment rules protect people who habitually work there, whatever law their contracts choose: under Article 8 of the Rome I Regulation, a choice of law cannot deprive an employee of the mandatory protection of the law of the country where they habitually work, unless the contract is more closely connected with another country. In practice:

  • Map every tool that touches promotion, pay, scheduling, discipline, appraisal or termination of Italian staff, including tools run by the parent company abroad.
  • Record who takes each final decision and on what basis they could depart from the system's output.
  • Update Article 1-bis notices and set up a human-delivered explanation process for Article 41(3) requests.
  • Stop relying on employee consent for automated HR decisions in Italy.
  • Providers selling into Italy should check exposure under Articles 25, 73 and 80, which Italy fines in the €15 million tier.
  • Review recruitment tools against the AI Act too (see the AI in hiring guide).

What to watch next

Much of the decree depends on secondary measures, including a regulation on how ACN exercises its powers, AgID's sanctions regulation and the decrees on the national regulatory sandbox. Within twelve months, professional fee parameters must allow "fair compensation" to vary with the risk class of the AI used (Article 49). The decree also brings training data, algorithms and model architectures within the Industrial Property Code's trade-secret protection where its conditions are met (Article 52). At EU level, Annex III high-risk obligations, including employment, now apply from 2 December 2027 after the Digital Omnibus (see our note on the moved high-risk deadline). Article 41 applies from 23 October 2026.

Frequently asked questions

What is Italy's AI law?

Italy has two instruments. Law No. 132 of 23 September 2025 sets national principles and sector rules for AI and designates AgID and ACN as national AI authorities. Legislative Decree No. 179 of 7 October 2026, adopted under that law, implements the EU AI Act: it allocates supervisory powers, sets fines of up to €35 million or 7% of turnover, and adds workplace and training rules.

When does Italy's AI law enter into effect?

Law 132/2025 has been in force since 10 October 2025. Legislative Decree 179/2026 was published on 8 October 2026 and enters into force on 23 October 2026. The AI Act's own high-risk obligations follow the EU timetable, with Annex III systems now due from 2 December 2027.

Where can I read the Italy AI law text?

Both texts are in the Gazzetta Ufficiale: Law 132/2025 in General Series No. 223 of 25 September 2025, and Legislative Decree 179/2026 in General Series No. 234 of 8 October 2026. The online edition presents each article separately, with editorial notes reproducing the provisions it cross-refers to.

Can an employer in Italy fire someone using AI?

An employer may use AI to support the decision, but the final decision must be taken by a person with real and autonomous authority. A dismissal based solely on automated processing is void under Article 41, and the worker's consent does not change that. Candidate screening is outside this rule, although the GDPR and the AI Act still apply to it.

Does Italy's AI law apply to non-EU companies?

Yes. The decree applies to the operators covered by Article 2(1) of the AI Act, including providers and deployers outside the EU whose systems or outputs are used in the Union. Article 41 is part of Italian employment law, so it will normally protect staff who habitually work in Italy, including those of Italian subsidiaries and branches of Turkish or Korean groups.

Burhan Doğuş Ayparlar's View

Most of this decree is good plumbing: it does what Articles 70 and 99 asked of every member state. The fourth penalty tier is the most interesting technical choice: by pricing the right to an explanation, Italy has turned Article 86 into an obligation with a visible cost, and I expect complainants to use it.

Article 41 is the provision I would put in front of any board with Italian staff, because of its remedy. A fine is a cost a large company can budget for; reinstatement and back pay for every affected employee are not. The real test will be "effective and autonomous". If a manager cannot explain why they agreed with the system, or never disagrees with it, I would not want to defend that decision before an Italian labour court.

For Turkish employers the comparison is instructive. KVKK Article 11(1)(g) is a right to object rather than a rule of conduct, and the Labour Act says nothing about automation. Yet Article 19's demand for a clear reason and a prior defence already points where Italy has now gone explicitly. Turkish groups would do better to apply one human-review standard to all their staff than to treat Italy as a stricter exception.

This article is for information only and does not constitute legal advice. It is based on Legislative Decree No. 179/2026 as published in the Gazzetta Ufficiale on 8 October 2026 (in force 23 October 2026), Law No. 132/2025, Regulations (EU) 2024/1689 and 2016/679, and the Turkish and Korean statutes cited, all consulted on 20 October 2026, together with the decisions and earlier reports linked in the text. Translations of the Italian provisions are the author's own. Several parts of the decree await implementing measures, and how Italian courts will read Article 41 is not yet known. Statements about Italian, Turkish and Korean law are general; specific cases require individual assessment. The analysis and assessments are the author's own.