Italy's Legge 23 settembre 2025, n. 132 (Legge 132/2025), the first national organic AI statute in the EU, delegates to the Government the adoption of legislative decrees aligning national law with Regulation (EU) 2024/1689 under Article 1, with a delegation deadline of October 10, 2026. The Consiglio dei Ministri approved two implementing decree schemas in preliminary form on June 10, 2026, covering training, labour, policing, and civil and criminal liability.
Italian AI system providers and developers, importers and distributors, private deployers of high-risk AI systems, AI-enabled medical-device manufacturers, and vendors supplying Italian public administration must have AI governance, fundamental-rights impact assessment (FRIA) and conformity-assessment processes ready by October 10, 2026, or face national criminal sanctions under Legge 132/2025 Articles 2 to 7 and administrative penalties alongside AI Act ceilings once the decrees are adopted.
- Deadline : October 10, 2026, the Article 1 delegation deadline for adopting the AI Act implementing decrees
- Who : Italian AI providers, developers, importers, distributors, deployers of high-risk AI, and AI-enabled medical-device manufacturers
- What : Government must adopt legislative decrees aligning national law with the AI Act; operators must have governance, FRIA and conformity processes ready
- Otherwise : Criminal sanctions under Legge 132/2025 Arts. 2-7 and administrative penalties; if the Government misses the delegation, the adopting power lapses (Art. 76 Cost.)
- Official source : Legge 132/2025 in the Gazzetta Ufficiale
What is due on October 10, 2026
The obligation falling due on October 10, 2026 is the adoption, by the Italian Government, of the legislative decrees aligning national law with Regulation (EU) 2024/1689, under the Article 1 delegation of Legge 132/2025. The delegation runs for 12 months from the law's entry into force on October 10, 2025. The decrees will detail the national procedures, sanctions regime and institutional arrangements that complement the directly applicable AI Act, rather than transpose it.
The Consiglio dei Ministri, in sitting n. 177 of June 10, 2026, gave preliminary passage to two decree schemas covering training, labour, policing, and civil and criminal liability. Final adoption is expected within the October 2026 delegation window; if the Government misses it, the adopting power lapses under Article 76 of the Constitution.
| Date | Event |
|---|---|
| September 25, 2025 | Legge 132/2025 published in the Gazzetta Ufficiale (GU n. 223) |
| October 10, 2025 | Legge 132/2025 enters into force; criminal sanctions (Arts. 2-7) and competent-authority designations (Art. 20) apply |
| June 10, 2026 | Consiglio dei Ministri n. 177: preliminary passage of two AI implementing decree schemas |
| October 10, 2026 | Article 1 delegation deadline: implementing decrees due |
Who is covered
Legge 132/2025 reaches every actor that places or deploys an AI system on the Italian market. By market exposure, the exposed actors are Italian AI system providers and developers, importers and distributors of AI systems, private deployers of high-risk AI systems in Italy (finance, HR and recruitment, critical-infrastructure operators), Italian AI-enabled medical-device and SaMD manufacturers whose products carry MDR or IVDR high-risk AI under Annex III, and AI vendors and integrators supplying Italian public administration and regulated industries.
The law designates AgID (Agenzia per l'Italia Digitale) as the notifying authority under Article 70 of the AI Act and ACN (Agenzia per la Cybersicurezza Nazionale) as the market-surveillance authority and single EU point of contact under Article 20. The Garante privacy remains the GDPR Article 51 authority for high-risk AI touching fundamental rights; financial-sector high-risk systems stay with Banca d'Italia, CONSOB and IVASS. Operators should not collapse these authorities into a single supervisor.
What to do before October 10, 2026
- Map your AI systems against the AI Act high-risk categories (Annex III) and the Legge 132/2025 scope to identify which fall under the national sanctions
- Stand up AI governance structures: appoint a responsible AI compliance lead and establish internal risk-management and quality-management processes
- Prepare fundamental-rights impact assessment (FRIA) procedures for high-risk AI deployments, following the AI Act Article 27 model the Italian decrees will operationalise
- Ready conformity-assessment documentation and technical files for high-risk AI systems, including the MDR and IVDR overlap for AI-enabled medical devices
- Track the AgID and ACN notification and registration portals, and monitor the regulatory sandbox timeline the decrees will open
- Review contracts with AI vendors and integrators supplying Italian public administration for the national obligations the decrees will impose
- Brief legal and compliance teams on the criminal sanctions regime (Arts. 2-7) sitting alongside the AI Act administrative penalties
What happens otherwise
Once the implementing decrees are adopted, non-compliance exposes operators to Italy's national criminal sanctions under Legge 132/2025 Articles 2 to 7 and to administrative penalties alongside the AI Act ceilings (Article 99). The criminal sanctions have applied since October 10, 2025, the law's entry into force, and the decrees will attach the procedural and enforcement detail. If the Government misses the delegation window, the adopting power lapses under Article 76 of the Constitution. Continuous, per-jurisdiction monitoring surfaces the moment Italy adopts the decrees and publishes them in the Gazzetta Ufficiale.
How this differs from the EU AI Act high-risk timeline
- Italy's Legge 132/2025 has been in force since October 10, 2025, with national criminal sanctions (Arts. 2-7) already applicable, while the EU AI Act's Annex III high-risk obligations were deferred to December 2, 2027 via the Digital Omnibus (our briefing)
- Italian operators therefore face national penalties on a timeline that runs ahead of the deferred EU high-risk compliance date
