Italy has approved its AI Act implementing decrees, governing supervision, penalties and police biometrics

At its meeting of 4 August 2026 the Italian Council of Ministers approved two legislative decrees aligning national law with the AI Act. The decrees were adopted under the delegation contained in Article 24 of Law No 132/2025 on artificial intelligence.

The first decree creates a comprehensive framework for the use of AI systems in policing and at the same time addresses certain questions of civil and criminal liability. Its basic principle is to preserve human oversight and responsibility: a decision with adverse legal effects may not be based solely on the automated output of an AI system. A separate offence covers a professional user who intentionally fails to put human-oversight measures in place.

The decree also governs the use of biometric technologies. Real-time remote biometric identification is not banned outright but is permitted only in exceptional cases, for a limited time and under the conditions laid down by the AI Act and by national law. Its use requires a reasoned request and authorisation by the public prosecutor, tied to a specific event or to a period of no more than fifteen days, renewable, within a defined area and in respect of named persons; where there is a risk of serious and irreparable harm, it may begin immediately by order of the heads of the police forces, with authorisation sought afterwards. Corresponding – and necessary – procedural safeguards are introduced.

Retrospective facial recognition integrated into CCTV systems is regulated separately. During the legislative process, requirements for reference databases, rules on erasure – collected data are deleted automatically after seven days – and safeguards against their continuous expansion for biometric matching purposes were added in particular. The government also states a prohibition on building biometric databases through mass, untargeted collection of information from the internet.

The second decree sets out the national institutional and supervisory framework for the AI Act. Agenzia per l’Italia Digitale (AgID) will act as the national notifying authority, while Agenzia per la cybersicurezza nazionale (ACN) will be the principal market surveillance authority and the single point of contact. Specific supervisory powers nevertheless remain with the financial regulators Banca d’Italia, CONSOB and IVASS, and with the Italian data protection authority, which takes systems deployed in the fields of security, border management, justice and the protection of democratic processes.

The decree further governs penalties, regulatory sandboxes and the use of artificial intelligence in education, the regulated professions, employment relations, healthcare and public administration. In employment matters it provides, among other things, that decisions on the creation, modification or termination of an employment relationship, including disciplinary measures and dismissals, may not be taken solely on the basis of automated processing; the final decision must remain with a natural person holding genuine and autonomous decision-making power, and a dismissal given in breach of that prohibition is void. A worker has the right to obtain, through human intervention, an intelligible statement of reasons setting out the parameters the system took into account and its influence on the outcome.

The final text was also adapted to the amendments to the AI Act made by Regulation (EU) 2026/1744 of 8 July 2026 (the Digital Omnibus on AI).