What happened. Parliament gave final approval on 17 September 2025; the law is dated 23 September, was published in the Gazzetta Ufficiale (Serie Generale n. 223) on 25 September and entered into force on 10 October 2025. It has 28 articles; Article 1(2) states that it must be interpreted and applied in conformity with the EU AI Act, and Article 3(5) that it creates no obligations beyond those of the AI Act for AI systems and general-purpose models. It is widely described as the first comprehensive national AI law of an EU Member State (Squire Patton Boggs).
Main provisions. According to the text published in the Gazzetta Ufficiale, the law:
- sets principles including transparency, proportionality, security, data protection, accuracy, non-discrimination, gender equality and sustainability, and requires respect for human autonomy and decision-making power, explainability and human oversight (Article 3);
- requires public administrations to ensure that people can know how AI works and trace its use, and to use it only in an instrumental, supporting role, with the person who takes the decision remaining solely responsible for it (Article 14);
- reserves to the judge every decision on the interpretation and application of the law, the assessment of facts and evidence and the adoption of rulings, and, until the AI Act is fully implemented, makes experimentation and use of AI in the ordinary courts subject to Ministry of Justice authorisation (Article 15);
- requires employers to inform workers when AI is used (Article 11) and creates an observatory on AI in work at the Ministry of Labour (Article 12);
- requires parental consent for children under 14 to access AI technologies (Article 4(4));
- limits copyright to works of human authorship, including works created with AI tools where they result from the author's intellectual work (Article 25);
- adds a general aggravating circumstance for offences committed by means of AI and a new offence of unlawfully disseminating AI-generated or altered images, video or voices that cause unjust harm, punishable by one to five years' imprisonment (Article 26);
- authorises up to €1 billion of equity and quasi-equity investment in AI, cybersecurity, quantum and telecommunications firms (Article 23);
- designates the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN) as national AI authorities, with ACN responsible for supervision, inspections and sanctions (Article 20), and delegates legislative decrees to the government, due within twelve months (Article 24).
Why it matters. Member States have room to legislate around the AI Act on matters it leaves to them, such as the public sector, justice and criminal law. Italy has used that room to write a human-responsibility rule into administrative law. Choosing two government agencies as authorities, rather than an independent regulator, was debated, because independence matters most when the state itself is the user.
What to watch. The implementing decrees; how 'attributable to a person' is applied in administrative courts; and how Italian rules sit with the EU timetable for high-risk systems, which was pushed back in 2026.