The Italian AI Law: the AI Act, speaking Italian 🇮🇹

Reading Law 132/2025 is a strange experience: it is Italy’s first comprehensive AI law, and its main message is “don’t worry, we’ve got your back and we are not adding anything.” Article 3.5 is almost reassuring: the law creates no new obligations compared to the AI Act. Yet by the time you reach Article 612-quater of the Criminal Code it is clear something has truly changed: deepfakes are now a crime, punishable by one to five years in prison.

Want the full picture? Principles, authorities, delegations, criminal sanctions, sector impacts and a compliance checklist are all in the practical guide: Italian AI Law — A practical guide.

A law that answers “who enforces?” 🎯

Regulation (EU) 2024/1689 is a perfect European law: it says what providers of AI systems must do, and offloads to member states the uncomfortable task of designating authorities and setting penalties. Law 132/2025 — published in the Official Gazette on 25 September 2025, in force since 10 October 2025 — answers exactly that question.

And the answer has two names. AgID promotes innovation and manages notifications, accreditation and monitoring of the bodies that verify AI conformity (it is the notification authority of Art. 70 AI Act). ACN — the same National Cybersecurity Agency that watches over your infrastructure — is the market-surveillance authority: inspections, controls and penalties go through it.

For businesses: from today you have two state counterparts. The one inspecting you will be ACN, and ACN does not go on picnics. The single contact point with the EU for surveillance matters is the same agency.

The principle that was not obvious: human oversight for everyone 🧑‍⚕️

The AI Act talks about human oversight for high-risk systems. The Italian law goes further: it elevates human autonomy and decision-making power to a general principle, valid for any system — paired with a second principle, cybersecurity throughout the entire lifecycle, “based on a risk-based approach, with specific security and resilience controls against attempted alterations.”

Anyone who writes code recognises the language: it is the Cyber Resilience Act vocabulary, now applied to AI systems. Not a coincidence — it is the regulatory puzzle closing.

The new piece: criminal law enters AI 🚨

While the AI Act sanctions at the administrative level, Italy has chosen to write into the Criminal Code as well. The amendments worth knowing:

• Art. 612-quater C.p. — illicit dissemination of content generated or altered by AI systems. Distributing without consent images, videos or voices falsified or altered by AI, capable of inducing a mistake as to their genuineness, is punishable by 1 to 5 years imprisonment. Private prosecution, except where connected to other crimes or vulnerable victims.
• Art. 61(11-undecies) C.p. — new common aggravating circumstance: using AI as an insidious means or one that obstructs defence.
• Art. 294 C.p. — coercion by AI: imprisonment from 2 to 6 years.
• Art. 2637 C.c. and Art. 185 TUF — market manipulation by AI: 2 to 7 years, plus fines up to €6,000,000 in the financial sector.

The most honest reading: the law does not punish “AI” — it punishes those who use it to cause harm. But if your product generates or alters content (voice, video, images), consent is no longer a checkbox: it is what separates a service from a crime.

Copyright turning human again ✍️

There is also an answer to the big copyright question: works created with the aid of AI remain protected provided they are the result of the author’s intellectual work — the AI Act and the Italian law keep the “human factor” at the centre.

And for those who train models: text-and-data mining of online works remains permitted within the boundaries of Articles 70-ter and 70-quater of the Copyright Law (the Directive 2019/790 exception, with rightholders’ reservations). The novelty? Violating those boundaries, even through AI, is now a crime (Art. 171 a-ter).

The delegations: where everything else gets decided 🧾

Article 24 delegates to the Government the adoption, within 12 months (October 2026), of legislative decrees adapting national law to the AI Act: inspection and sanctioning powers for AgID/ACN, the Art. 99 AI Act penalties framework (up to €35M or 7% of turnover), new criminal offences for the professional use of AI systems without security measures, rules on AI use in preliminary investigations.

Delegations are not paper tigers: they are the part that does not exist yet but will arrive. Tracking them is like following the changelog of a critical dependency.

Who applies the law, meanwhile 🏥

In healthcare AI is support, not a substitute: the decision stays with the doctor, and the patient has the right to be informed. At work, no algorithmic discrimination and mandatory disclosure to workers about AI use. For intellectual professions, AI remains instrumental and the client must be informed “in clear, simple and exhaustive language”. In the public administration the official remains the sole person responsible for decisions. In the courtroom, every decision stays with the judge.

And there are the numbers: one billion euros in public risk-capital investment for innovative Italian SMEs in AI, cybersecurity and quantum computing, through the Venture Capital Support Fund. You can argue about whether it is enough; you cannot say the signal is missing.

Conclusion: compliance now has an address 🗺️

Law 132/2025 does not ask you to redo your AI system. It asks you to know who your enforcer is (ACN, with AgID at the notifications traffic light), not to use AI to cause harm (deepfakes are a crime), to respect human ingenuity and the text-and-data-mining reservations, and to keep an eye on the decrees arriving by October 2026.

It is the final confirmation that the regulatory puzzle is complete: GDPR for data, NIS 2 for the organisation, CRA for the product, the AI Act for the system, and now the Italian law for real-world enforcement. Those who “waited to see how it was done” have no more excuses: all the rules are there, and now they even have an address to ring at.

Want the operational details — delegations, sanctions, a checklist for your sector? They are in the practical guide: Italian AI Law — A practical guide.