Italy's AI decree 179/2026: what changes for businesses from 23 October

On Friday 23 October 2026 Italy's decree implementing the EU AI Act comes into force. What changes if you use AI with staff, in risk assessment and with your data.

On Friday 23 October 2026 Legislative Decree no. 179 of 7 October 2026 comes into force in Italy. It was published in the Official Gazette on 8 October. It brings Italian rules in line with the EU AI Act: it says who supervises, what breaches cost and what companies using artificial intelligence at work have to do.

The short answer: if your company uses AI to decide something about people (who to hire, who to assess, who to discipline), from Friday the final say must stay with a person, and staff must be informed beforehand. If you use AI to organise work, it has to go into your risk assessment. Most of the rest concerns those who build or sell AI systems.

What changes if you use AI with your staff

This is the part that affects the most companies, small ones included. Article 41 of the decree says that final decisions about employment cannot be based solely on automated processing. It covers:

hiring, changes to the employment relationship and termination;
disciplinary measures;
performance reviews.

The final decision belongs to a person with real, independent authority. A click to confirm what the system decided is not enough.

Four more points matter in practice:

Candidate screening is excluded. Searching for and selecting candidates are not "final decisions", even when they rule someone out of later stages. GDPR rules on automated decisions and the ban on discrimination still apply.
Consent doesn't fix it. Even if the employee agrees, a decision taken by the machine alone is still banned.
Inform first, then use. The employer must give the notice Italian law already requires for automated systems before processing starts.
Employees can ask why. On request, a person must give them a clear explanation, including how much AI weighed in and the main parameters used.

The consequence is serious: dismissals and decisions taken in breach of these rules are void.

AI goes into the risk assessment

Article 42 deals with health and safety at work. AI systems that affect organisation, pace, the way work is done or decisions relevant to safety must be included in the risk assessment required by Italy's workplace safety code (Legislative Decree 81/2008). Staff must also receive adequate information and training on the risks linked to these systems.

Put simply: if AI software sets shifts, assigns warehouse tasks or times how people work, it's no longer just an efficiency choice. It goes into the risk document, like a new piece of machinery.

Who supervises, and what mistakes cost

The decree names the authorities. ACN, the national cybersecurity authority, is the market surveillance authority and the single point of contact with the EU. AgID is the notifying authority, responsible for the bodies that certify conformity. The Bank of Italy, Consob and Ivass supervise their own sectors, and the data protection authority acts within the limits set by the AI Act.

Fines go up to €35 million or 7% of worldwide annual turnover for practices banned by the AI Act, and up to €15 million or 3% for breaching other AI Act obligations. These are ceilings, not automatic fines: they are there to make clear the subject is no longer optional.

The parts that can help a business

It isn't only a list of bans. Two new measures can be useful:

An Italian AI regulatory sandbox (Article 26), run by AgID and ACN, where innovative systems can be tried in a controlled environment, with particular attention to SMEs and start-ups.
Trade secret protection now covers AI (Article 52): data, algorithms and methods used to train a system can be protected as trade secrets, if the legal requirements are met. If you build a custom system on your own data, you have one more way to defend it.

For professional firms there's another change: professional bodies will have to include AI in initial and continuing training, covering technical, regulatory and ethical content (Article 47).

Where to start this week

Make a list. Which AI tools you actually use, who uses them and for what. Many companies find they have more than they thought: inside the management software, the CRM, the attendance system.
Flag the ones that affect people. Recruitment, reviews, shifts, performance monitoring. For these you need a person who really decides and a notice given in advance.
Update the risk assessment with whoever handles health and safety in your company.
Write down who decides. For every process involving AI, in black and white: what the system suggests, who checks, who signs off.
Train the people using the tools. Not a generic course: how their tool works, what it can get wrong, when to stop it.

It's the same way we design AI systems for companies: AI prepares, a person checks and approves what matters. With the decree it's no longer just common sense: for decisions about people, it's the rule.

This article explains the decree in plain terms and is not a substitute for legal or employment advice: for specific cases, refer to the official text and your own advisers.

In short

Legislative Decree 179/2026 comes into force on Friday 23 October 2026 and brings Italy in line with the AI Act.
Hiring, reviews, disciplinary measures and dismissals cannot be decided by AI alone: a person decides, and decisions that break the rules are void.
Staff must be informed beforehand and can ask for a clear explanation.
AI that affects work goes into the risk assessment, with training for those who use it.
ACN and AgID supervise; there's a sandbox for SMEs and start-ups and extra protection for data and algorithms.

If you'd like to know which AI tools you already use and how to bring them into line without stopping work, let's talk.