AI | Italy approves implementing measures for the AI Act, strengthening the role of Data Protection Authority

On 10 June 2026, the Italian Council of Ministers approved, on a preliminary basis, two legislative decrees (together, the Decrees), implementing Law No. 132 of 2025 (the Italian AI Law) and complementing Italy’s institutional framework for the application of Regulation (EU) 2024/1689 (the AI Act). The measures remain subject to the opinions of the competent parliamentary committees and other institutional bodies before their final adoption.

The first Decree establishes Italy’s governance framework for the implementation of the AI Act. It designates the competent national authorities, regulates AI literacy and training across both the public and private sectors, and lays down sector-specific measures for the deployment of AI in areas such as employment, healthcare, education and public administration. The second Decree complements the AI Act by introducing national rules governing the use of AI by law enforcement authorities, as well as provisions on civil liability and criminal offences relating to AI systems. Together, the Decrees do not create a parallel regulatory regime but implement those aspects of the AI Act that require domestic legislation, while reaffirming the principle that AI should support, rather than replace, human decision-making and responsibility.

From a data protection perspective, the most significant development concerns the allocation of supervisory responsibilities. While the Italian Agency for Digital Italy (AgID) is designated as the primary authority for the implementation of the AI Act, the Italian Data Protection Authority (Garante per la protezione dei dati personali – the Italian DPA) is expressly entrusted with overseeing all matters involving the processing of personal data. The decrees also establish coordination mechanisms among the competent national authorities, reflecting the AI Act’s multi-authority governance model.

Newsletter n. 120 – July 2026