AI | Italy approves implementing measures for the AI Act, strengthening the role of Data Protection Authority

On 10 June 2026, the Italian Council of Ministers approved, on a preliminary basis, two legislative decrees (together, the Decrees), implementing Law No. 132 of 2025 (the Italian AI Law) and complementing Italy’s institutional framework for the application of Regulation (EU) 2024/1689 (the AI Act). The measures remain subject to the opinions of the competent parliamentary committees and other institutional bodies before their final adoption.

The first Decree establishes Italy’s governance framework for the implementation of the AI Act. It designates the competent national authorities, regulates AI literacy and training across both the public and private sectors, and lays down sector-specific measures for the deployment of AI in areas such as employment, healthcare, education and public administration. The second Decree complements the AI Act by introducing national rules governing the use of AI by law enforcement authorities, as well as provisions on civil liability and criminal offences relating to AI systems. Together, the Decrees do not create a parallel regulatory regime but implement those aspects of the AI Act that require domestic legislation, while reaffirming the principle that AI should support, rather than replace, human decision-making and responsibility.

From a data protection perspective, the most significant development concerns the allocation of supervisory responsibilities. While the Italian Agency for Digital Italy (AgID) is designated as the primary authority for the implementation of the AI Act, the Italian Data Protection Authority (Garante per la protezione dei dati personali – the Italian DPA) is expressly entrusted with overseeing all matters involving the processing of personal data. The decrees also establish coordination mechanisms among the competent national authorities, reflecting the AI Act’s multi-authority governance model.

The Decrees further reinforce existing safeguards where AI is used in contexts affecting fundamental rights. In employment, decisions producing legal or similarly significant effects cannot be based solely on automated processing and must remain subject to meaningful human intervention. Likewise, the use of biometric AI systems by law enforcement authorities is confined to the situations permitted under the AI Act and subject to strict safeguards, including necessity and proportionality requirements, judicial authorisation where applicable and the involvement of the Italian DPA in the cases provided by law.

Newsletter n. 120 – July 2026