Italy’s Law no. 132 of 23 September 2025 has 28 articles in six chapters: six on principles, twelve sector rules, six on strategy and authorities, one on copyright, one criminal and two final. For a company only a few are operational: 11 (work), 13 (professionals), 20 (authorities), 25 (works and training data) and 26 (crimes). Everything else should be read with article 3(5): the law adds no obligations beyond the AI Act.
Published in Official Gazette no. 223 of 25 September 2025, in force from 10 October 2025. For the short version of what to do in a company, start with Law 132/2025: what companies must do; this page is the article-by-article commentary.
General information, not legal advice.
Map of the 28 articles
| Chapter | Articles | Content | Relevance for a private company |
|---|---|---|---|
| I — Principles and purpose | 1-6 | Purpose, definitions, principles, data and minors, economic development, national security | High: sets the relationship with the AI Act |
| II — Sector provisions | 7-18 | Health, research, data, work, professions, public administration, justice, training data, cybersecurity | High for work and professions, low otherwise |
| III — Strategy, authorities, promotion | 19-24 | National strategy, AgID and ACN, foreign ministry, youth, investment, delegations | Medium: who supervises and the funds |
| IV — Copyright | 25 | Works created with AI, text and data mining | High for content producers |
| V — Criminal provisions | 26 | New offences and aggravating circumstances | High for risk and the 231 compliance model |
| VI — Financial and final | 27-28 | Financial neutrality, coordination on ACN and cybersecurity | Low |
Chapter I — Principles (arts. 1-6)
Art. 1 — Purpose and scope. Promotes a “correct, transparent and responsible” use of AI with a human-centric approach. Paragraph 2 states that the law is interpreted and applied in accordance with Regulation (EU) 2024/1689. The explicit reference came after the European Commission’s detailed opinion C(2024) 7814 of 5 November 2024 on the bill, which challenged definitions and overlaps.
Art. 2 — Definitions. AI system, data and AI model refer to the AI Act definitions. There is no separate Italian notion of “AI system”.
Art. 3 — General principles. Transparency, proportionality, security, data protection, non-discrimination, gender equality, sustainability; human decision-making autonomy, explainability, human oversight and intervention (para. 3). Paragraph 5 is the key rule for companies: it “does not create new obligations compared with those laid down by Regulation (EU) 2024/1689”. Paragraph 6 makes cybersecurity a precondition across the whole life cycle.
Art. 4 — Information and personal data. Lawful, fair and transparent processing; notices in “clear and simple language” with a right to object. Under 14, access to AI technologies requires the consent of whoever holds parental responsibility; from 14 to 17 minors can consent themselves, provided the information is easily accessible and understandable.
Art. 5 — Economic development. Promotion principles for SMEs and the market. Letter (d) is operational: public e-procurement platforms may favour suppliers that locate and process strategic data in data centres in Italy. It is a preference criterion, not an obligation for private companies.
Art. 6 — National security and defence. Excludes intelligence, ACN national cybersecurity and defence activities from the scope of the law; they remain subject to constitutional rights.
Chapter II — Sector provisions (arts. 7-18)
| Art. | Topic | What it says in substance | Who it affects |
|---|---|---|---|
| 7 | Health and disability | AI is support; the decision always rests with the doctor; the patient has a right to be informed | Healthcare providers, medical software vendors |
| 8 | Health research | Data processing for research and testing of health AI systems is declared of significant public interest | Research bodies, IRCCS, private partners |
| 9 | Research data | Health Ministry decree (within 120 days) on simplified processing and testing spaces | Health research |
| 10 | Digital health | AI platform run by AGENAS for community care, with non-binding suggestions to doctors and professionals | National health system |
| 11 | Work | Safe, transparent, non-discriminatory AI; notice to workers under art. 1-bis of Legislative Decree 152/1997 | All employers and clients |
| 12 | Work observatory | Observatory at the Labour Ministry: strategy, monitoring, training | Social partners |
| 13 | Intellectual professions | AI only for instrumental and support activities, intellectual work prevails; notice to the client | Lawyers, accountants, consultants, engineers |
| 14 | Public administration | AI as support; the official remains solely responsible for the decision | Public bodies and their suppliers |
| 15 | Justice | Every decision on interpretation, facts, evidence and rulings stays with the judge | Courts |
| 16 | Training data | 12-month delegation on the use of data, algorithms and mathematical methods to train AI, “without further obligations” beyond the AI Act | Model developers |
| 17 | Civil procedure code | Cases on the functioning of an AI system go to the tribunale (art. 9 of the Civil Procedure Code) | Anyone in an AI dispute |
| 18 | Cybersecurity | ACN promotes AI for national cybersecurity, including through private partnerships | ACN, security vendors |
Art. 11 — what to do in practice
Article 11 does not create a new obligation: it refers to the notice already required by art. 1-bis of Legislative Decree 152/1997 for automated decision-making or monitoring systems. Anyone using AI for hiring, shift allocation, evaluation or monitoring must already inform workers and their representatives. What is new is that non-discrimination and respect for dignity are written explicitly for AI. Under the AI Act many HR uses are high-risk (Annex III): see the deployer guide.
Art. 13 — professionals
Two rules. First: AI may only do instrumental and support work, and intellectual work must prevail. Second: the client must be informed about the systems used “in clear, simple and exhaustive language”. In practice: a clause in the engagement letter stating which tools you use, for what, and that responsibility for the work remains yours.
Chapter III — Strategy, authorities and funds (arts. 19-24)
Art. 19 — National strategy. Drafted by the Prime Minister’s Office unit for innovation and digital transition, in agreement with AgID and ACN, and approved at least every two years by the Interministerial Committee for Digital Transition.
Art. 20 — National authorities. They are AgID (promotion, notification and accreditation of conformity assessment bodies) and ACN (supervision, inspections and sanctions, and single point of contact with the EU). Banca d’Italia, CONSOB and IVASS remain market surveillance authorities in their sectors (art. 74(6) AI Act). AgID and ACN jointly run regulatory sandboxes for compliant systems.
Art. 21 — Foreign ministry. €300,000 a year in 2025 and 2026 for pilot AI projects in consular services.
Art. 22 — Youth and sport. Among other things, AI research counts towards the tax regime for returning workers (art. 5 of Legislative Decree 209/2023).
Art. 23 — Investment. Up to €1 billion in equity and quasi-equity, through CDP Venture Capital, in Italian SMEs and innovative companies in AI, cybersecurity, quantum and telecommunications.
Art. 24 — Delegations. Twelve months for decrees aligning Italian law with the AI Act (sanctioning powers for the authorities within the limits of art. 99 AI Act, AI literacy, training for professionals, AI for police) and for decrees on unlawful AI use (tools to remove unlawful content, new offences for failure to adopt safety measures, liability criteria).
Chapter IV — Copyright (art. 25)
Two changes to the Italian Copyright Law (Law 633/1941):
- art. 1 protects works of human intellect, including those created with the help of AI, provided they are the result of the author’s intellectual work. Output generated without human creative input is not protected;
- the new art. 70-septies allows reproduction and extraction for text and data mining with AI models, including generative ones, on content lawfully accessed, within the limits of arts. 70-ter and 70-quater (including rightsholders’ opt-out).
For anyone producing content with AI, the practical consequence is to document the human contribution (brief, choices, edits) if you want to claim rights in the work.
Chapters V and VI — Criminal and final provisions (arts. 26-28)
| Provision | What it introduces | Penalty |
|---|---|---|
| Art. 61(11-decies) Criminal Code | General aggravating circumstance: offence committed with AI systems when they are an insidious means, hinder defence or worsen the consequences | Increase of up to one third |
| Art. 612-quater Criminal Code | Unlawful dissemination, without consent, of images, video or voices falsified or altered with AI (deepfakes) capable of misleading and causing unjust harm | 1-5 years’ imprisonment; on complaint, ex officio in some cases |
| Art. 294 Criminal Code | Offence against political rights, when the deception uses AI | 2-6 years |
| Art. 2637 Civil Code | Market rigging committed with AI | 2-7 years |
| Art. 185 Consolidated Finance Act | Market manipulation with AI | 2-7 years and a fine of €25,000-€6 million |
| Art. 171(a-ter) Law 633/1941 | Reproducing or extracting text and data in breach of arts. 70-ter and 70-quater, including through AI | Art. 171 penalties |
Art. 27 is the financial neutrality clause; art. 28 coordinates rules on ACN and on Law 90/2024 on cybersecurity.
The 2026 implementing decrees
Legislative Decree no. 160 of 9 September 2026 (Normattiva), Official Gazette no. 214 of 15 September 2026, in force from 30 September 2026. It covers police use of AI and civil and criminal liability. For companies:
- art. 437-bis Criminal Code: punishes failure to adopt safety measures or human oversight on high-risk systems when this creates a concrete danger to life or safety (1-5 years, reduced for gross negligence). A professional user who fails to ensure human oversight is also punishable;
- art. 25-vicies of Legislative Decree 231/2001: corporate liability for art. 437-bis (600-1,000 quotas) and for the art. 612-quater deepfake offence (200-700 quotas). The 231 compliance model needs updating;
- civil liability: court orders to disclose evidence, a rebuttable presumption of causation where the AI Act has been breached, certified conformity does not by itself exclude liability, and direct action against the insurer.
Decree on authorities, training and work. Final approval by the Council of Ministers on 4 August 2026; as of 25 September 2026 we have not found its publication in the Official Gazette. The core announced by the Government: decisions on hiring, changes to employment, disciplinary measures and dismissal cannot be taken solely through automated processing, and a dismissal made in breach is null. Some details (a statement of reasons on request, the scope of CV screening) changed between the preliminary and final text: read the Gazette text before updating HR procedures.
What to do in a company, article by article
| If your company… | Article | Action |
|---|---|---|
| Uses AI for hiring, shifts, evaluation or monitoring | 11 (+ work decree) | Notice under art. 1-bis of Legislative Decree 152/1997; final decision always by a person |
| Is a professional or a firm | 13 | Notice clause in the engagement letter; AI for support only |
| Produces content with AI | 25 | Document human input; respect text and data mining opt-outs |
| Publishes synthetic images, audio or video | 26 (612-quater) | Labelling (art. 50 AI Act), checks on real people depicted |
| Uses high-risk systems | Legislative Decree 160/2026 | Documented human oversight; update the 231 model |
| Sells to the public sector | 5, 14 | Data located in Italy as an advantage in tenders |
For the EU side, start with deployer vs provider: SME checklist and AI Act article 50. For work and skills: AI and work: roles and skills.
FAQ
How many articles does Italian Law 132/2025 have?
Twenty-eight, in six chapters: principles (1-6), sectors (7-18), strategy and authorities (19-24), copyright (25), criminal (26), final (27-28).
Which articles of Law 132/2025 affect companies?
Mainly 3, 4, 5, 11, 13, 20, 23, 25 and 26. For most SMEs the two operational ones are 11 (work) and 26 (crimes), plus 25 if they produce content.
What does article 11 of Law 132/2025 say?
AI at work must be safe, transparent and non-discriminatory, with notice to workers under art. 1-bis of Legislative Decree 152/1997.
What does article 13 require from professionals?
AI only for instrumental and support activities, intellectual work prevailing, and notice to the client in clear, simple and exhaustive language.
Which crimes does Law 132/2025 introduce?
Unlawful deepfakes (art. 612-quater, 1-5 years), a general aggravating circumstance for crimes committed with AI, and aggravated penalties for political rights offences, market rigging and market manipulation. Legislative Decree 160/2026 added art. 437-bis.
Does Law 132/2025 replace the AI Act in Italy?
No: it applies in accordance with the AI Act and adds no obligations (art. 3(5)).
Which implementing decrees have been issued?
Legislative Decree 160/2026, in force from 30 September 2026. The decree on authorities, training and work has Council of Ministers approval: check the Official Gazette.
Sources
- Normattiva: Law no. 132 of 23 September 2025
- Official Gazette no. 223 of 25 September 2025
- Normattiva: Legislative Decree no. 160 of 9 September 2026
- Italian Government: Council of Ministers press release on the implementing decrees (preliminary examination)
- EUR-Lex: Regulation (EU) 2024/1689 – AI Act
Dig deeper in the series
- Law 132/2025: what companies must do
- AI Act deployer: who it is and what to do
- AI responsibility and accountability
- UNI/PdR 125:2022 certification guide
If you want to know which of these articles actually touch your processes (HR, content, high-risk systems), we start from the inventory of your tools. Write to info@zendata.it.
Pietro Ciattaglia, CEO of Zendata AI, Rome