Law No. 132 of 23 September 2025 does not replace the European AI Act: it interprets and completes it at national level. For Italian companies, what matters most is understanding what remains European, what is specifically Italian, and who the reference authorities are.
General information, not legal advice.
What Law 132/2025 is
It is the Italian law on “provisions and delegations to the Government on artificial intelligence,” published in the Official Gazette and in force from 10 October 2025 (Normattiva).
Article 1 clarifies two points:
- it promotes correct, transparent, and responsible use of AI, in a human-centric key;
- its provisions are interpreted and applied in conformity with Regulation (EU) 2024/1689 (AI Act).
In addition, Article 3(5) states explicitly that the law does not create new obligations beyond those already set by the AI Act for AI systems and general-purpose AI models. That is an important signal against “double bureaucracy” panic.
AI Act vs Italian law: who does what
| Level | What it regulates | Source | |---|---|---| | European Union | Risk classification, provider/deployer duties, transparency, GPAI, fine framework | AI Act | | Italy | National principles, sectors (work, public administration, healthcare, professions), authorities, delegations, some criminal profiles | Law 132/2025 |
The AI Act remains the engine of technical and market obligations. Law 132 builds the Italian framework of principles, governance, and sector specifics.
What really changes for companies
For an SME using AI in processes, the most relevant Italian-law points are operational, not theoretical.
Work (Art. 11)
AI use at work must be safe, reliable, transparent, and non-discriminatory. The employer or client must inform the worker of AI use in the cases and ways set by the employment rules referenced in the law. This is not an HR detail “for later”: if you use automated CV screening or evaluation tools, internal transparency matters.
Intellectual professions (Art. 13)
AI is allowed as instrumental support to professional activity, with prevalence of the intellectual work. Information on the systems used must be communicated clearly to the client. If you are a firm or consultancy using GenAI in deliverables, disclosure is not optional.
Public administration (Art. 14)
For those selling or integrating AI in the public sector: AI remains instrumental; the person remains responsible for the administrative act. Knowability and traceability of use are required.
National governance (Art. 20)
The following are designated as National Authorities for AI:
- AgID (Agency for Digital Italy): promotion, innovation, notification/assessment/accreditation functions for bodies that verify conformity;
- ACN (National Cybersecurity Agency): market surveillance and single point of contact with EU institutions, without prejudice to the roles of the Bank of Italy, CONSOB, and IVASS in their respective fields.
This answers a practical question: “who do we refer to in Italy?” The official answer is AgID + ACN, plus sector supervision where provided.
What does not change (and is worth not confusing)
- The European AI Act continues to apply directly.
- Using ChatGPT or Copilot does not become “illegal” solely because of Law 132.
- You do not need a parallel compliance track misaligned with Europe: the law explicitly refers to the EU regulation.
- GDPR and sector rules (employment, health data, etc.) remain in force.
The real risk for SMEs is not “not knowing article X.” It is using AI without an inventory, without data rules, and without ownership. On that, Italian law and the AI Act push in the same direction.
FAQ
Does Law 132/2025 replace the AI Act in Italy?
No. It is interpreted and applied in conformity with the EU regulation. For GPAI systems and models, it does not create additional obligations beyond the European ones (Art. 3(5)).
When did it enter into force?
On 10 October 2025 (Normattiva).
Who supervises in Italy?
AgID and ACN are the National Authorities for AI; market-surveillance competences of the Bank of Italy, CONSOB, and IVASS remain in the sectors provided (Art. 20).
Do I need to do something different if I operate only in Italy?
You must respect the AI Act plus relevant national specifics (worker/client information, sector principles, relations with authorities). The operational checklist still starts from inventory, role (provider/deployer), transparency, and literacy.
Sources
- Normattiva: Law No. 132 of 23 September 2025
- EUR-Lex: Regulation (EU) 2024/1689 – AI Act
- European Commission: AI regulatory framework
Dig deeper in the series
- AI Act: practical company guide
- Deployer vs provider: SME checklist
- AI literacy and mandatory training
- AI responsibility and accountability
If you want to understand, on your real perimeter (tools, processes, data), what is already covered by the AI Act and what needs Italy-specific attention, we can discuss it without turning it into a treatise. Write to info@zendata.it or visit zendata.it.
Pietro Ciattaglia, CEO of Zendata AI, Rome