Italy's AI Act framework takes shape: What Legislative Decree No. 179/2026 means for organizations

Italy's national framework for the EU Artificial Intelligence Act took a decisive step forward 23 Oct., as Legislative Decree No. 179 entered into force. 

Published in the Official Journal of the Italian Republic 8 Oct., the decree is the second step of a two-step approach. First came Law No. 132 in September 2025, Italy's general law on AI, which set national principles, introduced rules for specific sectors and asked the government to align Italian law with the AI Act. The new decree is the government's answer to that request.

The decree matters for organizations operating in Italy, because the AI Act, although directly applicable in every member state, leaves important pieces to national law. Member states must designate competent authorities, lay down penalties and procedures, and set up regulatory sandboxes. How Italy has filled those gaps will shape day-to-day compliance, and in at least two areas, Italy has made choices of its own that deserve attention.

Who supervises what

Law No. 132/2025 named two national authorities for AI: the Agency for Digital Italy, known as AgID, and the National Cybersecurity Agency. The decree now spells out their roles. 

AgID acts as the notifying authority. It designs and runs the procedures to assess, designate and notify conformity assessment bodies, monitors notified bodies through periodic and extraordinary audits and, where it finds shortcomings, can initiate proceedings to restrict, suspend or withdraw their designation.

ACN is the main market surveillance authority for AI systems and the single point of contact with EU institutions. It holds investigative and enforcement powers, including the power to inspect testing in real-world conditions, also without prior notice. It is also responsible for the national registration of high-risk systems used in critical infrastructure, those listed in point 2 of Annex III of the AI Act.