Italy's latest approach to AI, privacy and cybersecurity

Italy continues to distinguish itself as one of Europe's most interventionist jurisdictions at the intersection of privacy, artificial intelligence and cybersecurity. 

Recent enforcement actions by its data protection authority, the Garante, combined with new legislation under the EU AI Act, offer insight into how Italy is translating digital governance principles into practice. 

Two legislative decrees recently completed Italy's transposition of the AI Act within its national legal framework. Legislative Decree No. 160, adopted 9 Sept., introduced corporate and individual criminal liability provisions. Legislative Decree No. 179, adopted 8 Oct. and entered into force 23 Oct., clarifies the roles and responsibilities of Italy's national AI supervisory authorities.

Alongside these legislative developments, the Garante has continued its scrutiny of AI providers, acting with its in remit over privacy-related infringements, with two major decisions involving an AI-powered plug-in for the sentiment analysis of employees and an AI "companion" app. The latter addressed issues relating to minors' online protection.

On the cybersecurity front, there have been no regulatory developments, 2026 marked the transition from legislative implementation to operational compliance and active supervision under the NIS2 Directive and Digital Operational Resilience Act.

Garante enforcement actions against AI providers continue

In July, the Garante concluded its ex officio investigation into Character Technologies, the U.S.-based provider of the generative AI service Character.AI, an AI "companion" app that allow users to engage in conversations with customizable characters, create their own, craft their personalities and then publish them to the community for others to chat with.