01. Introduction
On September 25th, 2025, the Italian Artificial Intelligence Act (the “Act”) was definitively published in the Italian Official Gazette approved and will enter into force on October 10, 2025. It supplements Regulation (EU) 2024/1689 (the “AI Act”) by regulating areas not fully harmonized at the European level.
The new legislation marks a fundamental step in the regulation of a technology destined to have a profound impact on economic, professional, and institutional activities. The provisions introduced concern, on one hand, the use of AI in particularly sensitive sectors, and on the other, industrial policy and innovation measures, including significant updates to liability and copyright law.
02. Sector-Specific Applications
Healthcare
AI is recognized as a support tool for prevention, diagnosis, and treatment, but with precise limits to protect patients: the final decision always rests with the physician, and the data subject must be informed about the use of these technologies. The Act also establishes a national AI platform at AGENAS (which, moreover, assumes the role of data controller for personal data collected and generated within said national platform) to facilitate the use of innovative solutions by healthcare professionals and citizens. It also opens the Electronic Health Record (Fascicolo Sanitario Elettronico – FSE) to AI: the Ministry of Health will be able to adopt one or more decrees to regulate artificial intelligence solutions supporting the FSE’s purposes, which range from treatment, prevention, and international prophylaxis to healthcare planning, and scientific research in the medical, biomedical, and epidemiological fields.
Of central importance is the provision (Article 8) dedicated to data processing for scientific research purposes. This provision declares the processing of data for scientific research and experimentation for the development of AI systems in the healthcare sector to be of “significant public interest,” resolving ex lege the issue of identifying legal bases for processing special categories of data in this context. However, it does so with some gaps, as the rule remains rather vague and does not precisely identify the processing activities, data sources, and other safeguards to be applied in the specific case.
Furthermore, the same provision establishes a simplified regime for the secondary use of data without direct identifiers (i.e., pseudonymized, anonymized, or synthesized), which is authorized ex lege, including for special categories of data and without the need for new consent from the data subjects, provided that both AI-based processing for primary and secondary research purposes “must be communicated to the Personal Data Protection Authority with an indication of all the information provided for in Articles 24, 25, 32, and 35 of Regulation (EU) 2016/679, as well as with the express indication, where present, of the subjects identified pursuant to Article 28 of the same Regulation (EU) 2016/679, and may be initiated thirty days after the aforementioned communication if they have not been subject to a blocking measure ordered by the Personal Data Protection Authority“.
Finally, the Act promotes the development, study, and dissemination of AI systems dedicated to people with disabilities, facilitating their accessibility, autonomy, safety, and social inclusion processes.
Labor
Companies will be able to adopt AI systems to increase productivity and improve working conditions, while respecting the dignity and privacy of workers. An obligation of prior information to the employee is introduced, and a ministerial Observatory is established to monitor the impact of AI in the world of work.
The Act expressly provides that the use of AI systems in the management of the employment relationship must in any case guarantee the observance of the inviolable rights of the worker without discrimination based on sex, age, ethnic origin, religious belief, sexual orientation, political opinions, and personal, social, and economic conditions.
Intellectual Professions
For regulated professions, AI is permitted only as a purely auxiliary tool, without ever replacing the intellectual contribution of the professional. The Act strengthens the obligation of transparency: clients must be informed in a clear and understandable way about the systems used, to protect the fiduciary relationship.
Public Administration and Judicial Activities
Public administrations will be able to use AI to improve the efficiency of proceedings, always in an instrumental capacity and without diminishing the responsibility of the public official. Similarly, AI will be permitted in courts to simplify the organization of judicial work, while the assessment of evidence and legal issues remains reserved for the magistrate.
03. Measures to Support Innovation
In Article 21, the Act authorizes an investment of up to one billion euros, through the Venture Capital Support Fund, to promote innovative start-ups and SMEs operating in the AI, cybersecurity, and enabling technology sectors (including quantum technologies, 5G, and Web3). Access to these resources is reserved for:
(i) innovative start-ups and SMEs with legal and operational headquarters in Italy that are in the experimentation phase (seed financing), incorporation phase (start-up financing), business launch phase (early-stage financing), or product development phase (expansion, scale-up financing); or
(ii) companies, with legal and operational headquarters in Italy and operating in the aforementioned sectors, with high development potential and that are highly innovative.
This is a measure aimed, on the one hand, at allowing companies to obtain capital from the very beginning of their activity and, on the other, at fostering the competitiveness of Italian companies in the European and global markets.
04. Delegation to the Government
Within 12 months, the Government must adopt implementing legislative decrees to:
- align domestic legislation with the AI Act;
- grant supervisory and sanctioning powers to AgID (Agency for Digital Italy) and ACN (National Cybersecurity Agency);
- regulate the use of AI in investigative and police activities;
- update the civil and criminal sanctions framework;
- introduce training courses on digital skills and AI, including in university curricula and professional training;
- define the criteria for attributing criminal liability and for the allocation of the burden of proof in civil matters for damages caused by AI systems.
05. Updates on Copyright Law
Chapter IV amends the copyright law (Law no. 633/1941, “LDA”) and clarifies, reaffirming that protection is reserved for works of human intellect, that such works can be created “also with the aid of artificial intelligence tools,” provided they are the result of the author’s creative contribution. Therefore, works generated in total autonomy by AI systems, without human intervention and/or contribution, will not enjoy protection. The recent legislative formulation offers a first attempt to clarify the uncertain admissibility of protection for works created with the help of artificial intelligence, proposing what we might call a “moderate anthropocentric” approach.
However, the rule does not specify what the minimum level of human contribution must be for a work to be considered protectable as a fruit of human intellect and what the scope of the permissible “aid” of AI is for this purpose.
The new Article 70-septies has also been introduced into the LDA, which governs the use of protected works for training AI models. Specifically, this provision allows “reproductions and extractions from works or other materials contained in a network or in databases to which one has legitimate access, for the purpose of text and data mining through artificial intelligence models and systems,” provided that such use is in accordance with the provisions on exceptions to copyright provided for in Articles 70-ter and 70-quater of the LDA. Text and data mining (“TDM”) — i.e., the automated extraction and reuse of large quantities of content and data — is therefore permitted through the use of AI systems, unless the rights holders exercise their right to opt-out, i.e., the right to exclude their protected works from TDM.
It should also be noted that a new criminal offense has been introduced into the LDA. Specifically, letter a-ter has been added to Article 171 of the LDA, providing for a monetary sanction for anyone who, without right, for any purpose and in any form, “reproduces or extracts text or data from works or other materials available on the network or in databases in violation of Articles 70-ter and 70-quater, including through artificial intelligence systems.”
The new law also intervenes in the Criminal Code on intellectual property matters, introducing a new criminal offense, pursuant to Article 612-quater, titled “Unlawful dissemination of content generated or altered with artificial intelligence systems,” and two specific aggravating factors for the use of artificial intelligence in the crimes provided for in Articles 2637 of the Civil Code (Market rigging) and 185 of Legislative Decree no. 58 of February 24, 1998 (T.U.F.) (Market manipulation).
06. Governance and Sanctioning Profiles
AgID and ACN are designated as the national authorities for artificial intelligence, with distinct competencies in promotion, supervision, and cybersecurity. In particular, also consistent with the current functions respectively exercised by these authorities:
(i) AgID is responsible for promoting the innovation and development of AI, as well as defining the procedures, and for exercising the functions and tasks related to the notification, assessment, accreditation, and monitoring of the bodies in charge of verifying the conformity of AI systems;
(ii) ACN, also for the purpose of ensuring cybersecurity protection, is responsible for the supervision, including inspection and sanctioning activities, of AI systems, as well as for the promotion and development of AI in relation to cybersecurity profiles;
(iii) AgID and ACN, each for its own area of competence, ensure the joint establishment and management of experimental spaces aimed at the creation of AI systems, after consulting the Ministry of Defense for aspects related to dual-use artificial intelligence systems.
On the criminal law front, the Act introduces a common aggravating factor for crimes committed with the aid of AI and the new offense of unlawful dissemination of generated or altered content (in particular, deepfakes).
07. Conclusions
The Italian AI Act is a fundamental piece of a rapidly evolving regulatory framework, which requires companies to:
- map the AI systems in use;
- update contracts and internal policies;
- review risk management strategies.
This is a crucial step to ensure regulatory compliance and maintain competitiveness in an increasingly regulated European context which, now more than ever, requires the integration of cross-disciplinary skills to properly manage the multiple (technical, organizational, and compliance) requirements for operators in a rapidly evolving sector.