Italy puts AI Act decree into force with cyber agency fines and algorithm dismissal ban

Legislative Decree 179/2026 entered into force in Italy on October 23, 2026, after adoption on October 7 and publication in Gazzetta Ufficiale No. 234 on October 8. It is Italy's second implementing measure for Regulation (EU) 2024/1689, the EU AI Act, following Legislative Decree 160/2026 on law enforcement activities and liability. The decree has 54 articles and covers national governance, market surveillance, sanctions, regulatory sandboxes, education, trade secrets and employment law. Its purpose is to turn the EU rulebook into an operating system for Italian authorities.

The legal basis is Article 24 of Law No. 132 of September 23, 2025, Italy's national AI law. The decree keeps the Coordination Committee at the Presidency of the Council of Ministers as the central policy forum. It designates AgID as the national notifying authority for conformity assessment bodies. It makes ACN the market surveillance authority for AI systems. For high risk AI in credit, banking, investment and insurance, it assigns duties to the Bank of Italy, CONSOB and IVASS. The Italian Data Protection Authority is designated for Article 74(8) of the AI Act. This distributed model gives each regulator the part of the AI economy closest to its existing expertise.

Article 41 is the employment core. Final decisions on establishing, modifying or terminating an employment relationship, including disciplinary measures and performance evaluations, cannot be adopted solely on automated processing. The definitive decision must be reserved to a natural person exercising effective and autonomous power. Worker consent is not an exception. A dismissal issued in breach is null and void, and other decisions taken in breach are also null. Workers may request an intelligible explanation of the decision, including the influence of AI and the main parameters considered.

Key Facts

Il Sole 24 Ore reported on October 22, 2026 that the decree sets four tiers of AI Act fines. The highest is up to €35,000,000 or 7% of total annual worldwide turnover for prohibited practices. The next is up to €15,000,000 or 3% for failure to comply with operators' obligations and transparency requirements. A third tier reaches €7,500,000 or 1% for supplying incorrect, incomplete or misleading information. The fourth is up to €1,000,000 or 0.5% for breaches of Articles 27 and 86, covering fundamental rights impact assessment and the right to explanation. For undertakings the maximum is the higher of the fixed amount and the percentage, with the less onerous amount for SMEs, micro enterprises and innovative start ups. For low severity breaches, an order to remedy may replace a fine.

LEXIA reported on October 23, 2026 that Article 4 designates AgID as the national notifying authority for conformity assessment bodies and Article 5 identifies ACN as a market surveillance authority, alongside the Bank of Italy, CONSOB and IVASS for high risk AI in credit, banking, investment and insurance, and the Data Protection Authority for Article 74(8). The Coordination Committee at the Presidency of the Council of Ministers remains the central policy forum. A coordination committee is also planned to share information and facilitate checks with the Guardia di Finanza, Carabinieri, Police and DIA, according to Il Sole 24 Ore. The decree also encourages cross border collaboration with the Regions and in sectors such as defence, justice and fintech.

PwC Italia Blog reported on October 22, 2026 that Article 41 allows AI to support human resources work but not to replace the human decision maker. The final decision must be made by a natural person who independently assesses the algorithm's output rather than simply accepting it. The provision covers performance assessments, assignment of duties, career progression, disciplinary measures and termination. Automated systems may still source and shortlist candidates, even where they exclude applications from later stages. The decree also requires employers to include the effects of AI systems on work organisation, production pace and task allocation in the risk assessment document required under Legislative Decree No. 81/2008, and to provide information and training on associated risks and preventive measures.

Gazzetta Ufficiale reported on October 8, 2026 that the official text confirms candidate search and selection activities are not among the final decisions on establishing the employment relationship, even where they result in exclusion from later stages of selection. Il Fatto Quotidiano reported on October 23, 2026 that Guido Scorza, an Italian data protection lawyer, called this carve out a huge error of assessment and perspective that threatens to deprive millions of qualified people of jobs because of bias in the algorithms and models behind candidate pre screening services. Scorza cited Amazon's abandonment of an early algorithmic recruiting project in 2015 after it showed an extraordinary preference for men over women. He also cited the Harvard Business School and Accenture study Hidden Workers: Untapped Talent, published in 2021 and based on 2,275 executives and 8,720 workers in the United States, the United Kingdom and Germany. According to that study, more than 90% of employers use screening software for first stage candidate selection, 88% admit that qualified workers are rejected because they do not match the job advert exactly, and 48% exclude resumes with work gaps longer than six months.

Analysis

What this really means is that Italy has created a two tier system of accountability. For final employment decisions, the law draws a hard line: a human being with effective and autonomous power must decide, and a dismissal produced solely by an automated system is void. For earlier stages, such as sourcing and shortlisting, the law leaves room for automated exclusion. That distinction allocates legal risk. Employers can automate the top of the hiring funnel while reserving human judgment for the formal act of hiring, promoting or dismissing. Scorza's criticism goes to the heart of this design: if an algorithm removes a candidate from the pipeline, the later human decision may never happen, so protection arrives too late for the person who was screened out.

The bigger picture here is that enforcement capacity will determine whether the decree changes behavior. Italy has not created a single AI regulator with a blank check. It has given ACN the market surveillance role and AgID the conformity assessment notification role, while the Bank of Italy, CONSOB, IVASS and the Data Protection Authority keep sector specific mandates. This matches the EU AI Act's structure, but it also creates coordination costs. A company deploying high risk AI in lending may face several financial regulators, and a data protection question may pull in the Data Protection Authority. The planned coordination committee with the Guardia di Finanza, Carabinieri, Police and DIA is meant to reduce fragmentation. The test will be whether information moves quickly enough to produce timely checks.

The fine structure is severe on paper. Up to €35 million or 7% of worldwide turnover for prohibited practices gives ACN leverage in negotiations and investigations. The lower tiers matter too, because they cover failures of transparency and the supply of incorrect, incomplete or misleading information. Those are the everyday compliance risks for companies that use AI but do not fall into the prohibited category. The concession for SMEs, micro enterprises and innovative start ups, and the possibility of an order to remedy for low severity breaches, suggest that the Italian legislator wants compliance rather than indiscriminate punishment. The open question is resources. Fines are not self executing.

Why It Matters

The decree matters first for workers. Article 41 gives Italian employees a direct legal ground to challenge dismissals and other adverse decisions taken solely by automated systems. The remedy is not a small procedural fix: the dismissal is null and void. The worker can also ask for an intelligible explanation of the decision, including the main parameters considered and the influence of AI. That explanation right will force employers to document how algorithms feed into human resources decisions. It will also test whether human oversight is real or a rubber stamp. A manager who simply clicks approve on an algorithm's recommendation may not satisfy the requirement of effective and autonomous power.

It matters for companies because the compliance map is now more concrete. ACN is the market surveillance authority, AgID is the notifying authority for conformity assessment bodies, and the Bank of Italy, CONSOB and IVASS supervise high risk AI in credit, banking, investment and insurance. The Data Protection Authority handles its designated AI Act provision. Companies must map which authority governs which system and how they will document human intervention in employment decisions. The four tiers of fines, from €35 million or 7% down to €1 million or 0.5%, create a ladder of risk, and the reputational effect of an ACN investigation may exceed the monetary penalty. The national regulatory sandbox in Articles 26 to 31 adds a constructive route for businesses, start ups and developers, with priority access for SMEs and start ups. The education chapter receives €100 million from the PN Scuola e Competenze 2021-2027 programme, the only part funded with ad hoc resources.

Next Up

Next up is implementation and legal testing. AgID and ACN must establish the joint task force by joint decree and set up the sandbox's operating rules. The coordination committee must begin sharing information with the Guardia di Finanza, Carabinieri, Police and DIA. Employers must update their risk assessment documents under Legislative Decree No. 81/2008 and review human resources technology contracts for automated screening, performance scoring and termination workflows. The first legal tests are likely to come from dismissal cases and from workers requesting explanations of AI assisted decisions. Scorza's critique has given opponents of the candidate screening carve out a clear argument: the law protects the final human decision but not the automated exclusion that prevents a person from ever reaching it. If ACN enforcement or early court cases show discriminatory outcomes, pressure to close the gap may grow.