Italy aligns national legislation with the EU regulation on artificial intelligence

The Italian Government has aligned the national legal system with Regulation (EU) 2024/1689 on artificial intelligence through Legislative Decree no. 160 of September 9, 2026, published in the Official Gazette of the Italian Republic, General Series no. 214 of September 15, 2026 (reference 26G00179). The measure, issued by the President of the Republic Sergio Mattarella, regulates the use of AI systems for policing activities and the civil and criminal liability connected to their employment.

The decree implements the delegation contained in Article 24 of Law no. 132 of September 23, 2025 (AI Law), following the preliminary deliberation of the Council of Ministers on June 10, 2026, and the final one on August 4, 2026, having acquired the opinions of the Data Protection Authority and the Unified Conference. The text was proposed by the President of the Council Giorgia Meloni in concert with Ministers Foti, Piantedosi, Nordio, Tajani, Crosetto, and Giorgetti.

Use of AI systems in policing activities

Title I of the decree regulates the research, experimentation, development, and use of AI systems by police forces, in compliance with fundamental rights and the principles of proportionality, non-discrimination, human oversight, and transparency. The following are provided for:

• mandatory training courses for police personnel, with minimum training outcomes regarding the limits, biases, and errors of the systems, biometric recognition, and predictive analysis;
• collaborations with universities, research institutions, and public and private entities, excluding the sharing of sensitive operational data;
• regulatory sandboxes for the development of high-risk systems.

Real-time remote biometric identification in public places is permitted for prevention purposes and for the search for missing persons or victims of kidnapping, trafficking, and sexual exploitation. Use requires authorization from the Public Prosecutor for a maximum of fifteen extendable days, and in cases of urgency, notification within twenty-four hours. Log files are kept for five years and every use is notified to the Authority.

Video surveillance and facial recognition

Video surveillance systems may be integrated with AI components for ex-post facial recognition, with the Ministry of the Interior – Department of Public Security as the data controller. Facial images are stored for seven days and automatically deleted; the activation of recognition requires authorization from the judge for preliminary investigations within forty-eight hours. Non-targeted or indiscriminate use and non-targeted scraping of facial images are prohibited.

Criminal and civil liability

Title II introduces new criminal offenses. Article 437-bis is inserted into the penal code, which punishes the failure to adopt security measures in high-risk AI systems with imprisonment from one to five years, increased to two to eight years in the event of danger to State security; the unlawful alteration of systems is punished by two to six years, up to ten in the event of danger to State security. Article 359-ter on identification and localization via remote real-time biometric AI is introduced into the code of criminal procedure. Legislative Decree no. 231 of June 8, 2001, is supplemented with article 25-vicies, which provides for pecuniary sanctions from six hundred to one thousand quotas for entities.

On the civil front, the decree regulates compensation for damages caused by the use of AI systems, with the presumption of a causal link in case of violation of the obligations of Regulation (EU) 2024/1689, access to evidence regarding the functioning of the systems, and the direct action of the injured party against the insurance company.

Final provisions

AI systems already in use or under development for policing purposes must be made compatible within one year of the decree’s entry into force. The measure, signed in Rome on September 9, 2026, does not entail new or increased burdens on public finances.

For citizens, businesses, and law enforcement, the decree marks a decisive step toward a safer and more transparent use of artificial intelligence, aligning Italy with common European rules and defining clear guarantees and responsibilities for those who develop, employ, or suffer the effects of AI systems.

Source: Official Gazette of the Italian Republic, General Series no. 214 of September 15, 2026 — Legislative Decree no. 160 of September 9, 2026 (reference 26G00179), “Adjustment of national legislation to the provisions of Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, regarding the use of artificial intelligence systems for policing activities and civil and criminal liability”.