Part of the AI Regulation News hub.
Italy's Legislative Decree 179 of 7 October 2026, in force from 23 October 2026, assigns the AI Act's national roles: AgID notifies, ACN, the financial regulators and the Garante supervise, and fines are set
We read articles 1 to 25 of the decree in full and articles 26 to 35 in outline, in the Gazzetta Ufficiale text. ACN is the general market surveillance authority; the financial regulators take high-risk AI used in banking, securities and insurance; the Garante is limited to article 74(8) of the AI Act. Articles 19 to 25 set the fines.
Bottom line: Binding and in force. This is an enacted legislative decree, effective 23 October 2026 per Normattiva, so it is law and not a draft. We read the decree text as published in Gazzetta Ufficiale n. 234 of 8 October 2026, articles 1 to 25 in full and 26 to 35 in outline. We did not analyse articles 36 to 54 on training, work and the professions.
Who this affects: Providers and deployers of AI systems in Italy; compliance and legal teams at banks, investment firms, asset managers, payment and e-money institutions, insurers and crypto-asset service providers (the decree's istituti finanziari); notified-body candidates; and public administrations.
Issue date: Decree dated 7 October 2026. Published in Gazzetta Ufficiale n. 234 of 8 October 2026. Normattiva gives the date of entry into force as 23 October 2026. Article 10(2) sets a 90-day deadline from entry into force for a decree fixing the cost parameters for supervision of non-conforming products.
What changed: Article 4 makes AgID the notifying authority. Article 5 makes ACN a national market surveillance authority for AI systems, gives Banca d'Italia, CONSOB and IVASS the competence over high-risk AI systems used in their respective financial and insurance services, and limits the Garante to article 74(8) of the AI Act. Articles 15 to 17 give ACN and the financial authorities inspection and supervisory powers, including unannounced checks on real-world testing. Articles 19 to 25 set penalties: up to EUR 35,000,000 or 7 percent of worldwide annual turnover for prohibited practices (article 23(1)), down to EUR 1,000,000 or 0.5 percent for the obligations in AI Act articles 27 and 86 (article 23(4)).
Analysis: Inference, not text: for a financial firm the question is which hat the system wears. Article 5(b) gives Banca d'Italia, CONSOB and IVASS the high-risk systems used in the services their sector codes regulate, and article 9(1) has ACN and the financial authorities cooperate on AI used by financial institutions that falls outside article 74(6) of the AI Act. A firm with a credit-scoring model and a customer chatbot may therefore face more than one authority. The designation of AgID and ACN as national AI authorities is not new: article 1(2)(a) points to article 20(1) of Law 132 of 2025.
Primary sources: Gazzetta Ufficiale n. 234 of 8 October 2026 (Serie generale, PDF) · Normattiva: Decreto legislativo 7 ottobre 2026, n. 179
- Instrument (EN)
- Legislative Decree of 7 October 2026, no. 179, adapting national law to Regulation (EU) 2024/1689 as regards the powers of the national authorities and the use of artificial intelligence in education and training. Native title: Adeguamento della normativa nazionale alle disposizioni del regolamento (UE) 2024/1689 ... in materia di poteri delle Autorità nazionali e di utilizzo dell'intelligenza artificiale nella formazione. English rendering is ours
- Authority
- Issued by the President of the Republic on the proposal of the Prime Minister and the Minister for European Affairs, with other ministers concerting, per the preamble. Preliminary Council of Ministers deliberation of 10 June 2026; final deliberation of 4 August 2026, per the preamble
- Jurisdiction
- Italy
- Status
- Enacted and in force
- Bindingness
- Binding national legislative decree, adopted under the delegation in article 24 of Law 132 of 23 September 2025
- Issue date / next deadline
- 7 October 2026; Gazzetta Ufficiale n. 234 of 8 October 2026; in force from 23 October 2026 per Normattiva. Article 10(2): decree of the Prime Minister on costs of supervision of non-conforming products within 90 days of entry into force. Other deadlines (6 and 12 months) appear in the education and training provisions, which we did not analyse
- Structure
- Chapters I to V, 54 articles. Chapter II (articles 2 to 35) has eight sections: general provisions; authorities, single contact point and coordination (4 to 12); notification (13); market surveillance (14 to 18); penalties (19 to 25); regulatory sandboxes (26 to 31); sector amendments (32 to 33); further provisions (34 to 35)
- Editorial Note
- Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
- Primary source
- https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2026;179
What the official text gave us
The Gazzetta Ufficiale Serie generale of 8 October 2026 prints the decree in full, from the preamble to the financial-neutrality clause in article 54, followed by the official notes. We read the articles that allocate authority and set penalties (articles 1 to 25), plus the sandbox, amendment and further-provisions articles in outline (26 to 35).
Normattiva's page for the same decree, which we opened first, rendered only article 1 in its body. The Gazzetta text is the complete one, and article numbers below are the Gazzetta's.
How the decree was made
The preamble names Law 132 of 23 September 2025, in particular article 24, as the source of the delegation, and the AI Act as the thing being adapted to. It records a preliminary deliberation of the Council of Ministers on 10 June 2026 and a final one on 4 August 2026.
Between the two, the preamble lists opinions obtained from AgID, ACN, the Garante per la protezione dei dati personali, the Conferenza unificata and the competent parliamentary committees of both chambers. The preamble says only that the opinions were obtained. It does not say what they recommended or whether the final text followed them.
Article 1: a vocabulary that sorts the regulators
Article 1(2) is a list of defined terms, and the roles are the point. The autorità nazionali per l'intelligenza artificiale are AgID and ACN. The autorità nazionali di vigilanza del mercato are ACN, Banca d'Italia, CONSOB, IVASS and the Garante, the text adding that this is as provided in article 5. The autorità nazionale di notifica is AgID.
Two further definitions matter for regulated firms. Autorità del settore finanziario means Banca d'Italia, CONSOB and IVASS, in their capacity as market surveillance authorities for the financial sector. And istituti finanziari is defined by a long list that runs from banks and investment firms through asset managers, payment and e-money institutions, crowdfunding providers, crypto-asset service providers, trading venues, central securities depositories and central counterparties to insurers and insurance intermediaries.
The same article defines the Comitato di coordinamento at the Presidency of the Council, the Italian AI sandbox under article 57 of the AI Act, and the FinTech sandbox under the 2019 decree-law.
Who supervises what: articles 4 to 9
Article 4 says that AgID is the national notifying authority, responsible for the procedures to assess, designate, notify and monitor conformity assessment bodies. Article 13 gives AgID the powers for those procedures under AI Act articles 28, 30 and 36, including audits and, after hearing the notified body, proceedings to limit, suspend or revoke a designation. Under article 13(4), the costs of AgID's checks on notified bodies fall on those bodies.
Article 5 is the allocation. In its words, the following are national market surveillance authorities: "l'ACN, per la vigilanza del mercato sui sistemi di IA"; Banca d'Italia as competent authority for high-risk AI systems used in providing finance or other financial services under the banking consolidated act; CONSOB for those used in services under the securities consolidated act; IVASS for those used in insurance and reinsurance activity and insurance distribution; and "il Garante per la protezione dei dati personali, limitatamente a quanto previsto dall'articolo 74, paragrafo 8, del regolamento IA". Article 6 makes ACN the single point of contact.
Articles 7 to 9 are about coordination, not allocation. Article 8 has ACN work jointly with sector market surveillance authorities where a product is covered by both the AI Act and EU harmonisation law. Article 9(1) has ACN and the financial authorities collaborate, including by agreements, on AI used by financial institutions other than those within article 74(6) of the AI Act.
Powers and procedure: articles 14 to 18
Article 14 makes ACN competent for national registration of the high-risk systems listed in Annex III, point 2, of the AI Act. Article 15 gives ACN the supervisory and inspection powers of the AI Act and of articles 14 and 16 of Regulation (EU) 2019/1020, and, for real-world testing, the power to carry out remote or on-site inspections "anche senza preavviso".
Article 17 gives the financial authorities the same powers toward the financial institutions they supervise, with the same unannounced-inspection power on real-world testing, and keeps their existing powers under article 22 of Law 262 of 2005. Article 18 requires market surveillance authorities to receive complaints under AI Act article 85 and forward a complaint filed with the wrong authority to the right one. It also makes the banking, insurance and securities out-of-court dispute schemes competent for appeals about AI Act violations by member institutions, where the violation arose in the activities those schemes cover.
Penalties: articles 19 to 25
Article 20 lets AgID impose the fines in AI Act article 99(4)(f) and (5). Article 21 gives the market surveillance authorities the power to fine the persons in article 99(1). Article 22 adds non-pecuniary measures for violations of low gravity, as an alternative to fines: an order to end the infringement, or, if it has ceased, a public statement naming the violation and the person responsible. If an order is ignored, the fine under article 23 applies and can be raised by up to one third, within the article 23 ceilings.
Article 23 sets the ceilings. Unless the conduct constitutes a criminal offence, non-compliance with the prohibited practices of AI Act article 5 attracts an administrative fine of up to EUR 35,000,000 or, if higher, 7 percent of the prior year's worldwide turnover. Breaches of the obligations listed in article 23(2), which names AI Act articles 16, 22 to 26, 31, 33(1), (3) and (4), 34, 50, 73 and 80, draw up to EUR 15,000,000 or 3 percent. Unless the conduct constitutes a criminal offence, supplying incorrect, incomplete or misleading information to notified bodies or competent national authorities in response to a request attracts up to EUR 7,500,000 or 1 percent. AI Act articles 27 and 86 carry up to EUR 1,000,000 or 0.5 percent. Article 23(7) says SMEs, including micro-enterprises, and innovative start-ups are fined under the criterion in AI Act article 99(6).
Article 24 requires reasoned decisions after the charges are notified and publication of the sanction decision on the authority's website, with anonymised publication in three listed cases. Banca d'Italia uses its procedure under article 145 of the banking act, CONSOB article 195 of the securities act, IVASS articles 311-septies and 324-octies of the insurance code, and the Garante article 166 of the privacy code. Under article 25, ACN's and AgID's fine proceeds go to the State budget for reassignment, ACN's and AgID's for their functions under the decree.
What traces to Law 132 rather than to this decree
Article 1(2)(a) does not itself designate AgID and ACN. It cites article 20, paragraph 1, of Law 132/2025. The official notes to article 1 reproduce article 20 of that law, which designates AgID and ACN as national AI authorities while leaving Banca d'Italia, CONSOB and IVASS in the role of market surveillance authorities under article 74(6) of the AI Act.
The notes also show that the same article 20 designates AgID as notifying authority and ACN as market surveillance authority and single point of contact with EU institutions. The notes themselves carry a warning that they were drafted by the competent administration only to ease reading and leave the value of the transcribed acts unchanged.
So the decree sits on a structure already set by statute. What we can say is new in article 1 is the definitional list of five market surveillance authorities including the Garante, and its cross-reference to article 5. What articles 4 to 6 add is the operative detail: the Garante's limited role under article 74(8), the financial authorities' split by sector code, and the coordination duties.
What we did not verify
We read the decree as printed in the Gazzetta Ufficiale Serie generale of 8 October 2026: articles 1 to 25 in full and articles 26 to 35 in outline. Nothing after that. Articles 36 to 54 went unread.
The preamble says opinions were obtained from AgID, ACN, the Garante, the Conferenza unificata and the competent parliamentary committees. The opinions themselves were not in front of us, so whether the final text followed them is unknown. Any later correction notice or amendment is also unchecked.
Before telling a client which Italian regulator will supervise an AI system, start at article 5 of the decree and then check article 9 for AI used by financial institutions. ACN is the default authority; the financial regulators take high-risk systems in their own services; the Garante's role is limited to article 74(8) of the AI Act. Penalty ceilings sit in article 23, and the lower ones apply to specific obligations the article names.
Source File
https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2026;179
Open the Gazzetta Ufficiale n. 234 PDF, find decree 179, and confirm article 1(2) (definitions), article 5 (market surveillance authorities), article 23 (fine ceilings) and article 24 (procedure). Normattiva shows the entry-into-force note of 23/10/2026.
sono autorità nazionali di vigilanza del mercato ai sensi del medesimo regolamento: a) l'ACN, per la vigilanza del mercato sui sistemi di IA · Decreto legislativo 7 ottobre 2026, n. 179, art. 5(1)(a)
FAQ
When did Italian Legislative Decree 179/2026 enter into force?
Normattiva gives 23 October 2026 as the date of entry into force and shows the text as in force from that date. The decree is dated 7 October 2026 and was published in Gazzetta Ufficiale n. 234 of 8 October 2026.
Which authorities does the decree name?
National AI authorities: AgID and ACN (article 1(2)(a)). Notifying authority: AgID (article 4). Market surveillance authorities (article 5): ACN generally; Banca d'Italia, CONSOB and IVASS for high-risk systems in banking, securities and insurance services; the Garante, limited to article 74(8) of the AI Act. ACN is single point of contact (article 6).
Does the decree itself designate AgID and ACN?
Article 1(2)(a) defines them by reference to article 20(1) of Law 132 of 23 September 2025, and the official notes reproduce that article. On our reading, the designation comes from the law, and articles 4 to 6 add the roles under the AI Act.
What penalties does the decree set?
Article 23 sets fines: up to EUR 35,000,000 or 7 percent of worldwide annual turnover, if higher, for prohibited practices; up to EUR 15,000,000 or 3 percent for the obligations it lists; up to EUR 7,500,000 or 1 percent for incorrect, incomplete or misleading information supplied in response to a request; up to EUR 1,000,000 or 0.5 percent for AI Act articles 27 and 86. Article 22 allows an order or public statement instead of a fine for low-gravity violations.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.