AI Law: the beginning of Italy’s (and Europe’s) catch-Up?

After just under a year and a half since the government bill was first introduced and three rounds of parliamentary readings, Italy has finally passed its first comprehensive law regulating the use of artificial intelligence (AI) within the national legal framework. In fact, that “finally” may seem unfair when compared with the broader European (and global) picture, where Italy certainly positions itself at the forefront. This is likely because elsewhere attention remains fixed on the long, troubled, and in some respects uncertain implementation process of the EU’s AI Act. Moreover, Italy—having arrived late to the appointment with a genuine national AI strategy (despite repeated attempts by previous governments)—has used this legislative vehicle to implement one, and, even more commendably, to give it continuity and structure over time. Despite many fears and endless debates, the final result is overall praiseworthy, even if—given how the law was designed—it may best seen as an important first step to boost AI in Italy, one that must be followed by many more to achieve the ultimate goal.

A balanced framework

On the positive side of the scale, the law strikes an excellent balance among the various principles that must guide responses to such complex issues—especially between the goal of fostering innovation and economic growth, on the one hand, and that of ensuring the best protections for citizens, consistent with the Constitution and European law, on the other. The drafting style also appears clearer and more concise than many other parliamentary texts in recent legislatures, with numerous references to secondary implementing measures that provide a degree of flexibility—particularly if the follow-up work is carried out effectively and within the prescribed timelines. Finally, another commendable element—absent or less prominent in previous attempts to give Italy a national strategy—is the transversal nature of the discipline and the governance mechanism, which ensures the full involvement of various ministries as well as a significant number of agencies and authorities, each within its own competence, under a unified framework.

The main limitation remains financial, as the budget neutrality clause currently weighs heavily on the prospects for implementing the government’s strategy, approved over a year ago for the 2024–2026 period.

Keeping pace with risks and opportunities

The law includes several provisions that respond promptly to real risks that have emerged in recent years, especially with the spread of generative AI models. Others, rather than slowing innovation, seek to accelerate it—thanks, for once, to legislation.

Among the former are Article 3(4), which addresses democratic interference through AI tools, and Article 4(4), which regulates minors’ access to AI technologies. This debate—part of the broader issue of protecting minors online and on social media—has accelerated in recent years, and the Italian law handles it in a measured way: requiring parental consent for those under 14, and the minors’ own consent above that age. Given that data show young people, particularly teenagers, are heavy users of these tools (and that such use could also serve as digital literacy for older age groups), the approach seems proportionate and in line with the evolving European debate.

Among the measures intended to foster innovation are provisions regarding research and scientific experimentation in healthcare. These recognize public interest in the collection and processing of data for this purpose by public entities or private ones working with non-profit partners. The suppression of the originally foreseen role of ethics committees, and the optional nature of Agenas guidelines (Agenas is a public technical body supervised by the Italian Ministry of Health) allows for immediate application—subject, of course, to oversight by the Data Protection Authority to ensure proper data handling.

Also in healthcare, the creation of a national AI platform for healthcare and territorial assistance, entrusted to Agenas, looks very promising. If well implemented, it could become a key pillar of healthcare reform—urgently needed after Covid and funded by the National Recovery and Resilience Plan (NRRP). The same applies to the electronic health record, after the long struggle to establish it.

The frequent references to experimental spaces (sandbox environments), including through university involvement, are encouraging. Still, implementation of the regulatory sandboxes foreseen by the AI Act will require further acts, likely to be carried out by the Digital Italy Agency (AgID), one of the two national authorities designated along with the National Cybersecurity Agency (ACN).

Speaking of cybersecurity and AI’s growing role as both a weapon and a defense, the law promotes initiatives to leverage AI as a resource for strengthening national cybersecurity (Article 18), as well as possible partnerships with EU, NATO, and non-EU countries that have signed cooperation agreements for AI system development (Article 28). This example, relevant to cybersecurity, should in fact be extended to AI as a whole—particularly at the European level, to build critical mass for joint investments, especially since other major EU countries like France and Germany have recently expressed in a joint document their intention to deepen bilateral cooperation in this area.

Between growth and safeguards, reflecting Italy’s strengths and weaknesses

The law takes due account of Italy’s economic system and the technological trajectories it must pursue to reduce current weaknesses in the AI race.

This is clear already from Article 5, which sets out economic development principles, identifying AI as a tool to increase productivity within a system largely made up of micro and small-to-medium enterprises (SMEs). Particularly valuable are the provisions in the same article to foster the creation of an innovative, fair, open, and competitive AI market, and to facilitate the availability of high-quality data. On this point, thanks to an amendment adopted in the second reading, the law explicitly prohibits imposing additional obligations beyond those in the EU AI Act regarding data, algorithms, and mathematical methods for training AI models (Article 16).

Also worth noting is the removal of Article 6(2), which in its first reading had mandated that AI systems used in the public sector be hosted on servers located within national territory. That rule would have contradicted the data classification developed under the Draghi government with ACN’s support—treating all data the same and potentially conflicting with EU law—while also unnecessarily limiting public administrations’ choices in cases where risks were minimal.

The same logic applies to copyright: contrary to many expectations, Article 25 simply introduces adjustments consistent with the European approach, which currently appears more solid than U.S. or U.K. systems, where litigation is much more frequent. At the same time, the law extends protection to works created with AI support, provided they result from the author’s intellectual effort.

Equally sensible are provisions granting the right to be informed about AI use (e.g., Article 7 for healthcare users, Article 11 for workers, Article 13 for clients of professional services)—not only to encourage informed use, but also to promote AI as complementary rather than substitutive, with specific norms in healthcare, justice, and intellectual professions. However, for this to work in practice (and to maximize AI’s benefits), the training initiatives frequently mentioned in the law—mostly delegated to the government (Article 24)—must be timely and effective in both the public and private sectors.

Governance

On governance, some doubts remain about entrusting the role of national authority entirely to two executive-dependent agencies (even though the law reiterates the involvement of independent authorities like Agcom and the Data Protection Authority, given their specific roles). Still, the framework outlined is sufficiently clear and coordinated. Notably, the Presidency of the Council plays a central role in defining and implementing strategy. The law also introduces, in its second reading, a Coordination Committee on digital innovation and AI, composed of the ministers most involved in the matter and the heads of the most active research institutions. In theory, this should ensure unified leadership and avoid overlaps or, worse, dispersions of financial and human resources. Ideally, such coordination should extend—through the principle of loyal cooperation—to regions and local authorities, alongside public-private market growth driven by Italian and European actors, as hoped for in Article 5.

Limits and uncertainties

Doubts remain about the timeliness of government implementation of delegated acts, and about the law’s overall execution (though we sincerely hope such doubts prove unfounded). The most evident limit, however, is budgetary: resources largely center on the €1 billion CDP Venture fund, which is not dedicated solely to AI but to multiple technologies (though the launch of the dedicated AI Fund, active for several months, is a welcome step). Otherwise, Article 27 introduces a financial neutrality clause—meaning no additional budget commitments for national authorities, which will struggle to fulfill their new responsibilities with unchanged resources. The hope is that delegated acts (and the role of entities and foundations mentioned in governance) will offer some prospect of a less meager future, aided also by upcoming budget laws.

Final thoughts

Commenting on the law’s approval, Undersecretary of State Alessio Butti stated: “Italy is the first EU country with a national framework fully aligned with the AI Act. This is a choice that brings innovation back into the scope of the public interest, orienting AI toward growth, rights, and full citizen protection.” He added: “To businesses we say clearly: invest in Italy. You will find reliable governance, transparent rules, and an ecosystem ready to support concrete projects in all key sectors of the country.”

Mr. Butti certainly deserves credit for his patience and determination in steering the law to approval, and with it a governance structure and level of government involvement that—for the first time, at least on paper—appear adequate to today’s challenges, aside from the unresolved financial issue. But many aspects will only become clear in practice, and when it comes to attracting investment, many factors beyond the AI law will matter—starting with Europe’s generally low competitiveness.

This is why, after proving capable of passing such an important law—one that nods to innovation while remaining consistent with the EU regulatory framework—it would be desirable for Giorgia Meloni’s government to promote, at the European level, the urgent need for far larger joint public-private investments. This is precisely what another Italian, Mario Draghi—incidentally, Meloni’s predecessor as Prime Minister—called for in a sharp speech delivered in Brussels just a few days ago.