Italy's New AI Law: What the Decrees Mean for Your Business

Italy just became the first EU country to pass a comprehensive national AI law — and the real game-changer is what comes next.

In the time it takes to finish your coffee, Giulio Coraggio and journalist Antonio Ravenna break down how Italy's Law No. 132/2025 plugs into the EU AI Act, and why the upcoming implementing decrees could reshape compliance for anyone building or deploying AI in Italy.

No 40-page memos. No jargon. Just the essentials — in one coffee break. ☕

In this episode:
 🇮🇹 Why Italy moved first in Europe — and what Law No. 132/2025 actually changes
 ⚖️ How the Italian framework is designed to sit inside the EU AI Act (not on top of it)
 📜 The implementing decrees coming by October 2026 — and what they'll cover
 🏥 Sector hotspots: healthcare, employment, professional services, justice & deepfakes
 🚨 The compliance traps companies need to watch now

Whether you're in-house counsel, a compliance lead, or a founder shipping AI products, this is the short briefing you didn't know you needed.

🎧 Follow The Legal Break wherever you listen — new episodes unpack the legal topics that matter, one coffee at a time.
 💬 Got a topic you want us to cover? Let us know.
 ⭐ Enjoying the show? Leave a rating and review — it helps more listeners find us.

Send us Fan Mail

Episode Transcript

SPEAKER_00 (00:00):
Welcome everyone.

(00:00):
I'm Giulio Coraggio, atechnology and data lawyer at
the Global Affirm DLA Piper.

SPEAKER_01 (00:05):
And I'm Antonio Ravenna, a journalist.

SPEAKER_00 (00:07):
We're here to discuss a very interesting
development when it comes to AIcompliance.

SPEAKER_01 (00:13):
And we're gonna make it during the time of a coffee
break.
So, Giulio, Italy's Council ofMinisters approved two
implementing decrees onartificial intelligence.
But why does it matter beyondItaly?

SPEAKER_00 (00:28):
First of all, it's worth it to say that Italy is
the first country that hasadopted a legislation that
integrates the UAI Act.
The UAI Act is a regulation, soit's directly applicable, but it
leaves to each single EU memberstate some grey areas where
local laws can be can be added.

(00:50):
And Italy was the first one todo that, speeding up the process
of creating a legal framework onartificial intelligence during a
time where basically some of theprovisions of the UAI Act are
already in place.
So it's kind of puzzling thefact that the legislation became
applicable before, for instance,the authorities in charge of

(01:14):
supervising the compliance withthe obligations were kind of uh
identified.

SPEAKER_01 (01:20):
What do the decree say about AI driven decisions in
the workplace?

SPEAKER_00 (01:25):
This is one of the most tricky elements of the
decree.
We are seeing that AI systemsare shifting from pure pilot
projects to the usage in theoperational companies and in
large organizations, especially.
We see that AI-driven decisionsare coming more frequently than

(01:46):
in the past.
The risk is then that um thereis a dismissal of an individual
just based on uh analyticaldecisions made by machine, and
this is exactly what um theItalian degrees try to address.
They specifically ban this kindof dismissals, declaring that
they are newly and void, butthis leads to the next question:

(02:11):
what shall companies do to avoidthis kind of challenge?
Uh well, it's always a questionof accountability and being able
to document the process that isin place.
Because it is true that with theAI, the business of a company is
more and more data-driven, andum, with AI, there is a risk of

(02:31):
monitoring of uh individualswhose performance, whose
behavior could be bettertracked, even though, as we
know, monitoring uh through atrain systems of uh employees'
behavior is specificallyprohibited under Italian law.
So the problem arises when theAI reaches the conclusion that a

(02:53):
person misbehaved or is anunderperformer.
In that case, it's not enough tosay that the process is adopted
or is provided by an internalpolicy to review the assessment
based by the machine, but theall assessment process from the
outcome generated by the machineto the final decision should be

(03:18):
carefully documented and usedthen in a potential dispute, or
at least companies should haveit ready to be used in a
potential dispute.
So, in a way, this provisionputs an additional burden on
companies and an additional toolin the hands of employees to
start a potential dispute incase of dismissals.

SPEAKER_01 (03:40):
And Giulio, Italy also has introduced new criminal
liability for AI failures, itsfirst.
What does that mean concretely?

SPEAKER_00 (03:48):
Well, it introduced not only a criminal liability
regime but also a civilliability regime.
This move from Italy was theresult of the decision by the
European Union not to moveforward with the directive on
the liability arising from theusage of AI systems.
Basically, what Italy did iswhat uh the European Union

(04:11):
decided not to do.
It introduced a sort of apresumption of liability in case
of damage is caused by AIsystems.
So basically, the company thatis the uh provider, the deployer
of a solution should prove thatpotential damages were not
caused by the AI system.
So the burden proof is reversedon the company putting on the

(04:34):
market using that technology.
On top of that, for high-risk AIsystems, there is a criminal
liability not only of theindividual that made the
decision but also of the companyin case of lack of
implementation of adequatesecurity measures.
So if there is a damage to anindividual, there would be two

(04:55):
layers of liability, or actuallyI would say three, because uh
there would be the potentialsanction under the UAI Act,
there would be a civil liabilityin case of claims from the
victim of um they suffered thedamages, and then there will be
also a potential criminalliability if we are within the

(05:15):
perimeter of applicability ofthis criminal liability regime
against again both the companyand the individual, the company
would uh basically face anadditional fine.
In order to avoid that, it willhave to put in place what is
called a corporate criminalliability model.

(05:36):
In Italian, we call it 231model, uh, because of uh the law
231 that is the one introducingthe corporate criminality regime
that shifts away from thecompany the potential liability,
obviously, if it's properly putin place.

SPEAKER_01 (05:53):
And so, Giulio, what is the single most important
thing that a company should doright now?

SPEAKER_00 (05:57):
This is all happening uh during a period
where, with the digital omnibus,some of the deadlines of the UAI
Act were postponed.
These degrees will move forwardand probably will be adopted
before the coming into force ofsome relevant provisions of the
UAI Act.
Companies need to put in placean internal AI governance model

(06:20):
that is crucial in order to mapwhat uh your employees are doing
with the AI systems and makesure that the safeguards
provided by the UAI Act but alsoby the other types of
legislation applicable to thespecific AI solution are in
place in order to avoid any sortof liability.

(06:42):
There is no way of avoiding anypossible damage or risk, but the
companies need to prove to havedone what they were required to
do in order to avoid sanctions,to avoid civil liability, and to
avoid now also a potentialcriminal liability.

SPEAKER_01 (07:01):
So we can conclude that the AA Act is no longer a
distant Europe legislation.

SPEAKER_00 (07:06):
No, I mean uh we should be operating, we as
businesses, and uh that extendsalso to law firms.
We should be operating as if allthe obligations of the UAI Act
are already in place.
Because um the time windowavailable to businesses is very
short because it's not just aquestion of implementing a

(07:27):
policy that needs to change theDNA of a company, the way a
company is actually operating inrelation to a technology that is
evolving so quickly that uh noone basically can keep pace with
that.

SPEAKER_01 (07:42):
Thank you, Julio.

SPEAKER_00 (07:43):
Thank you, everyone.
Arrivedercies.