Italy adds criminal AI penalties

Italy’s government moved on June 10 to add national enforcement and criminal-law provisions to Europe’s artificial intelligence rulebook, approving two draft implementing decrees under Italy’s 2025 AI law. The package sits alongside the EU AI Act rather than replacing it, but it goes further in some areas by setting out Italian authorities, sanctions, policing rules, and civil and criminal liability. The decrees were approved only at a preliminary stage, meaning the text can still change before final adoption and publication. For companies operating in Europe, the immediate effect is a compliance picture that now runs on two tracks: EU-wide obligations already taking effect, and country-level rules that can add enforcement risk. ### What exactly did Italy approve? The Italian Council of Ministers approved two draft legislative decrees on June 10, 2026, according to legal analyses of the government action. One draft covers national authorities, supervision, sanctions, testing environments, training, and employment-related provisions. The second covers the use of AI in policing and adds rules on civil and criminal liability. The drafts were issued under Law No. 132/2025, which Italy adopted on September 23, 2025 and which entered into force on October 10, 2025. (technologyslegaledge.com) Law No. 132/2025 was designed to complement Regulation (EU) 2024/1689, the EU AI Act, not to create a separate regime, Norton Rose Fulbright and Technology’s Legal Edge said. The Italian framework already included sector rules for work, healthcare and research, and delegated further implementing powers to the government. (technologyslegaledge.com) ### Where do the criminal penalties come in? The June 10 draft on policing and liability introduces civil and criminal provisions tied to AI use, according to Technology’s Legal Edge. The same analysis said the draft also addresses access to evidence, a presumption of causation in some civil-liability settings, and possible implications for companies’ compliance models under Italy’s corporate liability framework. (nortonrosefulbright.com) Italy’s broader 2025 AI law had already moved into criminal-law territory. Regulatory summaries say the national regime introduced specific penal-code provisions targeting some AI-enabled harms, including the illicit dissemination of AI-generated or altered content that causes unjust damage. ### Why are hiring, credit, insurance and biometrics getting so much attention? (technologyslegaledge.com) Italy’s 2025 law imposed workplace transparency duties on employers using AI in work processes, including obligations to inform workers and disclose the logic, purpose, data, parameters, accuracy metrics, cybersecurity measures, human oversight and impact assessments tied to those systems, Norton Rose Fulbright said. That makes documentation central for any company using AI in employment decisions. (regulations.ai) The June 10 draft decrees also identify sector authorities beyond Italy’s general AI supervisors. Technology’s Legal Edge said the Bank of Italy, CONSOB and IVASS remain competent authorities in banking, finance and insurance, while the Data Protection Authority keeps its role within its remit. The same draft highlights biometrics and facial recognition in policing as a specifically regulated area. (nortonrosefulbright.com) At EU level, high-risk systems already carry documentation, logging, transparency and human-oversight duties. The European Commission’s summary of the AI Act says high-risk systems must assess and reduce risks, maintain logs, be transparent and accurate, and allow complaints and explanations where rights are affected. ### What changed on August 2 under the EU AI Act? (technologyslegaledge.com) The European Commission said Article 50 transparency obligations started applying on August 2, 2026. Those rules require disclosures in four cases, including when people interact with AI, when they are exposed to deepfakes, and when AI-generated text on matters of public interest is published without human review or editorial control. (programmagoverno.gov.it) The Commission said providers must apply a machine-readable mark to synthetic image, video and audio content generated or manipulated by AI so it can be detected, while deployers must use clear labels for deepfakes. The penalties can reach €15 million or 3% of total worldwide annual turnover for companies. A grace period runs until December 2026 for marking obligations on generative AI systems placed on the market before August 2, 2026. (digital-strategy.ec.europa.eu) ### What should companies watch next? The draft decrees still have to complete Italy’s legislative procedure before final approval and publication in the Official Gazette, and the texts may still be amended, Technology’s Legal Edge said. That means companies face one set of rules that is already live at EU level and another that is still moving through Rome. (digital-strategy.ec.europa.eu) August 2, 2026 is already the operative date for Article 50 transparency duties across the EU, while Italy’s national measures will matter once the government finalizes the decrees under Law No. 132/2025. Firms with AI systems in employment, finance, insurance, biometrics and public-facing content will be watching the final Italian text and the Official Gazette publication for the next binding step. (digital-strategy.ec.europa.eu) (technologyslegaledge.com)