Italy's Legislative Decree 179 entered into force on 23 October 2026. It is the administrative half of Italy's AI Act transposition: it names the authorities, sets the fines, opens a national regulatory sandbox and adds AI-literacy and training duties. Most of it is machinery. Chapter III, on AI in training, the professions, work, health and the public administration, is not — because Article 41 attaches a remedy, not a guideline, to automated decisions at work.

A person has to make the call

Article 41(1) provides that where an employer uses AI systems in decision-making processes relating to the employment relationship, the final decisions — on the establishment, modification or termination of that relationship, including disciplinary measures and performance assessments — must not be adopted solely on the basis of automated processing. In the decree's words, the definitive decision "è in ogni caso riservata a una persona fisica, che eserciti un potere effettivo e autonomo": it is in any case reserved to a natural person exercising effective and autonomous power. Article 41 does not prohibit AI assistance itself; an employer may use scoring and ranking tools as support. What it removes is the option of letting the system make the final call.

Legal commentators read that wording as aimed at the rubber stamp: a manager who simply confirms whatever a scoring tool recommends, without weighing the case, is unlikely to satisfy a requirement of effective and autonomous power. That reading is the commentators', not the decree's own words, and the decree prescribes no universal checklist or review-log format for proving the point.

The consequence is set by Article 41(4): a dismissal imposed in violation of Article 41(1) is null and void ("il licenziamento intimato in violazione del comma 1 è nullo"), and the other decisions taken in violation of paragraph 1 are void as well. A worker's consent is not an exception to Article 41(1); the protection cannot be signed away.

Under Article 41(3), the worker also has the right, on request, to obtain — through the involvement of a natural person — an intelligible explanation of the decision affecting them: whether and how the AI system influenced the decision, and the main parameters considered. The employer must also have provided the advance notice required by Article 1-bis of Legislative Decree 152/1997 before the processing starts.

One boundary is deliberately narrow. Candidate search and selection activities are not final decisions on establishing the employment relationship, even where screening excludes a candidate from later stages of a selection. That early screening sits outside this final-decision prohibition; it remains governed by GDPR Article 22 and by anti-discrimination and privacy law.

Safety paperwork, and a separate criminal decree

Article 42 brings AI into workplace safety documentation. Employers must assess, as part of their Risk Assessment Document (Documento di Valutazione dei Rischi — DVR), the effects of AI systems that may affect work organization, the pace of work, the manner in which work is performed or decision-making processes relevant to occupational safety, and must inform and train workers on the specific risks.

A separate decree covers the criminal side. Legislative Decree 160/2026 took effect on 30 September, and its new Criminal Code Article 437-bis establishes offences involving omitted AI safety or human-oversight measures where the statutory danger conditions are met. The principal omission offence — failing to adopt the required technical security or human-oversight measures for high-risk systems, resulting in danger to life or public or individual safety — carries one to five years' imprisonment, rising to two to eight years where state security is endangered. An omission without that danger condition is not the offence Article 437-bis describes.

The enforcement machine, briefly

ACN, the National Cybersecurity Agency, is the market surveillance authority and the single point of contact. AgID, the Agency for Digital Italy, is the notifying authority, designating and monitoring the bodies that certify high-risk systems. Banca d'Italia, CONSOB, IVASS and the data protection authority (the Garante) keep supervision in their own sectors, coordinated through a dedicated committee. The decree also opens a national regulatory sandbox and promotes AI-literacy and training measures.

On penalties, Italy's decree adopts the AI Act's main penalty ceilings and adds a separate national band of up to €1 million or 0.5% of worldwide annual turnover for breaches of specified duties. Presented with their provenance, the four tiers in Article 23 of the decree are: up to €35 million or 7% of worldwide annual turnover for the prohibited practices in Article 5 of the AI Act; up to €15 million or 3% for breaches of the specified obligations; up to €7.5 million or 1% for supplying incorrect, incomplete or misleading information to notified bodies or authorities; and up to €1 million or 0.5% for breaches of specified duties including the AI Act Article 27 fundamental-rights impact assessment and Article 86 explanation obligations. That last band is Italy-specific — it is the decree's own Article 23 addition, not a general minimum and not a catch-all tier for deployers. For small and medium-sized enterprises and innovative start-ups, the decree applies the gentler AI Act criterion under which the lower of the fixed amount and the turnover percentage is used; that is a calibration, not an exemption.

Timing, and what it does not mean

The comparison date is precise. Regulation (EU) 2026/1744 set 2 December 2027 as the application date for the AI Act's Chapter III obligations for systems classified as high-risk under Article 6(2) and Annex III, the class that includes recruitment, promotion and dismissal tools. Decree 179 took effect on 23 October 2026 — more than 13 months earlier. That does not mean other European employment protections are suspended until 2027: GDPR Article 22 already applies across the EU today, and other member states may have their own national protections. What Italy has added, earlier, is a national nullity remedy on top of that floor.

For multinationals, the rule applies to staff in Italy regardless of where the HR software runs. The practical work, as compliance guidance rather than a court-tested formula, is unglamorous: inventory the tools that score, rank or monitor employees; name the actual decider for each covered decision type; and make sure employers can demonstrate that a person exercised meaningful independent judgment. Maintaining records of what the decision-maker considered may help support that position, although Article 41 does not prescribe a universal review-log format, and no record by itself guarantees how a court would rule.

Sources

  1. [1] Legislative Decree 179/2026, official text as published in Gazzetta Ufficiale no. 234 of 8 October 2026 and carried on Normattiva (Article 41 paragraphs 1, 3 and 4 and Article 23 read and quote-checked in the original Italian for this article); analysis: Mondaq, "AI Act — Italy's Implementing Legislation" (authorities, penalty tiers, Article 41, the DVR passage and Decree 160)Read source
  2. [2] Regulation (EU) 2026/1744 of 8 July 2026, EUR-Lex (the 2 December 2027 application date for the Chapter III obligations for AI systems classified as high-risk pursuant to Article 6(2) and Annex III)Read source
  3. [3] Mondaq, "Artificial Intelligence: Legislative Decree 160/2026 Enters Into Force On 30 September" (Criminal Code Article 437-bis, its danger conditions and the one-to-five and two-to-eight year penalty ranges)Read source
  4. [4] Noze, "Decree 179/2026: AI authorities, fines, work and training" (Gazzetta Ufficiale no. 234 of 8 October 2026; in force 23 October; Article 23's four penalty bands, including up to €1 million or 0.5% for the Article 27 and 86 obligations)Read source
  5. [5] Advant Nctm / MBG Legal, analysis of Decree 179 (the AgID notifying-authority and ACN market-surveillance and single-point-of-contact role split)Read source