Italian employers must adjust their workplace risk assessments once they deploy AI systems. According to the source BornCity, the rules introduced by Legislative Decree D.Lgs. 179/2026, in force since 23 October 2026, apply when AI systems affect work organisation, production rhythms, the way services are delivered or safety-relevant decision processes.
Background
According to BornCity, the decree operationalises the European legal framework of the EU AI Act in Italy. The market surveillance authority is, per the source, the cybersecurity agency ACN, while the digital agency AgID supervises the certification bodies. According to the source, existing competences of the Banca d'Italia, the securities regulator Consob, the insurance supervisor IVASS and the data protection authority Garante privacy remain in parallel.
Seven Duties for Employers
BornCity lists seven core obligations: first, maintaining an accurate inventory of deployed systems and determining the legal role as deployer or provider under Article 25. Second, purely automated procedures are not permitted for decisions concerning staff; a natural person with effective decision-making authority is required. Third, the risk assessment document (DVR) must be updated for occupational safety under Article 42. Fourth, the training obligation applies, which according to the source has been in force since 2 February 2025 under Article 4 of Regulation (EU) 2024/1689. Fifth, the internal organisational model under Decree 231 must be updated; sixth, supplier contracts must be reviewed; seventh, records must be stored in a legally compliant way.
For health professions and managers, the source says the requirements also provide for integrating AI training into mandatory continuing professional education (ECM); the relevant rules are to be set by April 2027.
Sanctions
BornCity reports that the regime provides for administrative sanctions of up to 35 million euros. According to the source, Legislative Decree D.Lgs. 160/2026, in force since 30 September 2026, supplements this by introducing Article 437-bis into the Italian Criminal Code, providing for prison sentences of one to five years. The source also says Article 25-vicies of Decree D.Lgs. 231/2001 sets corporate sanctions of 600 to 1,000 quotas for cases under Article 437-bis and 200 to 700 quotas for dissemination of unlawful AI content. The text was published, per the source, in the Gazzetta Ufficiale No. 234 of 8 October 2026.
Assessment
For German companies with Italian sites or staff, it may matter whether their AI deployments fall under the described criteria. Per the source, it remains open how future official inspections will work in practice, as their modalities are reserved for a ministerial decree (DPCM) still to be adopted.
Sources
Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.
