Italy's AI decree: what already applies

Italy's AI decree has been in force since 23 October, and the part that already applies is getting the least attention.

The deadline that moved, and the one that didn't

The EU AI Act's high-risk deadlines have moved to December 2027 and August 2028, so it is tempting to file all of this under next year. That would be a mistake. Legislative Decree 179/2026 does not wait. Some of its obligations are live today, and they sit in one of the most sensitive areas any organisation manages: decisions about people's jobs.

What already applies: a person must decide

The core rule is simple to state and harder to live with:

• A dismissal or other final employment decision can no longer rest solely on automated processing.
• A person with real, autonomous authority has to make the decision. A reviewer who simply clicks "approve" on a system's output does not meet that bar.
• Worker consent does not change this. You cannot contract your way around it.
• A decision that breaks the rule is void.
• Automated CV screening is the one carve-out.

The practical consequence is that "human in the loop" stops being a design aspiration and becomes something you may have to demonstrate after the fact. If a decision is challenged, the question will not be whether a person was nominally involved, but whether that person genuinely had the authority, the information and the independence to decide differently.

Who supervises

The decree also settles a question many organisations had been waiting on: who is in charge.

• ACN (the national cybersecurity agency) for market surveillance.
• AgID as notifying authority.
• Banca d'Italia, Consob and IVASS for their own sectors.

For regulated businesses this means AI governance will be read alongside existing supervisory relationships, not in a separate silo.

My practical advice: start with an inventory

It is unglamorous, but it works. List every AI system you use, including the features that arrived quietly inside your HR, CRM and productivity platforms. Many organisations are surprised by how much automated scoring, ranking or recommendation already sits inside tools they bought for other reasons.

Then ask one question of each system:

Where does a person actually decide, and could we prove it?

Proving it usually means a few concrete things:

• A named role with the authority to override the system.
• A record of what the system suggested and what the person decided.
• Enough information for that person to understand the suggestion, not just accept it.
• A process that is written down, known and followed.

The real risk is the process

In my experience the tool is rarely what gets you into trouble. The undocumented process around it is. An inventory, clear decision points and a simple evidence trail put you in a far stronger position, both for this decree today and for the AI Act obligations that follow. The same groundwork also supports a management system approach such as ISO/IEC 42001.

Has your organisation mapped where AI touches employment decisions yet? If you would like help building that inventory, see my AI governance consulting service or get in touch.

Sources: noze (Decree 179/2026); regulations.ai (decree summary, Art. 41 etc.); Informazione Fiscale, 23 October; IAPP, 27 October; Cyber Security 360, 23 October; White & Case (AI Omnibus dates). This article is general information, not legal advice.