Italy's EU AI Act implementing decree enters into force, giving supervision to ACN and AgID

According to Cybersecurity360 on 23 October 2026, Italy's Legislative Decree No. 179/2026 was published in the Gazzetta Ufficiale on 8 October 2026 and entered into force on 23 October. It sets up Italy's supervision system for the EU AI Act, the inspection powers of the authorities and the procedures for penalties.

• The Agency for Digital Italy (AgID) becomes the notifying authority that designates and monitors conformity assessment bodies.
• The National Cybersecurity Agency (ACN) becomes the general market surveillance authority for AI systems and may carry out unannounced inspections of real-world testing.
• Banca d'Italia, Consob and IVASS are also involved in supervising high-risk systems used in their sectors, and the data protection authority Garante exercises the supervisory powers set out in Article 74(8) of the Act.
• Fines for prohibited practices can reach 35 million euros or 7 percent of global annual turnover; for low-severity violations, authorities may use non-monetary measures instead.

Why it matters

According to IAPP's analysis of 27 October, the decree completes the second stage of the two-stage plan laid down in Italy's national AI law, Law No. 132/2025. Cybersecurity360 points out that the decree does not make every obligation apply at once: the reference dates for high-risk systems are 2 December 2027 and 2 August 2028. Its recommendations include building an inventory of all AI systems in use, defining the company's role and the risk class for each system, and reviewing supplier contracts. These steps could also be useful for Turkish companies with customers in Italy or with AI-enabled products for the EU market.