Italy has become the first EU member state to pass comprehensive artificial intelligence legislation, with Bill 1146/2024 receiving Senate approval in 2025. This pioneering law establishes criminal penalties, child protection measures, and a complex regulatory framework that both complements and challenges the EU AI Act, positioning Italy at the forefront of global AI governance while raising significant questions about implementation and market harmonization.

Criminal penalties signal enforcement teeth

The Italian law introduces unprecedented criminal penalties for AI misuse, with prison sentences of 1-5 years for unlawfully distributing harmful AI-generated content, particularly deepfakes that cause unjust harm. When AI facilitates traditional crimes like fraud, identity theft, or money laundering, penalties increase by up to one-third as an aggravating circumstance. This personal dimension resonates with Prime Minister Giorgia Meloni, who experienced being a deepfake victim herself and is pursuing €100,000 in damages from perpetrators who created pornographic deepfakes using her image.

The law mandates parental consent for children under 14 to access AI services, establishing enhanced privacy protections specifically for minors. Age verification mechanisms are now required from all AI service providers operating in Italy. For copyright protection, the law extends protections to AI-generated works that demonstrate “genuine human intellectual effort” and creative genius, while restricting text and data mining for AI training to non-copyrighted content or authorized scientific research. Workplace transparency requirements mandate that employers disclose AI system deployment to workers, with an Observatory created within the Ministry of Labor to monitor adoption patterns.

Sector-specific regulations maintain human primacy across critical domains. In healthcare, medical professionals retain final decision-making authority for prevention, diagnosis, and treatment choices, with mandatory patient notification about AI system use. The education sector requires human oversight and traceability for all AI decisions in schools. In the justice system, judges preserve sole authority for legal rulings, with rapid takedown powers for illicit AI-generated material.

Dual-authority enforcement structure raises independence concerns

Italy’s enforcement framework centers on two government agencies rather than independent regulators, a structure that has drawn sharp criticism from the European Commission. The Agency for Digital Italy (AgID) serves as the national notifying authority, managing conformity assessments and promoting AI innovation across public and private sectors. Meanwhile, the National Cybersecurity Agency (ACN) acts as the primary supervisory authority with inspection powers, monitoring system adequacy and security throughout the AI lifecycle.

The European Commission’s formal opinion (C(2024) 7814) raised substantial concerns about this governance structure, noting that AgID and ACN are governmental rather than independent authorities, potentially conflicting with EU requirements for data protection authority-level independence. The Commission warned against creating unnecessary restrictions on non-high-risk AI systems and highlighted risks of market fragmentation within the EU single market. Despite these criticisms, Italy maintained its government agency structure while making some adjustments to align definitions with the EU AI Act.

Enforcement mechanisms demonstrate Italy’s willingness to act decisively. The country has already imposed a €15 million fine on OpenAI (currently under appeal), temporarily suspended ChatGPT in 2023, and banned DeepSeek in January 2025 for privacy and security concerns. Administrative sanctions can reach €35 million or 7% of annual global turnover for serious violations, following the EU AI Act framework.

The €1 billion fund predates the AI law

Contrary to initial impressions, the €1 billion venture capital fund existed before the AI law as part of CDP Venture Capital’s 2024-2028 Industrial Plan. The fund comprises €500 million dedicated to an “Artificial Intelligence Fund” led by Vincenzo Di Nicola, with an additional €500 million for co-investments in AI-related applications. The AI law itself adds only €300,000 per year for 2025-2026 for experimental AI projects at the Ministry of Foreign Affairs.

CDP Venture Capital SGR, 70% owned by Cassa Depositi e Prestiti (which itself is 70% owned by Italy’s Ministry of Economy and Finance), administers the fund. The investment focuses on seven strategic sectors including AI and cybersecurity, agrifoodtech, spacetech, and healthcare. Eligible companies must be Italian limited liability companies established for no more than 60 months, dedicating at least 15% of expenditure to R&D activities or meeting specific team composition requirements. The fund aims to attract €1 billion from private investors by 2028, though critics argue this amount remains insufficient compared to US and Chinese investments.

Complex alignment with EU framework creates regulatory tensions

Italy’s law represents both alignment with and divergence from the EU AI Act, creating a complex regulatory landscape. While both frameworks employ risk-based approaches, mandate human oversight, and ban discriminatory applications, Italy adds unique provisions including parental consent requirements for minors under 14, specific criminal penalties for deepfakes, and enhanced copyright protections requiring human intellectual effort for AI-generated works.

Compared to other European countries, Italy stands alone in passing comprehensive legislation. France and Germany focused on influencing EU AI Act negotiations rather than creating national laws, with France leading resistance to strict foundation model regulations. Spain created Europe’s first AI supervisory agency but hasn’t passed comprehensive legislation. The UK, post-Brexit, explicitly rejected comprehensive AI legislation in favor of a sectoral approach with context-specific guidance.

International comparisons reveal Italy’s distinctive position. The United States maintains a distributed, multi-stakeholder approach without comprehensive federal legislation, relying instead on existing agency authority and a growing patchwork of state laws. China employs a centralized, state-led model with pre-approval requirements and strict content controls. Italy’s approach occupies a middle ground: more comprehensive than the US distributed model, more democratic than China’s centralized approach, and more assertive than the UK’s flexible framework.

Industry pushback highlights implementation challenges

Italian tech industry associations have launched strong opposition to the law’s implementation timeline. Anitec-Assinform initiated a “stop the clock” campaign calling for a 2-year delay, citing unprecedented compliance requirements without sufficient adaptation time. Technical standards aren’t expected until early 2026, creating an implementation gap that could isolate Italy with provisions more detailed than EU AI Act requirements. Association President Massimo Dal Checco warned that without gradualism, European competitiveness risks being hindered during a critical AI development phase.

Major tech companies have responded with varying degrees of criticism. Meta refused to sign the EU AI Pact, citing “unworkable and technically unfeasible requirements,” while facing investigation by Italian authorities for potential market dominance abuse. Google and Amazon signed the EU AI Pact but warned against over-regulation that could delay product rollouts. Microsoft has been more cooperative, participating in major AI infrastructure investments in Italy including a €4.3 billion commitment over two years.

Civil society organizations express significant concerns about the governance structure. Digital rights advocates heavily criticized placing AI control directly in government hands rather than with independent regulators, raising democratic concerns about sensitive technology oversight. Academic experts provide measured analysis, with Italy’s AI Strategy Committee of 14 experts generally supporting the human-centric approach while acknowledging compliance complexity beyond EU requirements.

The “Italian way” reflects Meloni’s sovereignty agenda

Prime Minister Giorgia Meloni has positioned the law as establishing an “Italian way” to AI governance, balancing technological innovation with cultural heritage and humanistic values. This anthropocentric approach places humans at the center of AI decision-making while emphasizing ethical frameworks that focus on people’s rights and needs. The legislation directly supports Meloni’s technology sovereignty agenda by reducing dependence on foreign AI systems, establishing national authorities under government control, and supporting domestic industry through the €1 billion fund.

The parliamentary vote of 77-55 with 2 abstentions indicates significant but not unanimous support. Opposition parties criticized the law as a “missed opportunity” with insufficient funding. Democratic Party member Anna Ascani called it a “no-cost measure” that doesn’t prioritize AI development. The broader political motivation includes positioning Italy as a European leader while appealing to security-conscious voters through strong criminal penalties.

The legislation integrates with Italy’s broader digital transformation strategy, including development of Italian-language AI models through the Minerva project and collaboration with NVIDIA on local AI capabilities. During Italy’s 2024 G7 presidency, AI’s impact on jobs and inequality became a focal point, promoting shared governance frameworks for AI development.

Critical gaps limit the law’s potential impact

Despite its comprehensive scope, the law contains significant gaps that may limit effectiveness. The lack of independent regulatory oversight remains the most criticized aspect, with government agencies rather than independent regulators controlling AI governance. The €1 billion investment fund faces widespread criticism as inadequate compared to international competitors, with opposition parties and industry associations arguing for greater financial commitment.

Technical implementation gaps include unclear definitions of “critical data” requirements, creating compliance uncertainty for businesses. The law provides minimal provisions for international AI governance coordination beyond EU alignment. Questions remain about practical enforcement capabilities of designated authorities, while the potential for disproportionate compliance costs on small and medium enterprises raises competitiveness concerns.

The government has 12 months to adopt implementing decrees aligning national law with the EU AI Act. The Department for Digital Transformation must create a comprehensive national AI strategy subject to periodic revision. Health ministers must issue decrees within 4 months regarding personal data processing for AI research, while specialized AI platforms led by AGENAS will be developed for digital health.

Business implications demand strategic compliance planning

For businesses operating in Italy, the law creates extensive compliance requirements including mandatory human oversight, comprehensive technical documentation, and regular risk assessments. Companies must maintain proof of adherence to all principles with documented evidence, establish appropriate policies, and ensure regular monitoring and updates of AI systems. Sector-specific requirements add complexity, with healthcare maintaining medical professional authority, workplaces requiring employee disclosure, and professional services restricting AI to support activities only.

Small and medium enterprises face disproportionately higher compliance costs relative to revenue, with limited resources for comprehensive documentation and specialized expertise. Multinational corporations must navigate dual compliance frameworks while potentially gaining competitive advantage through early compliance investment. Foreign companies serving Italian customers fall under the law’s broad territorial application, requiring equal compliance with domestic companies and possible local representation.

The implementation timeline provides a 12-month period for government decree issuance, with phased compliance aligned to the EU AI Act timeline through 2027. Direct compliance costs include legal consultation, technical documentation, system auditing, and staff training. Companies should budget for significant expenses given the regulatory complexity, with immediate actions including compliance assessment, legal consultation, and risk mapping.

Conclusion

Italy’s comprehensive AI law represents a bold experiment in national AI governance within the EU framework, establishing unprecedented criminal penalties, child protection measures, and sector-specific regulations while creating significant tensions with European harmonization efforts. The law successfully positions Italy as a regulatory pioneer and reflects the Meloni government’s technology sovereignty agenda, yet faces substantial criticism regarding funding adequacy, regulatory independence, and implementation feasibility.

The enforcement framework’s reliance on government agencies rather than independent regulators, combined with the European Commission’s formal criticisms, suggests ongoing regulatory tensions that could complicate market harmonization. Industry opposition to implementation timelines and compliance costs indicates potential challenges ahead, particularly for smaller enterprises struggling with the dual burden of EU and Italian requirements. The €1 billion investment fund, while substantial, appears insufficient when compared to global AI investments, potentially limiting Italy’s competitiveness despite its regulatory leadership.

Success will ultimately depend on how effectively Italy balances its sovereignty aspirations with practical implementation challenges, whether the government can address identified gaps through implementing decrees, and how businesses adapt to this complex but potentially advantageous regulatory environment. As the first EU member state to pass comprehensive AI legislation, Italy serves as a crucial test case for national AI governance, with implications extending far beyond its borders to influence the future of European and potentially global AI regulation.