'Sophisticated' Italian AI Act Could Influence Others' Approaches, Attorneys Say

Italy's government and various authorities are empowered to flesh out the measure with legislative decrees, Squire Patton Boggs regulatory attorney Daniela Sabelli wrote in an Oct. 21 email to us.

For instance, the Agency for Digital Italy and the country's National Cybersecurity Agency are charged with developing criminal provisions for illegal AI use, Sabelli noted. In addition, they will supervise, inspect and enforce the law. One of the biggest challenges for companies, therefore, will be to put systems in place to comply with those secondary regulations.

Some provisions took effect Oct. 10 and are now enforceable, Sabelli said. For example, the act requires AI professionals to notify clients that they're using AI tools, and specify which ones, in the performance of their activities.

It's too soon to know if the current version of the measure could serve as a template for other EU countries, Sabelli told us. The picture will be more complete once various legislative decrees are issued. There have been no major implementation issues so far.

While the law "represents a sophisticated regulatory approach that complements rather than duplicates EU legislation," it's uncertain whether other countries will follow suit, Sabelli said.

However, Sabelli added, the decision of the Italian Parliament to delegate implementation of the law to multiple governmental bodies and authorities "should be positively evaluated as it provides for major flexibility" in regulating a constantly evolving sector.

The Italian law also ensures involvement of all relevant authorities, compared with the German draft bill, for example, which appears to exclude the country's DPA from implementing the EU AI Act, she said.

Italian lawmakers were "particularly focused" on data protection issues when AI is used. As such, they included principles and obligations that safeguard data used by and/or fed to AI-based systems, especially in the health care sector, Sabelli wrote in an analysis.

For Giulia Mariuz, a tech, media and communications lawyer at Hogan Lovells, Italy's AI law can't be read in isolation. For example, what will the Italian AI law's reach be, given European Commission intervention and guidance that has shaped how far Italy, and any other EU member, can go within the harmonized framework created by the AI Act? The Italian law's "provisions, and any implementing decrees, must be construed in conformity with the EU framework," she wrote in an Oct. 21 firm insight.

Italy "aims to set human‑centric guardrails around AI deployment, while encouraging innovation across the economy," Lewis Silkin technology attorney JJ Shaw said in a Sept. 25 analysis. It "offers a playbook (and some cautionary tales) for other countries, including the UK, as it calibrates its own path."

The Italian law also includes additional operational, sector-level duties and criminal offenses on top of the AI Act baseline, expanding Europe's layered regulatory matrix of regulations, directives and national laws, he noted.

U.K. regulators have historically advocated for a more flexible, "pro-innovation" approach, Shaw said, and the country is likely to continue its "wait and see" approach to AI regulation. Italy's move alone won't force the U.K. to pivot, "but a cascade of similar national measures across the EU will raise pressure on the UK to align to reduce friction, particularly around criminal sanctions and protections for minors."

The longer it takes the U.K. to set its stance on AI regulation, Shaw said, "the more likely it is that it will become a follower of one of the emerging approaches."