AI, final go-ahead from the Senate: it's law. Security, rights, investment: here are the changes

Italy has its artificial intelligence law. After a tortuous parliamentary journey (three readings in all), the bill that the Council of Ministers had passed in April 2024 has received the Senate's final green light.

The measure, which contains delegations to the government to be exercised by means of subsequent decrees but also provisions for immediate implementation, sets out a series of principles on research, experimentation, development, adoption and application of artificial intelligence systems and models. Within a year, the government will have to adopt one or more legislative decrees to bring Italian legislation into line with the European AI Act and to define an organic discipline on the use of data, algorithms and training of AI systems.

The Presidency of the Council, with the coordinating role of the Department for Digital Transformation, will draw up a National Strategy to be updated periodically. Meanwhile, the Agency for Digital Italy (Agid) and the Agency for National Cybersecurity (Acn) have been assigned the role of National Authorities, without prejudice to the specific competences of the Bank of Italy, Consob, Ivass and Agcom. It is precisely the decision to delegate two government agencies, instead of an independent Authority, that is among the points criticised by the opposition in Parliament.

Another aspect on which the government has been prodded is the lack of a real allocation of resources for companies engaged in the sector. In fact, the measure only contains a provision that authorises the use of a sum already available to Cdp Venture Capital, amounting to EUR 1 billion, for investment, in the form of equity and quasi-equity, in the risk capital of SMEs and large companies operating in the AI and cybersecurity sector, but also in quantum technologies and telecommunications.

The text consists of 28 articles. Chapter I summarises principles and aims, e.g. the use of AI while respecting privacy and the freedom of democratic debate. Chapter II goes into the sectoral provisions. In the field of health, the use of AI is permitted under certain conditions as support for diagnosis and treatment, but without prejudice to the final decision of doctors and in any case with the right of patients to be informed. In the field of work, the activation of a national observatory is envisaged with the aim of maximising benefits and minimising risks, and it is stipulated that it is mandatory for the principal or the employer himself to inform the worker of the use of AI. The same communication obligation exists on the part of professionals vis-à-vis the client. A number of articles deal with the implications for justice, starting with the addition to the Criminal Code of the offence of 'unlawful dissemination of content generated or manipulated with AI systems', punishable by one to five years 'if unjust damage results from the act'. The use of AI systems in an insidious manner will also be considered a common aggravating circumstance and will increase by one third the penalties in the cases of substitution of person, fraud, money laundering, self-laundering, and market rigging. Provision is also made for a delegation of powers to be exercised by the Ministry of Justice, inter alia, to provide for tools, including precautionary tools, in civil, administrative and criminal law to inhibit dissemination and to remove unlawfully generated content. As for use in judicial activity, it is stipulated that any decision on the interpretation and application of the law is always reserved to the magistrate.