That burden of rules on the shoulders of scientific research

The Italian law on artificial intelligence, which is now close to final approval (C.2316- approved in the Senate on 20 March 2025 and now being examined by the Chamber of Deputies), makes an important opening on scientific research carried out in healthcare with artificial intelligence. The processing of personal and health data for research purposes, with artificial intelligence, is legitimised by the public interest, which is based on the constitutional principles protecting research and health referred to in the same provision (Art. 8). Therefore, to the most commonly used legal basis, that of the consent of the person concerned, and to the other legal bases constituted by the rules governing research projects, which are sometimes invoked, as well as Article 110 bis of the Privacy Code, which dictates a more open discipline for projects of which the Irccs are promoters, a further relevant assumption of legitimacy is added: that of the public interest. In a nutshell, personal data may be processed in the context of health research because a public interest is thereby realised.

The rule applies to research projects managed by public entities, by IRCCSs, and also by private entities together with IRCCSs.

While one can only applaud this important legislative innovation, which finally recognises the importance of scientific research in healthcare and relieves the regulatory burden, consisting mainly of so-called paper compliance, from the shoulders of our researchers, and makes the country more competitive, precisely on scientific research in healthcare, on the other hand, if one widens one's gaze, the need for simplification appears more evident and increasingly pressing.

In fact, one only has to go to the next article of the same law and it becomes apparent that a prima facie overlapping case is being regulated. It regulates, once again, the processing of personal and health data for research purposes with artificial intelligence. But the tangle of norms seems to unravel if one considers that the new provision actually concerns the so-called 'sandboxes', i.e. the regulatory and normative spaces for experimentation.

Italy has rightly seized the opportunity offered by the AI Act to establish these special spaces, which for general AI applications will be set up and managed by AgID and ACN, each within their respective competences. For sandboxes in the health field, with research purposes, managed with AI, specific rules will be dictated by the Ministry of Health, after consulting, of course, the Privacy Guarantor and the parties most directly concerned.