AI Act

Training, sanctions and regulatory sandboxes: the latest Legislative Decree on AI comes into force tomorrow

The notifying and supervisory authorities have been designated. Decrees and resources are required to implement all the provisions

by Camilla Colombo

22 October 2026

Aggiungi Il Sole 24 Ore
ai preferiti su Google

Chat with AI or Artificial Intelligence technology. Man touching chatting virtual with an intelligent artificial intelligence asks for the answers he wants. Smart assistant futuristic, Chatbot, Supatman - stock.adobe.com

4' min read

Translated by AI

Versione italiana

4' min read

Translated by AI

Versione italiana

Rather than training aimed solely at students, university students and lecturers, a wide-ranging initiative on the informed use of artificial intelligence which includes compulsory continuing professional development for members of various professional bodies (with a consequent adjustment to fair remuneration), adult literacy through the Provincial Centres for Adult Education (CPIA), the use of AI in employment agencies and, last but not least, regulations governing employers’ decisions supported by AI systems, including them in the risk assessment document (DVR).

Legislative Decree 179/2026, which comes into force tomorrow, Friday 23 October, brings national legislation into line with the provisions of EU Regulation 2024/1689 (known as the AI Act) and establishes harmonised rules on artificial intelligence, concerning the powers of national authorities (in particular AgID and Acn) and the use of AI in education. As with Law 132/2025 on the integration of AI into the Italian regulatory framework, the guarantee of an anthropocentric perspective remains central.

However, the effective implementation of all the provisions set out in the legislative decree could prove problematic, essentially for three reasons: the subsequent decrees to be adopted, following the entry into force of Legislative Decree 179/2026; co-operation between the various supervisory authorities; and financial neutrality, that is, the absence of new resources.

Regulatory sandbox

In an innovative move, the Legislative Decree also addresses the establishment of an Italian regulatory sandbox. This is the regulatory sandbox , a controlled and supervised environment in which businesses, start-ups and developers can test AI systems prior to market launch, whilst collaborating with the relevant authorities in compliance with the European AI Act and Italian regulations. Section VI of Chapter II of the Legislative Decree, in Articles 26–31, sets out the objectives, scope and parties involved; it stipulates that the Agency for Digital Italia (AgID) and the National Cybersecurity Agency (ACN) shall, by means of a jointly adopted decree, establish a task force; and encourages cross-border collaboration with the Regions and in specific sectors, such as Defence, Justice and Fintech.

Supervisory authorities and sanctions

Sections II, III, IV and V of Chapter II of Legislative Decree 179/2026 clarify which authorities are competent in this matter and what the system of penalties to be applied is. Firstly, AgID is identified as the national notifying authority, responsible for establishing and implementing the procedures necessary for the assessment, designation and notification of conformity assessment bodies and for their monitoring. Alongside the European AI Office, the following are also designated as national market surveillance authorities:

ACN for AI systems;
Bank of Italy for high-risk AI systems used for the provision of loans, in collaboration with Consob and Ivass for matters falling within their remit;
The Data Protection Authority.

Plans are in place to set up a co-ordination committee, with the aim of sharing information and data and facilitating checks – hence the collaboration with the Gdf, the Carabinieri, the Police and the DIA – including at European level, as well as with universities to develop research projects.

With regard to sanctions, the framework stipulates that AgID is responsible for imposing administrative fines (the proceeds of which are allocated to AgID), but for breaches of the AI Act characterised by low severity or risk, an order may be issued to remedy the breaches and to refrain from repeating them; where the alleged infringement has ceased, a penalty may be imposed in the form of a public statement detailing the infringement committed and the party responsible.

In the event of non-compliance with the prohibition on certain practices, failure to fulfil obligations and/or the provision of inaccurate, incomplete or misleading information, the administrative fines vary:

up to 35,000,000 euros or, if higher, up to 7 per cent of the total annual worldwide turnover for the previous financial year;
up to €15,000,000 or, if higher, up to 3 per cent of the total annual worldwide turnover for the previous financial year;
up to €7,500,000 or, if higher, up to 1 per cent of the total annual worldwide turnover for the previous financial year;
up to €1,000,000 or, if higher, up to 0.5 per cent of the total annual worldwide turnover for the previous financial year.

Concessions for SMEs, including micro-enterprises, and innovative start-ups.

Training for students and professionals

The most substantial part of the latest Legislative Decree implementing the AI Act – Chapter III, Articles 36–51 – is devoted to the regulation of training, which is divided into numerous sub-sections. It begins with a call to launch courses to educate both secondary school and university students on the responsible use and risks of AI, to train teachers and lecturers (pending the decree from the Ministry of the Interior) and parents, through a process of literacy training (particularly in the financial sphere) that also involves adults via the CPIA centres. Article 37, dedicated to the educational emergency relating to the use of social media and artificial intelligence, is the only one funded with ad hoc resources: 100 million from the national programme ‘PN Scuola e Competenze 2021–2027’.

Articles 41 and 42 are the most important in terms of safeguards in the workplace and the need for training provided by companies: it is stipulated that workers must be aware of the role of AI in decisions affecting them and that none of these decisions may be delegated exclusively to artificial intelligence. Furthermore, the use of AI is now included within the range of potential risks and accidents in the workplace, for which both prevention and staff training are necessary. AI systems are, in fact, included in the risk assessment document (DVR).

Finally, the training of staff within the judicial administration and the requirement to organise continuing professional development courses for legal professionals (including the healthcare sector) to be organised in conjunction with the relevant professional bodies. In the professional sphere, particular attention is being paid to the reform of fair remuneration, but a decree on this matter is expected within 12 months of the entry into force of Legislative Decree 179/2026.

Industrial property

Last but not least, Articles 52 and 53 amend the Industrial Property Code, providing for the possibility of protecting, as trade secrets, data , algorithms and mathematical methods used for training artificial intelligence systems.