Italy's latest approach to AI, privacy and cybersecurity - IAPP
Italy has passed two new laws to implement the EU AI Act and its data protection authority has fined an AI 'companion' app for privacy violations.
Italy has enacted two legislative decrees to integrate the EU AI Act into its legal framework.
Decree No. 160, adopted on 9 September, introduced criminal liability provisions for individuals and corporations.
Decree No. 179, adopted on 8 October and in force on 23 October, clarifies the roles and responsibilities of Italy's national AI supervisory authorities.
The Garante data protection authority has also continued its scrutiny of AI providers, acting on its remit over privacy-related infringements.
Fines for AI 'companion' app
The Garante concluded an ex officio investigation into Character Technologies, the U.S.-based provider of the generative AI service Character.AI.
The app, an AI 'companion' that allows users to engage in conversations with customizable characters, was found to have violated privacy rules.
The authority also addressed issues relating to minors' online protection in its decisions involving the app.
Operational compliance begins
On the cybersecurity front, 2026 marked the transition from legislative implementation to operational compliance and active supervision under the NIS2 Directive and Digital Operational Resilience Act.
Italy is distinguishing itself as one of Europe's most interventionist jurisdictions at the intersection of privacy, artificial intelligence and cybersecurity.
Related
