Guides · 2026-10-14

EU AI Act Italy Enforcement: D.lgs. 179/2026 Compliance Guide

By the Ingenious AI team

The EU AI Act's transparency rules have applied since 2 August 2026 — but on 23 October 2026, Italy becomes the first EU member state to switch on its own national enforcement machine. Legislative Decree 179/2026 names the enforcers, opens a regulatory sandbox, adds training duties, and stacks national sanctions on top of the EU's fines. If you publish AI-generated content or deploy AI systems for Italian audiences, this is the deadline that turns the AI Act from Brussels paperwork into a domestic inspection risk.

What D.lgs. 179/2026 actually is

Legislative Decree 179/2026 is Italy's national implementation of the EU AI Act. The AI Act is a regulation — it applies directly — but it leaves member states to designate their own market-surveillance authorities, notifying authorities, sandboxes, and penalty procedures. The decree fills those blanks for Italy: who inspects, who fines, how innovative systems get tested, and what training deployers owe their staff. It does not replace the AI Act's duties (Article 50's disclosure rules still come from Brussels); it decides who in Italy makes you follow them.

The two authorities you need to know

ACN — Agenzia per la Cybersicurezza Nazionale is the market surveillance authority and the single point of contact. In practice, that makes ACN the operational enforcer: the body that inspects AI systems on the Italian market and the front door for cross-border cooperation with other member states' regulators. AgID — Agenzia per l'Italia Digitale is the notifying authority: it notifies and assesses the conformity-assessment bodies that certify high-risk AI systems. If something goes wrong with an AI deployment in Italy, ACN is the name on the letter; if you certify a high-risk system, AgID is the name on the process.

What changes for publishers and marketers

Article 50's core duty — mark AI-generated content in a machine-readable format and disclose it visibly at first exposure — already applies. The Italian layer adds a practical sting: disclosure must be understandable to the recipient. An English-only "AI-generated" badge on content served to Italian audiences is a weak answer to an ACN inspector. The defensible posture is Italian-language disclosure — badge and caption in Italian, placed where it cannot be cropped out or buried — plus machine-readable provenance (C2PA manifest or XMP/EXIF generation metadata) that survives your publish pipeline.

The sanction stack: administrative plus criminal

Italy layers three levels. First, the EU AI Act's own ceilings, which the decree's enforcers apply: up to €15 million or 3% of worldwide annual turnover for transparency breaches (Article 50), and up to €35 million or 7% for prohibited practices. Second, national administrative sanctions under the decree itself. Third — and this is what makes Italy the strictest national regime in the EU — criminal sanctions under Legge 132/2025 (Articles 2–7) for the most serious AI misuse, including AI-generated non-consensual intimate imagery and related harms. Criminal penalties are imposed by the court on the facts of the case; there is no formula, and any exposure at that level means involving criminal counsel immediately.

The regulatory sandbox

The decree opens a national regulatory sandbox: a supervised space where providers can test innovative AI systems before full market deployment, under the authority's watch and with defined safeguards. Sandboxes admit genuine innovation with a written testing plan — objectives, duration, affected persons, risk controls, human oversight, and an exit plan for market deployment — not routine software. If you are building a novel AI system for the Italian market, assessing sandbox eligibility before launch is now part of a serious compliance file.

Training duties

The decree includes an AI-literacy training chapter aimed at deployers: staff who operate AI systems need documented training covering what the systems do and what the disclosure duties require. For marketing teams and agencies, this is the paper trail that proves the intern who published the unlabeled AI ad was trained not to — or the missing paper trail, if they weren't.

The Italy compliance checklist

A defensible Italy posture, in order:

1. Italian-language disclosure on every AI-generated asset served to Italian audiences — badge plus caption, at first exposure.
2. Machine-readable marking embedded at export (C2PA where tooling supports it, XMP/EXIF at minimum) and verified after publishing.
3. Per-asset evidence records — what was generated, which disclosure was applied, where it was published. ACN asks for evidence, not intentions.
4. ACN/AgID in the incident runbook — name the market surveillance authority and single point of contact before you need them.
5. Documented team training on AI disclosure duties.
6. Sandbox assessment for new high-impact AI systems before deployment.

Bottom line

23 October 2026 is the day the EU AI Act gets an Italian enforcement address. The duties themselves — disclose visibly, mark for machines, keep records — are the same operational discipline Article 50 already demanded; what changes is that a domestic authority with a sandbox, a training chapter, and a criminal statute is now watching. Teams that arrive with Italian-language labels, intact provenance, and an evidence dossier get a conversation. Teams that arrive with nothing get a file. DisclosureGuard's Italy Enforcement Pack automates the evidence side — Italian disclosure templates, ACN/AgID references, sanction-exposure math, and an exportable auditor-shaped dossier — but the duty itself is yours. Confirm your obligations with legal counsel.

Frequently asked questions

Informational explainer, not legal advice. Check a specific asset against the current rules with a free DisclosureGuard scan.

← All guides