AI, governance, training and employment: the main new provisions of Legislative Decree no. 179/2026

by Beatrice Mordonini

On 23 October, Legislative Decree No. 179/2026 (the “Decree”), the second implementing decree of the Italian Artificial Intelligence Law (Law No. 132/2025), will enter into force. The Decree forms part of the national regulatory framework on AI, together with Legislative Decree No. 160/2026, which governs the use of AI by law enforcement authorities and lays down provisions on criminal and civil liability (for further details, please refer to our previous article, “AI and Corporate Liability: What Changes under Legislative Decree No. 160/2026”).

At first glance, the Decree may appear to focus primarily on defining the powers of the national Authorities and promoting AI-related training in the fields of education, regulated professions, Public Administration and the justice system. In fact, the Decree also contains several provisions of immediate relevance to businesses.

In addition to completing the national framework for coordination with the AI Act, the Decree introduces specific provisions on the use of AI in employment relationships, links the use of AI systems to occupational health and safety obligations, and establishes the Italian AI Regulatory Sandbox (the so-called AI sandbox), within which AI systems may be tested in a controlled environment in accordance with predetermined conditions and criteria and under the supervision of AgID and ACN.

But what, in practical terms, are the main aspects of the Decree that are relevant to businesses?

Governance

The Decree defines the national AI governance framework. In this context, the Agency for Digital Italy (“AgID”) is designated as the notifying authority. It is therefore responsible for establishing and carrying out the procedures necessary for the assessment, designation, notification and monitoring of conformity assessment bodies, i.e. the independent accredited bodies provided for under the AI Act to verify that high-risk AI systems comply with the safety and transparency requirements laid down by law.

The National Cybersecurity Agency (“ACN”), on the other hand, is entrusted with the role of national market surveillance authority for AI systems and the national single point of contact.

Alongside AgID and ACN, the Decree assigns specific responsibilities to the Bank of Italy, CONSOB and IVASS with regard to high-risk AI systems used in their respective supervised sectors, as well as to the Italian Data Protection Authority with regard to matters falling within its remit.

The legislator’s approach reflects a supervisory model based on the sector-specific expertise of the Authorities involved. For this very reason, the Decree provides for agreements, memoranda of understanding and other forms of cooperation aimed at ensuring coordination among the various competent Authorities.

The Decree also strengthens the Authorities’ inspection powers: AgID may conduct both periodic and extraordinary audits and inspections, as well as initiate proceedings concerning the restriction, suspension or withdrawal of the designation of notified bodies. ACN, in turn, may carry out checks on testing conducted under real-world conditions and conduct unannounced inspections.

Lastly, the Decree provides for administrative fines in line with Article 99 of the AI Act, of up to EUR 35 million or 7% of annual worldwide turnover (for infringements of the prohibition of prohibited AI practices), as well as non-pecuniary corrective measures for infringements characterised by a low degree of harmfulness or risk.

Employment, HR, health and safety

One of the provisions with the greatest practical impact concerns the use of AI in employment relationships. The Decree confirms a principle that is set to have a direct impact on HR processes: AI may support decision-making, but it may not replace human responsibility for decisions that have an impact on employees.

In particular, the Decree provides that final decisions concerning the establishment, modification or termination of an employment relationship, including performance assessments and the adoption of disciplinary measures, may not be made solely on the basis of automated processing. The final decision must be entrusted to a natural person, and the employee’s consent may not constitute an exception to this prohibition. However, candidate search and selection activities are excluded from this provision, including where they result in a candidate not being admitted to subsequent stages of the selection process.

Employers are also required to inform employees about the use of such AI systems. Decisions adopted in breach of these provisions, as well as any resulting dismissals, are expressly deemed null and void under the Decree.

The Decree also addresses occupational health and safety, linking the use of AI to the obligations laid down in the Consolidated Act on Occupational Health and Safety (Legislative Decree No. 81/2008). AI systems that may affect work organisation, production rates, the manner in which work is performed or decision-making processes relevant to safety must be taken into account as part of the company’s risk assessment. Employers are also required to ensure that employees receive appropriate information and training.

These provisions are particularly relevant for organisations introducing AI tools into recruitment, performance assessment, work organisation or personnel management processes. Indeed, this requires not only assessing compliance with the AI Act, but also considering the impact of such systems on existing employment law and occupational health and safety obligations under Italian law.

Protection of business information

The data, algorithms and mathematical methods used to train AI systems may also be particularly relevant from the perspective of protecting business information. The Decree confirms that, where the relevant requirements are met, data, algorithms and mathematical methods used for training may benefit from the protections afforded to confidential business information and know-how.

This provision is particularly significant in a context where competitive value is increasingly linked to the data, methodologies and technical knowledge used in developing AI solutions. For businesses, this highlights the importance of properly identifying strategic information assets and adopting appropriate measures to ensure their confidentiality and protection.

Conclusions and practical considerations

The Decree contains several elements that businesses should begin considering immediately.

On the one hand, the designation of the competent Authorities and the strengthening of their inspection powers make the AI Act enforcement framework in Italy more concrete. On the other hand, the new rules governing the use of AI in employment relationships, together with the link to occupational health and safety obligations, confirm that the adoption of AI systems cannot be regarded as an exclusively technological matter.

For many businesses, the Decree therefore represents a further indication of the need to address AI governance on a cross-functional basis, involving not only IT functions, but also HR, compliance, privacy, cybersecurity and occupational health and safety functions.

In practical terms, also in view of the Decree’s forthcoming entry into force, it may be appropriate to assess:

  • which AI systems are already being used in business processes;
  • whether such systems affect HR processes or work organisation;
  • whether their use should be taken into account as part of the company’s risk assessment;
  • whether internal policies or procedures are in place governing the use of AI and human oversight of decisions supported by such systems and, if not, to adopt them;
  • whether the organisation has adequate governance safeguards in place in view of the full application of the AI Act.