Italy will void dismissals decided by AI alone from 23 October

What changes on 23 October

Italy's second national decree under the EU AI Act takes effect on Friday, 23 October 2026. Legislative Decree no. 179 of 7 October 2026 was published in the Gazzetta Ufficiale on 8 October, and the official record gives 23 October as its date of entry into force. It runs to 54 articles and covers two areas: which Italian authorities enforce the EU's AI Regulation, and how AI is used in education and training.

The part that will reach the most people is a single article about jobs. Article 41 says that when an employer uses an AI system in decisions about a working relationship, the final decision on hiring, changing or ending that relationship, including disciplinary measures and performance ratings, cannot be taken solely on the basis of automated processing. A dismissal made in breach of the rule is void.

The decree also names the agencies that can inspect AI systems and fine companies, sets maximum penalties that mirror the EU regulation, creates a national AI regulatory sandbox, funds teacher training on social media and AI, and extends Italy's trade-secret law to the data and methods used to train AI models. The quotes in this article are AI Lookout translations of the Italian text.

Article 41: a person signs off on work decisions

Article 41 builds on article 11 of Italy's framework AI law, Law 132 of 2025, and on article 22 of the EU's General Data Protection Regulation, which already restricts decisions based solely on automated processing. The new text is more specific. "The final decision is in every case reserved to a natural person who exercises effective and autonomous power," it says. A manager who rubber-stamps a system's output would not seem to meet that test, although the decree does not define what effective and autonomous power looks like in practice.

Two details stand out. First, the worker's consent is not an exception. An employer cannot ask staff to agree to fully automated decisions and rely on that agreement. Second, the rule has a carve-out for recruitment. Searching for and screening candidates does not count as a final hiring decision, "even when it results in non-admission to the later stages of selection." In other words, an AI tool that filters out applicants before an interview is not covered by the ban, as long as a person makes the final hiring call.

Before any processing starts, the employer has to meet the information duties in article 1-bis of Legislative Decree 152 of 1997. That provision already requires employers to tell workers about automated decision or monitoring systems, including what they are for, how they work, the main parameters and data used to train them, and their accuracy and cybersecurity metrics, and to answer written requests within 30 days. Article 41 adds a right to an explanation. On request, and through a person rather than a chatbot, the worker can get "an intelligible statement of reasons" for the decision, including whether AI influenced it and the main parameters considered.

The sanction is strong by employment-law standards. Paragraph 4 says a dismissal issued in breach of the rule is null, and so are other decisions taken in breach of it. Under Italian labour law, a void dismissal generally means the employment relationship is treated as never having ended, though how courts apply that here remains to be seen.

Who polices AI in Italy

The first part of the decree finishes Italy's enforcement map for the AI Act. The agency for digital Italy, AgID, becomes the notifying authority, which assesses and supervises the bodies that certify high-risk AI systems. Article 5 names the national cybersecurity agency, ACN, as the market surveillance authority for AI systems, and ACN is also the single point of contact with the EU, according to a summary by Italian consultancy noze.

Sector regulators keep their own patch. The Bank of Italy is the authority for high-risk AI used in lending and other banking services, CONSOB for high-risk AI in investment services and IVASS for insurance. The data protection authority, the Garante, supervises within the limits set by article 74 of the AI Act, which covers areas such as law enforcement and border control.

That split matters for companies, because a bank using an AI credit-scoring model will answer to the Bank of Italy, while a software maker selling a general AI system will deal with ACN. It also follows a pattern seen elsewhere, where financial supervisors write AI expectations for the firms they already oversee, as the UK's Financial Conduct Authority and Hong Kong's monetary authority did this month.

Fines up to 35 million euros

Article 23 sets maximum administrative fines that track the EU regulation. Using an AI practice banned by article 5 of the AI Act can cost up to 35 million euros or, if higher, 7 per cent of worldwide annual turnover in the previous financial year. Breaching the obligations of providers, importers, distributors and deployers listed in the second paragraph, including the transparency duties in article 50 of the AI Act, can cost up to 15 million euros or 3 per cent.

Giving inaccurate, incomplete or misleading information to notified bodies or national authorities is capped at 7.5 million euros or 1 per cent, and breaches of the AI Act's articles 27 and 86, which deal with fundamental-rights impact assessments and the right to an explanation of individual decisions, at 1 million euros or 0.5 per cent. Small and medium-sized companies and innovative start-ups get the lower of the two amounts, as the EU regulation provides. Regulators must also weigh whether the breach was substantive or merely formal.

The fines apply "unless the act constitutes a crime", a reference to the criminal provisions in the first decree. That decree, no. 160 of 9 September 2026, covered police use of AI and biometrics and came into force on 30 September, according to noze.

Sandbox, schools and trade secrets

Article 26 sets up an Italian AI regulatory sandbox, as the AI Act requires every member state to do. AgID and ACN will run a controlled environment where providers can test AI systems under supervision, with priority for small businesses and start-ups. The rules for getting in are left to a later joint decree from the two agencies.

The education articles are the most concrete on money. Article 37 tells the Ministry of Education to start a teacher-training plan within 90 days, aimed at what the decree calls an educational emergency linked to excessive use of social media and of "relational environments based on artificial intelligence systems", a phrase that appears to cover companion chatbots. It is funded with up to 100 million euros from the national schools and skills programme for 2021 to 2027.

Finally, article 52 amends Italy's industrial property code so that, when the usual conditions for a trade secret are met, the data, algorithms and mathematical methods used to train AI systems count as trade secrets. The text spells out model architectures, optimisation functions, training procedures and configurations. That gives AI developers a clearer legal route against staff or rivals who take training recipes, at a time when copying of models is a live issue.

What employers have to do now

For employers with staff in Italy, the practical steps start now. A regulation brief published on 22 October advises confirming that managers have written instructions and that a named person takes and signs final decisions on hiring, discipline, dismissal and performance. The decree applies regardless of company size.

Companies that use AI scheduling, performance scoring or productivity tools should check whether any of those tools ever trigger a decision on their own, such as an automatic warning or contract change. If so, a person with real authority has to review and own the outcome. Employers also need a process for the new explanation requests, since a worker can ask why a decision was made and whether AI played a part, and the answer has to come from a human.

Recruiters get more room. Because screening is excluded, CV-ranking and interview-scheduling tools can keep running, but the information duties of decree 152 still apply, and so do the GDPR and the AI Act, which treats many hiring systems as high-risk. The European Commission is also stepping up its own supervision of the largest model makers.

What the decree leaves open

Several pieces still need follow-up rules. The sandbox needs its joint decree, teacher training needs criteria from the education minister within 90 days, and the registration of high-risk systems in critical infrastructure is left to ACN's procedures. Article 54 also says the authorities must do all of this with existing staff and budgets, apart from the school funding.

The biggest open question is how courts will read article 41. The decree does not say how much human review is enough, how an employer proves that a person had "effective and autonomous power", or how the screening exception applies when a system rejects most applicants before any human looks. The first void-dismissal claims will test those lines.

Italy has now written a nullity sanction for AI-made workplace decisions into national law, so employers, unions and other EU governments will have reason to watch the early cases. For data protection questions raised by AI, Italian and UK courts are already busy, as the Clearview AI appeal in London shows.