Since October 23, 2026, Italy has one more decree on artificial intelligence. It is Legislative Decree no. 179 of October 7, 2026, published in the Gazzetta Ufficiale no. 234 of October 8, and it spells out how Italy applies the EU AI Act: who checks, who fines, how testing works. If you run a small business and use AI to write quotes or sort emails, you probably have one question in mind: "should I worry?". Short answer: you should know about it, and you can leave the panic at home.
What happened, in short?
The decree took effect on October 23, 2026 (official text on Normattiva, in Italian). According to ai4business, it leaves the EU AI Act application dates as they are: the framework stays the one in the regulation, and the decree organizes how it is carried out in Italy.
The text names two national AI authorities, AgID and ACN (the National Cybersecurity Agency). In detail:
- ACN supervises the market for AI systems and is the single point of contact with EU institutions;
- AgID is the notifying authority, the one that deals with the bodies that assess conformity;
- Banca d'Italia, Consob and IVASS keep their powers in their own sectors;
- the data protection authority (Garante) steps in where the regulation provides for it.
There is also the "Italian AI sandbox", a controlled environment run jointly by AgID and ACN where developers can test systems before launch. Access criteria will come through later measures.
What fines does the decree set?
The figures are the ones that have been circulating for months, restated in Article 23. Up to 35 million euros or 7% of worldwide annual turnover for prohibited practices. Up to 15 million or 3% for breaching a list of articles of the regulation. Up to 7.5 million or 1% for inaccurate or misleading information given to authorities. Up to 1 million or 0.5% for two other specific breaches.
Read by a shop with three employees, these numbers look like a lottery jackpot nobody wants to win. They are maximum ceilings, meant for the most serious cases. For SMEs and micro-enterprises the decree refers to Article 99(6) of the EU regulation. For minor breaches, Article 22 allows the authority to order the company to stop or to issue a public statement instead of a fine.
What changes if you use AI to decide about people?
According to Noze's analysis, Article 41 says the final decision on hiring, changes of duties, dismissals, disciplinary measures and performance reviews cannot rest on automated processing alone. A real person with effective, independent power to decide is required. The same analysis says the first screening of CVs does not count as a final decision.
Hypothetical example: a consulting firm uses a tool that scores job applications. As a help to sort a hundred CVs, it can be fine. When it comes to deciding who gets an interview and then who gets hired, a flesh-and-blood person has to be able to explain why. "The software told me" is not an explanation, it is an alibi. The text of Article 41 should be read in the Gazzetta Ufficiale before applying it to your case.
What should you do this week?
- List the AI tools used in the company, including the ones a colleague "tried once" and left connected to the company credit card.
- Next to each one, write what it is for and what data goes into it: customer names, contracts, payslips, quotes.
- Where AI touches people (candidates, employees, customers), note who actually makes the final decision.
- Check that the people using these tools know what they can and cannot paste into a chat. Article 4 of the AI Act asks for a sufficient level of AI literacy: we cover it in the guide AI Literacy: What It Is and What Your Company Must Do.
- If your data is sensitive, consider whether you need AI running on your own computers: it is explained in Local AI: What It Is and Why It Matters for Privacy.
If you need the picture on the other autumn decree, the one on the new crime and on 231 liability, read Italy's AI Decree 160/2026: what small businesses need to know.
When can you relax a bit more?
If you use AI to rewrite a post, summarize a meeting or sketch a newsletter, with no personal data and no decisions about anyone, the decree does not change your day. It is enough to know what you use and to always reread what the AI writes. This article describes a rule and is not legal advice: for your specific case, talk to your adviser.
How Sarabi.Cloud helps
On the AI Act training page you can find our program for companies. Three modules (safe use of AI, model errors and bias, privacy and rules applied to everyday work), a final test, an access and attendance register and named certificates. It can run as e-learning, in a classroom or by videoconference, or as a mix. The basic modules take three to six hours per person and the quote comes after a twenty-minute call. One caveat we also write on the page: an official AI literacy certification does not exist, what we deliver is documentation you can show to an authority or an adviser.
Not sure where to start? Write to info@sarabi.cloud: tell us in two lines which AI tools you use and who uses them, and we will tell you where to begin.
Sources: Normattiva, D.Lgs. 7 ottobre 2026, n. 179; Assolombarda, D.Lgs. 179 del 7 ottobre 2026; ai4business, Decreto italiano AI Act; Noze, Decreto 179/2026: autorità AI, sanzioni, lavoro e formazione.
Have a similar case or a doubt? Write to us at info@sarabi.cloud.