Italy

Legal Framework

Italy applies the EU AI Act directly. Its Article 50 transparency duties have applied since 2 August 2026: providers must tell people when they are interacting with an AI system and mark generated content in a machine-readable way, and deployers must label deepfakes. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to add marking, and new bans on AI systems that generate non-consensual sexual deepfakes or child sexual abuse material apply from the same date (Digital Omnibus on AI, Regulation (EU) 2026/1744). Rules for Annex III high-risk systems now apply from 2 December 2027. At EU level, the Commission said on 12 October 2026 that its AI Office has requested and received serious incident reports on recent loss-of-control incidents and will send further requests for information to the companies that developed the models involved. On 14 October 2026, Executive Vice-President Henna Virkkunen said the AI Office has started enforcing the AI Act's rules for general-purpose AI providers and has sent requests for information "addressing issues such as security, external evaluation and monitoring how models are used". None of these Commission statements addresses companies that deploy those models. In October 2026 the Official Journal cited EN 18286:2026, a quality management system standard, as the first harmonised standard supporting the AI Act; CEN-CENELEC says it gives providers of high-risk AI systems a route to a presumption of conformity with the Act's Article 17 quality management requirements. Italy also has its own framework law, Law 132 of 23 September 2025 on artificial intelligence, in force since 10 October 2025, which must be read consistently with the AI Act. It names AgID (Agenzia per l'Italia Digitale) as the notifying authority and the National Cybersecurity Agency (ACN) as the market surveillance authority, with inspection and sanction powers, and as the single point of contact with EU institutions. The Bank of Italy, CONSOB and IVASS keep supervision of AI in financial services, and the powers of the data protection authority (Garante per la protezione dei dati personali) are unchanged. Children under 14 need a parent's consent to use AI systems. Employers must inform workers when they use AI, and professionals must tell clients which AI systems they use, in clear language. The law added a criminal offence for spreading AI-generated or altered images, video or voices without the person's consent where this causes unjust harm, punishable by one to five years in prison, and limits copyright protection to works of human authorship, including works made with AI tools that result from the author's own intellectual effort. Legislative Decree 160 of 9 September 2026, in force since 30 September 2026, sets rules for police use of AI, makes it a crime to omit or tamper with safety measures in high-risk AI systems, and helps people harmed by AI bring civil claims through access to the system's technical documentation, a presumption of causation and a direct claim against the insurer. A second decree, covering the authorities' powers, sanctions and AI use at work, in education, in the professions, in health care and in public administration, received final government approval on 4 August 2026. It sets maximum fines below the AI Act ceilings and bars decisions on hiring, changes to employment, discipline or dismissal taken solely through automated processing; a dismissal made in breach is void. The Garante has been active on AI. In March 2023 it temporarily blocked ChatGPT's processing of Italian users' data. Sources: https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2025-09-23;132 ; https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/sg ; https://www.agid.gov.it/it/ambiti-intervento/intelligenza-artificiale ; https://www.gazzettaufficiale.it/eli/id/2026/09/15/26G00179/sg ; https://www.affarieuropei.gov.it/it/comunicazione/notizie/cdm-4-ago-26/ ; https://eur-lex.europa.eu/eli/reg/2026/1744/oj ; https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act ; https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations ; https://digital-strategy.ec.europa.eu/en/news/special-meeting-ai-scientific-panel ; https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9870847 ; https://ec.europa.eu/commission/presscorner/api/files/document/print/en/speech_26_2150/SPEECH_26_2150_EN.pdf ; https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-10-15-en-18286-2026-published-in-ojeu

Key Laws & Regulations

• ◆EU AI Act (Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744)
• ◆Law 132/2025 on artificial intelligence (in force 10 October 2025)
• ◆Legislative Decree 160/2026 on police use of AI and civil and criminal liability (in force 30 September 2026)
• ◆GDPR (Privacy Code)
• ◆Civil Code

Business Formation

The SRL (Società a Responsabilità Limitata) is the standard entity. Its share capital is normally at least EUR 10,000, but founders can set it as low as EUR 1 if it is paid in full in cash. The simplified SRL (SRL Semplificata) can only have individuals as shareholders, uses a fixed standard deed and has capital of at least EUR 1 and below EUR 10,000. Both are formed by public deed (atto pubblico). Sources: https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:regio.decreto:1942-03-16;262~art2463 ; https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:regio.decreto:1942-03-16;262~art2463bis

Tax Implications

Corporate taxation includes IRES at 24% plus IRAP (regional business tax) at approximately 3.9%, resulting in an effective rate around 27.9%. The Patent Box regime introduced in 2021 gives a 110% super-deduction on qualifying R&D costs for copyrighted software, patents, designs and models. Source: https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2026-06-19;117~art118