Italian AI Law 132/2025: what it adds to the AI Act for companies

In force since October 2025, law 132/2025 is Italy’s first comprehensive AI law. The question CEOs and DPOs keep asking us is: “I already did my AI Act homework, do I now have to redo everything?”

Honest answer: no. But something does get added, and it pays to know what.

Key takeaways:

• Law 132/2025 does not replace the EU AI Act: it sits alongside it, sets national principles and names the competent Italian authorities.
• The two reference authorities are AgID (notification and promotion) and ACN (security and inspections).
• A fund of up to 1 billion euro is planned for investment in AI, cybersecurity and emerging tech, aimed at startups and SMEs, but subject to implementing calls.
• For most SMEs the operational duties remain those of the AI Act: if you are already aligned you only need to close a small delta.
• Do not wait for public funds to build your AI business case: measure ROI on your process, not on the grant.

What law 132/2025 is (in 40 words)

Law 132/2025 is Italy’s national legislation on artificial intelligence, in force since October 2025. It sets general principles (human centrality, transparency, safety, human oversight), designates the national competent authorities and introduces measures to support investment, in coordination with the EU AI Act.

How it overlaps with the AI Act

The EU AI Act remains the primary source for substantive obligations, especially on high-risk systems (automated recruitment, scoring, healthcare). If you already followed our guide to the AI Act for companies, the heavy part is already set up.

The Italian law works on three different levels:

1. National principles: reaffirms human centrality, worker protection and transparency toward anyone interacting with an AI system.
2. Competent authorities: designates AgID and ACN as the Italian reference points for notifications, oversight and security.
3. Investment support: the fund dedicated to startups and SMEs.

It is not a second AI Act. It is the framework through which Italy applies and complements the European one.

AgID and ACN: what changes in practice

For an SME running 2-3 AI agents on its own processes, daily operations do not change the next morning. But who you deal with does change if a check or a notification arrives:

• AgID oversees national AI notification and promotion.
• ACN supervises the security and cybersecurity side, with inspection powers.

Translated: the immutable audit logs, the risk assessment and the documentation you already need for the AI Act become even more useful, because they are what you show if someone asks how one of your systems decides.

The 1bn fund: opportunity, not certainty

The law provides for a fund of up to 1 billion euro for investment in AI, cybersecurity and emerging tech, aimed at startups and SMEs. It is a strong signal, but read it calmly:

• It is not an automatic grant: it depends on implementing calls and management vehicles.
• The pool is broad, so competition will be high.
• The risk is building your AI business case while waiting for the fund.

Our advice from 40+ delivered projects: build the case on your process ROI. If the fund arrives later, it is an accelerator, not the precondition.

What to do, concretely

If you are already aligned with the AI Act, the delta from law 132/2025 is manageable:

1. Map your AI systems by risk level (you already did this for the AI Act).
2. Check transparency toward users and workers: anyone interacting with your agent must know it.
3. Keep documentation ready (risk assessment, audit logs, art. 28 DPA) to show AgID or ACN.
4. Appoint an internal owner for AI and compliance, even part-time, often the DPO.
5. Do not start from compliance to drive adoption: start from the process, then wrap governance on top.

If you do not yet have a map of your AI systems, we build it in the assessment. And if you need a partner who knows the Italian context (business software, e-invoicing, GDPR), our page on AI consulting in Italy explains how we work.

When a dedicated consultancy is NOT needed

Let me be clear: if you only use enterprise ChatGPT for drafting and research, without systems that make decisions about people, law 132/2025 imposes almost nothing on you beyond internal transparency. Do not pay for a complex legal consultancy for a risk you do not have. You need one when you have agents in production on recruitment, finance or processes that touch people’s rights.

Compliance is a by-product of adoption done well, not a project in itself. In our AI Adoption path, governance and daily use grow together.

Want to understand which level your company falls into and what you actually need to do? Let’s talk for 20 minutes or start with the 3-minute check-up. No pitch, we honestly tell you what is mandatory and what is not.