ItalyLegge 132/2025 Art. 20, National AI Authorities (AgID and ACN)
Legge 23 settembre 2025, n. 132, art. 20
In force since .
An AI governance rule binding government bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator, Registered or designated auditor
What it requires
- Article 20 designates AgID and ACN as Italy's national AI authorities: AgID notifies, assesses, accredits and monitors the bodies that verify AI systems' conformity, and ACN supervises AI systems, also in order to ensure cybersecurity protection, with inspection and sanctioning powers (comma 1).
These lines are LexLint's reading of the law's text. Also read by: Agenzia per l'Italia digitale (AgID) (guidance, recorded ).
Who enforces it
Settledness
Decreto Legislativo 179/2026, in force from , makes ACN the national market surveillance authority under Article 70 of Regulation (EU) 2024/1689.
- As of
- Guidance link
- https://www.agid.gov.it/en/intervention-areas/artificial-intelligence
- Guidance body
- Agenzia per l'Italia digitale (AgID)
- Open questions
- Does 'ferma restando l'attribuzione alla Banca d'Italia, alla CONSOB e all'IVASS' in Article 20, comma 1, leave those three authorities in charge of every AI system used by the entities they supervise, or only of the high-risk systems that Article 74(6) of Regulation (EU) 2024/1689 assigns to them?
- Does 'anche ai fini di assicurare la tutela della cybersicurezza' in Article 20, comma 1, lettera b), limit ACN's supervision, inspection and sanctioning of AI systems to cybersecurity matters, or does it supervise AI systems on any ground?
What it makes you log
Logging duty
Article 20, comma 1, lettera b) makes ACN responsible, also in order to ensure cybersecurity protection, for supervision of AI systems, including inspection and sanctioning activities. The clause grants ACN a power to inspect and sanction directly; it does not itself say that a developer or deployer must create, keep, demonstrate or produce a log, record or piece of documentation on demand. A documentation duty a regulated party owes for that inspection, if any, rests in the EU AI Act's own text (Articles 11, 12, 18, 21), not in this article's own words.
- Kind
- None
- As of
What this law does
Article 20 designates the Agenzia per l'Italia digitale (AgID) and the Agenzia per la cybersicurezza nazionale (ACN) as Italy's national AI authorities, without displacing the Bank of Italy's, CONSOB's and IVASS's existing sector market-surveillance roles under EU AI Act Article 74(6) (comma 1).
AgID is responsible for promoting AI innovation and development and for defining the procedures and exercising the functions for notifying, assessing, accrediting and monitoring the bodies charged with verifying AI systems' conformity (comma 1, lettera a); ACN is responsible, also in order to ensure cybersecurity protection, for supervising AI systems, including inspection and sanctioning activities, and for promoting AI development on cybersecurity aspects (comma 1, lettera b); the two agencies jointly establish and manage AI regulatory-sandbox spaces, consulting the Ministry of Defence on dual-use AI and the Ministry of Justice on AI used in judicial activity (comma 1, lettera c).
When LexLint raises it
When your app profile says your app generates content with AI or deploys a chatbot.
Back to the example · Lint your app
Page updated .