ItalyLegge 132/2025, Sector Human-Oversight and Disclosure Duties (Artt. 4, 11, 13)
Legge 23 settembre 2025, n. 132, artt. 4, 11, 13
In force since .
An AI sector rules rule binding public and private bodies.
- Audit expectation
- none
What it requires
- If your AI service can be accessed by a minor under fourteen, obtain the consent of whoever holds parental responsibility before processing their personal data; a minor between fourteen and eighteen may consent alone if the required information is easily accessible and understandable (art. 4).NIST AI RMFMAP 1.6
- If you are an employer or client deploying AI in the workplace, inform workers of the AI's use as required by Article 1-bis of Decreto Legislativo 152/1997, and keep the AI's use in employment safe, reliable, transparent, non-discriminatory, and respectful of workers' dignity and personal data (art. 11).NIST AI RMFMEASURE 2.8NIST AI RMFGOVERN 1.2
- If you provide services within a regulated intellectual profession using AI systems, use them only for instrumental and support tasks that leave your own intellectual work predominant, and clearly tell the client which AI systems you used (art. 13).NIST AI RMFMAP 3.3NIST AI RMFMEASURE 2.8
These lines are LexLint's reading of the law's text. Also read by: Ministero del Lavoro e delle Politiche Sociali (guidance, recorded ).
In the frameworks
- NIST AI RMF
- GOVERN 1.2The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The circular is dated and predates Legge 132/2025. It construes Article 1-bis of Decreto Legislativo 152/1997, not Articles 4, 11 or 13 of the 2025 law.
- As of
- Guidance link
- https://www.lavoro.gov.it/documenti-e-norme/normative/Documents/2022/Circolare-19-del-20-09-22.pdf
- Guidance body
- Ministero del Lavoro e delle Politiche Sociali
- Open questions
- Does 'nei casi e con le modalità di cui all'articolo 1-bis' in Article 11, comma 2, limit the duty to inform the worker to the automated decision-making and monitoring systems that Article 1-bis of Decreto Legislativo 152/1997 covers, or does it reach every use of artificial intelligence in the workplace?
- Does 'con prevalenza del lavoro intellettuale oggetto della prestazione d'opera' in Article 13, comma 1, set a measurable share of a professional's work that an AI system may do, or only a general direction?
- Does the consent that Article 4, comma 4, requires for 'l'accesso alle tecnologie di intelligenza artificiale' by a minor under fourteen attach to access itself, or only to the personal-data processing that follows from it?
What it makes you log
Logging duty
Articles 4, 11 and 13 impose informing, consent and disclosure duties: obtaining a parent's consent before an under-fourteen accesses AI technologies, telling a worker that AI is used, and telling a client which AI systems a professional used. None of the three articles states a duty to create, keep or produce a log or record of that information having been given or that consent having been obtained.
- Kind
- None
- As of
What this law does
Article 4 requires that use of AI systems in employment and elsewhere ensure lawful, correct and transparent personal-data processing consistent with EU data-protection law, communicated in clear and simple language (commi 2-3); a minor under fourteen needs the consent of whoever holds parental responsibility to access AI technologies and for the resulting personal-data processing, while a minor aged fourteen to eighteen may consent alone if that information is easily accessible and understandable (comma 4).
Article 11 requires that AI used in the workplace be safe, reliable, transparent, respect human dignity, and not violate personal-data confidentiality, and requires an employer or client to inform the worker of AI's use in the cases and manner already set by Article 1-bis of Decreto Legislativo 152/1997 (the automated-decision-and-monitoring-system disclosure duty); AI used to organise or manage an employment relationship must observe the worker's inviolable rights without discrimination on sex, age, ethnic origin, religion, sexual orientation, political opinion, or personal, social or economic condition (commi 1-3).
Article 13 limits the use of AI systems within a regulated intellectual profession to instrumental and support activities, so that the professional's own intellectual work remains predominant in the service provided. To preserve the trust relationship between professional and client, it requires the professional to communicate to the client, clearly, simply and completely, the AI systems used.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or serves under-18s.
Back to the example · Lint your app
Page updated .