Vatican CityGuidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)
Decreto n. DCCII della Pontificia Commissione per lo Stato della Città del Vaticano 16 dicembre 2024, recante “Linee Guida in materia di intelligenza artificiale”
In force since .
An AI governance rule binding government bodies.
- Criminal exposure
- No
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Place of effect
- Obligation class
- Prohibition, Content labelling, Governance
- Audit expectation
- none
- Setting the rule reaches
- General
What it requires
- Label AI-generated text, music, photographic, audiovisual, radio, or figurative-art content that a Vatican City State institution disseminates with the acronym 'IA'.NIST AI RMFMEASURE 2.8
- Do not use an AI system to draw discriminatory inferences about a person, to apply subliminal-manipulation techniques capable of physical or psychological harm, or to deny persons with disabilities access to AI's functions.NIST AI RMFMAP 3.3
- Do not let an AI system replace a magistrate's decision on the interpretation of law, the evaluation of facts and evidence, or the adoption of any judicial measure; use AI only to organize or simplify judicial work or to support legal and doctrinal research.NIST AI RMFMAP 3.3
- Verify and maintain oversight of the data your AI systems process so that outputs remain correct, reliable, and obtained transparently.NIST AI RMFMAP 2.3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 2.3Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.2-1Business need and security risks written down and assessed before deciding to build an AI system.
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.1.4-5End-users told which uses of the system are prohibited.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
Who enforces it
Enforcement body
The AI Commission established under article 14, composed of five members chaired by the Secretary General, monitors application and reports on AI's impact every six months to the Governorate; the decree creates no external supervisory authority.
What it makes you log
Logging duty
Article 3 Section 3 requires the covered bodies to verify and oversee their AI data-processing so that results are correct, reliable and obtained transparently; unlike GDPR Article 5(2)'s accountability principle, it does not use demonstrate, prove, document, retain or produce-on-request language, so it stays a governance principle rather than an implicit record duty. No other article imposes a record duty on a covered body either, so there is no kept record for anyone, including the AI Commission, to check.
- Kind
- None
- As of
What this law does
Decree No. DCCII of the Pontifical Commission for Vatican City State, dated , promulgates Guidelines on Artificial Intelligence that took effect on (art. 2).
The Guidelines bind the Governorate's operational and scientific bodies, its judicial organs, Governorate personnel, and the economic operators, suppliers, bidders and temporary professional appointees engaged under the Vatican's public-contracting decree, within Vatican City State territory or the Lateran Treaty extraterritorial zones (art. 1, paragraphs 1 and 3); they state no general duty reaching an ordinary private business outside that public-contracting relationship.
Article 4 bans seven uses of an AI system outright: drawing discriminatory anthropological inferences about a person; applying subliminal-manipulation techniques capable of physical or psychological harm; denying persons with disabilities access to AI and its functions; creating social inequalities that degrade human dignity; compromising the security of Vatican City State or public order; acting against the mission of the Supreme Pontiff or the integrity of the Catholic Church; and otherwise contravening the Guidelines.
Article 7 requires AI-generated textual, musical, photographic, audiovisual, radio or figurative-art content to be identified with the acronym “IA”, and vests the Governorate with exclusive authorship and economic rights over such content created within Vatican City State territory.
Article 12 reserves to the magistrate alone the decision on the interpretation of law, the evaluation of facts and evidence, and the adoption of any measure, permitting an AI system only for organizing and simplifying judicial work and for legal and doctrinal research.
Article 14 establishes a five-member AI Commission, chaired by the Secretary General, that drafts implementing laws and regulations, opines on proposed AI trials and applications, monitors deployment, and reports on AI's impact every six months; members serve renewable three-year terms. Article 15 calls for implementing laws and regulations within twelve months of the Guidelines' entry into force.
The Guidelines create no external supervisory authority beyond the Commission, state no penalty for a violation, and establish no private right of action.
When LexLint raises it
When your app profile says your app generates content with AI, generates text with AI, generates images with AI, generates video with AI, generates audio with AI, trains models, makes high-risk automated decisions or processes biometric data.
Back to the example · Lint your app
Page updated .