Italy

Article 20 designates the Agenzia per l'Italia digitale (AgID) and the Agenzia per la cybersicurezza nazionale (ACN) as Italy's national AI authorities, without displacing the Bank of Italy's, CONSOB's and IVASS's existing sector market-surveillance roles under EU AI Act Article 74(6) (comma 1).

AgID is responsible for promoting AI innovation and development and for defining the procedures and exercising the functions for notifying, assessing, accrediting and monitoring the bodies charged with verifying AI systems' conformity (comma 1, lettera a); ACN is responsible, also in order to ensure cybersecurity protection, for supervising AI systems, including inspection and sanctioning activities, and for promoting AI development on cybersecurity aspects (comma 1, lettera b); the two agencies jointly establish and manage AI regulatory-sandbox spaces, consulting the Ministry of Defence on dual-use AI and the Ministry of Justice on AI used in judicial activity (comma 1, lettera c).

Whoever causes unjust harm to a person by transferring, publishing, or otherwise disseminating, without that person's consent, an image, video, or voice recording falsified or altered through the use of an AI system and suited to deceive as to its genuineness, is punished with imprisonment from one to five years.

The offence is prosecutable only on the injured person's complaint, except that it is prosecuted ex officio if connected to another offence for which ex officio prosecution is required, or if committed against a person incapable by age or infirmity, or against a public authority because of its functions.

Article 4 requires that use of AI systems in employment and elsewhere ensure lawful, correct and transparent personal-data processing consistent with EU data-protection law, communicated in clear and simple language (commi 2-3); a minor under fourteen needs the consent of whoever holds parental responsibility to access AI technologies and for the resulting personal-data processing, while a minor aged fourteen to eighteen may consent alone if that information is easily accessible and understandable (comma 4).

Article 11 requires that AI used in the workplace be safe, reliable, transparent, respect human dignity, and not violate personal-data confidentiality, and requires an employer or client to inform the worker of AI's use in the cases and manner already set by Article 1-bis of Decreto Legislativo 152/1997 (the automated-decision-and-monitoring-system disclosure duty); AI used to organise or manage an employment relationship must observe the worker's inviolable rights without discrimination on sex, age, ethnic origin, religion, sexual orientation, political opinion, or personal, social or economic condition (commi 1-3).

Article 13 limits the use of AI systems within a regulated intellectual profession to instrumental and support activities, so that the professional's own intellectual work remains predominant in the service provided. To preserve the trust relationship between professional and client, it requires the professional to communicate to the client, clearly, simply and completely, the AI systems used.

The decree implements Directive 2000/78/EC and defines the principle of equal treatment as the absence of any direct or indirect discrimination on grounds of religion, personal convictions, disability, age, nationality, or sexual orientation. Direct discrimination occurs when, on one of those grounds, a person is treated less favourably than another is, has been or would be treated in a comparable situation.

Indirect discrimination occurs when a seemingly neutral provision, criterion, practice, act, agreement, or conduct can put persons with one of those characteristics at a particular disadvantage compared with other persons. Harassment, meaning unwanted conduct that aims or has the effect of violating a person's dignity and creating an intimidating, hostile, degrading, humiliating, or offensive climate, and an order to discriminate are also treated as discrimination.

The principle applies to all persons in the public and private sectors in access to employment and work, including selection criteria and hiring conditions, and in employment and working conditions, including career advancement, pay, and dismissal. A difference of treatment that is indirectly discriminatory is not discrimination where it is objectively justified by legitimate aims pursued through appropriate and necessary means.

Public and private employers are required to adopt reasonable accommodations for workers with disabilities. Civil proceedings against discriminatory acts and conduct are governed by article 28 of Legislative Decree 150/2011. The judicial protection also applies against any detrimental conduct towards the person harmed, or any other person, as a reaction to activity aimed at obtaining equal treatment.

Trade unions, associations, and organisations representing the right or interest harmed may bring the action, on delegation, in the name of or in support of the person discriminated against. They may also bring the action in cases of collective discrimination where the persons harmed cannot be directly and immediately identified.

The Garante's Provvedimento n. 146/2019 imposes specific security measures for genetic data (documented physical-access controls, encrypted or pseudonymized storage, controlled transmission), consent requirements for genetic testing and for processing genetic data to protect a third party's health, and a research-retention rule limiting secondary use of genetic data and biological samples to cases where equivalent research cannot be done on data from consenting subjects.

A biometric enforcement action of the Garante is Provvedimento n. 50 del 10 febbraio 2022 against Clearview AI: a EUR 20 million fine, a ban on further processing of the facial-recognition data of people in Italy, and orders to delete that data and to designate a representative in the EU.

A controller must notify the Garante without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms, and must notify the affected individual without undue delay where the breach is likely to result in a high risk. In Italy the supervisory authority under General Data Protection Regulation (GDPR) Article 51 is the Garante per la protezione dei dati personali.

Under Article 2-quaterdecies.1(1) of the Codice privacy, enterprises with fewer than five employees use a specific notification procedure to meet the duty in Article 33 of the Regulation. Article 2-quaterdecies.1(2) leaves that procedure to a measure of the Garante, which is to provide guided self-assessment tools and a simplified assistance channel. The provision was inserted by Article 12(1) of Decree-Law 19 of 19 February 2026, converted with amendments by Law 50 of 20 April 2026.

Italy gives the General Data Protection Regulation (GDPR) domestic effect through the Codice in materia di protezione dei dati personali (Personal Data Protection Code), Decreto Legislativo 196/2003 as amended by Decreto Legislativo 101/2018, in force from 19 September 2018. Beyond the GDPR baseline it adds its own Titolo III criminal offenses for unlawful processing (Artt.

167, 167-bis, 167-ter, 168, 170, 171; Art. 169 is abrogated), the Garante's own Article 166 sanctioning procedure, and sector-specific security and consent prescriptions for genetic, health, and biometric data.

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier of up to EUR 20 million or 4% of global turnover.

Article 167(3) of the Codice Privacy applies the penalty of Article 167(2) to anyone who, for profit or to cause harm, transfers personal data to a third country or an international organization outside the cases allowed by General Data Protection Regulation (GDPR) Articles 45, 46 or 49 and thereby harms the data subject.

Individuals in Italy have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

In the Garante's ChatGPT matter, an urgent measure of 30 March 2023 imposed a provisional limitation, with immediate effect, on OpenAI's processing of the personal data of data subjects established in Italy. It closed that inquiry by decision no. 755 of 2 November 2024, announced on 20 December 2024, which ordered OpenAI to run a six-month information campaign and pay a fine of 15 million euros.

The Court of Rome upheld the challenge to that decision in judgment no. 4153/2026, published on 18 March 2026, and the Garante has temporarily removed the decision from its website.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Italy can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. The Codice adds two rules that reach a private controller.

Article 2-undecies lets a controller delay, limit or exclude the rights in GDPR Articles 15 to 22, with reasoned notice to the person unless that would defeat the purpose, where exercising them would cause actual and concrete prejudice to listed interests, among them anti-money-laundering, defensive investigations or the exercise of a right in court, and a whistleblower's confidentiality.

Article 2-terdecies lets these rights be exercised for a deceased person by someone with their own interest, an agent protecting the deceased, or someone with a family reason worth protecting, unless the law excludes it or, for information society services offered directly to the person, the deceased expressly forbade it by written declaration.

In Italy the supervisory authority under General Data Protection Regulation (GDPR) Article 51 is the Garante per la protezione dei dati personali. Under Article 166(3) of the Codice Privacy the Garante imposes the fines of GDPR Article 83. GDPR Article 82 arms an individual with a direct private right of action.

Italy additionally has a general class-action mechanism, Article 840-bis of the Codice di procedura civile (azione di classe), which covers homogeneous individual rights against enterprises or public-service managers, brought by an individual class member or a registered nonprofit organization. The class-action law entered into force on 19 May 2021. The article does not name data protection specifically, and no use of it for a GDPR claim has been located.

General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category. The Codice Privacy adds its own criminal offense in Article 167(2), punishing the processing of Article 9 and 10 data in breach of Articles 2-sexies, 2-octies or the safeguards under Article 2-septies, which covers genetic, biometric and health data. The Garante's Provvedimento 146/2019 sets prescriptions for the processing of genetic data.

In its decision of 10 February 2022, the Garante declared unlawful Clearview AI's processing of facial images collected by web scraping, including biometric data. It fined Clearview AI EUR 20 million in the same decision.

Processing of data, including personal data, by non-profit public and private bodies, IRCCS research hospitals and private health-sector bodies in projects with them, for research and experimentation in building AI systems for health purposes, is declared to be of substantial public interest under General Data Protection Regulation (GDPR) Article 9(2)(g).

For the same purposes, secondary use of personal data without direct identifiers, including special category data, is always authorized without further consent where consent was initially required by law, subject to the duty to inform the data subject, except where knowing the data subject's identity is inevitable or necessary to protect their health.

Processing to anonymize, pseudonymize or synthesize personal data, including special category data, is always allowed after the data subject has been informed under GDPR Article 13. The processing under paragraphs 1 and 2 must be communicated to the Garante with the information required by GDPR Articles 24, 25, 32 and 35 and the processors named under Article 28, and may start thirty days after the communication unless the Garante has blocked it.

Whoever, to procure an advantage for themselves or another or to cause harm to another, abusively obtains, holds, produces, reproduces, distributes, imports, communicates, delivers, otherwise makes available to others, or installs apparatus, instruments, parts of apparatus or instruments, codes, passwords or other means suited to accessing a computer or telematic system protected by security measures, or otherwise supplies indications or instructions suited to that purpose, is punished with imprisonment up to two years and a fine up to ten million lire, about EUR 5,164 (comma 1).

The penalty rises to imprisonment from two to six years where one of the aggravating circumstances of art. 615-ter, comma 2, number 1) is present (comma 2), and to imprisonment from three to eight years where the conduct concerns the systems described in art. 615-ter, comma 3 (comma 3). Legge 90/2024 amended commi 1 and 2 and inserted the new comma 3, effective 17 July 2024.

Whoever abusively enters a computer or telematic system protected by security measures, or remains within it against the express or tacit will of whoever has the right to exclude them, is punished with imprisonment up to three years (comma 1); this base offence is prosecutable only on the victim's complaint.

Imprisonment rises to two to ten years where the offender is a public official or public-service employee abusing their powers or duties, or a person who also unlawfully practises as a private investigator, or an operator abusing their access to the system; where the offender uses threats or violence against people or property or is visibly armed; or where the offence causes destruction, damage, removal, inaccessibility, or interruption of the system, or destruction or damage of the data, information or programmes it holds (comma 2); these aggravated cases are prosecuted ex officio.

Where an offence under comma 1 or comma 2 reaches a system of military, public-order, public-security, health or civil-protection interest, imprisonment rises respectively to three to ten years or four to twelve years (commi 3-4). Legge 90/2024 raised the comma-2 introductory penalty range from one to five years to two to ten years and amended comma 3, effective 17 July 2024.

Article 70-ter permits reproductions by research organisations and cultural-heritage-protection institutions, for scientific-research purposes, for text-and-data-mining (text and data mining (TDM)) from works or other material in networks or databases to which they have lawful access, and communication to the public of the research's results where expressed in new original works (comma 1); TDM is defined as any automated technique for analysing large quantities of text, sound, images, data or metadata in digital form to generate information, including patterns, trends and correlations (comma 2).

Article 70-quater permits, without prejudice to Article 70-ter, reproductions and extractions from works or other material in networks or databases to which there is lawful access, for TDM purposes generally, including commercial use, unless the rightholders of the copyright, related rights or database right have expressly reserved the use (comma 1); copies made under that article may be kept only as long as needed for the TDM purpose, and must be secured to a level at least equal to that required under Article 70-ter.

Legge 132/2025 (Italy's national AI law), art. 25, inserted Article 70-septies, confirming that reproductions and extractions for TDM through AI models and systems, including generative AI, from lawfully accessible works or database material, are permitted under the same Articles 70-ter and 70-quater conditions, subject to the Berne Convention, effective 10 October 2025.

The same law's art. 26(3) added a new criminal offence at Article 171, comma 1, lettera a-ter, punishing reproduction or extraction of text or data from works or material in networks or databases in violation of Articles 70-ter or 70-quater, including through an AI system.

A database's maker ("costitutore"), meaning whoever makes a substantial investment, in money, time or work, to constitute, verify or present a database, holds the right, independent of any copyright protection the database may separately enjoy, to prohibit extraction or re-utilisation of the whole or a substantial part of its content (art. 102-bis, commi 1(a), 3).

"Extraction" is the permanent or temporary transfer of the whole or a substantial part of the database's content onto another medium; "re-utilisation" is any form of making that content available to the public (comma 1(b)-(c)).

The right arises when the database is completed and expires fifteen years after 1 January of the year following completion, or, for a database made available to the public before that period expires, fifteen years after 1 January of the year following first making-available; a substantial new investment in the database's content restarts an equally long protection term (commi 6-8).

Repeated and systematic extraction or re-utilisation of insubstantial parts of the database's content is not permitted where it presupposes operations contrary to the database's normal management or unjustifiably prejudices its maker (comma 9).

A legitimate user of a database made available to the public may not prejudice the rightholder, may not act contrary to the database's normal management or unjustifiably prejudice its maker, and may otherwise extract or re-use insubstantial parts, assessed qualitatively and quantitatively, of the database's content for any purpose without the maker's authorisation (art. 102-ter, commi 1-3). A contractual clause violating any of those rules is void (comma 4). Both articles have been in force since 16 June 1999.

Article 24 requires an essential or important entity, defined by Article 3 against the sector annexes and including the cloud computing, online marketplace, online search engine and social-network platform providers that Article 7(5) names, to adopt technical, operational and organisational measures adequate and proportionate to the risks its network and information systems face, on a multi-risk approach covering at least risk-analysis and security policy, incident handling (including the procedures for the Article 25 and 26 notifications), business continuity and disaster recovery, and supply-chain security, transposing NIS2 Article 21.

Article 23 requires the entity's management and governing bodies to approve how these measures are implemented, oversee the implementation of the obligations in that chapter and in Article 7, and undergo cybersecurity training, and makes those bodies responsible for violations of the decree. Article 3, paragraph 14 sets Chapters IV and V of this decree aside for essential or important entities of sectors 3 and 4 of Annex I, to which Regulation (EU) 2022/2554 applies instead.

Article 1, paragraph 2 of that Regulation treats it as a sector-specific Union legal act for a financial entity identified as an essential or important entity, so that entity answers under that Regulation instead. Article 42(1)(c), a first-application rule, provides that until 31 December 2025 the deadline for complying with Articles 23 and 24 is eighteen months from the entity's receipt of the communication under Article 7(3)(a) and (b).

Banca d'Italia, Consob, IVASS and COVIP are the competent authorities under Article 46 of the DORA Regulation (Regulation (EU) 2022/2554) for compliance with it by the entities each of them supervises (Article 3(1)). Banca d'Italia is also the competent authority for DORA compliance by Cassa depositi e prestiti and for compliance with the decree by financial intermediaries and Bancoposta (Article 3(2) and (3)).

The DORA competent authorities may issue provisions implementing the decree and the DORA Regulation (Article 9). The decree entered into force on 12 March 2025, after publication in Gazzetta Ufficiale 58 of 11 March 2025.

Article 25 requires an essential or important entity to notify computer security incident response team (CSIRT) Italia, without unjustified delay, of any incident with a significant impact on the provision of its services, on a graduated clock: a pre-notification within 24 hours of becoming aware of the incident, a full notification within 72 hours, an intermediate report on CSIRT Italia's request, and a final report within one month of the notification (or, for an ongoing incident, monthly progress reports and a final report within one month of its resolution).

A trust-service provider notifies within 24 hours rather than 72. CSIRT Italia in turn responds without unjustified delay and, where possible, within 24 hours of the pre-notification, with an initial assessment and, on request, guidance on mitigation, transposing NIS2 Article 23. Article 3, paragraph 14 sets Chapters IV and V of this decree aside for essential or important entities of sectors 3 and 4 of Annex I, to which Regulation (EU) 2022/2554 applies instead.

Article 1, paragraph 2 of that Regulation treats it as a sector-specific Union legal act for a financial entity identified as an essential or important entity, so that entity reports under that Regulation instead. Article 42(1)(c), a first-application rule, provides that until 31 December 2025 the deadline for complying with Article 25 is nine months from the entity's receipt of the communication under Article 7(3)(a) and (b).

Central public administrations, regions, metropolitan cities, municipalities above 100,000 inhabitants and regional capitals, urban and suburban public transport companies, local health authorities and their in-house IT, transport, wastewater and waste companies must report and notify the incidents on the National Cybersecurity Agency (ACN) taxonomy that affect their networks, information systems and IT services (Article 1(1)).

They must report any such incident without delay and within 24 hours of learning of it, and make a complete notification within 72 hours of that moment, through the procedures on the ACN website (Article 1(2)). For the municipalities, transport companies, local health authorities and in-house companies, these duties apply from the 180th day after the law came into force (Article 1(3)).

Repeated failure to notify within five years is punished by an administrative fine of 25,000 to 125,000 euro (Article 1(6)). The same entities, together with the entities under the national cybersecurity perimeter and the electronic communications providers named in Article 2(1), must apply the remedies ACN indicates for a specific vulnerability they are exposed to without delay and within 15 days of ACN's notice (Article 2(1)).

Failure or delay in applying them carries the same fines, unless technical or organisational reasons promptly communicated to ACN prevent or defer the remedy (Article 2(2)). The law entered into force on 17 July 2024.

Article 130(1) permits the use of automated calling or communication systems without the intervention of an operator to send advertising or direct-sale material, for market research or for commercial communication, with the consent of the subscriber or user. Article 130(2) applies that provision also to electronic communications sent for those purposes by email, fax, MMS or SMS messages or messages of another type.

Article 121(1-bis)(f) defines a subscriber (contraente) as any natural person, legal person, body or association party to a contract with a provider of publicly available electronic communications services for their supply, or otherwise the recipient of such services through prepaid cards.

Article 130(4) provides that a controller that uses, for direct sale of its own products or services, the email contact details the data subject gave in the context of the sale of a product or service may dispense with consent, provided the services are similar to those sold and the data subject, adequately informed, does not refuse that use, initially or on later communications.

The data subject must be informed, at collection and at every communication sent under that paragraph, of the possibility of objecting at any time, easily and free of charge.

Article 130(5) prohibits in every case sending communications for the purposes of paragraph 1, or otherwise for promotion, by disguising or concealing the sender's identity, in breach of Article 8 of Legislative Decree 70/2003, without a suitable contact where the data subject can exercise the rights in Articles 15 to 22 of the General Data Protection Regulation (GDPR), or by urging recipients to visit websites that breach that Article 8.

Under Article 130(6), in case of repeated violation the Garante may also prescribe to electronic communications service providers filtering procedures or other practicable measures for the email addresses from which the communications were sent. Article 166(2) places violations of Article 130, paragraphs 1 to 5, under the administrative sanction of Article 83(5) of the GDPR.

Article 83(5) of the GDPR sets fines of up to EUR 20,000,000 or, for an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.

Article 167(1) punishes with imprisonment of six months to one year and six months anyone who, to obtain a profit for themselves or others or to cause harm to the data subject, acts in breach of Article 123, 126 or 130 or of the Garante's measure under Article 129 and thereby causes harm to the data subject, unless the act is a more serious offense.

Article 8(1) requires commercial communications that constitute an information society service, or form an integral part of one, to contain from the first sending, clearly and unequivocally, specific information showing that it is a commercial communication, the natural or legal person on whose behalf it is made, that it is a promotional offer such as discounts, prizes or gifts and the conditions of access, and, for promotional contests or games where permitted, their conditions of participation.

Article 9(1) requires unsolicited commercial communications that a service provider sends by email to be identified clearly and unequivocally as such from the moment the recipient receives them and to state that the recipient can object to receiving such communications in future. Article 9(2) places on the provider the burden of proving that a commercial communication was solicited.

Article 21(1) punishes violations of Articles 7, 8, 9, 10 and 12, unless the act is an offense, with an administrative fine of EUR 103 to EUR 10,000. In cases of particular gravity or of recidivism, Article 21(2) doubles the minimum and maximum limits of that fine. Under Article 21(3), the administrative police bodies ascertain the violations, and the report of the finding is presented to the Ministry of Productive Activities named in the text.

Article 122(1) permits storing information in the terminal equipment of a subscriber (contraente) or user (utente), or accessing information already stored there, only on condition that the subscriber or user has given consent after being informed through simplified procedures.

That rule does not prevent technical storage or access whose sole purpose is to carry out the transmission of a communication over an electronic communications network, or that is strictly necessary for the provider of an information society service explicitly requested by the subscriber or user to supply that service.

In fixing the simplified procedures the Garante per la protezione dei dati personali (the Italian data protection authority) also takes account of proposals from the most representative national consumer and trade associations. Article 122(2) allows consent to be expressed through specific configurations of software or devices that are easy and clear for the subscriber or user to use.

Article 122(2-bis) prohibits, subject to paragraph 1, the use of an electronic communications network to access information stored in the terminal equipment of a subscriber or user, to store information or to monitor the user's operations.

Article 121(1-bis)(f) defines a subscriber as any natural person, legal person, body or association party to a contract with a provider of publicly available electronic communications services for their supply, or otherwise the recipient of such services through prepaid cards. Article 121(1-bis)(g) defines a user as any natural person who uses a publicly available electronic communications service, for private or business reasons, without necessarily being subscribed to it.

Article 166(2) places violations of Article 122 under the administrative sanction of Article 83(5) of the General Data Protection Regulation (GDPR). Article 166(3) makes the Garante the authority competent to adopt corrective measures and to impose the sanctions of Article 83 of the GDPR. Article 83(5) of the GDPR sets fines of up to EUR 20,000,000 or, for an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.

Article 615-bis(1) punishes with imprisonment of six months to four years anyone who, by means of visual or sound recording instruments, unduly procures news or images concerning private life taking place in the places indicated in Article 614. Unless the act is a more serious offense, the same penalty applies to anyone who reveals or disseminates, through any means of public information, the news or images obtained in that way.

The offenses are prosecutable on the complaint of the injured person, but the authority proceeds of its own motion, with imprisonment of one to five years, where the act is committed by a public official or person in charge of a public service abusing powers or violating duties, or by a person who practices, even unlawfully, as a private investigator.

Article 617(1) punishes with imprisonment of one year and six months to five years anyone who fraudulently takes cognizance of a telephone or telegraph communication or conversation between other persons, or in any case not directed to them, or interrupts or prevents it. Unless the act is a more serious offense, Article 617(2) applies the same penalty to anyone who reveals, through any means of public information, all or part of the content of those communications or conversations.

The offenses are prosecutable on the complaint of the injured person, but the authority proceeds of its own motion, with imprisonment of three to eight years, where the act is committed against a public official or person in charge of a public service in the exercise or because of their functions, by such a person abusing powers or violating duties, or by a person who practices, even unlawfully, as a private investigator. Law 238 of 23 December 2021 amended Article 617 through its Article 19(3)(a) and (b).

Article 617-bis(1) punishes with imprisonment of one to four years anyone who, outside the cases the law permits and in order to take cognizance of a telephone or telegraph communication or conversation between other persons or in any case not directed to them, or to prevent or interrupt it, procures, holds, produces, reproduces, distributes, imports, communicates, delivers, makes available to others or installs apparatus, instruments or parts of them suitable to intercept, prevent or interrupt telegraph or telephone communications or conversations between other persons.

The penalty is imprisonment of two to six years where one of the circumstances of the second paragraph, number 1, of Article 615-ter applies. The penalty is imprisonment of one to five years where the act is committed against a public official in the exercise or because of their functions. Article 19(4)(a) of Law 238 of 23 December 2021 amended the first paragraph of Article 617-bis.

Delibera 106/25/CONS is dated 30 April 2025 and was published on 19 May 2025. Its Annex B contains a Regulation that repeals and replaces the earlier regulation of 2016 approved by Delibera 252/16/CONS. Article 8(1) of the Regulation requires operators that directly handle incoming international voice calls on their international network interfaces to take measures to block incoming international voice calls that do not respect the ITU numbering Recommendations.

Article 8(2)(a) and (b) require the same operators to take measures to block incoming international voice calls that do not respect ITU-T Recommendation E.157 and those that present a national fixed (geographic) E.164 number, except in justified cases.

Article 8(2)(c) requires them to take measures to block incoming international voice calls that present a national mobile E.164 number as calling line identity, after checking and verifying that the end user is not roaming abroad, except in justified cases. Article 8(3) requires operators to ensure that the measures do not compromise the handling of legitimate incoming international voice calls and do not block the exceptions allowed at national level.

Article 8(5) requires operators to implement the measures according to the technical specifications in Annex A to the Delibera. Delibera 271/25/CONS records that the blocking of international calls presenting a fixed-network calling line identity had taken effect on 19 August and that the blocking of calls presenting a mobile-network calling line identity was to take effect on 19 November 2025.

Article 1(2) of Delibera 271/25/CONS subjects operators that offer specialised mobile and personal communications services to the obligations of Article 8(5) of Annex B. Under Article 1(3), operators of specialised mobile and personal services, of machine-to-machine services, or in similar cases where users cannot originate calls from abroad, may as an alternative to building the API interface ask for the blocking of all calls from abroad to Italy that present a calling line identity of numbers assigned to or used by them.

Article 12(1) of the Regulation applies to a violation of Article 8 the administrative fine of Article 30(12-bis) of the Codice delle comunicazioni elettroniche (Electronic Communications Code).

Article 30(12-bis) of that Code provides that the Ministry or AGCOM, each within its competence, impose a fine of EUR 50,000 to EUR 1,000,000 on persons, including call centers, that operate in breach of Article 98-decies through unfair commercial practices, fraud or abuse, or that do not comply with its orders and warnings.

Article 130(3-bis) of the Codice Privacy permits, notwithstanding Article 129, the processing of telephone and paper-mail contact data for advertising, direct sale, market research or commercial communication against those who have not exercised the right of opposition by registering their number and other personal data in a public register of oppositions.

Article 130(3) permits further communications for those purposes by means other than those in paragraphs 1 and 2 under Articles 6 and 7 of the General Data Protection Regulation (GDPR) and under paragraph 3-bis. Article 130(3-quater) gives the Garante supervision and control of the register's organization and operation and of the data processing.

Article 3(1) of Presidential Decree 26/2022 has the Ministry of Economic Development (Ministero dello sviluppo economico) establish the register for the postal addresses in the subscriber lists and for all national fixed and mobile numbers, whether or not they appear in those lists.

Article 2(2) applies the Decree to processing by telephone communications by any means, whether through an operator or, under Article 1(5) of Law 5/2018, through automated calling systems or calls without an operator, and to processing by paper mail, for advertising, direct sale, market research or commercial communication. Article 7(1) makes registration in the register free of charge.

Article 5(1) requires each operator that wants to process national fixed and mobile numbers by telephone, with or without a human operator, or postal addresses by paper mail, for those purposes to apply to the register's manager, with proof of identity and the lists that are the source of the data and, for processing by telephone only, a declaration that it activates calling line identification or uses the codes or prefixes set by AGCOM or, where it outsources the calls, the identity of each third party making them.

Article 5(2) provides that the validity of the operator's registration ends twelve months after its last consultation of the register. Article 7(6) provides that registration precludes any processing by operators, for those purposes, of the postal addresses in the subscriber lists and of national fixed and mobile numbers by telephone or paper mail, subject to the following paragraphs.

Under Article 7(7), registration or renewal made on the subscriber's explicit request is deemed to revoke all consents previously given, in any form or by any means, to the processing of national telephone numbers by telephone, with or without an operator, or by paper mail, for those purposes.

Under Article 7(5)(b), after a registered subscriber revokes the opposition, processing of national numbers is allowed if specific consent was collected after the most recent registration or renewal, in compliance with Articles 6, 7, 13, 14 and 21(2) of the GDPR.

Article 8(2) requires operators that use telephone advertising and sales systems, telephone market research or telephone commercial communications, or paper mail, to consult the register monthly and in any case before the start of each promotional campaign, and to update their lists. A consultation of the register is effective for fifteen days for processing by telephone, with or without an operator, and for thirty days for processing by paper mail.

Article 9(1) requires operators and call-center businesses that call subscribers for those purposes to guarantee the presentation of the calling line identification, as Article 2(1) of Law 5/2018 provides. Article 9(2) has AGCOM regulate and supervise compliance with that duty and apply, for a violation, the sanctions of Article 2(1) of Law 5/2018.

Article 10(1) requires operators, at the time of the call or in the paper advertising, to state precisely that the subscriber's data were lawfully extracted from the subscriber lists or from other sources and to give the information useful for registering in the register. Article 13 provides that, for a violation of the Decree's prescriptions, the subscriber relies on the remedies of Chapter VIII of the GDPR and Part III of the Codice Privacy.

Article 166(2) of the Codice Privacy names Article 130, paragraphs 1 to 5, for the administrative sanction of Article 83(5) of the GDPR.

Article 2(1) provides that AGCOM, by its own measure, orders service providers, including network-access providers, to disable access to unlawfully distributed content by blocking the DNS resolution of domain names and the routing of network traffic to the IP addresses used mainly for unlawful activities.

In serious and urgent cases involving live broadcasts, first showings of films and audiovisual works, sports events and similar content, Article 2(3) has AGCOM adopt a precautionary measure by an abbreviated procedure without a hearing of the other side. The text in force names virtual private network (VPN) service providers and publicly available DNS service providers, wherever resident and located, among the addressees of that order.

The measure is adopted on the request of the rightholder or licensee, a collective management or trade association with a mandate, or a trusted flagger within the meaning of Article 22(2) of the Digital Services Act. Under Article 2(4), the recipients of the request must remove or disable access promptly and in any case within a maximum of 30 minutes of the communication.

Article 2(5) requires network-access providers, search engine operators and information society service providers involved in any way in the accessibility of the website or illegal services to execute AGCOM's order without delay and in any case within 30 minutes of notification.

Search engine operators and information society service providers that are not involved in the accessibility of the site must still, within the same 30 minutes, take all useful technical measures to hinder the visibility of the illegal content, including de-indexing the blocked domain names.

Article 2(5-bis) requires IP-address assignment providers, the registry of the .it country-code domain and domain-name registrars to restore periodically the resolution and routing blocked under the Article, after at least six months and for those not used for unlawful purposes.

Article 2(7) requires the recipients of the orders, at AGCOM's request, to inform the Rome public prosecutor's office without delay of all the activities carried out to comply and to supply any data in their possession that could identify the providers of the unlawfully distributed content. Article 5(1) provides that for non-compliance with an Article 2 order AGCOM applies, for each violation found, the sanction in the third sentence of Article 1(31) of Law 249/1997.

That sentence sets, for non-compliance with AGCOM's orders protecting copyright and related rights, an administrative fine from EUR 10,000 up to 2 % of the turnover in the last financial year closed before notice of the charge. The consolidated text of Article 2 has been in force in its present form since 9 October 2024.

Article 102-sexies(1) defines a provider of online content-sharing services as an information society service provider whose main purpose, or one of whose main purposes, is to store and give the public access to large amounts of protected works or other materials that its users upload and that it organizes and promotes to make a profit, directly or indirectly.

Article 102-sexies(2) excludes non-profit online encyclopedias and non-profit educational or scientific repositories, open-source software development and sharing platforms, electronic communications service providers, online marketplaces, business-to-business cloud services and cloud services for uploading content for personal use.

The exclusion for online marketplaces and cloud services does not apply where the marketplace or cloud service allows protected works to be shared among several users. Article 102-sexies(3) provides that when such a provider gives the public access to protected works uploaded by its users it performs an act of communication to the public for which it must obtain authorization from the rightholders, including by a license agreement.

Article 102-sexies(4) extends that authorization to acts of users who upload works without acting for commercial purposes or whose activity does not generate significant revenue.

Article 102-septies(1) makes a provider without authorization liable for unauthorized acts of communication to the public unless it shows that it made its best efforts to obtain authorization, made its best efforts to keep unavailable the specific works for which rightholders gave relevant and necessary information, and, after a sufficiently reasoned notice, promptly disabled access to or removed the notified works and made its best efforts to prevent their upload in future.

Article 102-septies(2) provides that a provider that practices or facilitates copyright piracy is never exempt from liability. Article 102-septies(3) requires the provider to give rightholders, promptly and on their request, complete and adequate information on how the paragraph 1 conditions are implemented and, where license agreements exist, on the use of the content they cover. Article 102-septies(4) provides that applying the Title does not lead to a general monitoring obligation.

Article 102-octies(1) applies a lighter test to a new provider that has operated in the Union market for less than three years and has annual turnover below EUR 10 million, which is liable unless it shows its best efforts to obtain authorization and prompt disabling or removal after a sufficiently detailed notice.

Under Article 102-octies(2), a new provider whose average monthly unique visitors in the previous calendar year exceed 5 million must also show its best efforts to prevent future uploads of notified works. Article 102-nonies(1) provides that cooperation between providers and rightholders must not prejudice the availability of works uploaded by users in compliance with copyright, including works covered by an exception or limitation.

Article 102-nonies(2) lets users who upload content they generated rely on the exceptions for quotation, criticism and review and for caricature, parody and pastiche. Article 102-nonies(3) requires providers to inform their users, through their terms and conditions, of the possibility of using works under the exceptions or limitations to copyright.

Article 102-nonies(4) provides that applying the Title does not involve identifying individual users or processing personal data, without prejudice to the General Data Protection Regulation (GDPR) and the Codice Privacy. Article 102-decies(1) requires rightholders who ask a provider to disable access to or remove specific works to state the reasons for the request, makes the decisions on such requests subject to human review, and requires the provider to tell users immediately of the disabling or removal.

Article 102-decies(2) requires providers to set up and make available to users quick and effective complaint mechanisms against a decision to disable access to or remove their uploads, and provides that AGCOM adopts guidelines for that purpose. Article 102-decies(3) keeps the contested content disabled pending the decision on the complaint. Under Article 102-decies(4), the provider's decision on a complaint can be contested by an appeal to AGCOM, without prejudice to the right to go to court.

Article 102-sexies(5) provides that the limitation of liability in Article 16 of Legislative Decree 70/2003 does not apply to the cases the Title covers.

Before its repeal, Article 16 of Legislative Decree 70/2003 provided that a hosting provider is not liable for information stored at a recipient's request on condition that it has no actual knowledge that the activity or information is unlawful and, once aware, acts immediately on communication from the competent authorities to remove the information or disable access to it.

Legislative Decree 50/2024, in force since 2 May 2024, repealed in its Article 3(4) Articles 14 to 17 of Legislative Decree 70/2003. Article 3(1) of Legislative Decree 177/2021 provides that these articles also apply to works protected under the national copyright rules in force on 7 June 2021 and saves the contracts concluded and the rights acquired until 6 June 2021.

Article 3(1) makes the public prosecutor's office competent under the code of criminal procedure the authority that issues a removal order to a hosting service provider where the terrorist content is attributable to an offense committed for terrorist purposes. In other cases the removal order is issued by the public prosecutor's office at the court of the district capital that first learned of the presence of terrorist content on publicly available telecommunications networks.

Where the content is user-generated and hosted on platforms attributable to third parties, only the specific unlawful content is removed. Article 3(8) provides that, in case of non-compliance, access to the internet domain is interdicted in the forms of Article 321 of the code of criminal procedure, preserving where technically possible the use of content unrelated to the unlawful conduct.

Under Article 3(9), a hosting service provider that received an order and a content provider whose content was removed can lodge an opposition before the judge for preliminary investigations within ten days of learning of the measure. Article 4(1) makes the judge for preliminary investigations at the court of the district capital where the provider has its main establishment, or where its legal representative resides or is established, the authority that examines cross-border removal orders.

Article 5(1) makes the body of the Ministry of the Interior for the security and regularity of telecommunication services the authority that issues the decision under Article 5(4) of the Regulation and supervises the implementation of the specific measures adopted by hosting service providers exposed to terrorist content.

Article 6(1) sets an administrative fine of EUR 25,000 to 100,000 for a hosting service provider that, among other failures, does not report execution of a removal order on the Annex II form, fails to preserve removed content as the Regulation requires, does not meet the transparency obligations, or does not set up the complaint mechanism.

Article 6(2) sets a fine of EUR 50,000 to 200,000 for a hosting service provider exposed to terrorist content that, among other failures, does not include in its terms and conditions provisions against misuse of its services for spreading terrorist content or does not report to the Interior Ministry body, within three months of a decision and at each annual interval, the specific measures it has adopted and intends to adopt.

Article 6(3) sets a fine of EUR 75,000 to 300,000 for an exposed provider that fails to adopt specific measures to protect its services or fails to adopt the measures a decision imposes. The territorial inspectorates of the competent directorate of the Ministry of Enterprises and Made in Italy impose these fines under Law 689/1981, after the Interior Ministry body, which ascertains and contests the violations, communicates them.

Article 7(1) punishes with arrest of up to six months or a fine (ammenda) of EUR 100,000 to 400,000 a hosting service provider that, among other failures, fails to designate or establish a point of contact for receiving removal orders electronically or to publish its details, or, having no main establishment in the Union, fails to designate a legal representative.

Article 7(2)(a) punishes with arrest of up to six months and a fine of EUR 100,000 to 400,000 a hosting service provider or legal representative that fails to remove terrorist content, or to disable access to it, within one hour of receiving the removal order.

Article 7(3) raises the penalty to arrest of up to one year and a fine of EUR 250,000 to 1,000,000 or, if higher, up to 4 % of the provider's worldwide turnover in the last financial year closed before the finding, where the failure under paragraph 2(a) is systematic or persistent.

Under Article 7(4), the judicial authority may order the interdiction of access to the internet domain where, in the cases of paragraph 1, the provider does not perform the omitted acts within fifteen days of the finding and the contestation of the violation.

Article 15(1) designates the Autorità per le garanzie nelle comunicazioni (AGCOM, the Communications Regulatory Authority) as Digital Services Coordinator under Article 49(2) of the Digital Services Act. Article 15(2) requires the Autorità garante della concorrenza e del mercato, the Garante per la protezione dei dati personali and every other competent national authority to give AGCOM every necessary cooperation within their respective competences.

Article 15(3) has AGCOM set by its own measure the conditions, procedures and operating methods for exercising its powers as Digital Services Coordinator. Article 15(4)(b) inserts paragraph 32-bis into Article 1 of Law 249/1997, under which AGCOM applies administrative fines for a violation of the obligations in Articles 9 to 18, 20 to 24, 26 to 28, 30 and 45 of the Digital Services Act.

The fine can reach 6 % of the provider's worldwide annual turnover in the financial year before AGCOM notifies the start of the proceedings. For inaccurate, incomplete or misleading information, a failure to reply or rectify it, or a failure to submit to an inspection, the fine can reach 1 % of the worldwide turnover of the previous financial year.

The maximum daily periodic penalty payment is 5 % of the provider's average daily worldwide turnover in the previous financial year, counted from the date specified in the decision. The reduced-payment benefit of Article 16 of Law 689/1981 is excluded for these fines. Article 15(5) meets the costs arising from the Article through a contribution of 0.135 per mille of the turnover shown in the last approved financial statements of providers of intermediary services established in Italy.

AGCOM may vary the rate and the payment methods for later years by a reasoned decision, up to a maximum of 0.5 per mille of turnover. The decree-law was converted with amendments by Law 159 of 13 November 2023.

Article 114(1) of the Codice del consumo makes the producer liable for the damage caused by defects in its product. The Codice del consumo took in the rules of Presidential Decree 224 of 24 May 1988, which had transposed Directive 85/374. Article 115(1) defines a product as any movable good (bene mobile), even if incorporated in another movable or immovable good. Article 115(2) treats electricity as a product.

Article 115(2-bis) defines the producer as the manufacturer of the finished product or of a component, the producer of the raw material and, for agricultural, livestock, fishing and hunting products, the farmer, breeder, fisher or hunter. The text of Article 115 now in force applies from 14 December 2007.

Article 116(1) puts the supplier under the same liability when the producer is not identified and the supplier fails to name the producer, or its own supplier, within three months of the injured person's request. Article 116(6) applies that rule to an imported product when the importer into the Union is not identified, even if the producer is known. Article 117(1) makes a product defective when it does not offer the safety that can legitimately be expected, taking all circumstances into account.

Article 117(3) also makes a product defective if it does not offer the safety normally offered by the other units of the same series. Article 118(1)(a) and (b) exclude liability where the producer did not put the product into circulation or the defect did not exist when it did. Article 118(1)(d) excludes liability where the defect is due to the product's compliance with a mandatory legal rule or a binding measure.

Article 118(1)(e) excludes liability where the state of scientific and technical knowledge when the producer put the product into circulation did not yet allow the product to be considered defective. Article 118(1)(f) excludes the liability of the producer or supplier of a component or raw material where the defect is entirely due to the design of the product it was built into or to the instructions of that product's producer.

Article 120(1) puts on the injured person the burden of proving the defect, the damage and the causal link between defect and damage. Article 120(2) puts on the producer the burden of proving the facts that exclude liability, and for the exclusion in Article 118(1)(b) it is enough to show that the defect probably did not yet exist when the product was put into circulation.

Article 120(3) lets the court order the producer to advance the cost of the technical expert opinion where it is plausible that a defect in the product caused the damage. Article 121(1) makes every person responsible for the same damage liable for the whole of it. Article 122(2) bars compensation where the injured person knew of the defect and the danger and still exposed itself to it voluntarily.

Article 123(1) covers death and personal injury, and the destruction or deterioration of a thing other than the defective product that is normally intended for private use or consumption and mainly used that way by the injured person. Article 123(2) makes damage to things compensable only in the amount that exceeds EUR 387. Article 124 voids any agreement that excludes or limits in advance the liability towards the injured person.

Article 125(1) sets a limitation period of three years from the day the injured person knew, or should have known, of the damage, the defect and the identity of the person responsible. Article 126(1) extinguishes the right to compensation ten years after the producer or the importer into the Union put the product into circulation. Article 127(1) leaves untouched the rights that other laws give the injured person.

Article 127(3) keeps the title from applying to products put into circulation before 30 July 1988. The Government's explanatory report on the draft implementing decree says that the notion of product in the 1985 directive, centred on movable goods, left uncertain whether software, integrated digital services and defects arising from updates are covered.

Law 4/2004 applies also to legal persons other than the bodies in Article 3(1) that offer services to the public through websites or mobile applications, where the turnover test of Article 3(1-bis) is met. Article 29 of Decree-Law 76/2020, in force from 17 July 2020, inserted Article 3(1-bis) and Article 9(1-bis).

Article 3(2) excludes from the accessibility duties content found only on mobile devices or mobile user programs developed for closed groups of users or for specific use and not available to or used by large segments of users, and content of extranets or intranets published before 23 September 2019 until it is substantially revised. Article 3-bis(1) makes the websites and mobile applications of those providers accessible if they are perceivable, usable, understandable and robust.

Article 3-bis(3) leaves the technical rules for those principles to the guidelines adopted under Article 11. Article 3-ter(1) requires the providers to apply the accessibility requirements on the basis of the Article 11 guidelines unless, for websites and mobile applications, that imposes a disproportionate burden.

Article 3-quater(1) and (2) require the providers to supply and periodically update a detailed accessibility declaration that states the content left without accessibility because of a disproportionate burden, describes the feedback mechanism, and links the procedure of Article 3-quinquies.

Under Article 3-quinquies the Agenzia per l'Italia Digitale verifies the declaration, and the Digital Civic Defender decides disputes over it and complaints by users who receive no satisfactory answer within thirty days, and orders corrective measures. Article 4(2) bars those providers from concluding, on pain of nullity, contracts for building or changing websites and mobile applications unless the contracts require compliance with the accessibility requirements of the Article 11 guidelines.

Article 4(2) also requires contracts in force when the Article 11 guidelines were published to be brought into line, on pain of nullity, when they are renewed, modified or novated. Article 4(1) extends to the purchases of those providers the rule that acquiring goods or computer services without the accessibility requirements is allowed only in the cases of Article 3(2) or for a disproportionate burden, with adequate reasons.

Article 4(2-bis) requires the websites and mobile applications of those providers to be brought into line with the accessibility requirements by 5 November 2022. Article 9(1-bis) has the Agenzia per l'Italia Digitale ascertain and sanction non-observance by those providers, fix a time limit to remove the infringements, and apply an administrative fine measured on turnover if the notice is not obeyed.

Article 9(1-bis) preserves the right of the person discriminated against to bring an action under Law 67/2006 on judicial protection of persons with disabilities who are victims of discrimination. Article 25(3) of Legislative Decree 82/2022 disapplies Articles 3-bis(3), 3-ter, 3-quater, 3-quinquies and 4(2) and (2-bis) of Law 4/2004 from 28 June 2025 to the persons who provide the services that decree governs.

The Agency's guidelines for the providers of Article 3(1-bis) state that conformity with level AA of WCAG 2.1 is equivalent to conformity with the points of the harmonised standard that they list. Those guidelines refer to the European technical standard EN 301 549 version 3.2.1 (2021-03).

Article 3(1) applies Law 4/2004 to, among others, private companies that hold concessions for public services, companies that contract to supply computer services, and all persons who benefit from public contributions or concessions for supplying their services through information systems or the internet.

Article 3(2) excludes from the accessibility duties content found only on mobile devices or mobile user programs developed for closed groups of users or for specific use and not available to or used by large segments of users, and content of extranets or intranets published before 23 September 2019 until it is substantially revised. Article 3-bis(1) makes the websites and mobile applications of those providers accessible if they are perceivable, usable, understandable and robust.

Article 3-ter(1) requires the providers to apply the accessibility requirements on the basis of the Article 11 guidelines unless, for websites and mobile applications, that imposes a disproportionate burden. Article 3-quater(1) and (2) require the providers to supply and periodically update a detailed accessibility declaration that states the content left without accessibility because of a disproportionate burden, describes the feedback mechanism, and links the procedure of Article 3-quinquies.

Article 3-quinquies has the Agenzia per l'Italia Digitale verify the declaration and the Digital Civic Defender decide on disputes over it and order corrective measures. Article 4(2) bars those providers from concluding, on pain of nullity, contracts for building or changing websites and mobile applications unless the contracts require compliance with the accessibility requirements of the Article 11 guidelines.

Article 4(2) also requires contracts in force when the Article 11 guidelines were published to be brought into line, on pain of nullity, when they are renewed, modified or novated. Article 4(1) makes the accessibility requirements of the Article 11 guidelines necessary in the procedures of those providers to buy goods and supply computer services.

Article 4(3) makes the grant of public contributions to private persons for buying computer goods and services for workers with disabilities or for the public conditional on the goods and services meeting the accessibility requirements of the Article 11 guidelines.

Article 9(1) makes non-observance by the Article 3(1) subjects relevant to the performance evaluation of the managers responsible and a ground of managerial and disciplinary liability under Legislative Decree 165/2001, without prejudice to criminal and civil liability. Article 25(3) of Legislative Decree 82/2022 disapplies Articles 3-bis(3), 3-ter, 3-quater, 3-quinquies and 4(2) and (2-bis) of Law 4/2004 from 28 June 2025 to the persons who provide the services that decree governs.

Article 3(1)(zz) defines the Authority in the decree as the Authority for Communications Guarantees. Article 31(1) has the Authority adopt suitable and proportionate measures to make the services of audiovisual media providers progressively more accessible to persons with disabilities. Article 31(2) requires the providers to develop suitable action plans at least every three years and to report periodically to the Authority on the measures taken.

Article 31(4) requires audiovisual media services that carry emergency information, including public announcements in natural disasters, always to be provided in a way accessible to persons with disabilities. Article 31(5) has the Authority, after a notice of breach, warn the responsible provider to comply within a fixed period. If the provider does not comply with the warning, Article 31(5) applies Article 67(1)(q) and (2)(g).

Article 31(6) sets up an online single contact point at the Authority to give information and receive complaints. Article 67(1)(q) lists the rules on accessibility for users with disabilities in Article 31 among the rules whose breach the Authority sanctions. Article 67(2)(g) sets a fine of EUR 30,000 to EUR 600,000 for a breach of the rules of paragraph 1(q).

Article 8(1) and (2) require the importer to place on the market only products that conform to Article 3 and to verify, before doing so, that the manufacturer has carried out the conformity assessment, drawn up the technical documentation and affixed the CE marking.

Article 2(1)(u) and (v) define the importer as a natural or legal person established in the Union who places on the Union market a product from a third country, and the distributor as a natural or legal person in the supply chain, other than the manufacturer or the importer, who makes a product available on the market.

Article 8(3) requires an importer that considers a product non-conforming to inform the manufacturer and the supervisory authority and not to place it on the market until it conforms. Article 8(5) requires the importer to ensure that the product comes with instructions and safety information in Italian.

Article 8(6) and Article 9(3) require the importer and the distributor to ensure that, while a product is under their responsibility, its storage or transport conditions do not jeopardise its conformity. Article 8(7) requires the importer to keep a copy of the EU declaration of conformity for five years, to take corrective measures or withdraw a product it finds non-conforming, to inform the national authorities, and to keep a register of non-conforming products and complaints.

Article 8(8) requires the importer, on request, to give the Ministry or the authorities of the Member States the information and documentation showing conformity, in Italian or English, and to cooperate in removing the non-conformity.

Article 9(1) requires the distributor, before making a product available, to verify that it bears the CE marking, comes with the required documents and with instructions and safety information in Italian or English, and that the manufacturer and importer have complied with Articles 6 and 8. Article 9(2) requires a distributor that finds or has reason to believe a product is non-conforming not to place it on the market until it conforms and to inform the manufacturer or importer and the Ministry.

Article 9(4) requires the distributor to see that corrective measures are taken or the product withdrawn, and to inform the Ministry and the authorities of the Member States at once. Article 10 treats an importer or distributor that places a product on the market under its own name or trade mark, or modifies a product already on the market so as to affect conformity, as the manufacturer, subject to the manufacturer's duties under Article 6.

Article 11 requires the operators of Articles 6 to 9 to identify to the supervisory authorities, on request, each operator that supplied them with a product or to which they supplied one, and to keep that information for five years in each direction. Article 25(1) provides that the provisions of the decree have effect from 28 June 2025.

Article 1(2) applies the decree to general-purpose consumer computer hardware systems and the operating systems for them, to self-service payment terminals and to terminals for the services the decree covers, to consumer terminal equipment with interactive computing capability used for electronic communications services and for access to audiovisual media services, and to e-readers.

Article 2(1)(s) defines the manufacturer as a natural or legal person who makes a product, or has it designed or made, and markets it under its own name or trade mark. Article 3(1) requires those products to comply with the accessibility requirements of section I of Annex I and, except for self-service terminals, of section II.

Article 6(1) and (2) require the manufacturer to certify that the products were designed and made in conformity with Article 3, to prepare the technical documentation under Annex III, to carry out the conformity assessment procedure, and, if the result is positive, to draw up the EU declaration of conformity and affix the CE marking.

Article 6(3) requires the manufacturer to keep the technical documentation and the EU declaration of conformity for five years from the date the product is placed on the market.

Article 6(8) requires a manufacturer that finds or has reason to believe a product does not meet the accessibility requirements to bring it into conformity or withdraw it, to inform the Ministry and the national authorities of the Member States where it was made available, and to keep a register of non-conforming products and complaints.

Article 6(9) requires the manufacturer, on request, to give the Ministry or the authorities of the Member States the information and documentation needed to show conformity, in Italian or English, and to cooperate in the measures taken to make the products conform. Article 7(1) lets a manufacturer appoint an authorised representative by written mandate.

Article 7(1) requires the mandate to let the authorised representative at least keep the EU declaration of conformity and the technical documentation for five years, give the Ministry and the market surveillance authorities on reasoned request the information showing conformity, and cooperate with them. Article 7(2) excludes the compliance with Article 6 and the drawing up of the technical documentation from the mandate of the authorised representative.

Article 15(2) requires the EU declaration of conformity to be drawn up also in Italian on the model of Annex III to Decision 768/2008/EC and updated when the design, the product characteristics or the referenced standards change. Article 16 subjects the CE marking to the general principles of Article 30 of Regulation (EC) 765/2008 and requires it to be affixed visibly, legibly and indelibly before the product is placed on the market.

Article 13(1) applies the accessibility requirements only to the extent that compliance does not require a substantial modification that changes the nature of the product and does not impose a disproportionate burden on the operators concerned. Article 13(4) exempts the microenterprises that deal in products from the duty to document the disproportionate-burden assessment, although they must give the facts of the assessment if the Ministry asks.

Article 14 presumes a product that conforms to harmonised standards published in the Official Journal of the European Union to conform to the accessibility requirements those standards cover. Article 14(2) presumes the same for a product that conforms to technical specifications, or parts of them, to the extent they cover those requirements. Article 25(1) provides that the provisions of the decree have effect from 28 June 2025.

Article 1(1) provides that the decree states the accessibility requirements of products placed on the market from 28 June 2025.

Decree 82/2022 implements Directive (EU) 2019/882 on the accessibility requirements for products and services. Article 1(3) applies the decree to electronic communications services other than machine-to-machine transmission services, to services providing access to audiovisual media services, to elements of air, bus, rail and waterborne passenger transport services, to consumer banking services, to e-books and dedicated software, and to e-commerce services.

For passenger transport, the elements covered are websites, mobile services including mobile applications, electronic tickets and ticketing services, the provision of transport information, and interactive self-service terminals in the territory of the Union.

Article 1(5) excludes from the decree the content of websites and mobile applications that is pre-recorded time-based media or an office file format published before 28 June 2025, online maps and mapping services, third-party content, and archive content not updated after 28 June 2025.

Article 3(2) requires the services in Article 1(3) to comply with the accessibility requirements of sections III and IV of Annex I. Article 3(2) applies section III to every service in Article 1(3), while Article 4(3) of the Directive excepts urban and suburban transport services and regional transport services from section III. Article 3(3) exempts the microenterprises that provide services from those requirements.

Article 3(4) directs the Ministry of Economic Development, with the Ministry of Infrastructure and Sustainable Mobility and the political authority for technological innovation, to draw up guidelines for microenterprises. Article 12(1) requires a service provider to design and provide the services in conformity with the accessibility requirements of Article 3(2).

For the audiovisual media services defined in Article 2(1)(e), Article 12(1) requires the availability of more than one sensory channel to be ensured where possible. Article 12(2) requires the provider to prepare the information required by Annex IV on how the accessibility requirements are met, to make it available to the public in written and oral form, and to keep it while the service is operating.

Annex IV requires the provider to include that information in its general conditions or an equivalent document. Article 12(3) requires websites and mobile applications that give information on local public transport routes to show also the routes accessible to persons with disabilities. Article 12(4) requires the provider to put in place the measures needed to keep the provision of the service in constant conformity with the accessibility requirements.

Article 12(5) requires a provider of a non-conforming service to take the corrective measures needed and to inform the Agenzia per l'Italia Digitale and the national authorities of the Member States where it provides the service immediately.

Article 12(6) requires the provider, on reasoned request, to give the Agenzia per l'Italia Digitale and the competent authorities of the Member States the information needed to show conformity and to cooperate in the measures taken to bring the service into conformity.

Article 13(1) applies the accessibility requirements only to the extent that compliance does not require a substantial modification that changes the nature of the product or service and does not impose a disproportionate burden on the operators concerned. Article 13(2) and (3) require the operators to assess the disproportionate burden on the criteria of Annex V, to document the assessment and to keep the results for not less than five years from the last supply of a service.

Article 13(3) also requires the operators to give a copy of the assessment on request of the Ministry or of the competent authorities of the Member States. Article 13(5) requires a service provider that relies on the disproportionate-burden limb to renew the assessment when the service is changed, on request of the supervising authorities, and at least every five years.

Article 13(6) disapplies the disproportionate-burden limb for operators that receive public or private funding to improve accessibility. Article 13(7) requires operators other than microenterprises that rely on Article 13(1) for a specific service to inform the competent supervisory authorities.

Article 14 presumes a service that conforms to harmonised standards, or parts of them, published in the Official Journal of the European Union to conform to the accessibility requirements those standards cover. Article 14(2) presumes the same for a service that conforms to technical specifications, or parts of them, to the extent they cover those requirements.

Article 4 deems a transport service that meets the accessible-information requirements of Regulations (EC) 261/2004, 1107/2006, 1371/2007, 1177/2010 and 181/2011 and of the acts under Legislative Decree 57/2019 to conform to the corresponding requirements of the decree, unless the decree sets further requirements, which the service must then also meet.

Article 25(1) provides that service contracts concluded before 28 June 2025 may continue unchanged until they expire but for not more than five years from that date, and that until 28 June 2030 providers may keep providing their services with products they lawfully used before that date to provide similar services.

Article 25(2) lets self-service terminals lawfully used by service providers before 28 June 2025 stay in use for similar services until the end of their economically useful life, but for not more than twenty years from entry into use. Article 25(3) disapplies, from 28 June 2025, Articles 3-bis(3), 3-ter, 3-quater, 3-quinquies and 4(2) and (2-bis) of Law 4/2004 to the persons who provide the services the decree governs, subject to the last sentence of Article 24(1).

The Agenzia per l'Italia Digitale published its guidelines on the accessibility of services under Article 21(2) of the decree as version 1.0 of 4 March 2026. Those guidelines list EN 301 549 version 3.2.1 (2021-03) among the technical references.

Article 17(2) names the Ministry of Economic Development as the market surveillance authority for the products of the decree and charges it, where an operator relies on Article 13(1), to verify that the operator made the assessment, to review it, and to check conformity with the accessibility requirements. Article 2(1)(z) defines the economic operator as the manufacturer, the authorised representative, the importer, the distributor or the service provider.

Article 17(1) applies to products Articles 15(3), 16 to 19, 21, 23 to 28 and 29(2) and (3) of Regulation (EC) 765/2008. Article 17(3) makes the information the Ministry holds on operators' conformity and on their Article 13 assessments available to consumers on request and in an accessible format, subject to the confidentiality of trade secrets and personal data.

Article 18(1) requires the Ministry, where it has sufficient grounds to consider a product non-compliant, to assess it, and where it finds non-compliance to require the operator to take corrective measures within a reasonable period it sets, and then to set a further period for withdrawal from the market. Article 18(4) requires the operator to ensure that appropriate corrective measures are taken for the non-compliant products it made available on the Union market.

Article 18(5) requires the Ministry, if the operator does not take adequate corrective measures in time, to take all appropriate provisional measures to prohibit or restrict the making available of the product on the national market or to withdraw it. Article 18(7) deems a provisional measure justified if neither the Commission nor another Member State objects within ninety days, and has the Ministry then see that restrictive measures such as withdrawal from the market are taken without delay.

Article 18(2) directs the Minister of Economic Development to define the procedures for Article 18 by decree. An amending article adds to Article 2(1) of the decree the definition of withdrawal as letter ee-bis and adds Article 18(6-bis), which obliges the Ministry of Enterprises and Made in Italy to report to the Commission and the other Member States the measures it has taken when another Member State starts the Union safeguard procedure.

Law 103/2023 converting Decree-Law 69/2023 was published in the Gazzetta Ufficiale on 10 August 2023 and entered into force on 11 August 2023. Article 19 requires the Ministry to revoke its measure if the Union safeguard procedure finds it unjustified, and to withdraw a product from the market if a measure of another Member State is found justified.

Article 20 requires the Ministry to set a period in which the operator must end a formal non-compliance, such as a CE marking affixed in breach of Article 14, a missing marking, a missing, incorrect or incomplete EU declaration of conformity, unavailable or incomplete technical documentation, or missing, false or incomplete identification data, and to limit, prohibit or withdraw the product if the non-compliance persists.

Article 24(2) fines an operator that does not comply with what the supervisory authority orders under Article 18(4) between EUR 2,500 and EUR 30,000. Article 24(3) fines an operator that does not give the due cooperation in the activities of Articles 6(9), 7(1), 8(8), 9(5), 11, 12(5), and the last sentences of 13(3) and 13(4), between EUR 2,500 and EUR 30,000, save a reasoned refusal where the information requested could expose it to punitive administrative sanctions or a criminal offence.

Article 25(1) provides that the provisions of the decree have effect from 28 June 2025. The Agenzia per l'Italia Digitale states in its published answers that the Ministry of Enterprises and Made in Italy is the supervisory authority for the products of Article 1(2) and for the audiovisual media services of Article 3 of Legislative Decree 208/2021.

The Agency states there that those audiovisual media services fall to the competences the law gives the Autorità per le garanzie nelle comunicazioni (AGCOM) and the Ministry of Enterprises and Made in Italy.

Article 21(1) names the Agenzia per l'Italia Digitale as the supervisory authority for services and requires it, where it has sufficient grounds to consider a service non-compliant, to assess the service against each applicable requirement.

Where it finds that a service in Article 1(3), letters (a), (b), (c)(1) to (4), (d), (e) or (f), does not meet the requirements, Article 21(1) has the Agency require the provider to take corrective measures within a reasonable and proportionate period it sets.

If the provider does not act in time, Article 21(1) lets the Agency set a reasonable period to block the specific service and, where necessary, withdraw the mobile application from the store, or adopt measures inhibiting use of the service. Before inhibiting a transport service, Article 21(1) requires the Agency to obtain the opinion of the Transport Regulation Authority.

Article 21(2) directs the Agency to adopt guidelines for the implementation of Article 21, after the opinion of the Communications Authority for electronic communications and audiovisual media access services and of the Transport Regulation Authority for transport.

Article 21(3) charges the Agency to examine users' complaints, to verify conformity of the services including the Article 13 assessment, to verify that the provider adopted the corrective measures, and to ascertain the offences of Article 24 for services. Article 21(5) requires the Agency to inform the public, in accessible formats, of how complaints can be filed and of the resulting activities and decisions.

Article 21(6) gives the supervision of self-service terminals used for transport services to the public bodies that awarded or authorised the transport service. Article 24(1) punishes an operator that contravenes Articles 3, 12(1) to (4) and the other duties it lists, outside the exemptions of Articles 3(3) and 13(1), with an administrative fine of EUR 5,000 to EUR 40,000.

For a legal person within Article 3(1-bis) of Law 4/2004, Article 24(1) applies in every case the sanction of Article 9(1-bis) of that Law. Article 24(2) fines an operator that does not comply with what the supervisory authority orders under Article 21(4) between EUR 2,500 and EUR 30,000.

The Agenzia per l'Italia Digitale states that any person may file a complaint about an accessibility problem in a digital service listed in the decree, and that it will verify compliance and may ask the provider to take corrective measures. The Agency also states that the audiovisual media services of Article 3 of Legislative Decree 208/2021 are excluded from its competence and fall to the Autorità per le garanzie nelle comunicazioni (AGCOM) and the Ministry of Enterprises and Made in Italy.

The Agency's regulation on the exercise of its sanctioning power sets 90 days from receipt of the notice opening the proceedings for concluding the sanctioning procedure. The Agency states in its published answers that a provider within Article 3(1-bis) of Law 4/2004 that provides a service governed by the decree no longer has to file the accessibility declaration of Law 4/2004. Article 25(1) provides that the provisions of the decree have effect from 28 June 2025.

Article 1(1) of Resolution 291/25/CONS approves the measures for the first accessibility action plans of audiovisual media service providers. Article 1(2) applies the measures to linear and on-demand audiovisual media service providers under Italian jurisdiction, including the public service concessionaire. Article 1(2) excludes radio broadcasters and radio media service providers from the measures.

Article 1(4) excludes at first application local audiovisual media service providers, pay audiovisual media service providers, and radio broadcasters and radio media service providers that also provide audiovisual content. Article 1(5) requires the obligated providers to report on the measures taken in each calendar year by 15 February of the following year, and the public service concessionaire to report by 15 April.

Article 1(7) has the Authority, after a notice of breach, warn the providers to comply with Article 31 of the decree and its implementing rules within a fixed period. If a provider does not comply with the warning, Article 1(7) applies Article 67(1)(q) and (2)(g) of the decree. Article 1(8) sets up the online single contact point at the Authority. The Authority published Resolution 291/25/CONS on its website on 18 December 2025.

Article 1(9) requires the providers to ensure the accessibility of the services that give access to audiovisual media services under Article 1(3)(b) of Legislative Decree 82/2022.

Article 79 of Legislative Decree 36/2023, the public contracts code, leaves the technical specifications to Annex II.5. Annex II.5, Part II, point 3, requires that, for every contract intended for use by natural persons, the technical specifications be drawn up, save in duly justified cases, so as to take account of the accessibility criteria for persons with disabilities or of design for all users.

Part I, point 1(b), defines the technical specifications of service and supply contracts as the characteristics required of a product or service, among them a design that takes account of all requirements, accessibility for persons with disabilities included.

Article 22(1) of Legislative Decree 82/2022, which implements Article 24(1) of Directive (EU) 2019/882, makes the accessibility requirements of its Annex I the mandatory accessibility requirements for the products and services of its Article 1 within the meaning of Articles 68 and 170 of Legislative Decree 50/2016.

Article 226(1) of Legislative Decree 36/2023 repealed Legislative Decree 50/2016 from 1 July 2023, and Article 226(5) reads every reference to it in force as a reference to the corresponding provisions of the new code. Article 22(2) presumes a product or service whose features, elements or functions meet section VI of Annex I to meet the accessibility obligations of other Union acts for those features, unless otherwise provided.

Article 25(1) of Legislative Decree 82/2022 gives its provisions effect from 28 June 2025. The code entered into force on 1 April 2023 and its provisions took effect on 1 July 2023.

Article 42(1) requires a video-sharing platform provider subject to Italian jurisdiction to take appropriate measures to protect minors from programmes, user-generated videos and audiovisual commercial communications that may impair their physical, mental or moral development. Under paragraph 7(f), the provider must set up systems to verify the age of platform users, in compliance with personal data protection law, for content that may harm the physical, mental or moral development of minors.

Under paragraph 7(h), the provider must have parental control systems under the supervision of the end user for that content. Under paragraph 6, the most harmful content is subject to the strictest access-control measures. Under paragraph 8, personal data of minors collected or generated for the age verification and parental control systems is not processed for commercial purposes.

Paragraph 11 applies the article, so far as compatible, to platforms for audio-only content or user-generated audio. In the Act, the Authority means the Autorità per le garanzie nelle comunicazioni (AGCOM). Under paragraph 10, a violation of the article by the provider attracts the administrative sanctions of Article 67(9). Article 67(9) provides an administrative fine of 30,000 to 600,000 euros, or up to one percent of annual turnover where that percentage exceeds 600,000 euros. A later corrective legislative decree replaced Article 42 as a whole.

Establishes a legal duty for website operators and video sharing platform providers that distribute pornographic images or videos in Italy to verify that users are adults before granting access, delegating the technical and process details to AGCOM.

In judgments published on 7 April 2026 the regional administrative court of Lazio (TAR Lazio), after disapplying Article 13-bis, annulled the part of AGCOM's implementing delibera that starts the duty against providers established in other Member States three months after the list of covered sites, because AGCOM had not first asked the Member State of establishment to act or notified the European Commission.

The court rejected the argument that the Digital Services Act leaves no room for the national duty. AGCOM must follow the procedure of Article 3(4)(b) of Directive 2000/31/EC before the measures reach a provider established in another Member State.

Adopts the binding technical and process rules that website managers and video-sharing platform providers must use to verify users are adults before granting access to pornographic content, using a dual anonymity model with independent certified third party verifiers so that neither the verifier nor the site learns both the user's identity and the service accessed.

Providers established in Italy had six months from publication, until 12 November 2025, to comply; AGCOM issued a list of covered sites in a communication of 31 October 2025. AGCOM's published guidance gives the same date, 12 November 2025, for providers established outside the European Union, and 1 February 2026 for providers established in another Member State.

In judgments published on 7 April 2026 the regional administrative court of Lazio (TAR Lazio) annulled the part of the delibera that starts the measures against providers established in other Member States three months after publication of the list, because AGCOM had not first asked the Member State of establishment to act or notified the European Commission.

Before AGCOM extends the measures to those providers it must follow the procedure of Article 3(4)(b) of Directive 2000/31/EC, and the delibera can take effect against them only if the Member State of establishment has then not adopted adequate measures and the Commission has raised no objection.

Sets 14 as the minimum age at which a minor can independently consent to processing of personal data for an information society service, including registering for a social media account. Providers must obtain parental consent for users under 14. This functions as Italy's de facto minimum social media registration age, though it is a data protection consent rule rather than a mandated identity verification requirement.

AGCOM regulation 3/23/CONS sets the criteria and the procedure for the equitable compensation that information-society service providers owe press publishers for the online use of journalistic publications under Article 43-bis of the copyright act. It applies to publications aimed at the Italian public, judged for example by the language used or the revenue earned in Italy.

It does not apply to private or non-commercial use by individual users, to hyperlinks, or to single words or very short extracts. For providers other than media-monitoring and press-review businesses, the compensation is calculated on the provider's advertising revenue from the online use of the publisher's publications, net of the publisher's revenue from the traffic redirected to its own site.

A rate of up to 70 percent applies to that base, set cumulatively on criteria that include online consultations of the publisher's articles, the publisher's market relevance, the journalists it employs, both parties' investment costs and the publisher's years of activity.

For media-monitoring and press-review businesses, the compensation is calculated on the relevant turnover from activities connected to media monitoring and press reviews, weighed against criteria that include the number of articles reproduced and the number of end users under written contract. On the request of the interested party or of AGCOM, a provider must make available the data needed to apply the criteria.

A provider that does not supply the information within thirty days of a request faces an administrative fine of up to 1 percent of its turnover in the national market. During negotiation, a provider must not limit the visibility of publishers' content in search results. If no agreement is reached within thirty days of a request to negotiate, either party may apply to AGCOM within the following sixty days.

AGCOM's governing body decides within sixty working days of receiving the application which of the parties' proposals conforms to the criteria, and sets the amount itself if neither does. The regulation enters into force on the thirtieth day after its publication on the AGCOM website. It was published on 25 January 2023, so it took effect on 24 February 2023.

Press publishers, whether acting singly, in association, or as a consortium, hold the exclusive reproduction and communication-to-the-public rights of LDA Articles 13 and 16 over the online use of their journalistic publications by information-society service providers, including media-monitoring and press-review businesses (comma 1).

A journalistic publication is a collection of mainly journalistic literary works, which may include photographs or video, forming a single item of a periodical publication under one title, published under an editor's or press agency's editorial responsibility and control; purely scientific or academic periodicals are excluded (comma 2). The right does not reach private or non-commercial use by individual users, hyperlinking, or the use of single words or very short extracts (comma 6).

A very short extract is defined as any portion of the publication that does not dispense the reader from consulting the article in full (comma 7).

An online service must pay the publisher equitable compensation ("equo compenso") for online use, and AGCOM adopts the regulation setting the criteria for that compensation, weighing factors including the number of online consultations of the article, the publisher's years of activity and market relevance, the number of journalists it employs, both parties' technology and infrastructure investment costs, and both parties' economic benefits from the publication in visibility and advertising revenue (comma 8).

If the parties cannot agree an amount within thirty days of a request to negotiate, either may ask AGCOM to determine the equitable compensation, and AGCOM decides within sixty days based on the same regulatory criteria (commi 9-10). If the parties still do not reach a contract after AGCOM's determination, either may bring the matter before the specialised business-law section of the ordinary courts (comma 11).

The rights lapse two years after publication, counted from 1 January of the year following the date of publication (comma 14). The article does not apply to journalistic publications first published before 6 June 2019 (comma 15). The decree that inserted the article was published in the Gazzetta Ufficiale of 27 November 2021 (issue 283). Article 43-bis has been in force since 12 December 2021.

Current-affairs articles of an economic, political or religious character, published in magazines or newspapers, or broadcast, or made available to the public, and other material of the same character, may be freely reproduced or communicated to the public in other magazines or newspapers, including broadcast ones, if reproduction or use has not been expressly reserved, provided the source, date and author's name (if given) are indicated (comma 1).

Reproduction or communication to the public of protected works or material used on the occasion of current events is permitted for the exercise of the right to report news, within the limits of that informational purpose, again with source and author credited unless impossible (comma 2). The current text of Article 65 has been in force since 29 April 2003.

The summary, quotation or reproduction of passages or parts of a work, and their communication to the public, is free if done for criticism or discussion, within the limits justified by that purpose and provided it does not compete with the work's economic exploitation; if done for teaching or scientific research, the use must also be illustrative in purpose and non-commercial (comma 1).

A summary, quotation or reproduction must always be accompanied by the title of the work, the names of the author, publisher and, for a translation, the translator, where those appear on the reproduced work (comma 3). Commas 1 and 3 have had their present wording since 29 April 2003, when Legislative Decree 68 of 9 April 2003 came into force.