Vatican City

Decree No. DCCII of the Pontifical Commission for Vatican City State, dated 16 December 2024, promulgates Guidelines on Artificial Intelligence that took effect on 1 January 2025 (art. 2).

The Guidelines bind the Governorate's operational and scientific bodies, its judicial organs, Governorate personnel, and the economic operators, suppliers, bidders and temporary professional appointees engaged under the Vatican's public-contracting decree, within Vatican City State territory or the Lateran Treaty extraterritorial zones (art. 1, paragraphs 1 and 3); they state no general duty reaching an ordinary private business outside that public-contracting relationship.

Article 4 bans seven uses of an AI system outright: drawing discriminatory anthropological inferences about a person; applying subliminal-manipulation techniques capable of physical or psychological harm; denying persons with disabilities access to AI and its functions; creating social inequalities that degrade human dignity; compromising the security of Vatican City State or public order; acting against the mission of the Supreme Pontiff or the integrity of the Catholic Church; and otherwise contravening the Guidelines.

Article 7 requires AI-generated textual, musical, photographic, audiovisual, radio or figurative-art content to be identified with the acronym “IA”, and vests the Governorate with exclusive authorship and economic rights over such content created within Vatican City State territory.

Article 12 reserves to the magistrate alone the decision on the interpretation of law, the evaluation of facts and evidence, and the adoption of any measure, permitting an AI system only for organizing and simplifying judicial work and for legal and doctrinal research.

Article 14 establishes a five-member AI Commission, chaired by the Secretary General, that drafts implementing laws and regulations, opines on proposed AI trials and applications, monitors deployment, and reports on AI's impact every six months; members serve renewable three-year terms. Article 15 calls for implementing laws and regulations within twelve months of the Guidelines' entry into force.

The Guidelines create no external supervisory authority beyond the Commission, state no penalty for a violation, and establish no private right of action.

Legge N. VIII of 11 July 2013, Vatican City State's supplementary penal-law statute, entered into force on 1 September 2013 (art. 55).

Article 4(d) defines “materiale pedopornografico” (child sexual abuse material) as any representation of a minor, regardless of the medium used, involved in real or simulated explicit sexual activity, or any representation of a minor's sexual organs for predominantly sexual purposes; the definition is medium-neutral and reaches a simulated depiction on the same footing as a real one, so its text extends to a computer-generated or AI-generated depiction of a minor and not only to a photograph of a real child, even though the statute was drafted before generative AI and never uses that term.

Article 10 § 1 punishes producing such material using a minor, or recruiting or inducing a minor into a pornographic exhibition, with six to twelve years' imprisonment and a fine of 25,000 to 250,000 euro; § 2 applies the same penalty to trading in the material.

Article 10 § 3 punishes distributing, disseminating, transmitting, importing, exporting, offering, selling, or possessing such material for those purposes by any means, including telematically, with one to five years' imprisonment and a fine of 2,500 to 50,000 euro. Article 10 § 4 punishes offering or transferring the material, even without payment, with up to three years' imprisonment and a fine of 1,500 to 15,000 euro, increased under § 5 where the quantity is substantial.

Article 10 § 6 punishes attending a pornographic exhibition of a minor with up to two years' imprisonment and a fine up to 10,000 euro. Article 11 § 1 separately punishes procuring or knowingly possessing such material, outside the article 10 cases, with up to two years' imprisonment and a fine of 1,500 to 10,000 euro, increased under § 2 where the quantity is substantial.

Every offence binds any person (“chiunque”), and the statute states no exception for a computer-generated or AI-generated depiction.

Article 1 of the Regulation states rules on the protection of physical persons with regard to the treatment of personal data and norms on the free movement of such data, respecting human dignity and fundamental freedoms. Article 2, paragraph 1 makes implementation of the Regulation the responsibility of the Governorate, within the limits of the territory of Vatican City State, or for activities the Governorate carries out in the zones named in the Lateran Treaty.

Article 2, paragraph 2 excludes from that implementation personal data treatment a physical person carries out for exclusively personal reasons and does not destine for systemic circulation, data the Interested party has made clearly public, and anonymous data.

Article 11, paragraph 1 identifies the Data Controller as the Governorate, represented by the General Secretary, who decides the purposes and methods of data treatment, and paragraph 2 requires identifying organizational and technical security measures suitable to guaranteeing personal data protection.

Article 12 lets the Data Controller choose, from the senior roles of the Bodies of the Governorate, those responsible for treatment, who implement the Regulation and may appoint Representatives, and Article 13 has the Data Controller and each person responsible for treatment designate one or more Representatives in a written document, authorized to put security measures into action and identified in the Register of treatment activities.

The Regulation is modelled on the European Union's General Data Protection Regulation, but names no private-sector entity and Vatican City State has no ordinary private commercial sector at meaningful scale, so its practical effect is government and institutional processing rather than a general private-sector regime.

The Regulation gives the Interested party specific procedures to exercise the right to access, change, cancel, exercise the right to data portability and to limit the treatment of their personal data, exercised by a written or electronic request to the Data Controller. No response deadline for the Data Controller, or required format for data portability, is stated.

Article 25 gives the Interested party the right to make a written complaint to the Data Protection Officer where they feel a data treatment violates the Regulation, except in cases involving the judicial authority of Vatican City State. Article 10, paragraph 2 assigns the Data Protection Officer function to the General Councillor of Vatican City State, and paragraph 3 has that officer carry out the responsibility and exercise power independently and autonomously.

The complaint procedure sits alongside the preliminary involvement of the Data Controller and a possible recourse to Vatican judicial authorities, and no separate external supervisory authority, fine, or criminal offence provision is stated for the Regulation.

Legge N. DXXXI of 6 September 2022 amended Vatican City State's Penal Code, entering into force on 15 September 2022 (art. 31).

New article 158 ter punishes whoever abusively enters a computer or telematic system protected by security measures, or remains in it against the express or implied will of the person entitled to exclude them, with up to three years' imprisonment; the penalty rises to one to five years where a public official or a person entrusted with a public service commits the offence abusing their powers or duties, or with violence to persons or property, or where the offence causes destruction or damage to the system or an interruption of its operation, or destruction or damage to the data, information, or programs it holds; and it rises further, to three to eight years, where the system belongs to the Holy See, Vatican City State, or another public authority.

The base offence is prosecuted only on the victim's complaint; the aggravated forms proceed on the State's own initiative.

New article 158 quater punishes whoever, to gain a profit or cause harm, abusively procures, reproduces, disseminates, communicates, or supplies passwords, access codes, or other means suited to accessing a protected computer or telematic system, or otherwise supplies instructions for that purpose, with up to one year's imprisonment; this offence too is prosecutable only on complaint where the system belongs to a private party.

Neither provision addresses the status of a public, unauthenticated page carrying no security measure, and no reported Vatican City State case construes either article.

Legge N. CXCVII of 1 September 2017 repealed Vatican City State's prior copyright statute, Legge N. CXXXII of 19 March 2011, and entered into force on 1 October 2017 (art. 8).

Vatican City State has no autonomous copyright code of its own scope: article 1 § 1 provides that, except as this law states otherwise, Vatican City State observes the copyright and related-rights legislation in force in Italy, including its implementing regulations, so long as that legislation is not contrary to divine law, the general principles of canon law, the Lateran Pacts, or an international agreement the Holy See has joined, and so long as it is applicable given Vatican City State's own factual and legal situation; article 1 § 2 provides that a future amendment to Italian copyright legislation is automatically received into Vatican City State's own law on the same terms.

The law's own additions to that imported regime are narrow: article 2 extends copyright and related-rights protection to the published texts of Holy See and Vatican City State laws and official acts; article 3 protects the writings, speeches, image, and voice of the Roman Pontiff, and of emeritus and deceased Pontiffs, against exposure, reproduction, or commercial use without the Secretary of State's consent where doing so would prejudice his honour or dignity, with the Secretary of State empowered to litigate those rights before Vatican and foreign courts; article 4 confines the right to photograph or otherwise reproduce Vatican City State's protected cultural property to the institutions that hold custody of it, for a 70-year term from first fixation; and article 5 vests copyright in works the Holy See or Vatican City State create or publish under their own name, for 70 years from first publication or from the author's death where named, with article 6 preserving moral rights of attribution and integrity regardless of any transfer of the economic rights.

Article 7 creates a Commission for Intellectual Property, chaired by the Assessor of the Secretariat of State, that coordinates administration of the imported regime and mediates disputes among the entities article 5 covers.

The law states no independent Vatican City State text-and-data-mining exception, quotation right, or database right of its own; whatever such a right or exception exists is only the one the imported Italian legislation itself provides, and its current content is a question for Italian law rather than for this statute's own text.