Vatican City

Decree No. DCCII of the Pontifical Commission for Vatican City State, dated 16 December 2024, promulgates Guidelines on Artificial Intelligence that took effect on 1 January 2025 (art. 2).

The Guidelines bind the Governorate's operational and scientific bodies, its judicial organs, Governorate personnel, and the economic operators, suppliers, bidders and temporary professional appointees engaged under the Vatican's public-contracting decree, within Vatican City State territory or the Lateran Treaty extraterritorial zones (art. 1, paragraphs 1 and 3); they state no general duty reaching an ordinary private business outside that public-contracting relationship.

Article 4 bans seven uses of an AI system outright: drawing discriminatory anthropological inferences about a person; applying subliminal-manipulation techniques capable of physical or psychological harm; denying persons with disabilities access to AI and its functions; creating social inequalities that degrade human dignity; compromising the security of Vatican City State or public order; acting against the mission of the Supreme Pontiff or the integrity of the Catholic Church; and otherwise contravening the Guidelines.

Article 7 requires AI-generated textual, musical, photographic, audiovisual, radio or figurative-art content to be identified with the acronym “IA”, and vests the Governorate with exclusive authorship and economic rights over such content created within Vatican City State territory.

Article 12 reserves to the magistrate alone the decision on the interpretation of law, the evaluation of facts and evidence, and the adoption of any measure, permitting an AI system only for organizing and simplifying judicial work and for legal and doctrinal research.

Article 14 establishes a five-member AI Commission, chaired by the Secretary General, that drafts implementing laws and regulations, opines on proposed AI trials and applications, monitors deployment, and reports on AI's impact every six months; members serve renewable three-year terms. Article 15 calls for implementing laws and regulations within twelve months of the Guidelines' entry into force.

The Guidelines create no external supervisory authority beyond the Commission, state no penalty for a violation, and establish no private right of action.

Legge N. VIII of 11 July 2013, Vatican City State's supplementary penal-law statute, entered into force on 1 September 2013 (art. 55).

Article 4(d) defines “materiale pedopornografico” (child sexual abuse material) as any representation of a minor, regardless of the medium used, involved in real or simulated explicit sexual activity, or any representation of a minor's sexual organs for predominantly sexual purposes; the definition is medium-neutral and reaches a simulated depiction on the same footing as a real one, so its text extends to a computer-generated or AI-generated depiction of a minor and not only to a photograph of a real child, even though the statute was drafted before generative AI and never uses that term.

Article 10 § 1 punishes producing such material using a minor, or recruiting or inducing a minor into a pornographic exhibition, with six to twelve years' imprisonment and a fine of 25,000 to 250,000 euro; § 2 applies the same penalty to trading in the material.

Article 10 § 3 punishes distributing, disseminating, transmitting, importing, exporting, offering, selling, or possessing such material for those purposes by any means, including telematically, with one to five years' imprisonment and a fine of 2,500 to 50,000 euro. Article 10 § 4 punishes offering or transferring the material, even without payment, with up to three years' imprisonment and a fine of 1,500 to 15,000 euro, increased under § 5 where the quantity is substantial.

Article 10 § 6 punishes attending a pornographic exhibition of a minor with up to two years' imprisonment and a fine up to 10,000 euro. Article 11 § 1 separately punishes procuring or knowingly possessing such material, outside the article 10 cases, with up to two years' imprisonment and a fine of 1,500 to 10,000 euro, increased under § 2 where the quantity is substantial.

Every offence binds any person (“chiunque”), and the statute states no exception for a computer-generated or AI-generated depiction.

Article 13, paragraph 2 requires the Referente to communicate to the person responsible for treatment and to the Data Protection Officer, within 72 hours from the moment the Referente learns of it, the violations of the Security Measures and the resulting violations of Personal data that are found.

Article 3 defines a violation of Personal data as a violation of the security measures that leads, accidentally or knowingly, to the destruction, loss, alteration, unauthorized disclosure of or access to Personal data that are transmitted, stored or otherwise treated.

Article 1 of the Regulation states rules on the protection of physical persons with regard to the treatment of personal data, and rules on the free movement of such data, respecting human dignity and the rights and freedoms of the person.

Article 2, paragraph 1 applies the Regulation to treatment of personal data carried out by the Governorate, limited to the territory of Vatican City State or to activities the Governorate carries out in the zones named in Articles 15 and 16 of the Lateran Treaty.

Article 2, paragraph 2 excludes treatment a physical person carries out for exclusively personal purposes where the data are not destined for systematic communication or dissemination, data the Interested party has made manifestly public, and anonymized data. Article 11, paragraph 1 makes the Data Controller the Governorate, represented by its General Secretary.

Article 11, paragraph 2 has the Data Controller determine the purposes and methods of treatment so that those responsible for treatment can identify technical and organizational measures (Security Measures) suited to guarantee the protection of personal data. Article 12, paragraph 1 has the Data Controller choose, from the senior roles of the Bodies of the Governorate, those responsible for treatment, who implement the Regulation and appoint Referenti where the Regulation provides.

Article 13 has the Data Controller and each person responsible for treatment designate one or more Referenti, drawn from their employees, by a written act setting the duration, content, duties and responsibilities of the appointment, and makes the Referenti the persons authorized to put into effect the Security Measures identified in the Register of treatment activities.

Because the Regulation applies only to treatment carried out by the Governorate, its practical effect is government and institutional processing rather than a general private-sector regime.

Article 15, paragraph 1 has the Interested party exercise the rights in Title VI by a written request, on paper or electronically, addressed to the Data Controller. Article 16, paragraph 2 sets the response deadline for every right at 30 working days, extendable to 90 days in cases of particular complexity, and paragraph 3 requires a written answer even where the request is refused.

Article 17, paragraph 1 gives the right to obtain confirmation of whether personal data are being treated and access to them. Article 18 gives the right to rectification of personal data without undue delay. Article 19, paragraph 1 gives the right to erasure without undue delay where one of the listed grounds applies.

Article 20, paragraph 1 gives the right to receive the personal data provided to the Data Controller in a structured, commonly used and readable format and to transmit them to another controller outside the scope of the Regulation, where the treatment rests on consent. Article 21 gives a right to object, including to treatment for direct marketing and the profiling connected to it, and Article 22 gives a right to restriction of treatment.

Article 25 gives the Interested party, without prejudice to recourse to the judicial authority of Vatican City State, the right to make a written complaint to the Data Protection Officer where they consider that the treatment of their data violates the Regulation.

Article 10, paragraph 2 always assigns the Data Protection Officer function to the General Councillor of Vatican City State, and paragraph 3 has that officer act in full independence in carrying out the tasks and exercising the powers the Regulation gives. Under Article 26, paragraph 3, the Data Protection Officer issues a reasoned opinion on a complaint within 30 days, extendable to 90 days in a particularly complex case, and sends it to the President of the Governorate.

Article 27, paragraph 1 has the President of the Governorate close the complaint procedure with a reasoned ordinance, not open to appeal, upholding or rejecting the complaint. Where a complaint is upheld, Article 27, paragraph 3 allows the ordinance to contain reprimands, admonitions and appropriate corrective measures.

Article 27, paragraph 2 provides that an ordinance upholding the complaint refers the Interested party to the competent judicial authority for any claim for compensation of material or immaterial damage caused by the treatment.

Article 6, paragraph 1 prohibits treating Personal data that reveal racial or ethnic origin, political opinions or religious convictions, and treating genetic data, biometric data intended to identify a natural person uniquely, health data or other situations connected with the private life of the person.

Article 6, paragraph 2, letter a lifts the prohibition where the Interested party has given explicit consent to the treatment of such Personal data for one or more specific purposes, unless the consent is revoked.

Article 6, paragraph 2, letter b lifts the prohibition where the treatment is necessary to meet the specific obligations and exercise the specific rights of the Data Controller or of the Interested party in matters of employment and of health and safety of workers at the workplace, with appropriate safeguards for the Interested party.

Legge N. DXXXI of 6 September 2022 amended Vatican City State's Penal Code, entering into force on 15 September 2022 (art. 31).

New article 158 ter punishes whoever abusively enters a computer or telematic system protected by security measures, or remains in it against the express or implied will of the person entitled to exclude them, with up to three years' imprisonment; the penalty rises to one to five years where a public official or a person entrusted with a public service commits the offence abusing their powers or duties, or with violence to persons or property, or where the offence causes destruction or damage to the system or an interruption of its operation, or destruction or damage to the data, information, or programs it holds; and it rises further, to three to eight years, where the system belongs to the Holy See, Vatican City State, or another public authority.

The base offence is prosecuted only on the victim's complaint; the aggravated forms proceed on the State's own initiative.

New article 158 quater punishes whoever, to gain a profit or cause harm, abusively procures, reproduces, disseminates, communicates, or supplies passwords, access codes, or other means suited to accessing a protected computer or telematic system, or otherwise supplies instructions for that purpose, with up to one year's imprisonment; this offence too is prosecutable only on complaint where the system belongs to a private party.

Neither provision addresses the status of a public, unauthenticated page carrying no security measure, and no reported Vatican City State case construes either article.

Legge N. CXCVII of 1 September 2017 repealed Vatican City State's prior copyright statute, Legge N. CXXXII of 19 March 2011, and entered into force on 1 October 2017 (art. 8).

Vatican City State has no autonomous copyright code of its own scope: article 1 § 1 provides that, except as this law states otherwise, Vatican City State observes the copyright and related-rights legislation in force in Italy, including its implementing regulations, so long as that legislation is not contrary to divine law, the general principles of canon law, the Lateran Pacts, or an international agreement the Holy See has joined, and so long as it is applicable given Vatican City State's own factual and legal situation; article 1 § 2 provides that a future amendment to Italian copyright legislation is automatically received into Vatican City State's own law on the same terms.

The law's own additions to that imported regime are narrow: article 2 extends copyright and related-rights protection to the published texts of Holy See and Vatican City State laws and official acts; article 3 protects the writings, speeches, image, and voice of the Roman Pontiff, and of emeritus and deceased Pontiffs, against exposure, reproduction, or commercial use without the Secretary of State's consent where doing so would prejudice his honour or dignity, with the Secretary of State empowered to litigate those rights before Vatican and foreign courts; article 4 confines the right to photograph or otherwise reproduce Vatican City State's protected cultural property to the institutions that hold custody of it, for a 70-year term from first fixation; and article 5 vests copyright in works the Holy See or Vatican City State create or publish under their own name, for 70 years from first publication or from the author's death where named, with article 6 preserving moral rights of attribution and integrity regardless of any transfer of the economic rights.

Article 7 creates a Commission for Intellectual Property, chaired by the Assessor of the Secretariat of State, that coordinates administration of the imported regime and mediates disputes among the entities article 5 covers.

The law states no independent Vatican City State text-and-data-mining exception, quotation right, or database right of its own; whatever such a right or exception exists is only the one the imported Italian legislation itself provides, and its current content is a question for Italian law rather than for this statute's own text.

Article 1 of Regulation No. 3 applies it to entities carrying out financial activities on a professional basis within the State that are authorized for issuing and managing means of payment. Article 61(1) of Regulation No. 3 requires payment service providers to establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks relating to the payment services they provide.

Article 61(2) of Regulation No. 3 requires payment service providers to give the Financial Information Authority, each year or at shorter intervals the Authority sets, an updated and comprehensive assessment of those risks and of the adequacy of the mitigation measures. Article 4 of Instruction No. 4 applies its provisions consistently with the principle of proportionality, taking into account the provider's size and the nature, scope, complexity and riskiness of its services.

Article 5 of Instruction No. 4 requires a payment service provider to establish an effective operational and security risk management framework. Article 5 requires the provider to communicate the framework to the Financial Information Authority within 30 days of its adoption or annual update. Article 6 requires the internal control model, including the security measures, to be audited by external auditors with expertise in IT security and payments.

Article 9 requires the provider to carry out and document a risk assessment of its functions, processes and information assets once a year, and before any major change affecting the security of payment services. Article 9 requires the provider to give the Authority its updated and comprehensive risk assessment within 30 days of its adoption or annual update.

Article 10 requires the provider to establish and implement preventive security measures against the identified operational and security risks. Article 10 requires the provider to implement a defence-in-depth approach of multi-layered controls covering people, processes and technology. Article 20 requires the provider's testing of its security measures to include vulnerability scans and penetration tests adequate to the level of risk identified with its payment services.

Article 34 of Instruction No. 4 provides that for a violation of the Instruction the Authority may apply the administrative sanctions established by Article 69 of Regulation No. 3. Article 69 of Regulation No. 3 refers to the administrative sanctions established by Articles 47 and 66 of Law No. XVIII. Article 66 of Law No. XVIII provides for a fine of up to 10% of the gross annual income in the preceding financial year for legal persons, and of at least EUR 1 million.

Article 62(1) of Regulation No. 3 requires payment service providers to notify the Financial Information Authority of a major operational or security incident. Article 62(1) requires the provider, where the incident has or may have an impact on the financial interests of its payment service users, to inform them without undue delay of the incident and of the measures they can take to mitigate its adverse effects.

Article 25 of Instruction No. 4 classifies an incident as major if one or more criteria have a higher impact level or three or more criteria have a lower impact level. Article 30 requires an initial report to the Authority within 4 hours of the moment a potential major incident was first detected. Article 31 requires each intermediate report to state the date for the next update, which may not go beyond 3 business days.

Article 32 requires the final report within a maximum of 2 weeks after the activity is deemed back to normal. Article 29 requires the provider to give the Authority a copy of the information provided to its users as soon as it is available. Article 34 of Instruction No. 4 provides that for a violation of the Instruction the Authority may apply the administrative sanctions established by Article 69 of Regulation No. 3.

Article 69 of Regulation No. 3 refers to the administrative sanctions established by Articles 47 and 66 of Law No. XVIII. Article 66 of Law No. XVIII provides for a fine of up to 10% of the gross annual income in the preceding financial year for legal persons, and of at least EUR 1 million.