Italy's AI Decree Takes Effect, Marking EU AI Act's First Full National Implementation

By Hector Herrera | October 26, 2026

Italy became the first European Union member state to fully implement the EU AI Act, with its AI Decree — Legislative Decree no. 179 — taking full legal effect on October 23. The milestone marks the transition from the Act's phased transition periods to actual national enforcement. It arrived in the same week that California issued executive orders on AI kill switches and China proposed adding large AI models to its export control list. Three major AI governance moves in seven days.

Why this matters now: The EU AI Act passed in 2024 with staggered compliance timelines — most provisions did not require national implementation until 2026 or 2027. Italy moved ahead of schedule by pairing the EU Act with its own Law 132/2025, creating a domestic framework that covers both European obligations and Italian-specific requirements. Every other EU member state is now watching how Italy's enforcement plays out.

Italy's AI Decree: What It Does

According to Mondaq and TLT, Legislative Decree no. 179, dated 7 October 2026, completed Italy's transposition of both the EU AI Act and Italian Law 132/2025. Full effect arrived October 23.

What the decree establishes:

• National AI authority: Designates the body responsible for oversight, enforcement, and market surveillance of AI systems operating in Italy
• Risk classification enforcement: Applies the EU AI Act's four-tier risk framework — unacceptable risk (banned), high risk (strict requirements), limited risk (transparency obligations), minimal risk (no specific obligations) — with Italian implementing rules
• Prohibited systems: AI used for real-time remote biometric identification in public spaces, social scoring by public authorities, and manipulation of vulnerable individuals — all prohibited under EU rules — are now enforceable under Italian law
• High-risk AI requirements: Systems in health, education, employment, critical infrastructure, and law enforcement must meet conformity assessment, technical documentation, and human oversight requirements before deployment

For non-EU companies selling AI products or services into Italy, the practical impact is immediate: systems that touch high-risk categories now face enforceable compliance obligations, not just forthcoming ones.

The Same Week: California and China Move

Italy's implementation landed alongside two other significant AI governance actions:

California: Governor Newsom issued executive orders requiring independent verification of AI models operating in state-regulated domains and establishing expert committees to develop "kill switch" mechanisms for AI agents that behave outside intended parameters. California's executive action is not law — it does not carry the same enforcement weight as Italy's decree — but it signals direction for what could become the most consequential AI regulatory jurisdiction in the US, given the state's role in the tech economy.

China: Beijing proposed adding 23 AI technologies to its export control catalogue, including large language models and autonomous agents. If finalized, the controls would restrict the transfer of these technologies abroad without government authorization — mirroring US export controls on advanced chips, but applied to software and models rather than hardware.

The three moves together illustrate how AI governance is regionalizing: the EU through mandatory enforcement, the US through state-level executive action, and China through export controls rather than domestic safety rules.

What This Means for Businesses Operating in Europe

For EU-based companies: Italy's decree is a useful preview of what full EU AI Act enforcement looks like in practice. Watch Italian enforcement decisions — they will reveal how regulators interpret ambiguous terms like "high-risk application" and "adequate human oversight."

For US and global AI companies with European operations: Italy is the first enforcement environment, but it will not be the last. France, Germany, and the Netherlands are expected to complete transposition within 12 months. Building compliance infrastructure now, rather than waiting for every member state to publish its own rules, is the lower-cost path.

For companies using AI in regulated sectors: Health, education, financial services, and law enforcement applications face the most immediate compliance obligations under the high-risk tier. The time to conduct conformity assessments is before enforcement begins, not after the first investigation.

What to Watch

Watch Italy's AI authority for its first enforcement action — the choice of target will signal whether the regulator plans to focus on large platforms (high visibility, high deterrence value) or category-specific high-risk systems (health AI, employment AI). Also watch France and Germany for their transposition timelines; the pattern Italy sets will influence how those national frameworks are built. On the California front, expect legal challenges to the kill switch executive orders within 30 days.