Italy’s Legislative Decree No. 179/2026 took effect on October 23, 2026. It assigns AgID responsibility for assessing and overseeing conformity-assessment bodies, gives ACN general market-surveillance duties for AI systems, and sets bounded roles for financial, insurance and data-protection authorities. The decree was dated October 7 and published in Italy’s Official Journal on October 8. The official text of Legislative Decree No. 179/2026 sets out the national arrangements for applying the EU AI Act, Regulation (EU) 2024/1689.
Which Italian authorities oversee AI?
The decree separates oversight of conformity-assessment bodies from market surveillance of AI systems, then assigns specific market-surveillance responsibilities to several sector regulators.
| Authority | Statutory responsibility | Scope |
| AgID | National notifying authority for conformity-assessment bodies | Assesses, designates, notifies and monitors those bodies |
| ACN | Market-surveillance authority for AI systems | General AI market surveillance |
| Bank of Italy | Market surveillance of specified high-risk AI uses | Regulated banking and financial services |
| CONSOB | Market surveillance of specified high-risk AI uses | Regulated financial-intermediation services |
| IVASS | Market surveillance of specified high-risk AI uses | Insurance, reinsurance and insurance-product distribution |
| Garante per la protezione dei dati personali | Market-surveillance authority within a limited remit | EU AI Act Article 74(8) |
For regulated financial and insurance uses, Article 5 assigns responsibilities to the relevant sector regulator within its stated remit. The data-protection authority’s role is tied to the specific EU AI Act provision listed in the decree.
AgID audits conformity-assessment bodies
A conformity-assessment body evaluates whether a system meets applicable requirements. Under Articles 4 and 13, AgID sets and applies the procedures to assess, designate and notify these bodies, and monitors their work through periodic and extraordinary audits.
If AgID identifies deficiencies or non-compliance, it may begin proceedings to limit, suspend or revoke a body’s designation after giving that body an opportunity to be heard. The bodies bear the costs of specified controls.
ACN handles market surveillance, inspections and registration
The decree authorizes ACN to inspect real-world AI testing remotely or on site, including without prior notice. A further government regulation, proposed by ACN, is to define how those inspection powers and measures are exercised.
For national registration, Article 14 assigns ACN responsibility for high-risk AI systems covered by point 2 of Annex III to the EU AI Act. A later decree by ACN’s director general, agreed with AgID, is to set the registration and information-management procedures.
Sanctions depend on the authority’s remit
Article 20 gives AgID administrative-fine powers for specified violations by notified bodies, referring to EU AI Act Article 99(4)(f) and (5). Article 21 assigns sanctioning powers to national market-surveillance authorities within their respective areas of responsibility. The decree does not set a single general fine amount.
