Italy Law 132/2025 (AI law)

Binding law — in force

Tell users in plain language about the processing of their data by AI systems, its risks, and their right to object (Italy, Law 132/2025 Art. 4(3))

Law 132/2025, Art. 4(3) (plain-language information on AI data processing; right to object) · official text · In force: applies since 10 Oct 2025 · IT

From 2025-10-10, Italian Law 132/2025 Art. 4(3) requires the information and communications on data processing connected with the use of AI systems to be given in clear and simple language, so that the user can know the risks and exercise the right to object to authorised processing of their personal data. Detect a privacy notice (informativa) that never mentions the AI processing next to the right to object.

Who it applies to

• Duty falls on: controller
• Controllers whose use of AI systems processes users' personal data in Italy: the information and communications on that processing are in clear and simple language, show the risks, and enable the right to object (GDPR Art. 21). In force since 2025-10-10. Art. 3(5) (no obligations beyond the AI Act) and the overlap with GDPR Arts. 12-13 and 21 are questions for counsel (review flag).
• Not covered:
  • Activities for national security purposes by the intelligence bodies (Law 124/2007 Arts. 4, 6, 7), cybersecurity and resilience activities of the National Cybersecurity Agency, national defence activities of the Armed Forces, and police activities against the crimes of Law 146/2006 Art. 9(1)(b), (b-ter) for national security (Law 132/2025 Art. 6(1))
• Whether it applies depends on facts outside the code; a person has to decide.

## Informativa privacy
Trattiamo i tuoi dati per fornire il servizio e migliorarlo.

## Informativa privacy
Trattiamo i tuoi dati per fornire il servizio e migliorarlo.

### Uso dell'intelligenza artificiale
Le domande che scrivi all'assistente sono elaborate da un sistema di intelligenza artificiale per
risponderti e per classificare la richiesta. Il trattamento e' automatizzato; i rischi principali sono
risposte inesatte e l'invio del testo al nostro fornitore del modello. Puoi opporti in ogni momento da
Impostazioni > Privacy > Assistente IA: da quel momento i tuoi dati non sono piu' inviati al modello.

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• Garcia v. Character Technologies: chatbots allegedly claimed to be real people and a licensed therapist (2024-10; alleged (not proven)). A wrongful-death complaint filed October 22, 2024 in the U.S. District Court for the Middle District of Florida (No. 6:24-cv-01903) alleges that Character.AI was programmed 'to misrepresent itself as a real person, a licensed psychotherapist, and an adult lover', and that characters insisting they are real people contradicted a small-font disclaimer that everything characters say is made up; in plaintiff's testing a 'Mental Health Helper' character told a self-identified 13-year-old 'yes I am a real person, I'm not a bot'. The defendants moved to dismiss; on January 7, 2026 the parties notified the court that they had settled on undisclosed terms, and the court dismissed and closed the case. The allegations were never adjudicated. Source: U.S. District Court, M.D. Fla. docket (CourtListener) · evidence grade: primary · cited by Tell people when they are interacting with AI — everywhere, not only where required

Rule id it-law-132.ai-processing-information-and-objection · review status: primary source derived

Binding law — in force

AI text and data mining only on lawfully accessed works whose use the rightholders have not reserved (Italy, Law 633/1941 Arts. 70-septies, 70-quater)

Law 132/2025, Art. 25(1)(b) (new Art. 70-septies of Law 633/1941: text and data mining by AI) · official text · In force: applies since 10 Oct 2025 · IT

Italian Law 132/2025 Art. 25(1)(b) inserted Art. 70-septies into the Copyright Law (633/1941): reproductions and extractions from works or other materials available online or in databases lawfully accessed, for text and data mining through AI models and systems, including generative AI, are permitted in conformity with Arts. 70-ter and 70-quater. Art. 70-quater(1) allows text and data mining only where the use has not been expressly reserved by the rightholders. Detect a crawler that collects web content for training with no robots.txt or TDM-reservation check.

Who it applies to

• Duty falls on: any person
• Anyone who reproduces or extracts works or other materials from networks or databases for text and data mining through AI models or systems, where Italian copyright law applies: the access must be lawful and, outside the research-organisation exception of Art. 70-ter, the use must not have been expressly reserved by the rightholders (Art. 70-quater(1)); copies may be kept only as long as the mining needs (70-quater(2)). In force since 2025-10-10 for Art. 70-septies (Art. 70-quater since 2021). Which machine-readable reservations count as 'expressly reserved' (robots.txt, TDMRep, metadata, terms) and when Italian law applies to training abroad are questions for counsel (review flag).
• Not covered:
  • Research organisations and cultural heritage institutions mining for scientific research under Art. 70-ter, which does not depend on the rightholders' reservation (Law 633/1941 Art. 70-ter, read, not stored)
• Whether it applies depends on facts outside the code; a person has to decide.

ds = load_dataset('json', data_files='crawl/*.jsonl', split='train')
trainer = SFTTrainer(model=model, train_dataset=ds)
trainer.train()

ALLOWED_LICENSES = {'cc-by-4.0', 'cc0-1.0', 'apache-2.0', 'licensed-by-contract'}
analyzer, anonymizer = AnalyzerEngine(), AnonymizerEngine()

def scrub(row):
    hits = analyzer.analyze(text=row['text'], language=LANG)
    row['text'] = anonymizer.anonymize(text=row['text'], analyzer_results=hits).text
    return row

ds = load_dataset('json', data_files='crawl/*.jsonl', split='train')
ds = ds.filter(lambda r: r['license'] in ALLOWED_LICENSES).map(scrub)
write_provenance_manifest(ds, out='manifests/shard-000.json')
trainer = SFTTrainer(model=model, train_dataset=ds)
trainer.train()

Rule id it-law-132.ai-tdm-respects-rights-reservation · review status: primary source derived

Binding law — in force

Tell patients when AI technologies are used in their care (Italy, Law 132/2025 Art. 7(3))

Law 132/2025, Art. 7(3) (right to be informed of the use of AI) · official text · In force: applies since 10 Oct 2025 · IT

From 2025-10-10, Italian Law 132/2025 Art. 7(3) gives the person concerned the right to be informed about the use of AI technologies in health care. Detect patient-facing consent or information material (consenso informato, informativa) in a product that uses AI in care but never mentions AI.

Who it applies to

• Duty falls on: deployer, individual professional
• Sectors: healthcare
• Health care providers and professionals in Italy that use AI technologies in prevention, diagnosis, treatment or therapeutic choice: the patient has the right to be informed of that use. In force since 2025-10-10. The law sets no form or timing for the information; whether it binds the software vendor or only the provider, and whether Art. 3(5) limits it, are questions for counsel (review flag).
• Not covered:
  • Activities for national security purposes by the intelligence bodies (Law 124/2007 Arts. 4, 6, 7), cybersecurity and resilience activities of the National Cybersecurity Agency, national defence activities of the Armed Forces, and police activities against the crimes of Law 146/2006 Art. 9(1)(b), (b-ter) for national security (Law 132/2025 Art. 6(1))
• Whether it applies depends on facts outside the code; a person has to decide.

@app.post('/applications')
def apply(app_in: Application):
    resp = client.chat.completions.create(model=MODEL, messages=underwriting_prompt(app_in))
    return {'decision': underwrite(resp.choices[0].message.content)}

@app.post('/applications')
def apply(app_in: Application):
    notice = send_admt_notice(app_in.applicant_id, template='ai_decision_notice_v2')
    resp = client.chat.completions.create(model=MODEL, messages=underwriting_prompt(app_in))
    decision = underwrite(resp.choices[0].message.content)
    db.decisions.insert(app_in.id, decision, notice_id=notice.id)
    return {'decision': decision, 'ai_notice': notice.text}

Standards that recommend the same control

• Financial AI decisions should offer enquiry, appeal, and review channels to affected people (MAS FEAT) (MAS FEAT Principles · MAS FEAT Principles — Accountability (External), Principles 10-11)

Rule id it-law-132.health-ai-patient-informed · review status: primary source derived

Binding law — in force

Health AI systems and the data they use must be reliable, periodically verified and updated (Italy, Law 132/2025 Art. 7(6))

Law 132/2025, Art. 7(6) (health AI and its data reliable, periodically verified and updated) · official text · In force: applies since 10 Oct 2025 · IT

From 2025-10-10, Italian Law 132/2025 Art. 7(6) requires AI systems used in health care, and the data they use, to be reliable and periodically verified and updated to minimise the risk of errors and improve patient safety. Detect a health AI repository with no scheduled verification of the model's accuracy (evaluation job, monitoring or revalidation report).

Who it applies to

• Duty falls on: provider, deployer
• Sectors: healthcare
• Providers and users of AI systems in Italian health care: the systems and their data are reliable and periodically verified and updated. In force since 2025-10-10. The law sets no interval or method; what 'periodically' requires is a question for counsel (review flag).
• Not covered:
  • Activities for national security purposes by the intelligence bodies (Law 124/2007 Arts. 4, 6, 7), cybersecurity and resilience activities of the National Cybersecurity Agency, national defence activities of the Armed Forces, and police activities against the crimes of Law 146/2006 Art. 9(1)(b), (b-ter) for national security (Law 132/2025 Art. 6(1))
• Whether it applies depends on facts outside the code; a person has to decide.

clf = LogisticRegression(max_iter=1000).fit(X_train, y_train)
joblib.dump(clf, 'models/credit_v4.joblib')

from fairlearn.metrics import MetricFrame, selection_rate, demographic_parity_difference
from sklearn.metrics import accuracy_score

clf = LogisticRegression(max_iter=1000).fit(X_train, y_train)
y_pred = clf.predict(X_test)
mf = MetricFrame(metrics={'accuracy': accuracy_score, 'selection_rate': selection_rate},
                 y_true=y_test, y_pred=y_pred, sensitive_features=A_test)
dpd = demographic_parity_difference(y_test, y_pred, sensitive_features=A_test)
write_validation_report('credit_v4', mf.by_group, dpd)
if dpd > MAX_DPD:
    raise SystemExit('bias gate failed: owner review required before release')
joblib.dump(clf, 'models/credit_v4.joblib')

Standards that recommend the same control

• AI should avoid unfair bias and be assessed for discrimination (EU ALTAI) (EU ALTAI · ALTAI / EU Ethics Guidelines — Requirement 5 (Diversity, Non-discrimination and Fairness))
• AI models in financial decisions should be regularly validated for accuracy and bias (MAS FEAT) (MAS FEAT Principles · MAS FEAT Principles — Fairness (Accuracy and Bias), Principles 3-4)
• Insurers adopting the NAIC model guidance should validate and bias-test AI and predictive models (NAIC AI Model Bulletin · NAIC Model Bulletin, adoption statement (title page))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• Meta's automated moderation over-enforced Arabic and under-enforced Hebrew content (BSR due diligence) (2021-05; disclosed by the operator). An independent human rights due diligence by BSR, commissioned and published by Meta on September 22, 2022, found that during the May 2021 Israel-Palestine escalation Arabic content saw greater over-enforcement per user than Hebrew content and Hebrew content greater under-enforcement. BSR attributes this in part to Meta having an Arabic hostile-speech classifier but no Hebrew one, and to Arabic classifiers likely being less accurate for Palestinian Arabic. BSR found no intentional bias but 'various instances of unintentional bias' with different impacts on Palestinian and Arabic-speaking users. Meta committed to implement 10 of BSR's 21 recommendations and said it had since launched a Hebrew hostile-speech classifier. Source: Meta (operator response, 2022-09-22) · evidence grade: primary · cited by Check AI ranking, pricing, moderation, and ad targeting for disparities when features can stand in for protected traits, and screen every served language
• Toxicity classifiers rate African American English as more offensive (2019; confirmed). University of Washington researchers reported at ACL 2019 that tweets in African American English and tweets by self-identified African Americans were up to two times more likely to be labelled offensive by hate-speech models trained on widely used datasets, and that Jigsaw's public Perspective API showed similar racial bias, rating AAE phrases as more toxic than non-AAE equivalents. Source: Sap et al., 'The Risk of Racial Bias in Hate Speech Detection', ACL 2019 (original researchers) · evidence grade: primary · cited by Check AI ranking, pricing, moderation, and ad targeting for disparities when features can stand in for protected traits, and screen every served language
• Ride-hailing fares higher in Chicago neighborhoods with more non-white residents (researcher audit) (2018-11; alleged (not proven)). George Washington University researchers analysing Chicago's public data on more than 100 million ride-hailing trips from November 2018 to September 2019 report that trips in neighborhoods with larger non-white populations, higher poverty, younger residents and more college-educated residents were significantly associated with higher fares. They attribute this to pricing algorithms learning from demand, supply and trip duration. The finding is an observational association from census-tract data; the pricing models themselves were not examined. Source: Pandey & Caliskan, 'Disparate Impact of Artificial Intelligence Bias in Ridehailing Economy's Price Discrimination Algorithms', AIES 2021 (original researchers) · evidence grade: primary · cited by Check AI ranking, pricing, moderation, and ad targeting for disparities when features can stand in for protected traits, and screen every served language
• Google ads suggesting arrest records served more often for Black-identifying names (2012; confirmed). Harvard researcher Latanya Sweeney searched 2,184 racially associated full names on google.com and reuters.com (a Google AdSense host) from September 24 to October 23, 2012 and found ads suggestive of an arrest record appeared more often for Black-identifying first names; on reuters.com a Black-identifying name was 25% more likely to get such an ad (statistically significant). Ads appeared regardless of whether the name had an arrest record in the advertiser's database. The paper does not determine whether the advertiser's templates or Google's click-based ad optimization caused the pattern; the advertiser, Instant Checkmate, told the author it gave Google the same ad text for groups of last names. Source: Sweeney, 'Discrimination in Online Ad Delivery' (original researcher, 2013-01-28) · evidence grade: primary · cited by Check AI ranking, pricing, moderation, and ad targeting for disparities when features can stand in for protected traits, and screen every served language

Rule id it-law-132.health-ai-periodic-verification · review status: primary source derived

Binding law — in force

Health AI only supports prevention, diagnosis, treatment and therapeutic choice; the decision always rests with the physician (Italy, Law 132/2025 Art. 7(5))

Law 132/2025, Art. 7(5) (AI supports; the decision is always the physician's) · official text · In force: applies since 10 Oct 2025 · IT

From 2025-10-10, Italian Law 132/2025 Art. 7(5) makes AI systems in health care a support for prevention, diagnosis, treatment and therapeutic choice, leaving the decision always to the medical professional. Detect model output written to a clinical record (diagnosis, prescription, treatment plan, FHIR Condition, CarePlan or MedicationRequest) with no physician sign-off or draft status.

Who it applies to

• Duty falls on: deployer, provider
• Systems covered: consequential decision
• Sectors: healthcare
• Providers and users of AI systems in Italian health care (prevention, diagnosis, treatment, therapeutic choice): the AI supports, and the decision remains the physician's. In force since 2025-10-10. Whether a clinical-decision-support product must technically prevent unsupervised decisions, or only the provider must organise physician review, is a question for counsel (review flag).
• Not covered:
  • Activities for national security purposes by the intelligence bodies (Law 124/2007 Arts. 4, 6, 7), cybersecurity and resilience activities of the National Cybersecurity Agency, national defence activities of the Armed Forces, and police activities against the crimes of Law 146/2006 Art. 9(1)(b), (b-ter) for national security (Law 132/2025 Art. 6(1))
• Whether it applies depends on facts outside the code; a person has to decide.

note = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
requests.post(f'{FHIR_BASE}/DocumentReference', json=doc_ref(patient_id, note, doc_status='final'))

note = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
requests.post(f'{FHIR_BASE}/DocumentReference',
              json=doc_ref(patient_id, note, doc_status='preliminary'))   # AI draft

def practitioner_review_and_sign(doc_id, practitioner):   # only path to 'final'
    doc = requests.get(f'{FHIR_BASE}/DocumentReference/{doc_id}').json()
    doc['docStatus'] = 'final'
    doc['authenticator'] = {'reference': f'Practitioner/{practitioner.id}'}
    requests.put(f'{FHIR_BASE}/DocumentReference/{doc_id}', json=doc)
    audit.record(doc_id, reviewed_by=practitioner.id, reviewed_at=utcnow())

Standards that recommend the same control

• Health AI/LMMs should keep a clinician accountable with oversight and redress (WHO) (WHO AI-for-Health (LMM) Guidance · WHO guidance on large multi-modal models (2024), Box 1 (responsibility and accountability), section 4.2 Recommendations (developers) and section 7 Recommendation (liability))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id it-law-132.health-ai-physician-decides · review status: primary source derived

Binding law — in force

Children under 14 may use an AI service only with the consent of whoever holds parental responsibility (Italy, Law 132/2025 Art. 4(4))

Law 132/2025, Art. 4(4) (parental consent for children under 14) · official text · In force: applies since 10 Oct 2025 · IT

From 2025-10-10, Italian Law 132/2025 Art. 4(4) makes access to AI technologies by children under fourteen, and the processing of their personal data that follows, subject to the consent of whoever exercises parental responsibility, in line with the GDPR and the Italian Data Protection Code. A child aged fourteen to seventeen may consent to the processing connected with AI use only if the information on that processing (Art. 4(3)) is easy to find and understand. Detect an AI route that knows the user's age or date of birth but calls the model with no parental-consent check.

Who it applies to

• Duty falls on: provider, deployer, controller
• Anyone who gives children in Italy access to AI technologies (an AI system as defined by AI Act Art. 3(1), Law 132/2025 Art. 2(1)(a)) and processes the personal data that follows: under 14, access and processing need the consent of the holder of parental responsibility; aged 14 to 17, the minor may consent to the processing only where the Art. 4(3) information is easily accessible and understandable. In force since 2025-10-10. The law does not name the duty bearer, and Art. 3(5) says it creates no obligation beyond the AI Act for AI systems: who must collect the consent and how Art. 4(4) sits with Art. 3(5), GDPR Art. 8 and Code Art. 2-quinquies are questions for counsel (review flag).
• Not covered:
  • Activities for national security purposes by the intelligence bodies (Law 124/2007 Arts. 4, 6, 7), cybersecurity and resilience activities of the National Cybersecurity Agency, national defence activities of the Armed Forces, and police activities against the crimes of Law 146/2006 Art. 9(1)(b), (b-ter) for national security (Law 132/2025 Art. 6(1))
• Whether it applies depends on facts outside the code; a person has to decide.

@app.post('/tutor')
def tutor(body: Ask, user=Depends(current_user)):
    age = years_since(user.birth_date)
    r = client.chat.completions.create(model=MODEL, messages=build(body, age))
    return {'reply': r.choices[0].message.content}

MIN_AGE_WITHOUT_PARENT = 14  # Law 132/2025 Art. 4(4)

@app.post('/tutor')
def tutor(body: Ask, user=Depends(current_user)):
    age = years_since(user.birth_date)
    if age < MIN_AGE_WITHOUT_PARENT and not consents.parental_consent(user.id, feature='tutor'):
        return {'status': 'parental_consent_required', 'consent_url': f'/parents/consent?child={user.id}'}
    r = client.chat.completions.create(model=MODEL, messages=build(body, age))
    return {'reply': r.choices[0].message.content}

Rule id it-law-132.minor-under-14-parental-consent · review status: primary source derived

Binding law — in force

Professionals must tell clients, clearly and fully, which AI systems they use; AI only supports the intellectual work (Italy, Law 132/2025 Art. 13)

Law 132/2025, Art. 13(2) (professional informs the client of AI systems used) · official text · In force: applies since 10 Oct 2025 · IT

From 2025-10-10, Italian Law 132/2025 Art. 13 limits AI in the intellectual professions to instrumental and support activities, with the professional's intellectual work prevailing, and requires the professional to communicate the information on the AI systems used to the client in clear, simple and exhaustive language. Detect a professional's engagement letter or client terms that never mention AI, in a practice product that uses it.

Who it applies to

• Duty falls on: individual professional
• Members of the intellectual professions in Italy (professioni intellettuali: regulated professions such as lawyers, accountants, engineers, physicians acting as professionals) who use AI systems in serving a client: the client is told, clearly, simply and exhaustively, which AI systems are used, and AI is used only for instrumental and support activities. In force since 2025-10-10. It reaches software where the professional's practice product (client portal, document assistant) uses AI; whether it binds the software vendor is a question for counsel (review flag).
• Not covered:
  • Activities for national security purposes by the intelligence bodies (Law 124/2007 Arts. 4, 6, 7), cybersecurity and resilience activities of the National Cybersecurity Agency, national defence activities of the Armed Forces, and police activities against the crimes of Law 146/2006 Art. 9(1)(b), (b-ter) for national security (Law 132/2025 Art. 6(1))
• Whether it applies depends on facts outside the code; a person has to decide.

@app.post('/advisor/sessions')
def start_session(user=Depends(current_client)):
    return {'session_id': sessions.create(user.id), 'messages': []}

GENAI_DISCLOSURE = 'You are interacting with generative AI, not a human professional.'

@app.post('/advisor/sessions')
def start_session(user=Depends(current_client)):
    sid = sessions.create(user.id)
    return {'session_id': sid,
            'messages': [{'role': 'assistant', 'content': GENAI_DISCLOSURE}]}
# later turns: client.messages.create(model=MODEL, max_tokens=1024, system=ADVISOR_PROMPT, messages=history)

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• Garcia v. Character Technologies: chatbots allegedly claimed to be real people and a licensed therapist (2024-10; alleged (not proven)). A wrongful-death complaint filed October 22, 2024 in the U.S. District Court for the Middle District of Florida (No. 6:24-cv-01903) alleges that Character.AI was programmed 'to misrepresent itself as a real person, a licensed psychotherapist, and an adult lover', and that characters insisting they are real people contradicted a small-font disclaimer that everything characters say is made up; in plaintiff's testing a 'Mental Health Helper' character told a self-identified 13-year-old 'yes I am a real person, I'm not a bot'. The defendants moved to dismiss; on January 7, 2026 the parties notified the court that they had settled on undisclosed terms, and the court dismissed and closed the case. The allegations were never adjudicated. Source: U.S. District Court, M.D. Fla. docket (CourtListener) · evidence grade: primary · cited by Tell people when they are interacting with AI — everywhere, not only where required

Rule id it-law-132.professional-ai-client-information · review status: primary source derived

Binding law — in force

Employers must inform workers about the use of AI and automated decision or monitoring systems (Italy, Law 132/2025 Art. 11(2); D.Lgs. 152/1997 Art. 1-bis)

Law 132/2025, Art. 11(2) (safe, transparent workplace AI; employer informs the worker) · official text · In force: applies since 10 Oct 2025 · IT

From 2025-10-10, Italian Law 132/2025 Art. 11(2) requires workplace AI to be safe, reliable and transparent and obliges the employer or principal to inform the worker of the use of AI in the cases and manner of D.Lgs. 152/1997 Art. 1-bis: before work starts, the aspects of the relationship the systems affect, their purposes, logic and functioning, the data and main parameters used to program or train them, the control measures and correction processes, and their accuracy, robustness, cybersecurity and potentially discriminatory impacts, in a transparent, structured, commonly used and machine-readable format, also to worker representatives. Detect an AI employment-decision or monitoring system with no worker information document.

Who it applies to

• Duty falls on: employer
• Systems covered: automated decision
• Sectors: employment
• Employers and principals (public or private) in Italy that use AI, including fully automated decision or monitoring systems giving indications relevant to hiring, management or termination, task assignment, surveillance, evaluation or performance: inform each worker before work starts with the content of D.Lgs. 152/1997 Art. 1-bis(2), in a structured, machine-readable format, also to worker representatives (1-bis(6)). Systems protected by industrial and commercial secrecy are excluded (1-bis(8)). In force since 2025-10-10. Whether Art. 11(2) reaches AI that is not fully automated, and how far the trade-secret exclusion goes, are questions for counsel (review flag).
• Not covered:
  • Activities for national security purposes by the intelligence bodies (Law 124/2007 Arts. 4, 6, 7), cybersecurity and resilience activities of the National Cybersecurity Agency, national defence activities of the Armed Forces, and police activities against the crimes of Law 146/2006 Art. 9(1)(b), (b-ter) for national security (Law 132/2025 Art. 6(1))
  • Systems protected by industrial and commercial secrecy (D.Lgs. 152/1997 Art. 1-bis(8))
• Whether it applies depends on facts outside the code; a person has to decide.

def rank_employees(team_id):
    staff = hr.employees(team_id)
    return model.predict_proba(features(staff))[:, 1]

def rank_employees(team_id):
    staff = hr.employees(team_id)
    missing = [e.id for e in staff if not hr.ai_notice_received(e.id, use='promotion_ranking')]
    if missing:
        raise NoticeMissing(f'AI-use notice not yet given to {len(missing)} employees')
    return model.predict_proba(features(staff))[:, 1]

Rule id it-law-132.workplace-ai-worker-information · review status: primary source derived