Article by Serena Urbano. From the AI Act to Law 132/2025.
With Law No. 132 of 23 September 2025, Italy introduced the first organic national legislation to regulate the use of Artificial Intelligence, following the path of the AI Act but, in fact, acting as a forerunner. Many terms, definitions and principles are obviously linked to the European framework (even with an explicit reference), but the national declination provides operational cues and elements of strategic value for anyone wishing to make use of this new technology and that may also serve as inspiration for other legislators.
The ambition of the standard is already in the aims it intends to pursue: to set “principles on research, experimentation, development, adoption and application of artificial intelligence systems and models”, so as to promote “a correct, transparent and responsible use, in an anthropocentric dimension, of artificial intelligence, aimed at seizing its opportunities”. Very important statements of principle that have significant implications for entrepreneurs who intend to approach this business sector. It doesn't matter whether they employ so-called foundational models, i.e. pre-trained basic models including LLMs (large language models such as ChatGPT, Claude, Gemini, Deepseek or Llama, for example), or otherwise customised or specialised models: the principles define a framework - or rather, a direction - so that the development of technologies of this type can take place in compliance with the regulations. In practice, they provide fundamental information to minimise business risk.
Relevant sectors and the subject of personal data
Already a reading of the heading of the articles of the regulation reveals the areas covered by the regulation: economic development, national security and defence, health, research and scientific experimentation, labour, intellectual professions, public administration and judicial activity. One of the common denominators is that of the processing of personal data, since both training and the use of the tools meet the limits and conditions laid down by the legislation on the protection of personal data, whose European presidium is in EU Reg. 2016/679 or GDPR. This issue has been addressed several times by national supervisory authorities and by the EDPB, the European Committee of Data Protection Supervisors, since especially in the digital transformation we are experiencing it is necessary to be able to coordinate the protection of fundamental rights with business needs. Indeed, regulation must not prevent the advancement of technology but make it sustainable in terms of risks and, above all, benefits for both individuals and the community.
From the Italian example to ideas for shared standards
The Italian example is that of legislation that first of all identifies a number of particularly relevant sectors in which to promote the sustainable and conscious use of new Artificial Intelligence technologies through guidelines and conditions, as well as the provision of working tables and observatories to continuously monitor the “state of the art” of a sector that is constantly evolving. The reason is simple: to adapt the rules to a changing world.
In practice, the standard formalises what are the fundamental pillars of the business models of those who intend to promote the offer of tools and services based on the use of Artificial Intelligence. For example, the general limitation of preserving the autonomy and decision-making power of man, both as an individual and in the
bodies of the state, is an element that any legislative framework or regulatory standard will necessarily have to take into account to regulate this area. On the other hand, with regard to making actors responsible for ensuring that development processes are able to guarantee correctness, reliability, safety, quality, appropriateness, transparency and security, if it is not a law and the corresponding sanction, then the negative consequences will simply come from the market.
The Italian example is obviously that of a forerunner, from which, however, quite a few interesting hints may emerge, useful both for those who intend to standardise Artificial Intelligence systems at a national level and for those who intend to identify the elements that are capable of making the entrepreneurial strategy to be undertaken in this particularly innovative technological sector competitive.
