There is a misconception we encounter constantly in our meetings with Italian SMEs: the idea that, once a national law on artificial intelligence exists, the European Regulation takes a back seat. The exact opposite is true. Since autumn 2025, a business that develops or uses AI in Italy operates on two parallel and cumulative tracks: the Regulation (EU) 2024/1689 — AI Act, directly applicable, and Law No. 132 of 23 September 2025, the first organic Italian national law on AI. You do not choose between them. You comply with both.
Why two rules, and not one
The reason is one of hierarchy of sources. The AI Act is a European Union regulation: as such it is binding in all its elements and directly applicable in each Member State, without the need for any national transposing act. An Italian SME is required to comply with it even if the Italian legislator had never written a single line. Law 132/2025, for its part, does not replace and cannot derogate from the AI Act — the primacy of EU law prevails. It does something different and complementary: it designates the competent national authorities, adapts the domestic legal order and lays down its own principles on sensitive sectors.
Who are these authorities? The Italian law entrusts AgID with promotion and development functions, and ACN with supervision, inspection and enforcement tasks; for the processing of personal data the Italian Data Protection Authority (Garante) remains competent. This is an architecture an SME must know, because it identifies who knocks at the door in the event of an inspection.
A methodological note: the exact numbering of the articles of Law 132/2025 (for example the one that designates the authorities) is in part still to be confirmed against the official text on Normattiva. On these details we maintain a verification flag: we prefer to say "the law designates AgID and ACN" — a solid fact — rather than cite an article number before having checked it against the primary source.
What changes in practice, today
The point that most interests a business owner is which obligations are already operative. On the European track, some deadlines have already passed:
- since 2 February 2025, the prohibitions on unacceptable-risk practices (Art. 5 AI Act) and the AI literacy obligation (Art. 4) apply — a cross-cutting duty, often underestimated, that requires an adequate level of competence from the staff who use these systems;
- since 2 August 2025, the rules on general-purpose AI models (GPAI) and the governance framework have been operative;
- the more stringent obligations for high-risk systems, by contrast, have a more distant horizon (Annex III and Annex I), following a staggered application timeline that the European legislator has revised with the simplification package under discussion. On these dates we maintain editorial caution until official publication is completed.
On the Italian track, Law 132/2025 has been in force since 10 October 2025, but it is largely a law of principles and of delegation: many detailed rules will arrive with the implementing legislative decrees, expected by around October 2026. This does not mean "wait". It already binds today on principles, authorities and certain specific rules — in particular the human-centric framework (the person remains the centre of gravity, with human oversight), the rules on the use of AI in the intellectual professions as a support tool, and the obligations to inform workers.
The NomotecnIA reading for an SME
Our operational advice is simple in logic, demanding in execution: a single governance framework, two tracks to oversee. Concretely:
- Map the AI systems used in the company and establish your own role — most SMEs are deployers (deployer/user), not providers, and this changes the obligations.
- Close the prohibitions immediately (Art. 5) and activate AI literacy for staff: they are already due.
- Monitor the implementing decrees of Law 132 up to October 2026, because that is where concrete obligations and penalties will be defined on the national side.
- Document the use of AI in the intellectual professions as support, and inform workers where required.
The competitive advantage, for an SME, is not "having the paperwork in order". It is being able to demonstrate — to clients, partners, tenders — a verifiable AI governance. The dual track is not a bureaucratic burden: it is the infrastructure of trust on which an Italian business builds credibility.
Informative and editorial content. It does not constitute legal advice nor an attestation of conformity. NomotecnIA is not a notified body. For any assessment, the official source cited in the linked pages prevails.