National law · source: Normattiva

Does Law 132/2025 replace the AI Act for businesses in Italy?

In short: no. It is a dual track. An Italian SME must comply with both: the European regulation (directly applicable) and the first comprehensive national law on AI. Law 132/2025 is largely a law of principles and delegations: the implementing decrees are expected by October 2026. Below are the facts verified on Normattiva, then our reading.

The facts · fields 1–10

What the official source says.

Verified on Normattiva

01 · Name

Law No. 132 of 23 September 2025

«Provisions and delegations to the Government on artificial intelligence». Common abbreviation: Law 132/2025 — the first comprehensive Italian national law on AI.

Normattiva · urn:nir:stato:legge:2025-09-23;132

02 · Type of source

Ordinary national law, with delegations

A law of the Italian State, also containing legislative delegations to the Government (Art. 76 of the Constitution) for the adoption of subsequent legislative decrees.

Normattiva · Law 132/2025

03 · Nature

Binding, in part principle-based and delegating

Hard law: a law of the State in force. Part of the provisions, however, is principle-based and delegating in nature: it will become fully operational only with the implementing legislative decrees.

Normattiva · Law 132/2025

04 · Subject matter

National principles, in a human-centric dimension

It sets out national principles and rules on the research, experimentation, development, adoption and use of AI systems and models, in a human-centric dimension, and aligns the Italian legal order with Regulation (EU) 2024/1689. It intervenes in specific sectors (healthcare, employment, intellectual professions, public administration, justice), on copyright and on the Criminal Code, and delegates to the Government the completion of the framework.

Normattiva · Law 132/2025

05 · Who it applies to

National scope, with sector-specific rules

It concerns public and private entities that develop or use AI on Italian territory, with sector-specific provisions for healthcare operators, employers, intellectual professionals (use of AI as a mere support tool), public administrations and the judicial system. It is grafted onto the AI Act without amending its European personal scope.

Normattiva · Law 132/2025

06 · Key dates

From publication to the delegating decrees

  1. Publication in the Official Gazette, General Series No. 223.

  2. Entry into force (after the ordinary 15-day vacatio legis).

  3. Deadline of the delegation to the Government (within 12 months of entry into force) for the adoption of the implementing legislative decrees and those aligning with the AI Act.

OG General Series No. 223 of 25/09/2025 · Normattiva

07 · Competent authorities

AgID and ACN; the Garante for personal data

  • AgID (Agency for Digital Italy) — promotion and development functions for AI, and notification.
  • ACN (National Cybersecurity Agency) — supervision, inspection and penalty functions and security aspects.
  • Italian Data Protection Authority (Garante) — remains the competent authority for the processing of personal data.

The designation is made by the law; the article indicated by secondary sources is Art. 20 ⚠️ [to verify] the exact numbering on the Normattiva/OG text (corroborated by AI Legal Atlas + an independent legal source).

Normattiva · Law 132/2025 (article number to be confirmed)

08 · Status

In force since 10 October 2025, partial implementation

Numerous provisions require the delegating legislative decrees (expected by October 2026) to become fully operational. As at the date of this briefing, the implementing decrees are pending.

Normattiva · Law 132/2025

09 · Relationship with other rules

It adds to the AI Act; touches the GDPR and the Criminal Code

  • ↔ AI Act (Reg. EU 2024/1689): Law 132/2025 adds to and gives national effect to the AI Act; it does not replace it and cannot derogate from it (primacy of EU law). It designates its national authorities.
  • ↔ GDPR: the processing of personal data connected with AI remains subject to the GDPR and to the Privacy Code, with the Garante as the competent authority.
  • ↔ Criminal Code: the law amends the Criminal Code by introducing protection against the unlawful dissemination of content generated/altered with AI (deepfakes) — ⚠️ [to verify] the exact number of the new Criminal Code article (sources indicate the insertion of an Art. 612-quater of the Criminal Code).
  • ↔ ISO/IEC 42001: a voluntary AI management standard, useful as a governance framework supporting compliance; not invoked as a legal obligation.

Normattiva · Law 132/2025 (Criminal Code article number to be confirmed)

10 · Official source

Normattiva — text in force

Primary source to cite: Normattiva, text in force. Publication: Official Gazette of the Italian Republic, General Series No. 223 of 25 September 2025.

Open the official source on Normattiva

Primary source · Normattiva + OG General Series No. 223/2025

NomotecnIA reading · interpretation, not a source

Fields 11–12 · our own synthesis

Our reading for an SME.

Synthesis

  • Law 132/2025 does not replace the AI Act: it is a dual track. An Italian SME must comply with both — the European Regulation (directly applicable) and the national law.
  • It is largely a law of principles and delegation: many detailed rules will arrive with the legislative decrees expected by October 2026. Today it binds on principles, authorities and some specific rules (e.g. criminal, professions, employment).
  • Immediate practical relevance for SMEs: the rules on the use of AI in the intellectual professions (AI as a support tool, with the prevalence of human work) and the transparency/information obligations towards workers.
  • The framework is human-centric: human oversight and the responsibility of the person remain the centre of gravity.
  • Italian reference authorities: AgID (promotion) and ACN (supervision and penalties); for personal data, the Garante remains.

Practical obligations for a deployer / SME

  1. Monitor the implementing decrees (window until October 2026): the detailed rules will affect concrete obligations and penalties.
  2. Intellectual professions: if AI is used in professional activity, document that it is a support tool and that the prevalence of human/intellectual work remains; ensure client information where required.
  3. Employment: inform workers about the use of AI systems that concern them; coordinate with labour-law obligations and with the AI Act.
  4. Healthcare (where applicable): comply with the provisions on the use of AI to support (not replace) clinical decision-making and on informed consent.
  5. Transparency on synthetic content: safeguard against the criminal risk linked to deepfakes and the unlawful dissemination of altered content.
  6. Coordinate the Law 132 controls with those of the AI Act and the GDPR within a single internal governance framework, avoiding duplicated obligations.

Positioning note (NomotecnIA): NomotecnIA provides guidance and support towards readiness; it is not a notified body and does not issue certifications of compliance.

In depth

The articles that cite this rule.

Editorial watch · dated
Regulations

The dual track: AI Act and Law 132/2025 for SMEs

Why an Italian SME must comply with both regimes — European and national — and how to manage them with a single governance framework. The article that directly cites this law.

10 Jul 2026 · 5 min Read

Meta · fields 13–15

Review, disclaimer, changelog, author and source

Last updated · 2026-07-10

Disclaimer

This content is provided for information and general guidance purposes only; it does not constitute legal advice or an attestation of compliance. As this is a law still partly implemented by delegated decrees, the official source (Normattiva / Official Gazette) always prevails for any assessment. NomotecnIA is not a notified body.

  • #L132_2025
  • #ItalianAILaw
  • #ArtificialIntelligence
  • #DelegationToGovernment
  • #AgID
  • #ACN
  • #Garante
  • #AIAct
  • #Deepfake
  • #SME

Changelog

Revision history

  1. 2026-07-06

    First publication — a 15-field briefing with facts verified on Normattiva and a separate NomotecnIA reading.

  2. 2026-07-10

    Editorial enrichment — added In-depth section, accredited author and changelog; schema updated to TechArticle with a Person author.

Author

Matteo Colacchio

CEO · AI Governance, NomotecnIA

Author profile →

LinkedIn: to be linked

Official source · Normattiva

From the rule to your company

How does Law 132 coordinate with the AI Act in your SME?

The AI Entry Assessment unifies national and European compliance into a single governance framework: a map of the systems, gap analysis, a prioritised roadmap — without duplicated obligations.