Italy’s AI Act penalties: what Decree 179/2026 says

Italy’s Legislative Decree 179/2026 has been in force since 23 October 2026. It sets out who enforces the EU AI Act in Italy and which penalties apply. For a company that uses or sells chatbots and AI agents, the figure that matters is the one tied to Article 50 of the Regulation, the transparency obligations: up to 15 million euro or 3% of worldwide annual turnover, although for SMEs the decree points to a specific rule of the Regulation. Here is what the text says, what it does not say, and what to check now.

Facts checked against the decree as published in the Italian Official Gazette no. 234 of 8 October 2026 (Italian text; quotations are our translation). Updated 13 November 2026. This is not legal advice.

What Decree 179/2026 changes

The AI Act is an EU regulation and applies directly, but each Member State had to designate authorities and set penalties. The decree’s title says so: «powers of the national authorities and use of artificial intelligence in education». The text, also available on Normattiva, names AgID and ACN as the national AI authorities, referring back to Law 132/2025.

• AgID is the notifying authority and imposes the fines under Article 99(4)(f) and (5) of the Regulation (Art. 20 of the decree).
• ACN is a market surveillance authority; so are the Bank of Italy, CONSOB, IVASS and the Garante, each within its own remit (Art. 1(2)).
• Market surveillance authorities impose the penalties on the subjects listed in Article 99(1) of the Regulation (Art. 21).

The penalties, article by article

Article 23 of the decree sorts infringements into four bands. The amounts are maximums and, for companies, are calculated on the «total worldwide annual turnover of the preceding financial year»: the wording is «up to» a fixed sum «or, if higher», up to a percentage of turnover.

• Prohibited practices (Art. 5 of the Regulation): up to 35,000,000 euro or 7% of turnover.
• Obligations under Articles 16, 22, 23, 24, 25 and 26, 31, 33 (paragraphs 1, 3 and 4), 34, 50, 73 and 80 of the Regulation: up to 15,000,000 euro or 3% of turnover. Articles 16 to 26 mostly concern providers, importers, distributors and deployers of high-risk systems; Article 50 contains the transparency obligations.
• Incorrect, incomplete or misleading information given to notified bodies or authorities: up to 7,500,000 euro or 1% of turnover.
• Articles 27 and 86 of the Regulation: up to 1,000,000 euro or 0.5% of turnover.

In setting the amount, the authority considers the criteria of Article 99(7) of the Regulation and whether the obligation breached is substantive or formal (Art. 23(6)).

What about SMEs?

Article 23(7) states that for small and medium-sized enterprises, micro-enterprises included, and for innovative start-ups the penalty «is determined according to the criterion in Article 99(6) of the AI Regulation». The decree gives no other figures for SMEs: read Article 99 of the Regulation with your adviser for the exact rule.

A fine is not the only outcome

Article 22 provides, for infringements of «low offensiveness or danger», two alternatives to a fine: an order to end the breach and not repeat it, possibly with measures and a deadline, or, if the breach has ceased, a public statement naming the breach and who committed it. If the order is not met in time the fines apply, increased by up to one third.

Chatbots and AI agents: what to check now

The decree does not change the obligations of the AI Act, but it makes an inspection a realistic prospect. For a chatbot or an AI agent that talks to customers and suppliers, a sensible internal check starts with three questions:

1. Do people know they are talking to an AI system? The notice belongs in the interface (website, WhatsApp, phone), not only in the privacy policy.
2. Is there a hand-over to a human when the conversation leaves the intended scope?
3. Is there a log of what the system answered, with which data and which version, ready if an authority asks?

These are technical and organisational measures: deciding how the law classifies your case (for example whether a system is high-risk) is a job for a lawyer. If you are considering a virtual assistant, our chatbots and virtual assistants service builds them with a transparency notice, hand-over to a person and conversation logs. For the basics, see our guide to AI for business and intelligent agents, and the AI agents for business service page if you want to see where AI really helps your processes.

Frequently asked questions

Is Decree 179/2026 already in force?

Yes. It was published in the Italian Official Gazette no. 234 of 8 October 2026, and the Normattiva database gives 23 October 2026 as the date it entered into force.

Who enforces the AI Act in Italy?

The national AI authorities are AgID and ACN. ACN is also a market surveillance authority, together with the Bank of Italy, CONSOB, IVASS and the data protection authority (Garante), each within its own remit.

What is the maximum fine for a chatbot without a transparency notice?

Article 50 of the Regulation is among the obligations in Article 23(2) of the decree: up to 15 million euro or 3% of worldwide annual turnover. The decree also provides non-monetary measures for minor infringements and, for SMEs, refers to a specific rule in the Regulation.

Written by. The URETECH team: developers and consultants who design and integrate ERP systems, custom software, automations and AI agents for SMEs. About us and how we work.