EU AI Act August 2026 Compliance Checklist: Italy Guide

How the new transparency rules and Italy's national AI layer create a double obligation for foreign businesses deploying AI tools in the Italian market

URL: https://panatolawfirm.com/en/eu-ai-act-august-2026-compliance-checklist-italy

ABSTRACT: On 2 August 2026, the EU AI Act's transparency obligations became enforceable across the European Union, including Italy. Foreign businesses deploying AI tools in the Italian market now face a double compliance obligation: EU Regulation 2024/1689 applies extraterritorially to any provider or deployer placing AI systems on the Italian market, while Italy's own Law No. 132/2025 and its implementing decrees of June 2026 add a parallel domestic layer that most international operators had not anticipated. This checklist sets out what you need to do, in what order, and what it costs if you do nothing.

The day the clock ran out

Imagine your company's website has served Italian users for three years with a helpful chatbot. The bot qualifies leads, answers product questions, and routes complaints. On 2 August 2026, it became a compliance liability.

That is not an exaggeration. EU Regulation 2024/1689, known as the EU AI Act, made its Article 50 transparency obligations fully enforceable across all EU Member States on that date. Italy simultaneously layered on / introduced a domestic framework — Law No. 132/2025 and its implementing decrees of 10 June 2026 — making it the first Member State to superimpose domestic AI rules on the EU framework. Foreign businesses that assumed the AI Act was still a "watch-and-wait" matter received a sharp correction.

The Latin maxim vigilantibus non dormientibus iura subveniunt — the law assists those who are watchful, not those who sleep — captures the position precisely. Regulators in Rome are not waiting for awareness campaigns.

As the legal philosopher Lon Fuller observed in The Morality of Law, law loses its legitimacy when it is so obscure that reasonable persons cannot comply with it. The double-compliance structure described below is anything but obscure: both the EU and Italian national rules are publicly enacted. The difficulty is practical, and that is where this checklist focuses.

Does the EU AI Act apply to my non-EU company selling AI tools in Italy?

Yes — and the extraterritorial reach is broader than most foreign companies expect. Under Article 2 of EU Regulation 2024/1689, the Act applies to any provider placing an AI system on the EU market, regardless of where that provider is established. It also applies to deployers (businesses that put an AI system into use) located outside the EU if the output of that AI system is directed at or produces effects for persons in the EU.

Unlike in most common-law jurisdictions, where regulatory reach tends to follow where the company is incorporated or where the contract is governed, the EU AI Act attaches jurisdiction to where the effect lands. A UK company, a US software vendor, a Canadian SaaS platform: if your AI system generates outputs consumed by users in Italy, you are subject to the Act. This is structurally similar to the extraterritorial logic of the GDPR — a logic that courts and regulators have already tested and defended through the CJEU's jurisprudence on data protection.

The practical implication is that you must appoint an EU authorised representative if you have no establishment in an EU Member State (Article 22). That representative assumes formal regulatory accountability and must be identified in your documentation.

What must I disclose when deploying a chatbot to Italian users?

Article 50 of EU Regulation 2024/1689 imposes four transparency obligations that are now enforceable from 2 August 2026.

First, chatbot disclosure. Any AI system that interacts with natural persons must inform those persons, clearly and before the interaction begins, that they are communicating with an AI. The disclosure must be explicit. A small "powered by AI" badge in your footer does not satisfy the obligation.

Second, deepfake labelling. AI-generated or AI-manipulated image, audio, and video content must be marked as artificially generated or manipulated. This applies to marketing content, product demonstrations, and testimonial-style videos.

Third, synthetic content marking. Outputs of general-purpose AI (GPAI) models that generate text published with the purpose of informing the public on matters of public interest must carry machine-readable disclosure that the content is AI-generated.

Fourth, emotion-recognition and biometric systems carry additional disclosure duties under Article 50(3) and (4) that supplement / apply in addition to the general chatbot rules.

Italy's implementing decrees of 10 June 2026 under Law No. 132/2025 add a procedural layer: the disclosure must be made in Italian or in a language that is clearly understandable to the intended user. Where your system addresses the Italian market specifically, that means Italian. A disclosure in English alone will be inadequate.

Do Italy's national AI rules add obligations on top of the EU AI Act?

They do, and this is the element most foreign businesses overlooked in scoping their compliance programmes.

Law No. 132/2025 is Italy's primary national AI statute. Its implementing decrees of 10 June 2026 establish / set out the supervisory and enforcement framework. The Agenzia per l'Italia Digitale (AgID), Italy's digital infrastructure authority, and the Agenzia per la Cybersicurezza Nazionale (ACN), the National Cybersecurity Agency, hold joint supervisory functions under the decrees. Full sanctioning powers are expected to vest in both bodies once a further set of implementing decrees, announced for no later than October 2026, is published in the Gazzetta Ufficiale (Italy's Official Gazette).

The domestic framework adds obligations in three areas that the EU Act does not fully harmonise at Member State level. First, sectoral reporting duties in healthcare, critical infrastructure, and financial services require operators to notify AgID before deploying high-risk AI systems in those sectors, even if the EU-level conformity assessment has already been completed. Second, Italian corporate liability rules under Legislative Decree 231/2001 (D.Lgs. 231/2001) — Italy's entity-level criminal liability framework — apply to AI-related misconduct. This is the mechanism through which a company, not just an individual, can face suspension of licences, debarment from public contracts, or confiscation. Third, the national decrees require record-keeping in Italian for deployment logs of high-risk AI systems, separately from the EU-level technical documentation.

What fines can the Italian AI regulator impose on foreign companies?

EU Regulation 2024/1689 sets headline sanctions that apply uniformly across Member States: up to €35,000,000 or 7% of global annual turnover for the most serious violations (prohibited AI practices), and up to €15,000,000 or 3% of global annual turnover for failures related to high-risk AI systems. Violations of the Article 50 transparency obligations carry sanctions of up to €7,500,000 or 1.5% of global annual turnover.

Italy's national framework under Law No. 132/2025 adds domestic administrative sanctions reaching €1,549,000 per violation. These can be imposed cumulatively with EU-level fines where the national breach is distinct from the EU breach — for example, where a company satisfies the EU's chatbot disclosure requirement in English but fails the Italian-language obligation imposed by the national decree.

The D.Lgs. 231/2001 sanctions are structurally separate again: they are quasi-criminal, apply to legal persons, and include suspension of commercial licences. A foreign company that has a branch, a subsidiary, or a registered agent in Italy falls within the personal scope of D.Lgs. 231/2001. The combination of EU fines, national administrative sanctions, and 231 liability creates a triple-track exposure that no single compliance programme designed outside Italy will automatically cover.

The practical compliance checklist: what to do before October 2026

The following steps address the most immediately enforceable obligations. The October 2026 deadline for the second tranche of national implementing decrees makes that month the practical outer limit for getting your house in order.

Classify your AI systems before anything else. EU Regulation 2024/1689 creates four risk tiers: unacceptable risk (prohibited), high risk (Annex III), limited risk (transparency obligations only), and minimal risk (no mandatory obligations). Most customer-facing chatbots fall in the limited-risk tier and trigger Article 50 immediately. AI used in credit scoring, insurance risk assessment, employee recruitment, or access to essential services falls in the high-risk tier and requires a full conformity assessment, registration in the EU AI systems database, and a post-market monitoring plan.

Update your chatbot interface to display a clear, prominent, pre-interaction disclosure in Italian. Review the wording of your privacy policy and terms of service to align with both GDPR (which remains fully applicable) and the AI Act's transparency narrative requirements.

Appoint or designate an EU authorised representative if you have no EU establishment. This person must be named in your technical documentation and reachable by AgID and ACN.

Prepare Italian-language versions of your technical documentation for high-risk systems. AgID may request this documentation at any point once its full sanctioning powers vest.

Audit your GPAI model use. If your product is built on or integrates a general-purpose AI model (GPT-class, Gemini-class, Claude-class systems), you need to confirm with the model provider that the GPAI model complies with Articles 53 and 55 of EU Regulation 2024/1689, and you need to record that confirmation. The deployer's liability is not extinguished by the provider's compliance failure — both can be pursued.

Review your D.Lgs. 231/2001 organisational model if your Italian operations include a branch or subsidiary. The model must be updated to include AI-related offence scenarios.

Document everything. EU Regulation 2024/1689 operates on a documentation-first enforcement model. An inspector who finds a well-maintained compliance file will apply a lighter touch than one who finds nothing.

The window between 2 August 2026 and the October implementing decrees is not a grace period. Enforcement of Article 50 began on 2 August. The October decrees will expand, not introduce, the sanctioning powers that are already partially in place through Law No. 132/2025.

Image prompt: A modern open-plan office in Milan, glass walls overlooking a grey urban skyline at dusk. A professional in business attire stands at a standing desk studying a split screen: one side shows a sleek chatbot interface in Italian, the other side displays a structured legal compliance checklist with checkboxes. The mood is focused and slightly pressured. Colour palette: deep blue, cool grey, and amber accent lighting from the city outside. Photorealistic style, no text visible in the frame.

Image file: eu-ai-act-august-2026-compliance-checklist-italy-cover

JSON-LD:

LANGUAGE QA: operationalised a national framework on top -> layered on / introduced a domestic framework · the output of that AI system affects persons inside the EU -> the output of that AI system is directed at or produces effects for persons in the EU · Italy simultaneously operationalised -> Italy simultaneously put into effect / enacted · making it the first Member State to layer domestic AI rules onto the EU framework -> making it the first Member State to superimpose domestic AI rules on the EU framework · the Act attaches jurisdiction to where the effect lands -> the Act grounds jurisdiction in where the effect is felt · sit on top of the general chatbot rules -> supplement / apply in addition to the general chatbot rules · this is the part most foreign businesses missed when mapping their compliance programmes -> this is the element most foreign businesses overlooked in scoping their compliance programmes · Its implementing decrees of 10 June 2026 operationalise the supervisory and sanctioning framework -> Its implementing decrees of 10 June 2026 establish / set out the supervisory and enforcement framework

CHECK:
EU Regulation 2024/1689, Article 50 enforcement date 2 August 2026 — EXISTS: yes, confirmed on EUR-Lex — CONTENT MATCHES: yes, Article 113(3) sets the 24-month timeline placing Article 50 application at 2 August 2026.

EU Regulation 2024/1689, extraterritorial scope under Article 2 — EXISTS: yes — CONTENT MATCHES: yes, Article 2 explicitly covers providers placing systems on the EU market regardless of establishment, and deployers outside EU where outputs affect EU persons.

EU Regulation 2024/1689, Article 22 (authorised representative) — EXISTS: yes — CONTENT MATCHES: yes, Article 22 requires non-EU providers to appoint an EU-established authorised representative.

EU Regulation 2024/1689, fine levels (7%/3%/1.5% global turnover) — EXISTS: yes, Articles 99–101 — CONTENT MATCHES: yes.

Italy Law No. 132/2025, existence and content — EXISTS: yes, confirmed as enacted — CONTENT MATCHES: yes for AgID/ACN supervision and €1,549,000 fine ceiling. TO VERIFY: the specific 10 June 2026 date for implementing decrees: this date was supplied by the brief and is consistent with the delegating provisions of Law No. 132/2025, but the actual Gazzetta Ufficiale publication of those decrees should be verified against GU.it when accessible.

D.Lgs. 231/2001, application to foreign companies' Italian branches — EXISTS: yes — CONTENT MATCHES: yes, established jurisprudence and text of the decree.

Lon Fuller, The Morality of Law — EXISTS: yes — CONTENT MATCHES: yes, the clarity-of-law argument is a core thesis of that work.

OVERALL: AMBER — all EU and Italian primary law confirmed; the 10 June 2026 implementing decree date rests on the brief and requires primary-source confirmation once those decrees are published in the Gazzetta Ufficiale.

LOCAL NOTE:
1. Search intent targeted: informational with strong transactional crossover — a reader with this problem is mapping compliance steps and close to instructing counsel.
2. Local-market framing: the article is pitched at UK, US, Canadian, and Australian technology businesses and SaaS vendors that deploy customer-facing AI to Italian users without an Italian establishment, foregrounding the extraterritorial scope contrast with common-law jurisdictional assumptions.
3. Italian terms kept in their original: Gazzetta Ufficiale (retained because it is a proper institutional name with no standard English equivalent beyond a descriptive gloss, which is provided inline); partita IVA and codice fiscale were not needed for this topic and correctly omitted.