Content developed with the assistance of AI tools and reviewed by the author.
What every US company using recruitment or performance software for Italian employees must fix before 23 October 2026 — and what it costs to get it wrong
Your US company expanded into Italy. You use the same ATS, performance-management platform and workforce-analytics dashboard you run everywhere else. Your employment counsel confirmed GDPR compliance. You assumed the EU AI Act covered everything else.
That assumption is the single most expensive mistake we see in files right now.
On 23 October 2026, D.Lgs. 7 ottobre 2026, n. 179, published in the Gazzetta Ufficiale, Serie Generale n. 234 dell'8 ottobre 2026, takes effect / comes into force. From that date, any final employment decision — hire, promote, discipline, dismiss — made or effectively replaced by an automated system for employees working in Italy is unlawful. Penalties of up to €35 million or 7 % of worldwide annual turnover, whichever is higher. And that figure is only the administrative exposure.
Italy's 23 October 2026 deadline activates the decreto legislativo (legislative decree) that implements the national supervisory and enforcement layer of EU AI Act Regulation (EU) 2024/1689 on harmonised rules for artificial intelligence. That EU regulation classifies recruitment, CV screening, job-candidate ranking, performance evaluation, and dismissal tools as high-risk AI systems under Article 6 and Annex III, point 4.
D.Lgs. 179/2026 goes further than the EU baseline in three ways that matter to US employers:
First, it designates two Italian national authorities — AgID (Agenzia per l'Italia Digitale) and ACN (Agenzia per la Cybersicurezza Nazionale) — as enforcement bodies with autonomous investigative and sanctioning powers. You may already deal with the EU's national AI supervisors; Italy gives you two.
Second, it reserves every final employment decision to a natural person. The word final is doing the legal work. A system may rank, score, flag, and shortlist — but a human being must review the output and make an independent decision before any offer is extended, any warning is issued, or any dismissal is notified. The decree adopts a functional test: it looks at what the system effectively does in practice, not how the vendor describes it in the contract.
Third, Italy has added criminal liability provisions that are entirely absent from the EU AI Act itself. The decree attaches personal criminal liability for officers who authorise or fail to prevent a prohibited automated decision. No equivalent mechanism exists under US federal law.
The sister decree, D.Lgs. 9 settembre 2026, n. 160, published in the Gazzetta Ufficiale, Serie Generale n. 214 del 15 settembre 2026, completes the second pillar. It reverses the burden of proof in civil claims: when an employee or rejected candidate argues that AI caused them harm, the employer or system deployer must prove the system was compliant. That is the opposite of the default rule under US employment litigation, where the claimant generally carries the burden.
Yes — with strict conditions. Under the two-pillar framework, an applicant-tracking system that generates a ranked shortlist is not automatically unlawful. What is unlawful is using that ranked list as the decision: automatically rejecting everyone below rank 10, or automatically advancing everyone above a 78 % compatibility score, without a documented human review.
The practical test is this: could the hiring manager override the system's output without triggering a separate approval workflow? If the answer is no, or if overrides are logged as exceptions requiring justification, the system is likely effectively making the decision within the meaning of D.Lgs. 179/2026.
There is a further layer that most US employers miss entirely. Law 3 maggio 2022, n. 99, known as the Decreto Trasparenza (Transparency Decree, which transposed EU Directive 2019/1152 on transparent and predictable working conditions and amending the Italian Civil Code to introduce automated-decision disclosure obligations), requires employers to give employees 24 hours' advance notice of any material change to an automated or algorithmic system that affects their working conditions. This obligation has been in force since 2022 and is entirely separate from the AI Act framework. Fines for non-compliance with Law 99/2022 reach €5,000 per affected worker. For a headcount of 50 Italian employees, a single missed notification round carries a €250,000 exposure — before any AI Act sanction.
Unlike in the United States — where no federal statute currently mandates human oversight of AI-driven employment decisions, and state-level rules such as New York Local Law 144/2021 focus on bias audits rather than decision-making authority — Italy now imposes an absolute human-override mandate for every final HR decision. There is no size threshold, no industry carve-out, and no safe-harbour for good-faith compliance efforts after the fact.
American employers are accustomed to a system where the risk of AI bias claims is managed through periodic audits and disparate-impact analysis. In Italy, the risk attaches at the point of decision, not after the hire cycle closes. The burden-of-proof shift under D.Lgs. 160/2026 means a former employee's day-one pleading puts compliance evidence immediately on your desk, not theirs. Your Italian employment attorney, not your US outside counsel, controls that evidence strategy.
Quod non apparet non est — what does not appear does not exist. In Italian compliance practice this means: undocumented human review is the same as no human review.
As Shoshana Zuboff observed in The Age of Surveillance Capitalism, the extraction of behavioural data for prediction and modification operates most powerfully when it is invisible to the person affected. Italy's legislature has read that argument and converted it into a legal obligation: visibility, documentation, and human accountability are now mandatory, not optional design choices.
Not illegal in itself — but severely constrained. Performance-management platforms that track productivity metrics, flag attendance anomalies, or compute engagement scores are lawful as analytics tools. They become unlawful the moment their output automatically generates or pre-populates a performance improvement plan, triggers a disciplinary notice, or feeds directly into a dismissal recommendation without documented human intervention.
The checklist below maps the critical control points. You should verify each one with your HR operations team before 23 October 2026.
Step 1 — Inventory your systems. List every platform that touches Italian employees: ATS, HRIS, performance-management software, scheduling tools, engagement platforms, workforce-analytics dashboards. Include third-party integrations and vendor-provided scoring APIs.
Step 2 — Classify each system. Apply the Annex III, point 4 test from Regulation (EU) 2024/1689: does the system assess, rank, evaluate, or influence a decision on recruitment, advancement, retention, or dismissal? If yes, it is high-risk under the EU AI Act and subject to D.Lgs. 179/2026 domestic obligations.
Step 3 — Map decision nodes. For each high-risk system, trace the workflow to the moment a final employment decision is made. Document precisely who signs off, what information they see, and whether the system output is advisory or effectively binding. This documentation is your primary defence under the D.Lgs. 160/2026 burden-of-proof reversal.
Step 4 — Insert mandatory human checkpoints. Any step where a system currently generates an automated outcome — rejection email, warning letter, grade assignment — must be redesigned to require a named individual's documented approval before the output is acted upon. Update your Italian employment contracts and works-council agreements (where applicable) to reflect the new workflow.
Step 5 — Audit your Transparency Decree notifications. Under Law 99/2022, your Italian employees must have received written disclosure of every automated or algorithmic system that affects their working conditions. Verify that disclosures cover the current version of each tool. Budget for the 24-hour advance-notice obligation the next time a vendor updates an algorithm.
Step 6 — Designate an Italian-law compliance owner. D.Lgs. 179/2026 imposes training obligations on personnel involved in AI deployment in employment. Assign a named officer in Italy, confirm they have completed the required training, and document that assignment. Criminal liability under the decree attaches to those who authorise or fail to prevent a violation — not just to the legal entity.
The administrative penalty structure under D.Lgs. 179/2026, read with Regulation (EU) 2024/1689, provides for three tiers. Prohibited AI practices — those that manipulate, exploit vulnerabilities, or are listed as unacceptable-risk under Chapter II of the EU AI Act — carry fines of up to €35 million or 7 % of total worldwide annual turnover. High-risk violations, which cover the employment category, carry fines of up to €15 million or 3 % of worldwide turnover. Non-compliance with information or documentation obligations carries fines of up to €7.5 million or 1 % of turnover.
On top of these figures: civil compensation under D.Lgs. 160/2026 is uncapped. An employee who demonstrates that an automated system caused wrongful dismissal can claim full reinstatement, back pay for every month of unlawful separation (Italian unfair dismissal remedies are significantly more generous than US at-will defaults), and damages for non-economic harm. Where criminal liability attaches to a company officer, penalties include personal fines and — in the most serious cases — temporary disqualification from holding management roles in Italy.
Italy's Garante per la protezione dei dati personali (the national data-protection authority, equivalent to a state privacy regulator but with national jurisdiction) retains a separate enforcement track under the GDPR. An AI-driven employment decision that processes biometric, health or trade-union data without a valid legal basis attracts a concurrent GDPR fine of up to €20 million or 4 % of global turnover. Both AgID/ACN and the Garante may act on the same set of facts.
In our files the most common mistake is not a rogue algorithm — it is a vendor contract that grants the software provider the right to update the scoring model unilaterally, with no obligation to notify the deploying employer. The update happens overnight. The Italian employees' working conditions change. No 24-hour notice is given. The employer carries full liability under Law 99/2022 even though it never knew the model changed. Before 23 October 2026, read every AI vendor SLA for Italian deployments: if it does not include a mandatory pre-update notification to you, renegotiate or terminate.
Does the 23 October 2026 deadline apply to US companies with only a handful of Italian employees?
Yes. D.Lgs. 179/2026 sets no headcount threshold. A US parent with a single Italian subsidiary employing five people is within scope if it deploys a high-risk AI system for employment decisions. The fine ceiling is calculated on worldwide group turnover, not Italian turnover alone.
Can we rely on our EU AI Act compliance programme and our EU-based DPO to cover Italy?
Not fully. Your EU AI Act programme addresses the baseline Regulation (EU) 2024/1689 obligations. Italy's two-pillar domestic framework adds the human-decision mandate, the burden-of-proof reversal, and criminal provisions that sit outside the EU regulation. Your DPO covers data-protection aspects under the GDPR; they are not the designated contact for AgID or ACN enforcement actions under D.Lgs. 179/2026.
What is the first concrete step we should take this week?
Commission an Italian-law HR-systems audit: a structured review of every automated tool touching Italian employees, mapped against D.Lgs. 179/2026 high-risk categories and the Transparency Decree notification log. The audit generates the documentation record that reverses your exposure under the D.Lgs. 160/2026 burden-of-proof shift. Without that record, you enter 23 October 2026 with liability on your balance sheet and no evidence on your side.
If your company uses automated hiring, performance or dismissal tools for Italian employees and has not yet reviewed its workflows against the two-pillar Italian AI framework, the time to act is now — not after an AgID investigation letter arrives.
Panato Law Firm, led by Avv. Marco Panato in Verona, Italy, advises international companies on Italian employment law, data compliance, and digital regulatory obligations. To commission an HR-systems audit or discuss your company's exposure under D.Lgs. 179/2026, write to info@panatolawfirm.com or call +39 045 5867034.
HREFLANG BLOCK:
Editorial Team — Panato Law Firm Staff
