Content developed with the assistance of AI tools and reviewed by the author.
Law 34/2026 imposed mandatory annual risk notices for every remote worker in Italy — and criminal sanctions on directors who miss them
Your Dublin-headquartered software firm has three engineers who relocated to Lake Como, Puglia, and Rome over the past two years. They work full-time, remotely, under Irish contracts. Your HR team issued them each a self-assessment questionnaire on their home-office setup — the same one you use for your Wexford-based remote staff. You assumed that covered it. Under Italian law, it does not. And the gap is a criminal matter, not an HR formality.
Law No. 34/2026 — known as the Annual SME Law 2025–2026 — came into force on 7 April 2026. Article 11 of that law inserted a new paragraph 7-bis into Article 3 of Legislative Decree No. 81/2008 (the decreto legislativo that is Italy's consolidated health and safety statute, equivalent in function to Ireland's Safety, Health and Welfare at Work Act 2005). The amendment extended the full set of Italian occupational health and safety obligations to all smart working and remote-working arrangements, regardless of the employer's size, nationality, or sector.
The obligation is not triggered by the number of employees. A single remote worker in Italy is enough. There is no transitional period. The requirement applied from the day the law entered into force.
Yes — and it must be a company-issued written notice, issued annually to each remote worker individually. That notice must also be sent to the Rappresentante dei Lavoratori per la Sicurezza (RLS), the workplace safety representative — an internal or, where none is elected, the territorial trade-union-nominated representative under Italian law.
The notice must identify, at a minimum: risks from display-screen equipment (DSE), ergonomic hazards arising from the employee's home or remote workspace, and psychosocial risk factors such as isolation, pressure to remain constantly available / always-on pressure, and the blurring of working and rest time. The employer must also document that the remote worker has received adequate training on those risks and on the proper use of any equipment provided.
A worker's self-declaration — however detailed / no matter how comprehensive — does not satisfy this obligation. Irish law does require employees to cooperate in workplace risk assessments, and many Irish HR teams issue self-assessment forms for homeworkers under the 2005 Act or under Health and Safety Authority guidance. That is not the same instrument. The Italian obligation is a company-signed, employer-authored written notice delivered to a named individual. The direction of the document is from employer to worker, not the other way around.
The text of Article 3 of Legislative Decree 81/2008, as amended, applies by reference to the location of the work activity. Where a worker habitually or regularly performs remote work from Italian territory, Italian health and safety law governs that activity. This applies whether the employer is an Italian company, an Irish limited company, or a US corporation with no Italian legal entity at all.
Unlike in Ireland — where the Health and Safety Authority enforces obligations against identifiable legal entities registered or operating in the State — the Italian enforcement model focuses on the individual who holds the statutory position of datore di lavoro (the employer's legal representative or the person who effectively directs the work). For a foreign company, that person is typically the director or officer with Italian employment authority. Italian prosecutors do not need an Italian entity to target an individual: Italy's criminal jurisdiction is grounded in the location of the offence.
Regulation (EU) 593/2008 (Rome I) governs the applicable law on the employment contract itself, and under its Article 8 a worker who habitually works from Italy will, in most cases, have Italian mandatory rules applied to their employment relationship regardless of the choice-of-law clause in their contract. Italian health and safety provisions are mandatory rules within the meaning of Article 9 of Rome I. An Irish-law employment contract does not extinguish / does not override this obligation.
Nemo auditur propriam turpitudinem allegans — no one may rely on their own wrongdoing as a defence. The maxim is apt here: claiming ignorance of Italian obligations does not extinguish criminal liability.
Sanctions for non-compliance with Article 3 paragraph 7-bis are governed by Article 55 of Legislative Decree 81/2008. The penalty for an employer who fails to issue the required risk-assessment notice is imprisonment of between two and four months, or a fine of between €1,644.00 and €7,403.96, applicable against the individual datore di lavoro. These are criminal penalties under Italian criminal law, not administrative fines.
The distinction matters enormously to an Irish director. An administrative fine — even a significant one — does not appear on a criminal record. A criminal conviction under Article 55 of Legislative Decree 81/2008 does. A conviction, even a suspended sentence, can affect the director's fitness-and-probity assessments under Central Bank of Ireland rules, their eligibility for future Irish work-permit sponsorship, and their personal mobility across Schengen and beyond. Competitor HR blogs routinely treat this exposure as a compliance risk with a financial ceiling. It is not. It is a personal criminal risk with professional consequences that outlast any fine.
The Italian Court of Cassation, Third Criminal Division, judgment No. 38431 of 17 September 2024 (Cass. pen., Sez. III, sent. 17 settembre 2024 n. 38431) confirmed — in the context of Article 55 — that the criminal liability of the employer's legal representative is strict in nature where the specific protective obligation is codified and the failure to fulfil it is documented. The prosecution does not need to show that harm resulted; the omission itself constitutes the offence.
The following elements are required, based on Article 3 paragraph 7-bis of Legislative Decree 81/2008 and the ministerial guidance on smart working issued by the Italian Ministry of Labour:
The notice must state the general risks applicable to all remote workers in the company (DSE exposure, musculoskeletal hazards, lighting and ventilation standards, electrical safety of home equipment). It must also address the specific risks identified for that individual's location and role. Psychosocial risks — isolation, always-on availability, inadequate rest — must be named explicitly, not subsumed into a generic catch-all clause. The notice must confirm the worker's right to disconnect and cross-reference the mandatory individual smart-working agreement (the written individual agreement under Law 81/2017, which remains separately required alongside the new notice obligation).
The document must be signed by the employer and delivered in writing — hard copy or, more commonly, by means of certified email (PEC, the Italian certified email system with legal-delivery status). Delivery by ordinary email does not create a legally reliable audit trail under Italian procedural rules. The notice must be renewed annually, not only when the remote-working arrangement changes.
The employer must also appoint or confirm the identity of the occupational physician (medico competente) who has access to remote workers for health surveillance purposes, and ensure that the worker knows how to request an examination.
In addition to the annual notice, a separate written individual smart-working agreement must document: the right to disconnect (specifying the hours during which the employer will not contact the worker), the equipment supplied and who bears the cost of maintenance, data-protection responsibilities, and the applicable collective bargaining agreement. Failure to have this agreement in place is itself a separate breach.
Here is the exposure point that most cross-border employment advisers have not yet built into their risk matrices. An Irish director who is named as the datore di lavoro in an Italian smart-working agreement — or who would be identified as such by an Italian court — faces personal criminal liability. If the competent Italian court (the Tribunale of the Italian city where the worker is based) issues a decree penale di condanna — a simplified criminal payment order — and the director does not oppose it within 15 days, it becomes final and enforceable. The Central Bank of Ireland and Irish financial regulators treat foreign criminal convictions as disclosable. The Irish Naturalisation and Immigration Service considers them in permit renewals. The Schengen Information System records them where the sentence exceeds a threshold. A quick compliance audit, in comparison, costs very little.
In our files, the most common mistake is that Irish companies with fewer than twenty Italian remote workers have relied entirely on their Irish health and safety consultants to produce a generic remote-working policy, without involving Italian-law counsel at all. The policy is typically excellent under Irish law and legally worthless under Italian law because it does not name an Italian-law datore di lavoro, does not mention Article 3 of Legislative Decree 81/2008, and is not issued annually to a named individual. The Italian labour inspectorate (Ispettorato Nazionale del Lavoro) has been cross-referencing smart-working notifications filed with the Ministry of Labour — required separately under Law 81/2017 — with employment records, and companies that have filed smart-working notifications but cannot produce the corresponding annual risk notice are the primary audit targets in 2026.
We have an Irish employment contract with a choice-of-Irish-law clause. Does that protect us from Italian health and safety obligations?
No. Under Article 9 of Regulation (EU) 593/2008 (Rome I), Italian health and safety rules are mandatory provisions of Italian law that apply regardless of the governing-law clause in the employment contract. The choice-of-law clause determines which law governs contractual matters such as notice periods and pay; it does not displace the Italian statutory obligations that protect the worker in the country where they are physically working.
The worker set up their own home office in Italy and chose their own desk and chair. Are we still liable for the ergonomic risk assessment?
Yes. The Italian obligation rests on the employer, not the worker. The employer must issue the annual written notice identifying ergonomic risks and provide written guidance on compliant workstation setup. The fact that the worker purchased their own equipment does not transfer the employer's statutory duty. You may wish to include an equipment subsidy clause in the individual smart-working agreement and document that the worker has been trained on correct workstation configuration.
What is the first concrete step an Irish employer should take this week?
Identify every employee working remotely from Italy — including those on informal or undefined arrangements — and cross-check whether a valid written individual smart-working agreement and a current-year annual risk notice are on file for each one. If either document is missing, treat it as an open criminal exposure for the director named or identifiable as the Italian datore di lavoro. The remediation is straightforward and the documents can be issued promptly, but neither document can be backdated legally. The clock for the next annual renewal runs from the date of the first valid issue.
HREFLANG BLOCK:
Editorial Team — Panato Law Firm Staff
