The Garante per la protezione dei dati personali adopted provvedimento n. 532 on 14 July 2026, an opinion on a draft legislative decree adapting Italian law to Regulation (EU) 2024/1689. The opinion was favourable subject to conditions. The measure sits at the draft decree stage, and the opinion forms part of the procedure that precedes adoption of the final text.
The draft decree addresses the powers of national authorities under the AI Act and the use of artificial intelligence in education. The Garante asked that its power to issue guidelines under Article 11 of the draft be extended, that the sanctioning procedure refer to Article 166 of the Italian Data Protection Code, that responsibility for conformity assessment under Article 31(9) of Regulation (EU) 2024/1689 be clarified, that Article 26 of the draft provide for Garante participation in projects involving personal data, and that the prohibition on automated decisions in Article 40 of the draft be considered for extension to evaluative decisions that materially affect an employment relationship. The opinion also engages Articles 20, 24, 43, 57, 70, 74(8), 75, 78, 79 to 83 and 88 to 89 of the Regulation.
Providers and deployers of high risk AI systems placed on the Italian market are affected by the allocation of supervisory powers, because the decree determines which authority investigates and sanctions them. Notified bodies face the conformity assessment point raised on Article 31(9). Employers running automated evaluation tools are exposed to the wider prohibition the Garante proposed for Article 40 of the draft.
The conditions attached to the opinion are requests to the drafting ministries rather than binding amendments, so the adopted text may depart from what the Garante asked for. The extension of the automated decision prohibition to evaluative employment decisions carries the widest commercial reach among the conditions and is the one most likely to be contested.
Licentium advises providers, deployers and importers of AI systems on European and Italian obligations under Regulation (EU) 2024/1689. Work we undertake includes system classification opinions, conformity assessment planning, supervisory authority engagement and review of automated decision practices in employment.
Source: Garante per la protezione dei dati personali, provvedimento n. 532 del 14 luglio 2026