Italy adopts the AI Bill: implications for foreign companies

On 17 September 2025, the Italian Senate approved the AI (Artificial Intelligence) Bill setting out the principles, instruments and competent Authorities for the development and use of AI technologies in Italy.

It is important to highlight that this legislation does not introduce new technical obligations for AI system providers compared to those already set out by Regulation (EU) 2024/1689 (the “AI Act”), which applies in all Member States.

The Italian law, however, serves to transpose the AI Act into the national context, by designating the competent Authorities responsible for supervision and enforcement, promoting investments in innovation and establishing specific organizational rules applicable within Italian territory.

In light of this new legislation, it is worth recalling some of the key obligations under the AI Act, which are directly relevant to foreign companies already operating in the EU or those intending to enter in this market.

AI Act: key considerations and obligations

For a foreign company seeking to access the European market, the AI Act is relevant in several respects:

• AI Act categorizes AI systems according to the level of risk; it is therefore necessary to assess whether a system falls into the category of prohibited AI practices, high-risk AI systems, limited-risk or minimal-risk systems, in order to determine the applicable obligations;
• in case of high-risk AI systems, providers are required to comply with strict requirements regarding risk management, the quality of training data, technical documentation and record-keeping, human oversight, transparency, as well as robustness, accuracy and cybersecurity;
• in case of general-purpose AI models, relevant entities are required to provide adequate documentation (e.g. regarding the architecture, capabilities and limitations of the model), publish a summary of the training data used, and implement appropriate safety and cybersecurity measures;
• certain AI systems must be registered in the EU database and placed on the market only with the required CE marking, failing which a commercial ban may be imposed;
• users must be clearly informed when a content has been generated by AI, as well as when they are interacting with an AI system.

These and other obligations are crucial for any entity wishing to operate in the European market. Non-compliance may result in administrative fines of up to 7% of the total worldwide annual turnover of the preceding financial year.

Further legislation to consider

In addition to the AI Act, companies must also comply with other EU legislation, in particular Regulation (EU) 2016/679 (the GDPR). Non-compliance may even lead to suspension of services, as demonstrated by the case of DeepSeek, which was banned in Italy by the Italian Data Protection Authority.

In that case, the Authority identified several shortcomings in relation to personal data protection, including the absence of an adequate privacy notice for users, the possible collection and processing of personal data without an adequate legal basis, the lack of sufficient information on the processing activities carried out and the storage of personal data in Chinese territory, in breach of the safeguards required under the GDPR.

This case illustrates that the activities of AI providers – including those established outside the EU – may be subject to scrutiny by both EU and national supervisory Authorities where they fail to comply with the applicable regulatory framework.

Considerations for non-EU companies

Non-EU companies wishing to enter the European market must take into account two key factors:

1. compliance with the applicable legal framework in the target Country, both at EU and national level;
2. planning of local infrastructure, where required, and the establishment of partnerships with local entities.

While the regulatory framework releases opportunities for cooperation and investment, it also requires vigilant legal, technical and strategic management. In this context, the support of local experts can be decisive in ensuring a market entry that is as compliant as possible with Italian and European requirements.