AI delegation and workplace risk assessment: Article 42 of Italian Legislative Decree 179/2026

In short. Since 23 October 2026, Article 42 of Italian Legislative Decree 179/2026 requires employers to consider, within the risk assessment set out in Italy's consolidated occupational health and safety law, the AI systems that affect work organisation, production pace, the way work is performed or decisions relevant to safety. The likelihood that a system falls within the rule grows with the level of delegation, when it stops helping the person and starts allocating shifts and assigning tasks. That is why the check belongs in the adoption decision, before the system goes into production, and it is where we place it in our work, from the assessment to the rating.

Italian Legislative Decree No. 179 of 7 October 2026, published in Official Gazette No. 234 of 8 October, has 54 articles, and almost all of the attention in the first days went to Article 41, on automated decisions in the employment relationship, which we covered in the piece on AI-assisted decisions and effective human oversight. The next article made less noise and, in our view, affects more companies, because it deals with the way work is organised every day and requires the effect of AI on that organisation to enter the risk assessment document.

Going back over our assessment materials, we realised that occupational safety, in this sense, was almost absent: we discussed the AI Act, personal data and model robustness, and the head of the prevention and protection service was someone we rarely met. Article 42 brings that conversation much closer to our work than we expected.

Article 42 and the consolidated safety law

The text is short. It provides that the use of AI systems affecting work organisation, production pace, the way work is performed or decision processes relevant to safety is assessed within the risk assessment under Article 28 of Legislative Decree 81/2008, and it requires employers to provide workers with information and training on the specific risks linked to those systems and on the prevention measures adopted.

The rule builds on a mechanism that has existed since 2008. Article 29(3) of the consolidated law requires the risk assessment to be redone when the production process or the organisation of work changes in a way that matters for health and safety, with thirty days to update the document, and the review is carried out with the head of the prevention and protection service (and with the occupational physician where required), after consulting the workers' safety representative.

Anyone using a writing assistant or an internal search engine has no new obligation to deal with. Article 42 makes explicit that an AI system can be one of those organisational changes, and it moves the check onto actual use, onto what the system changes in people's work. The risks named in the first technical commentaries are ones anyone who works with these tools recognises immediately: faster work pace, cognitive overload, stress linked to algorithmic monitoring, excessive reliance on the system's indications, errors the system makes or the operator no longer notices.

The level of delegation as an indicator

In our method, adoption is measured on the individual process, with three levels of delegation that look at who produces the output and who checks it. The same distinction works here, because each level changes the work of the people next to the system in a different way.

With an AI-assisted process the person still sets the pace, and the system shortens a task without imposing new ones. When the process moves to AI-first, the person becomes a reviewer of outputs arriving at the system's speed, and the subtlest risk is reliance itself: after the hundredth correct draft, the hundred-and-first is approved with less attention, an effect no technical log shows unless someone looks for it. In AI-native it is the system that decides how work is distributed among people and with which priorities, and in that case the organisational change is the very way the system works.

Some systems touch Article 42 at any level, because their job is to organise work: shift planning, task assignment in warehouses or stores, work queue management, performance monitoring. In retail we often find them inside workforce management software, bought as ERP modules and grown over the years with predictive features without anyone reassessing the purchase, and it is the same point that brings down the Risk dimension in our sector rating. Logistics and contact centres have a very similar profile.

The check in the adoption decision

The risk assessment document is drawn up by the employer, under a duty the consolidated law makes personal and non-delegable, and prepared with the head of the prevention and protection service. What can arrive earlier, and is almost always missing today, is the information on what changes: when a company decides to move a process to AI-first, or to switch on the predictive features of a management system, whoever has to reassess the risks often finds out once the system is already running, with thirty days to catch up.

In the assessment, the use case map flags those that affect shifts, assignments, pace or monitoring, because for those cases the time between decision and value also includes redoing the risk assessment, consulting the safety representative and training the people involved.

In the value case those steps become costs and lead times to set against the benefits, and sometimes they change the answer. A process that at the AI-native level would require reorganising shifts can deliver a return close to the AI-first level with a much smaller impact on the organisation, and stopping one level earlier is a choice a committee makes better when it has those numbers in front of it.

When the project goes ahead, the handover includes a system sheet written for whoever updates the risk assessment document: what the system does and decides, which data it uses, who can intervene when an indication is wrong or dangerous, how it is suspended. This is largely the information we ask for in AI policy 2.0 for the autonomy and control layers, reorganised for a reader who thinks in terms of prevention and protection.

In the training required by Article 42 we see two distinct contents. Safety training belongs to the employer and the prevention service, under the rules the consolidated law already sets. The other concerns the system, how it works, where it fails most often, when not to trust it, how to report an indication that does not add up, and it is the work we do in the AI Academy programmes, designed together with whoever runs safety training so that both contents reach the same people without overlapping.

Confidence and Risk in the AI Rating

The AI Rating measures four dimensions, and two of them need rereading in light of Article 42. In the Confidence dimension we measure, among other things, users' and teams' trust in outputs, which the model already links to clear validation processes and to manual fallback procedures when the system fails. A team that always approves the system's indications does not show maturity, it shows a risk the assessment document has to record. This is why we read Confidence as calibration: trust proportionate to the system's demonstrated reliability, with people who know when to contradict it and have the authority to do so.

In the Risk dimension, our model treats security as data protection and model robustness, alongside compliance and ethics, and the safety of the people working next to the system only entered indirectly. For systems that organise work we add an explicit check that they have been considered in the risk assessment and that someone has the authority to intervene when an indication from the system is dangerous. For those systems it makes sense to treat it as a critical gate, one that a good score on the other dimensions cannot offset.

The consequences for the 231 compliance model

The link to corporate liability runs through a rule that has existed since 2007. Article 25-septies of Legislative Decree 231/2001 includes among predicate offences manslaughter and serious or very serious injury caused in breach of occupational safety rules, and Article 30 of the consolidated safety law sets out what an organisational model must ensure to exempt the company from liability for those offences, from risk assessment and the resulting prevention measures to worker information and training.

If a system falls within Article 42 and the risk assessment does not consider it, the gap passes to the model, precisely on the elements Article 30 requires. For high-risk systems there is the additional route of Article 25-vicies and Article 437-bis of the Criminal Code, introduced by Legislative Decree 160/2026, which we covered in the piece on the new Article 25-vicies.

Our role has a precise scope: the risk assessment belongs to the employer, oversight of the model belongs to the supervisory body, and we replace neither. What we bring to both is the map of systems with the level of delegation of each one and the evidence on how they are supervised, material that for the supervisory body can become a periodic information flow. In our model a self-assessment never produces class A, and the same criterion applies to whoever receives the document: a sheet filled in by whoever runs the system describes an intention, the verification is done by someone else.

The question we will bring to our next assessments concerns the origin of these systems, how many were chosen by someone who knew they were changing an organisation and how many arrived as one more feature inside a management software update.

Main sources: Legislative Decree No. 179 of 7 October 2026, Articles 41 and 42 (Official Gazette No. 234 of 8 October 2026); Legislative Decree No. 81 of 9 April 2008, Articles 17, 28, 29 and 30; Legislative Decree No. 231 of 8 June 2001, Articles 25-septies and 25-vicies; Legislative Decree No. 160 of 9 September 2026.