Italy's Law 132/2025 and the EU AI Act: governance matters more than rules
Since 10 October 2025, Italy's Law 132/2025 is in force. From 2 August 2026, the EU AI Act's obligations become operative. Knowing the rules is not enough: you need the governance to apply them.
The AI regulatory landscape has changed, and it isn't only a matter for lawyers.
Since 10 October 2025, Italy's Law 132/2025 has been in force, the country's first national framework on artificial intelligence. It sits alongside the EU AI Act, whose transparency obligations and penalty regime become operative on 2 August 2026. Together they apply to companies of any sector and size.
What boards underestimate
Here is what boards underestimate: Law 132/2025 strengthens the link between AI and corporate criminal liability (Italy's "231" model). Using AI systems now falls inside that perimeter.
It becomes a boardroom topic, not just an IT one. The questions change in nature:
- who is accountable for decisions taken or suggested by an AI system?
- on which data was it trained and fed?
- what traceability exists today, in case of dispute?
The rules are the easy part
The usual reaction is to rush and read the rules. The rules are the easy part. The hard part is knowing whether the organisation can actually meet them: who answers for what, on which data, with what traceability of decisions.
That is the gap between knowing a rule and having the governance to apply it.
Only 9% of large Italian companies have structured AI governance. Osservatorio Artificial Intelligence, Politecnico di Milano, 2025
They are the ones already prepared for compliance.
Measure before you adapt
Before you adapt, measure where you stand. AI Rating assesses your AI Risk against objective criteria and shows the gaps while there is still time to close them.
The first step is a conversation: hello@zerofive.ai