Penalties and the regulatory sandbox in Italian Legislative Decree 179/2026: what the published text says
The text in the Official Gazette does not confirm the lower caps announced in August. The bands of Article 23, who imposes fines in finance, who can access the sandbox and when an algorithm becomes a trade secret.
In short. Italian Legislative Decree 179/2026, in force since 23 October, adopts the AI Act's maximum fines in full and adds a lower national band for the fundamental rights impact assessment and the right to an explanation. For minor breaches it allows compliance orders and public statements instead of a fine, it sets up the regulatory sandbox run by AgID and ACN, and it brings training data, algorithms and methods within the scope of trade secrets. These are the parts of the decree that do not concern employment, and for a company they matter just as much.
On this blog we have already covered the provisions of the decree that affect people, namely automated decisions and human oversight under Article 41 and the risk assessment under Article 42. This article covers the tools the Italian State will use to enforce the AI Act, that is fines and the procedure behind them, together with the space where companies that develop systems will be able to test them under supervision and the new protection for algorithmic know-how.
The press release and the published text
Press release No. 185 of the Italian Council of Ministers, issued with the final approval on 4 August 2026, announced two changes to the penalty regime: maximum amounts lower than the European ones, and a link to Regulation (EU) 2026/1744, the Digital Omnibus, under which fines would apply only once the corresponding obligations did. Neither appears in the text published in the Official Gazette No. 234 of 8 October 2026. Article 23 restates the maximum amounts of Article 99 of the AI Act, and the decree does not refer to Regulation 2026/1744.
The difference matters for anyone who built budgets and priorities on the August announcements. Without a commencement clause, the most straightforward reading is that a fine requires the breach of an obligation that already applies, so for the high-risk systems in Annex III the reference date remains 2 December 2027, as set by the Omnibus. For everything that already applies, from prohibited practices to the transparency obligations of Article 50, the Italian penalty system has been operational since 23 October.
The penalty bands of Article 23
Article 23 organises administrative fines into four bands. In each one the cap is the higher of a fixed amount and a percentage of total worldwide annual turnover for the preceding financial year, calculated as Article 99 of the AI Act provides.
| Band | Infringements | Cap |
|---|---|---|
| Paragraph 1 | Prohibited practices under Article 5 of the AI Act | EUR 35 million or 7% of turnover |
| Paragraph 2 | Obligations of providers, representatives, importers, distributors and deployers, notified bodies, transparency under Article 50 | EUR 15 million or 3% |
| Paragraph 3 | Incorrect, incomplete or misleading information to notified bodies and authorities | EUR 7.5 million or 1% |
| Paragraph 4 | Fundamental rights impact assessment (Art. 27) and right to an explanation (Art. 86) | EUR 1 million or 0.5% |
The fourth band is the only independent choice of the Italian legislator. Articles 27 and 86 are not listed in Article 99(4), and the decree gave them a cap of their own, set lower. They concern deployers of high-risk systems, in particular public bodies, private entities providing public services, banks and insurers using systems to assess creditworthiness or to price life and health insurance, and anyone taking decisions with legal effects on individuals based on an Annex III system.
Two paragraphs shape the actual amount. Paragraph 6 requires the authority to consider, alongside the AI Act criteria, whether the breached obligation is substantive or formal, a distinction that favours organisations that governed the risk even where their documentation has gaps. Paragraph 7 refers SMEs, micro-enterprises and innovative start-ups to Article 99(6) of the AI Act, which for these companies takes the lower of the two values as the cap.
Non-monetary measures and procedure
Article 22 allows the authority, for breaches of minor harm or danger, to forgo the fine and choose between two measures. One is an order to end the infringement and not repeat it, specifying the measures and a deadline. The other, where the infringement has already ended, is the publication of a statement naming the breach and the person responsible. If the order is not complied with, the fines of Article 23 apply, increased by up to one third, always within the caps.
The lighter measure therefore carries a specific reputational cost, because the company's name ends up in a public act. The same goes for penalty decisions, which Article 24 requires to be published in summary on the authority's website, with few exceptions linked to personal data, cybersecurity and criminal investigations. The procedure follows Law 689/1981 where compatible, with Article 16, the one on payment of a reduced amount, expressly excluded. Settling a case early by paying a predetermined reduced sum is therefore not an option here.
Detailed rules will come with regulations from AgID and ACN, for which the decree sets no deadline. Meanwhile ACN already holds inspection powers (Article 15), including remote or on-site checks without notice on real-world testing of systems.
Which framework does your company actually need?
AI Rating measures maturity across the four areas of the model and shows where to start, with priorities and estimated effort.
Start your AI RatingWho imposes fines in the financial sector
The decree assigns the power to impose fines according to role. AgID fines notified bodies (Article 20). The market surveillance authorities fine operators within their remit (Article 21): ACN as the general authority, the Italian Data Protection Authority in the areas set out in Article 74(8) of the AI Act, and the Bank of Italy, CONSOB and IVASS for high-risk systems used in the services they already supervise.
For the latter, the procedure follows sector rules, that is Article 145 of the Consolidated Banking Act, Article 195 of the Consolidated Law on Finance and the provisions of the Private Insurance Code. The definition of financial institution adopted by Article 1 is broad and includes, among others, Italian banks and branches of EU banks, investment firms, asset management companies, payment institutions, electronic money institutions and insurance undertakings. For a banking or insurance group this means that the penalty risk on AI systems runs through the same channels, and the same counterparts, it already deals with for inspections and enforcement.
The Italian AI regulatory sandbox
Article 26 establishes the regulatory sandbox provided for by Article 57 of the AI Act, under the direct supervision of AgID and ACN, which run it jointly. Access is reserved for providers and prospective providers of AI systems, with priority for SMEs and start-ups, and is based on eligibility criteria that the decree requires to be objective and transparent as regards eligible parties, priorities and maturity of solutions. A company that only uses systems bought from third parties is not the target, because the sandbox is meant for those who develop.
Governance works on two levels. The Coordination Committee sets testing priorities and the selection order, also after consulting stakeholders, Regions and Autonomous Provinces (Article 27). An Operational Group made up equally of AgID and ACN members reviews applications, selects projects, approves plans and monitors development, testing, validation, event logging and traceability (Article 28). The Data Protection Authority joins the Group for projects that process personal data, universities and research centres may join for individual projects, and for systems intended for financial institutions the sector authorities take part. Such systems can be tested in the national sandbox without losing access to the FinTech sandbox, and coordination between the two regimes is left to a prime ministerial decree (Article 30).
Operating procedures and admission criteria will come with joint decrees of the two agencies' directors general, for which the text sets no deadline. Anyone considering an application can still prepare for what the Operational Group will have to check: a test plan with stated validation criteria, event logging that allows the system's behaviour to be reconstructed, and documentation of the training data. These are the same materials the AI Act requires to place a high-risk system on the market.
Algorithms and training data as trade secrets
Article 52 adds a paragraph to Article 98 of the Italian Industrial Property Code that expressly includes data, algorithms and mathematical methods for training AI systems among protectable information. Article 53 confirms that disputes remain with the specialised business divisions of the courts.
Protection is not automatic. Article 98 sets three cumulative requirements: the information must be secret, it must have economic value because it is secret, and the holder must apply reasonably adequate measures to keep it confidential. The burden of proving them lies with whoever claims the secret. Recent case law assesses the adequacy of measures in concrete terms, looking at who had access, under which contractual obligations and with what tracking. A training dataset shared with a supplier without confidentiality clauses, or a system prompt pasted into a channel open to the whole company, would struggle to pass that test.
The provision does not create an exemption from disclosure duties. The technical documentation required by the AI Act is still owed to the authorities, which handle it under the confidentiality rule of Article 78 of the Regulation, and the information owed to workers on automated systems remains that set out in Legislative Decree 152/1997. The secret protects against competitors, while the duty to explain to regulators and employees stays in place.
What to check inside the company
The most useful step right now is to place every system in the inventory within the Article 23 band that applies to it. The criterion is the obligation the system triggers, regardless of the technology: a customer-facing chatbot falls under the transparency rules of Article 50, while a credit scoring model brings with it the impact assessment and the right to an explanation. Without an up-to-date inventory of AI systems this mapping cannot be done, and penalty exposure remains an estimate.
Documentation should be reviewed with the same lens, because paragraph 6 makes it relevant to the amount of the fine as well. The distinction between substantive and formal obligations works in favour of those who can show that the risk was governed, with logs, traced decisions and named owners, and against those who can only show written procedures that were never applied.
On know-how, companies that develop or adapt models should identify now which data, configurations and methods they treat as confidential, restrict access to them in a traceable way and update their contracts with staff and suppliers. Without these measures, the new paragraph of Article 98 remains a possibility on paper.
In our AI Rating model these elements weigh on the Risk dimension, where a failed critical gate cannot be offset by high scores elsewhere. To understand where your organisation stands you can start an AI Rating, book an assessment call or write to us at hello@zerofive.ai.
This article describes the legislative text and its organisational implications, and does not constitute legal advice.
Main sources: Legislative Decree No. 179 of 7 October 2026, Articles 1, 15, 20-31, 52 and 53 (Official Gazette, General Series, No. 234 of 8 October 2026); press release of the Council of Ministers No. 185; Regulation (EU) 2024/1689, Articles 27, 50, 57, 62, 78, 86 and 99; Regulation (EU) 2026/1744; Legislative Decree No. 30 of 10 February 2005, Articles 98 and 99; Law No. 689 of 24 November 1981.