Diritto intelligente – Issue N. 21

Italy closed the last gap in its AI Act enforcement machinery on 8 October 2026, when the second implementing law appeared in the Official Journal. With it, this issue of Diritto Intelligente moves on from what the rules require to who will knock on the door and what they will find once inside.

The answer to the first question deserves more attention than it has had so far. The central enforcer is the National Cybersecurity Agency. That is the same body that already runs NIS2 in Italy, receives incident notifications and holds the supplier registers that essential and important entities have had to file. For many groups, then, the authority now responsible for their artificial intelligence already knows them, from a registration made for different reasons and possibly telling a different story. The new law lets that agency inspect without notice. In my experience with data protection and cybersecurity inspections, what decides the day tends to be the local records nobody thought to keep current, much more often than the global framework approved at headquarters.

The rest of the issue shows how many proceedings can now open at once:

• IVASS has asked insurers for a Board-approved assessment of their cyber and AI resilience under DORA by 31 December 2026. For the first time, that will create a written record of what each Board knew about AI-driven cyber risk.
• The Italian Competition Authority opened an investigation into an AI company over potentially unfair terms, including broad licences over user content, waiver of moral rights and clauses requiring disputes to be resolved in Massachusetts. The case shows that AI businesses can face scrutiny beyond the AI Act.
• SIAE’s guide on generative AI and copyright, read together with its 2024 opt-out, sets up the licensing negotiation that providers training on Italian repertoire will have to face sooner or later.
• The ability of agentic AI to handle insurance claims turns on whether the person signing off on the final decision has the authority and information needed to override the system.

The WIPO Global Innovation Index supplies the economic backdrop: 86% of AI-related venture capital in the first half of 2026 went to North America. Most models deployed in Italy are built elsewhere, yet the inspections, the fines and the voided dismissals will be handled here, by the local entity, which often holds the least documentation.

We expect the first published decisions sooner than most compliance plans assume. Over the coming months, the companies that come through will be able to show evidence to an authority that arrived unannounced, and preparing that evidence takes far longer than drafting another policy.