What Law 132/2025 requires of enterprise AI
Italy enacted Law No. 132 of 23 September 2025 as a national artificial intelligence framework complementary to the EU AI Act. It does not replace Regulation (EU) 2024/1689. High-risk system obligations, general-purpose AI duties, and deployer responsibilities under the AI Act remain fully applicable to in-scope systems placed on the market or put into service in Italy.
The statute assigns national governance, supervision, and cybersecurity-related responsibilities in which the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN) figure prominently. National measures address AI in public administration, workplace contexts, healthcare, and justice, with recurring themes of transparency, human oversight, and protection of fundamental rights. The law also covers unlawful or harmful uses of AI and national sanctioning and enforcement mechanisms coordinated with EU structures.
For enterprise AI governance leaders, the practical implication is dual compliance. You must demonstrate AI Act conformity for the applicable risk class and, where your use cases touch Italian sectoral contexts or Italian supervisory processes, show that transparency, oversight, security, and accountability are implemented as operating controls. Documentation, logging, and traceability expected under the AI Act, especially for high-risk systems, are central evidence artifacts for Italian supervisory review. ACN’s cybersecurity mandate implies security-by-design, incident readiness, and resilience for AI systems that process sensitive data or connect to critical environments.
Which AI system and agent activities need documented controls
Start with an inventory of AI systems and agents used in or targeting Italy. Classify each under EU AI Act risk tiers and flag Italian sectoral contexts such as employment decisions, health-adjacent workflows, public administration interfaces, or justice-related processing. Sector flags should drive stronger human oversight hooks, access limits, and stop-use paths even when the system is not labeled high-risk under the EU scheme alone.
Activities that commonly require documented accountability include:
- Model and agent placement into service
- Changes to training data, prompts, tools, or policies
- Automated or semi-automated decisions that affect individuals
- Agent-initiated tool calls that read or change enterprise data
- Workflows that trigger external side effects (messages, tickets, payments, record updates)
Transparency obligations translate into user-facing notices where people interact with AI, plus internal explainability of why an agent was allowed a given action.
Human oversight is not a policy paragraph. It is a set of defined intervention points: approval gates before sensitive tool use, override and roll-back paths, and named owners who can halt an agent. Security and logging obligations span confidentiality of connectors and secrets, integrity of policy decisions, and retention of records sufficient for investigation. For agents, the compliance surface expands beyond static model cards to runtime behavior: which identity acted, under which purpose limit, with which tools, on which data class, and with what human intervention.
Map Italian obligations to a runtime control model
Design-time assessments alone cannot govern agents that discover tools and data at runtime. A workable control model separates a control plane (identity, policy, approval) from the agent execution plane so guardrails evaluate before data or tool access.
Treat each production agent as a non-human identity subject to authentication, authorization, and least privilege. Map capabilities to enterprise RBAC or ABAC and prefer just-in-time privileges over long-lived broad credentials. Runtime policy enforcement should encode purpose limits, data-class restrictions, allowed-tool lists, and rate or blast-radius limits. Tool-call governance should distinguish read-only exploration from high-impact mutations and require human approval workflows for the latter in regulated contexts.
Instrument full trajectories: inputs, intermediate tool calls, policy decisions, outputs, and human overrides. Logs should be immutable or tamper-evident and exportable for supervisory or internal review. Isolate higher-sensitivity use cases (HR, health-adjacent, credit or access decisions, PA interfaces) with stronger oversight and kill-switch paths. Align monitoring with ACN-oriented expectations: anomaly detection on agent behavior, secret hygiene, and secure connectors to enterprise systems.
Runtime governance focus
Trussed AI focuses on runtime governance and security for enterprise AI agents, including agent identity, permissions, tool approval workflows, runtime policy enforcement, monitoring, and audit logging. Those capability areas map directly to the operational gaps Italian and EU frameworks create when agents can act, not only generate text.
Control mapping at a glance
| Obligation theme | Operational control | Evidence artifact |
|---|---|---|
| Risk classification | Inventory with EU tier and Italian sector flags | System register, conformity linkage |
| Transparency | User notices and internal action explainability | Notice records, decision rationale logs |
| Human oversight | Approval gates, overrides, kill-switch owners | Workflow configs, override audit trails |
| Security | Least privilege, connector hygiene, anomaly detection | Identity records, incident procedures |
| Logging and traceability | Trajectory capture with retention policy | Tamper-evident logs, export packages |
Implementation sequence for governance and security teams
Translate the dual legal baseline into a single operating program so Italy-specific duties reinforce, rather than fork, EU AI Act conformity processes.
- Build or refresh the AI system and agent inventory for Italy exposure.
- Classify each entry under EU risk tiers and tag sectoral contexts.
- Define non-human identities, owners, and least-privilege tool maps.
- Encode purpose, data-class, and tool policies in a runtime control plane.
- Wire human approval and halt paths for high-impact mutations.
- Enable tamper-evident trajectory logging with retention and export.
- Align monitoring and incident playbooks with ACN-oriented expectations.
- Feed operational metrics into the enterprise AI risk register and conformity files.
Governance practices that reduce dual-framework friction
Secondary implementing guidance from AgID and ACN, and coordination details with the EU AI Office, may continue to evolve after the September 2025 statute. Enforcement practice for private-sector AI agents will also depend on forthcoming procedures and sectoral interpretation. Design your program so legal updates adjust policy packs and evidence templates without rebuilding the control architecture.
Integrate Italy-specific obligations into the enterprise AI risk register rather than maintaining a parallel register that conflicts with AI Act conformity files. Keep vendor and GPAI provider due-diligence files current (training-data statements, evaluation results, incident notices) where duties cascade to deployers. When public summaries differ in emphasis, validate obligations against the official legal text and qualified counsel.
Operational metrics that matter to auditors are concrete: percentage of production agents with named owners and classified risk; share of high-impact tool calls gated by human approval; completeness of trajectory logs for sampled incidents; mean time to revoke agent permissions; and evidence that model or tool changes shipped with matching policy versions. These measures demonstrate continuous control, which is what supervisory review ultimately tests.