Italy passes first comprehensive national AI law in EU with prison terms for deepfakes

Italy's parliament has given final approval to the European Union's first comprehensive national law regulating artificial intelligence, marking a milestone in the bloc's fragmented approach to implementing the EU AI Act. The legislation, passed after a year of debate, introduces criminal penalties for the malicious use of AI-generated content, mandates parental consent for children under 14, and sets sector-specific transparency rules for healthcare, education, justice and sport. Giorgia Meloni's right-wing government presented the bill as a decisive move to shape how AI is used across Italy while aligning with the EU's landmark regulation adopted last year.

Criminal penalties and sector-specific oversight

The law's most striking provision introduces prison sentences of between one and five years for anyone who illegally spreads AI-generated or manipulated content that causes harm. This directly targets deepfakes and synthetic media used for defamation, fraud or political manipulation. Harsher penalties apply when AI is used to commit crimes including identity theft and fraud. Beyond criminal sanctions, the legislation imposes stricter transparency and human oversight requirements for AI systems deployed in workplaces and across sensitive sectors: healthcare, education, justice and sport. These rules go beyond the EU AI Act's baseline, reflecting Rome's determination to address specific national concerns about automation in public services.

Children under the age of 14 will need parental consent to access AI services, a provision that anticipates the EU's broader focus on protecting minors online. The measure mirrors similar age-verification requirements in the Digital Services Act but applies them specifically to AI interaction. Schools and educational platforms using AI-driven tutoring or assessment tools will need to build compliance into their onboarding processes.

Copyright and data mining carved out

On intellectual property, the law stakes out a middle ground. Works created with AI assistance receive copyright protection only if they originate from "genuine intellectual effort", a formulation that leaves considerable room for judicial interpretation. Text and data mining by AI systems is permitted solely for non-copyrighted content or for scientific research conducted by authorised institutions. This is narrower than the EU AI Act's text and data mining exception, which allows mining for any purpose unless rights holders have expressly reserved their rights in a machine-readable format. Italian publishers and collecting societies had lobbied for tighter restrictions, arguing that the EU exception undermines licensing markets.

Enforcement split between two agencies

The government has designated the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN) as joint enforcers. AgID, which sits under the presidency of the Council of Ministers, will handle transparency, oversight and sectoral compliance. ACN, established in 2021, takes the lead on cybersecurity incidents and the criminal provisions. The dual mandate reflects Italy's institutional reality: digital transformation and cybersecurity have evolved as separate policy streams with distinct cultures and budgets. Coordinating them will be the first practical test of the law's effectiveness.

Funding for domestic AI capacity comes from a state-backed venture capital vehicle authorised to deploy up to €1 billion in AI, cybersecurity and telecommunications companies. Alessio Butti, the undersecretary for digital transformation, said the law "brings innovation back within the perimeter of the public interest, steering AI toward growth, rights and full protection of citizens." Critics, however, note that the €1 billion figure is spread over several years and pales beside the tens of billions flowing from US and Chinese public and private sources into foundation models and compute infrastructure.

Meloni's "Italian way" and political framing

The legislation bears Meloni's political imprint. Addressing the topic in March last year, she declared: "There can and must be an Italian way when it comes to artificial intelligence, an Italian way to develop artificial intelligence and an Italian way to govern artificial intelligence." She described the technology as "the greatest revolution of our time" but insisted it could only achieve its full potential "if it is developed within a framework of ethical rules that focus on people and their rights and needs." The rhetoric echoes her government's broader narrative of technological sovereignty, protecting national interests against both unregulated markets and over-centralised EU rulemaking.

That framing matters because Italy's relationship with EU digital regulation has been ambivalent. In March 2023, the Italian data protection authority temporarily banned ChatGPT over privacy concerns, making Italy the first Western country to block the service. The ban was lifted after OpenAI addressed the regulator's demands, but the episode signalled Rome's willingness to act unilaterally. The new law can be read as a more structured successor to that instinct: rather than ad hoc enforcement, a statutory framework that claims to anticipate the EU Act while adding national particularities.

Alignment and friction with the EU AI Act

The EU AI Act, formally adopted by the European Parliament and Council in 2024, enters into force in phases through 2026. It sets a risk-based framework: unacceptable risk systems are banned, high-risk systems face strict conformity assessments, and general-purpose models carry transparency obligations. Member states may maintain or introduce stricter national rules in specific areas, notably worker protection and fundamental rights. Italy's law uses that flexibility. The criminal penalties for harmful deepfakes, the parental consent threshold, and the narrower data mining exception all exceed the EU baseline.

Whether the Commission views these additions as legitimate national supplements or as obstacles to the single market remains an open question. The AI Act's governance structure includes a European AI Office and national competent authorities; Italy's decision to split enforcement between AgID and ACN will need to map cleanly onto that architecture. Other member states, France, Germany, Spain, are drafting their own implementing acts. Divergence in national transposition could recreate the fragmentation the AI Act was designed to prevent.

Implementation gaps and open questions

Several practical questions lack clear answers. The "genuine intellectual effort" standard for AI-assisted copyright will likely generate litigation before it settles into precedent. The parental consent mechanism for under-14s has no technical specification in the law; age verification systems that comply with both this rule and the GDPR's data minimisation principle do not yet exist at scale. The €1 billion venture fund's governance, investment criteria and timeline have not been published. And the coordination protocol between AgID and ACN, critical for consistent enforcement, is still to be drafted.

Business groups, including Confindustria Digitale, have warned that the criminal provisions could chill legitimate experimentation if prosecutors interpret "harm" expansively. The justice sector transparency rules, meanwhile, raise delicate questions about judicial independence: the law requires human oversight of AI used in judicial proceedings, but the Supreme Council of the Judiciary (CSM) guards its autonomy jealously. Negotiating that boundary will be a political as much as a legal exercise.