Italy's AI law: from October 23, a human must make the final call on AI-assisted hiring and firing

Italy's AI law on hiring and firing took effect on Friday, October 23, 2026. Legislative Decree No. 179/2026, which adapts Italian law to the EU AI Act, says employers that use AI can't base final decisions on hiring, changing or ending someone's employment solely on automated processing. The final decision is "in any case reserved to a natural person" with effective and autonomous power. The rule arrives more than a year before the AI Act's own high-risk rules for employment AI, which apply from December 2, 2027, as our AI Act timeline explains.

This story is based on the decree's entry on Normattiva, Italy's official legislation database, the Gazzetta Ufficiale's own text of Articles 41 and 42, and analyses by EcNews and Diritto.it, checked October 25, 2026. Italian quotes are 9to5AI's translations. This article describes the law; it isn't legal advice.

The short version

• The law: Legislative Decree No. 179 of October 7, 2026, Gazzetta Ufficiale No. 234 of October 8, 2026, in force October 23, 2026.
• The rule (Article 41): AI can't be the sole basis for final decisions on hiring, changes to employment, dismissal, discipline or performance reviews. A person with real power must decide.
• The carve-out: searching for and screening candidates doesn't count as a final hiring decision, even when it excludes someone from later stages.
• Consent doesn't help: "The worker's consent does not constitute an exception to the prohibition."
• The consequence: a dismissal in breach is null, as is any other decision taken in breach.

What does Italy's Decree 179/2026 require of employers?

Article 41 is titled "Protection of the worker in decision-making processes assisted by artificial intelligence systems." It has four parts:

Last verified: October 25, 2026

EcNews, a professional publication for Italian accountants and labor consultants, reads the decree's "effective and autonomous" test as a power that is "effective and autonomous, not merely formal"; the words "not merely formal" are EcNews's, not the decree's. It also noted the decree doesn't define in practice what makes human review effective. That's the open question for employers: a manager who rubber-stamps an AI recommendation may not meet the standard, but the decree doesn't spell out where the line is.

Article 42 adds a workplace-safety duty. Where AI affects work organization, pace, how work is done or safety decisions, it must be assessed in the employer's risk assessment under Article 28 of Legislative Decree 81/2008, and workers must be informed and trained on the specific risks.

What are the penalties?

For the employment rule, the decree's consequence is nullity, not a fine. A dismissal made in breach of Article 41 is null, which under Italian law means it has no legal effect, and other decisions taken in breach are void too. Diritto.it's analysis notes the decree doesn't spell out further consequences for Article 41.

The decree also has a separate sanctions section (Articles 19–25) that sets fines in four tiers of up to €35 million or 7% of worldwide annual turnover, mirroring the AI Act's Article 99. Those fines apply to the parties listed in the AI Act's Article 99(1) and are imposed by Italy's AI authorities, including the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN). The decree's text doesn't link those fines to Article 41, so it would overstate the law to say an employer faces millions in fines for an AI-made dismissal.

How does this relate to the EU AI Act?

The EU AI Act lists "employment, workers' management and access to self-employment" as one of the high-risk areas in Annex III (point 4), according to Germany's AI market surveillance authority, the Bundesnetzagentur; it covers AI such as hiring tools. After the AI Omnibus, those obligations apply from December 2, 2027, as covered in our explainer on the AI Act's dates. Italy's Article 41 is a national labor rule that applies from October 23, 2026, and covers decisions, not the design of AI systems.

Italy's AI employment rules and the EU AI Act

1. Oct 10, 2025Italy's AI law, Law No. 132/2025, takes effectConfirmed
2. Oct 8, 2026Decree 179/2026 published in the Gazzetta UfficialeConfirmed
3. Oct 23, 2026Decree 179/2026 takes effect, including Article 41Confirmed
4. Dec 2, 2027EU AI Act high-risk rules for Annex III systems, including employment, applyExpected

• Confirmed
• Expected

Law No. 132/2025, Italy's AI law, took effect on October 10, 2025. Its Article 11 already required employers to inform workers when they use automated decision or monitoring systems and barred discrimination in AI-assisted management. Decree 179/2026, issued under that law's delegation in Article 24, turns that into a hard rule on who decides. It also names AgID and ACN as Italy's national AI authorities under the AI Act.

Article 41 also keeps GDPR Article 22, which restricts decisions based solely on automated processing, in place, and adds an employment-specific line: a worker's consent doesn't lift the ban. For companies using models only through APIs, our guide to what the AI Act means for API users covers the EU-level duties. The first harmonised standard for high-risk AI quality management, which employers' AI vendors may use, is covered in our EN 18286 story.

What's confirmed, reported and uncertain

• Confirmed (Normattiva and the Gazzetta Ufficiale text): the decree's number, dates and title, the October 23, 2026 entry into force, Articles 41 and 42, and the designation of AgID and ACN.
• Reported (EcNews, Diritto.it): the "not merely formal" reading and the absence of further consequences beyond nullity in Article 41.
• Uncertain: what counts as "effective and autonomous" human review in practice, how courts will apply nullity, and whether the decree's administrative fines could reach employers for Article 41 breaches. The text 9to5AI reviewed doesn't say so.