Italy's AI decree takes effect today: discipline, performance and dismissal cannot rest on algorithms alone, and violations are void — but CV screening is explicitly excluded

2026-10-23·10 min read

Two things carry the real information here. First, this is harder than GDPR Article 22: employee consent does not rescue a decision, and a violation makes it void. Second, it carves out an explicit exception for recruitment screening, which several English-language headlines get backwards. To know whether a system is in scope, read Article 41 itself rather than the headline.

Pin the source first. The instrument is Decreto legislativo 7 ottobre 2026, n. 179, published in Italy's Official Journal, General Series No. 234, on October 8, 2026, and the Official Journal page states plainly that it enters into force on 23 October 2026 — today. The full title is long; it does two things: it puts national authority powers where Regulation (EU) 2024/1689 requires them, and it governs the use of AI in education and training. The text has five chapters, and Chapter III is titled AI for training paths, professions, work, health and public administration, running from Article 36 to Article 51. The employment provision is Article 41.

Article 41(1) is specific. In decision-making processes concerning the employment relationship, an employer using AI systems must ensure that final decisions on the establishment, modification or termination of the relationship — including disciplinary measures and performance evaluations — are not adopted solely on the basis of automated processing, in line with Article 11 of Law No. 132 of 23 September 2025. The definitive decision is in every case reserved to a natural person who exercises effective and autonomous power: not a signature that merely formalises what the system already decided.

Then comes the exclusion that is easy to miss: candidate search and selection activities, even where they result in a candidate not being admitted to later stages of the selection process, do not count as final decisions on the establishment of the employment relationship. That sentence removes the front half of the hiring funnel from the prohibition. Scoring CVs with a model, ranking them, filtering candidates out before the next round: Article 41's ban does not reach that. Several English-language headlines say AI hiring or firing now requires a human decision-maker, which overstates the hiring half of the rule.

Consent is not a shield. The last sentence of paragraph 1 states that the worker's consent does not constitute an exception to the prohibition. Paragraph 4 supplies the consequence: a dismissal issued in violation of paragraph 1 is void, and other employer decisions taken in violation of paragraph 1 are void as well. That combination differs from GDPR Article 22, which allows three exceptions — contract necessity, legal authorisation and explicit consent — and attaches administrative fines to breaches. Italy closes the consent route and swaps the consequence for civil nullity.

Three obligations come with it. Paragraph 2: use of these systems must respect the worker's dignity and confidentiality and the principle of non-discrimination. Paragraph 3: before processing begins, the employer must meet the information duties under Article 1-bis of Legislative Decree No. 152 of 26 May 1997; on request, and with the involvement of a natural person, the worker is entitled to an intelligible statement of reasons for the decision, including how the AI system may have affected it and the main parameters considered; access rights and the rights under GDPR Articles 13, 15 and 22 remain intact. In plain terms: if an employee asks why they were rated that way, someone at the company has to be able to explain, not hand over a number.

One more article in the same chapter matters directly to safety and operations people. Article 42 provides that AI systems affecting work organisation, production rhythms, how work is performed, or safety-relevant decision processes must be assessed within the risk assessment required by Article 28 of Legislative Decree No. 81 of 9 April 2008; employers must also give workers adequate information and training on the specific risks AI introduces and on the preventive and protective measures adopted. Putting a model into a shop floor or a shift-scheduling system is therefore not an IT-only decision: it has to enter the risk assessment document.

Enforcement and penalties sit inside the same decree, with hard numbers. Article 19 sets general principles, Article 22 lists non-pecuniary measures, and Article 23 sets administrative fines: up to €35 million, or 7% of total worldwide annual turnover if higher, for breaching the Article 5 prohibitions of the AI Act; up to €15 million or 3% for breaching obligations in Articles 16, 22, 23, 24, 25 and 26, parts of Articles 31 and 33, and Articles 34, 50, 73 and 80; up to €7.5 million or 1% for supplying incorrect, incomplete or misleading information to notified bodies or national authorities. Article 6 designates ACN as the single point of contact under the AI Act, while Articles 4 and 5 set up the national notifying authority and the market surveillance authorities.

What it means for people doing the work. If you have an Italian employer entity and a model feeds decisions on reassignment, ratings, discipline or dismissal, three things are needed: a genuinely empowered human in the loop whose override actually works; an explanation to the employee covering the model's weight and main parameters; and the system written into the risk assessment and worker information. Conversely, if the system only screens CVs, Article 41's ban does not cover it — though Article 42, the GDPR and non-discrimination principles do not disappear.

Boundaries, and what this article does not claim. First, this is Italian domestic law binding Italian employers and the provision or use of relevant systems in Italy; nothing here implies effect beyond that, or that other member states will adopt identical wording. Second, the text and effective date come from the Official Journal and its note, but application will depend on later guidance and case law; this article does not predict how a first case would be decided. Third, the rule targets decisions based solely on automated processing, not the use of AI in decision-making at all: a human in the loop who can override and explain remains a permitted design. Fourth, this is not legal advice; for a specific employment arrangement, consult an Italian-qualified lawyer.

🤔 Frequently Asked Questions

What exactly takes effect today?

Legislative Decree No. 179/2026, signed October 7, 2026, published in Official Journal No. 234 on October 8, with 23 October 2026 stated as its entry into force. It implements the EU AI Act (Regulation 2024/1689) and also lays out national authority powers and the use of AI in education, work, health and public administration.

Is AI CV screening now illegal?

Under the text of Article 41, no: candidate search and selection activities are expressly excluded from final decisions on establishing the employment relationship, even where screening keeps someone out of later stages. It remains subject to non-discrimination principles, the GDPR and Article 42's risk assessment duties, so legal risk does not vanish — it simply does not sit in this article.

Can consent let an employer decide by algorithm?

No. The last sentence of Article 41(1) states that worker consent is not an exception to the prohibition, unlike GDPR Article 22, which lists explicit consent among its exceptions. A dismissal taken in violation is void, and so are other decisions taken in violation.

Does this affect companies outside Italy?

This article stays within what the text supports: it binds Italian employers and the provision or use of relevant systems in Italy. Cross-border employment, remote teams and group-entity structures need to be assessed against the actual legal entity and applicable rules; this article does not extrapolate, and does not treat the decree as automatically having EU-wide effect.

🛠️ Recommended Tools

  • Privacy Policy Generator Article 41 builds an information duty into the process; getting the disclosure text right up front is cheaper than explaining afterwards.
  • Contract Generator Clauses covering changes to and termination of employment need to state clearly who actually makes the final decision.
  • AI Resume Builder Recruitment screening sits outside Article 41, but candidate-side tools still need to present information honestly rather than shifting risk onto the CV.

Summary

Italy's Legislative Decree No. 179/2026, signed October 7 and published in Official Journal No. 234 on October 8, takes effect on October 23, 2026, implementing the EU AI Act (Regulation 2024/1689). Article 41 provides that final decisions concerning the employment relationship — its establishment, modification and termination, plus disciplinary measures and performance evaluations — may not be adopted solely on automated processing and must be reserved to a natural person exercising effective and autonomous power; worker consent is not an exception; dismissals and other decisions taken in violation are void. Article 41 also expressly excludes candidate search and selection from final decisions, even where screening blocks a candidate from later stages, so English coverage that puts hiring in the headline does not match the text. Supporting duties: information before processing under Article 1-bis of Decree No. 152/1997; on request, an intelligible statement of reasons obtained through a natural person, covering the AI's effect and main parameters; GDPR Articles 13, 15 and 22 rights preserved. Article 42 requires AI affecting work organisation, production rhythms or safety decisions to enter the risk assessment under Article 28 of Decree No. 81/2008, with information and training. Article 23 penalties: up to €35 million or 7% of worldwide turnover for Article 5 prohibitions; up to €15 million or 3% for other obligations; up to €7.5 million or 1% for misleading information. Article 6 designates ACN as the single point of contact.

Sources: Gazzetta Ufficiale:DECRETO LEGISLATIVO 7 ottobre 2026, n. 179((26G00200),GU Serie Generale n.234 del 08-10-2026,生效日 23/10/2026)
Gazzetta Ufficiale n. 234 dell'8 ottobre 2026(PDF 原文,含第 41 条)

A&O Shearman:Italy's AI Act implementing legislation(法律分析)

ActuIA:Italy: from 23 October, AI hiring or firing requires a human decision-maker(2026-10)

EUR-Lex:Regulation (EU) 2024/1689(AI Act 原文)