Italy's Legislative Decree 179 of 7 October 2026, published in Official Gazette no. 234 on 8 October, entered into force on 23 October. It names AgID as the notifying authority and the National Cybersecurity Agency ACN as the market surveillance authority and single point of contact for the EU AI Act. Fines reach €35 million or 7% of worldwide turnover, with lower tiers of €15 million or 3% and €7.5 million or 1%. It also provides for a national regulatory sandbox run by the two authorities.

What it means: The EU AI Act applies directly in all member states, but leaves each to decide which authorities supervise it, how penalties are imposed and how regulatory sandboxes operate. Italy is one of the countries that has completed this step, choosing to split powers between its digital government agency and its cybersecurity agency rather than create a new authority. The fine levels follow the AI Act's ceilings, with the highest tier for prohibited practices. The national sandbox is an important tool for startups and small firms, as it lets them test systems under the authority's guidance before putting them on the market. Each member state names its own authorities, so a business operating in several countries needs to know who is competent in each. For Greek software companies with clients in Italy, ACN is now the main contact on market surveillance matters. For Greece, the Italian model is an example of how national supervision can be organised, and businesses should follow the corresponding Greek decisions.

Read the original on Lexia (Νομοθετικό διάταγμα 179/2026, GU 234/2026)

Related service: myDATA integrations

Related stories