After having examined Chapter I, the analysis of the Italian law on artificial intelligence (Law No. 132 of September 23, 2025) continues with Chapter II, which can be defined as the true core of this new law.
Chapter II: How AI Will Be Regulated in Critical Sectors
Chapter II addresses the regulation of AI use across individual sectors, many of which are considered “critical.”
Healthcare Sector
Among these, one of the most debated applications is undoubtedly in the healthcare field, to which Articles 7, 8, 9, and 10 are dedicated.
Specifically, part of the legal scholarship has highlighted the challenges of reconciling artificial intelligence with the risks associated with sensitive data, especially considering the large amount of data required to train algorithms.
On the other hand, prohibiting the use of such data would have completely paralyzed research and development in the healthcare sector.
To address these issues, the Legislator has introduced a series of general principles applicable to the healthcare field (Art. 7), including:
“Artificial intelligence systems used in healthcare and the related data employed must be reliable, periodically verified, and updated in order to minimize the risk of errors and improve patient safety.”
A general exception is then provided for cases of “Research and scientific experimentation in the development of artificial intelligence systems in the healthcare field” (Art. 8), which are considered to be of significant public interest and, therefore, always authorized for the secondary use of personal data stripped of direct identifying elements (i.e., pseudonymized), including those belonging to the categories listed in Article 9 of the GDPR. The legal basis is thus public interest, and consent from the data subject is no longer required.
The same provision further establishes an additional exception, allowing the use of data that reveal the identity of the data subjects when such identification is inevitable or necessary for the protection of their health.
In any case, the obligation to provide information remains in force, which may also be fulfilled through a general notice published on the data controller’s website.
Given the sensitivity of the data involved, supervision by the Data Protection Authority (Garante) is always required, along with constant monitoring of data anonymization and pseudonymization procedures.
Article 9, instead, seeks to regulate the methods of data processing used by AI for research and experimentation purposes.
The article does not make specific reference to the healthcare field, leaving doubts as to the scope of its application: does it concern all research and development sectors or only healthcare?
In particular, confusion arises from the provision of a delegation to the Minister of Health, who must issue a decree within 120 days from the law’s entry into force, after consulting the Data Protection Authority, research institutions, healthcare facilities, as well as relevant authorities and operators in the sector.
Finally, the explicit possibility of using AI technologies for managing the electronic health record is established (Art. 10).
Employment Sector
Articles 11, 12, and 13 are dedicated to the world of work, providing for the ethical use of Artificial Intelligence, in line with European principles of non-discrimination, reliability, transparency, and safety.
Workers must always be informed about the use of AI technologies within their employment relationships. Likewise, professionals engaged in intellectual work must always inform their clients of the use of AI systems in support of their professional activity.
It is clearly established that the use of AI must be only instrumental and supportive to intellectual work, which remains the predominant component of the service provided.
Given the sensitivity of the employment context, characterized by unbalanced power relations and high socio-economic impact, the Law introduces a specific “Observatory on the Adoption of AI Systems in the Workplace” tasked with maximizing the benefits and minimizing the risks arising from the use of such systems.
The composition and functioning of the Observatory will be regulated by decree, delegated to the Minister of Labour and Social Policies.
State Sector
The final articles regulate the use of AI in state apparatuses, namely in Public Administration, the Justice system, and national security.
The goal is to promote the use of AI systems aimed at improving efficiency, without sacrificing transparency of procedures, human oversight, and, above all, autonomy and decision-making power. It is repeatedly reaffirmed that the individual remains the only person responsible for the measures and proceedings in which artificial intelligence has been used (Art. 13), and that All decisions regarding the interpretation and application of the law, the assessment of facts and evidence, and the adoption of measures shall always be reserved to the judge (Art. 15).
Particular attention is deserved by Article 16, which introduces yet another delegation provided by the Italian AI Law.
This time, it is delegated to the Government and is of a general nature, aiming to define a comprehensive framework concerning the use of data, algorithms, and mathematical methods for training AI systems.
The guiding principles that the Government must follow in drafting the legislative decrees are:
- identification of rights and obligations imposed on those intending to make such use;
- provision of protective instruments of a compensatory, prohibitory, and sanctioning nature;
- allocation of disputes concerning the introduced framework to the specialized business sections.
Once again, beyond the uncertainty generated by such a delegation, concerns arise regarding the fact that these legislative decrees should regulate the matter “without imposing additional obligations, in areas already governed by Regulation (EU) 2024/1689, beyond what is already established therein.”
Conclusions
To date, the Italian Law on Artificial Intelligence regulates, among the “sector-specific provisions,” only the aforementioned areas, providing their general principles and directives.
The law, in fact, is not yet complete and will become fully operational only upon the issuance of the numerous delegated decrees, within 12 months from the law’s entry into force.
In this respect, the Italian initiative appears swift but not conclusive.
Barbara Tombini