Starting Thursday, every Italian employer whose software shapes how work gets done — from algorithmic scheduling platforms to production monitoring systems — will be legally required to assess those tools in mandatory workplace safety documentation. Legislative Decree No. 179/2026, published in Italy's Gazzetta Ufficiale on October 8, enters into force on October 23 with no transition period and no exceptions for tools that avoid the "AI" label.

The decree, which implements Italy's national AI law at the workplace level, is the most concrete employer-facing AI safety obligation to take effect anywhere in the European Union to date.

Italy's approach goes further than the EU AI Act's direct employer obligations: by embedding AI within the existing national occupational safety documentation framework, compliance is immediately enforceable through domestic labor inspection mechanisms, without waiting for EU-level harmonized standards or sector guidance.

What Article 42 Requires of Every Italian Employer

The core obligation sits in Article 42 of Decree 179/2026, which amends Italy's Consolidated Safety Act — Legislative Decree 81/2008, the Testo Unico on workplace health and safety. That statute already requires every employer to compile a Documento di Valutazione dei Rischi — a DVR, or Risk Assessment Document — identifying workplace hazards and the prevention and protection measures in place to manage them.

From October 23, any AI system that falls within the decree's functional scope must be assessed within that same DVR. The employer must document the specific risks the AI system poses, the prevention and protection measures in place, and the training and information program provided to affected workers. Oversight of the broader framework lands with Italy's Ministry of Labour, which is responsible for coordinating safety measures when AI enters the workplace, and with Italy's National Labour Inspectorate — the Ispettorato nazionale del lavoro — which holds existing inspection and enforcement powers over DVR compliance.

What "Affects Work Organization" Actually Means

The decree deliberately avoids a list of regulated products or technologies. Instead it applies a functional criterion: an AI system is in scope if it affects the organization of work, production pace, how tasks are performed, or decisions that are safety-relevant. Italy's decree Article 42 places responsibility for applying that test with the employer preparing the DVR.

In practice, a scheduling platform, a workflow automation tool, an algorithmic task-routing engine, or a production monitoring system can all fall within scope if they materially influence how workers spend their time or what risks they face — even when the vendor does not describe the product as artificial intelligence. Conversely, software that does not affect work organization or safety-critical decisions, however technically sophisticated, would not trigger the obligation. The EU AI Act's employment provisions frame the same categories as high-risk, which Italy's functional criterion is designed to draw into the DVR process.

This design is significant. AI vendors have commercial incentives to avoid regulated categories, and systems can be hard to classify by product label alone. By anchoring the test to observable workplace effects, the decree removes that escape route. Scholars of algorithmic labor management systems — a term coined in 2015 by researchers studying automated labor direction at Uber and Lyft — have long documented how managerial functions can be delegated to algorithms without those systems being marketed as AI at all.

Shadow AI: The Compliance Gap Affecting 80 Percent of Workplaces

One structural gap the decree does not resolve is shadow AI — tools that employees use without their employer's knowledge or formal adoption. A generative AI assistant an individual worker installs and uses independently for drafting, research, or decision support would not have a DVR entry, because the employer cannot assess risks from a system it does not know exists.

This is not a marginal concern. Research published by Unseen Security in May 2026 found that 80 percent use unapproved tools, a figure representing workers globally. Seventy-eight percent practice what Microsoft and LinkedIn have called "Bring Your Own AI" — using personal AI subscriptions for work tasks without employer authorization. Unauthorized AI tools remain active a median of 403 days before detection. IBM's 2025 cost-of-breach data found that shadow AI involvement adds approximately $670,000 in breach costs per incident.

Under Italy's broader AI governance framework, employers are already separately required to monitor and manage unauthorized AI use by employees — a compliance obligation that intersects directly with DVR requirements now entering into force. The DVR assessment, by design, can only evaluate AI systems the employer already knows about.

Workers Cannot Be Fired by Algorithm

Decree 179/2026's obligations extend beyond risk documentation. Article 41 — immediately adjacent to the AI safety provision — reserves to a human being the final decision on the establishment, modification, or termination of an employment relationship. Italy's Decree 179 Article 41 covers hiring, changes to contract terms, dismissal, disciplinary action, and performance evaluation.

Worker consent cannot override the requirement. Decisions taken in violation of Article 41 are legally void. Analysis by DLA Piper describes the provision as a prohibition on fully automated decisions for recruitment, dismissal, and disciplinary action, requiring that any such decision be "taken, or at least validated, by a person with real decision-making authority."

No Sanctions in Article 42 Itself — But Existing DVR Penalties Apply Immediately

Article 42 contains no dedicated penalty provisions and no transitional compliance window. The absence of a grace period means the obligation is active in full on Thursday.

Non-compliance is not without consequence. DVR obligations under Italy's Consolidated Safety Act carry existing enforcement mechanisms. Under Decree 81/2008, failure to prepare or properly maintain a DVR exposes the responsible employer or manager to fines of approximately €3,557 to €9,113 — or arrest of up to six months. These DVR sanctions under Article 55 reflect the amounts updated by the 2023 ministerial revaluation. More serious DVR failures that contribute to a workplace injury can trigger criminal prosecution. The National Labour Inspectorate, which conducted more than 157,000 workplace inspections in 2025 according to its annual surveillance report, holds active authority to enforce DVR compliance across all sectors.

The broader EU AI Act framework adds a further penalty layer: violations of high-risk AI provisions carry fines up to €35 million or 7 percent of global annual turnover, whichever is higher. Italy's Law 132/2025 administrative penalties separately authorize fines of up to €1,500 per employee for certain information violations.

Italy Built Two Enforcement Layers: Documentation and Criminal Liability

Decree 179/2026 is one of two implementing decrees completing Italy's national transposition of the EU AI Act at the workplace level. The companion decree, Legislative Decree No. 160/2026, took effect September 30, 2026, and introduced a criminal offense for failing to maintain required safety or human oversight measures on high-risk AI systems. Under the new Article 437-bis of the Italian Criminal Code, penalties can reach five years' imprisonment in standard cases and eight years where the failure endangers human life, personal safety, or state security. Corporate liability under Italy's organizational responsibility statute — Decree 231/2001 — was also extended to AI-related offenses.

Together, the two decrees establish a layered enforcement architecture: Decree 160 creates criminal exposure for systemic failures to oversee high-risk AI; Decree 179 creates an affirmative documentation and training duty for any AI affecting work organization or safety.

Both flow from Italy's Law 132/2025 national AI framework — the first comprehensive national AI statute enacted by any EU member state — which entered into force October 10, 2025, and delegated the government to issue implementing decrees within twelve months. Italy's national AI framework designates the Agency for Digital Italy (AgID) as the notifying authority and the National Cybersecurity Agency (ACN) as the market surveillance authority and single point of contact with EU institutions. Sector regulators retain supervision powers within their respective domains.

Which AI Systems Are High-Risk Under EU Law?

Under the EU AI Act — Regulation (EU) 2024/1689 — AI systems used in employment contexts are explicitly listed in the high-risk category. That classification covers automated candidate screening, performance evaluation tools, employee monitoring systems, workforce allocation platforms, and employee turnover prediction — precisely the categories Italy's functional criterion is designed to draw into the DVR process.

The EU Digital Omnibus (Regulation (EU) 2026/1744), which entered into force July 27, 2026, deferred the full slate of Annex III high-risk obligations — including those for employment AI — from August 2, 2026, to December 2, 2027. Italy's Decree 179 Article 42 is therefore the more immediate operative requirement for Italian employers: embedding AI within the DVR system makes compliance immediately enforceable through existing labor inspection mechanisms, independent of EU-level harmonized standards or the deferred Annex III deadline.

How Italy Stands Against Other EU Member States

Italy's pace of AI Act implementation places it ahead of most EU peers. Among the first EU member states to have national AI Act implementation statutes in force, Italy has proceeded further than most by embedding AI risk assessment directly within its national occupational safety documentation framework. Spain's AI regulatory agency, AESIA, is operational, but national implementing legislation is still working through Parliament. Malta has proceeded through secondary legislation. Most EU member states are currently relying on the AI Act's self-executing provisions while national transposition work continues.

The DVR requirement has no direct EU parallel. No other EU member state has yet embedded an AI risk assessment obligation inside a national occupational safety and health documentation framework. Italy has made AI safety assessment a domestic labor inspection matter — not only a specialized AI regulatory question handled by a designated technology authority.

How to Use the DVR Process to Comply Before Thursday

With no grace period in the decree, the practical starting point for any Italian employer is an immediate audit of AI systems currently in use and an assessment of whether each one meets the functional test. Systems that affect how work is organized, how fast it must proceed, how tasks are executed, or how safety-relevant decisions are made belong in the DVR.

For each qualifying system, the employer must document the specific risks it introduces, the prevention and protection measures in place, and the training and information program delivered to affected workers. The DVR's existing structure already names the responsible parties: the prevention and protection service manager (RSPP), the occupational physician (medico competente), and the employer. Under Article 17 of Decree 81/2008, the DVR is a non-delegable employer obligation. Decree 179 creates no new document and no new responsible role — it adds AI risk assessment to a compliance structure already in place for every Italian employer. The burden is knowing which tools belong in it.

Frequently Asked Questions

What AI systems are covered by Italy's Decreto Legislativo 179/2026?

Any AI system that materially affects how work is organized, how quickly work must proceed, how individual tasks are performed, or how safety-relevant decisions are made. The test is functional, not categorical — a scheduling tool, task-routing engine, or production monitoring system can qualify regardless of whether the vendor markets it as AI. The employer preparing the DVR makes the initial determination about which systems are in scope.

What penalties apply if an Italian employer fails to include AI systems in the DVR?

Article 42 contains no dedicated penalty, but the underlying DVR obligation under Decree 81/2008 carries existing sanctions. A failure to properly maintain the DVR can result in fines of approximately €3,557 to €9,113 or arrest of up to six months for the responsible employer or manager, reflecting amounts updated by the 2023 ministerial revaluation. DVR failures that contribute to a workplace injury can trigger criminal prosecution. Italy's National Labour Inspectorate has active inspection authority and no grace period was granted. Under Italy's Law 132/2025, additional administrative fines of up to €1,500 per employee may apply for information violations, and EU AI Act penalties for high-risk AI violations reach up to €35 million or 7 percent of global annual turnover.

Does Italy's new AI workplace decree cover shadow AI tools employees use on their own?

Not directly. The DVR obligation covers AI systems the employer has deployed and knows about. An AI tool an employee installs or uses independently — without the employer's knowledge — falls outside the DVR assessment process because the employer cannot evaluate risks from a system it is unaware of. Research from 2026 found that 80 percent of workers use unapproved AI tools, often for 400 or more days before detection. Under Italy's broader AI governance framework, employers are separately required to monitor and manage unauthorized AI use by employees — creating a parallel compliance obligation that intersects directly with the new DVR requirement.

What is Italy's Decree 179/2026 and how does it fit the EU AI Act?

Legislative Decree No. 179/2026 is the implementing decree that completes Italy's national transposition of the EU AI Act (Regulation (EU) 2024/1689) at the workplace level. It amends Italy's Consolidated Safety Act to require that all AI systems meeting a functional workplace-effect test be assessed in the DVR — the mandatory workplace risk document every Italian employer must maintain. It was published in the Gazzetta Ufficiale on October 8, 2026, and takes effect October 23 with no transition period. Italy is the first EU member state to embed an AI safety obligation directly inside the national occupational safety and health documentation framework, making AI risk assessment a routine labor inspection matter rather than a specialized technology regulatory issue.