Italy’s Artificial Intelligence Act and Global AI Governance: The EU Model’s Practice and Prospects

Paradigm Academic Press Law and Economy ISSN 27 88 - 7049 MAR. 202 6 VOL. 5 , NO. 1 41 Italy ’ s Artificial Intelligence Act and Global AI Governance: The EU Model ’ s Practice and Prospects Sirong Yu 1 1 Shanghai University of Political Science and Law , Shanghai, China Correspondence: Sirong Yu , Shanghai University of Political Science and Law, Shanghai, China . doi:10.63593/LE.2788 - 7049.2026.03.00 4 Abstract The Italian Artificial Intelligence Act, enacted on September 17, 2025, represents the first comprehensive national implementation of the European Union ’ s AI Act. This study examines the Italian legislation through the theoretical lens of multi - level governance, analyzing its dual function as both a “ bridging legislation ” that translates EU framework into domestic practice and a site of significant regulatory innovation. Through detailed textual analysis and case studies, particularly in healthcare AI, this research investigates how Italy has navigated the complex interplay between supranational standardization and national specificity. The findings reveal that Italy has not merely passively transposed the EU AI Act but has actively engaged in “ normative localization, ” refining the risk - based approach with distinctive national characteristics — such as stringent safeguards for cultural heritage and tailored provisions for small and medium enterprises. The study further explores Italy ’ s creation of a coordinated regulatory architecture involving multiple existing authorities and its development of a multi - layered enforcement regime that innovatively combines administrative, civil, and criminal liabilities. The Italian approach demonstrates a sophisticated balancing of legal certainty through clear prohibitions and regulatory flexibility through adaptive tools like regulatory sandboxes. This analysis contributes to theoretical understanding of implementation dynamics in multi - level governance systems and offers practical insights for other jurisdictions developing AI governance frameworks. The Italian experience suggests that effective AI governance requires both principled foundation and contextual adaptation, providing valuable lessons for global AI governance amid ongoing technological evolution and regulatory competition . Keywords: AI Act , artificial intelligence governance , legislation , regulatory sandbox 1. Introduc tion The global governance landscape for artificial intelligence is undergoing a profound period of institutional development. As technological iteration accelerates and application risks emerge, countries worldwide are exploring regulatory pathways aligned with their legal traditions and national circumstances. As technological advancements accelerate and application risks emerge, nations worldwide are exploring regulatory pathways aligned with their legal traditions and national circumstances. However, this EU - level legislation marks not the end of governance but the beginning of a complex implementation process. Given the multi - tiered governance structure of the EU legal system, the concrete effectiveness of this framework legislation ultimately depends on how its 27 member states translate its principles into operational domestic legal practices. On September 17, 2025, the Italian Republic became the first nation to enact its national Artificial Intelligence Act. This milestone not only signifies the EU AI regulatory framework ’ s entry into a new phase of domestic implementation but also propels a critical question to the forefront of academic research: As a pioneer within the EU framework, what legislative innovations and distinctive practices does the Italian Act demonstrate in the process of domesticating regional rules? What kind of national - level model does its institutional design offer for global AI governance? Therefore, the core research questions this paper aims to explore are: Building upon the EU ’ s higher - level L AW AND E CONOMY MAR. 2026 VOL.5, NO.1 42 legislation, what key refinements, developments, and innovations did the Italian Act introduce across three major dimensions regulatory content, institutional setup, and enforcement mechanisms? How do these institutional designs collectively form a domestic AI governance system that balances rigor with operability? What reference value and insights does its legislative practice offer to other sovereign states, including China? Examining this question not only concerns the evaluation of Italy ’ s domestic legislative practice but also profoundly involves the unity and flexibility of the EU ’ s Digital Single Market, the autonomous space of member states in technological regulation, and the ultimate realization of the “ European model ’ s ” global competitiveness. 2. Legislative Background of Italy ’ s Artificial Intelligence Act The emergence of Italy ’ s AI bill is not an isolated event, but rather an inevitable outcome shaped by profound global transformations in AI governance and strategic realignments within the European Union. It represents both a direct response to the multifaceted risks and challenges accompanying the rapid evolution of AI technology worldwide, and a pioneering legislative initiative within the broader context of the EU ’ s efforts to establish its position in the fiercely competitive global AI landscape. 2.1 The Current State and Challenges of Global Artificial Intelligence Technology Governance First, the fragmentation of governance systems and the absence of rules have become the most prominent challenges. Current global AI governance faces the dilemma of “ excessive rules and insufficient consensus. ” Ethical principles and regulatory models vary widely across nations, leading to fragmented rules. Developed and developing countries exhibit distinct divergences in their AI governance approaches, manifested in differing risk priorities, regulatory scopes, and levels of participation in international rule - making. Examining practices in developed economies reveals two distinct governance paradigms: the EU - led comprehensive risk oversight system covering the entire AI lifecycle, and the US - representative targeted governance mechanism focused on critical domains. (Calo, R, 2017) These approaches exhibit structural differences in legislative coverage. This fragmentation compels countries like Italy, seeking to establish a stable and predictable regulatory environment, to carefully consider how to align with potential international norms. As Ursula von der Leyen, the President of the European Commission, put it: “ To unlock the potential of artificial intelligence, we must find a European way to strike a balance between data flows and wide usage, while ensuring high levels of privacy, security and ethical standards. ” (Ursula von der Leyen, 2019 ). This core tenet is fully embodied in the legislative process. On one hand, the EU is seizing the “ limited window of opportunity ” presented by AI; on the other hand, it is endeavoring to lead and advance the ethical application of AI technology on a global scale. Secondly, technological hegemony has widened the digital divide and spawned new security threats. Data reveals that nearly 80% of global data centers are controlled by developed nations, leaving vast amounts of data from developing countries unable to translate into developmental momentum. This imbalance, when combined with AI technology, will further deprive latecomers of development opportunities. More gravely, AI technology faces the risk of “ reverse empowerment, ” where its capabilities are applied to destructive domains such as military operations, warfare, and biological weapons manufacturing. Moreover, AI - enabled crimes like deepfakes and cyberattacks pose direct threats to individual rights and social order, compelling the Italian legislation to impose stringent criminal penalties on such activities ( Katzenbach C, 2021). Finally, the cross - domain propagation of compound technological risks demands forward - looking legislation. While artificial intelligence drives productivity growth, it also brings multiple social and technical risks — including data breaches, algorithmic bias, and structural unemployment — that intertwine to pose a shared global threat. Concerns within the business community underscore this reality, with nearly 70% of enterprises identifying the rapidly evolving AI ecosystem as the greatest security risk associated with generative AI. These risks transcend national borders, leaving no country immune. This compels national - level legislation to move beyond narrow domestic perspectives and incorporate considerations for global governance. 2.2 The EU Artificial Intelligence Act as a Cornerstone: Unified Rules and Risk Pathways The introduction of the EU ’ s Artificial Intelligence Act reflects the bloc ’ s attempt to extend its renowned “ regulatory power ” in digital governance to the cutting - edge field of artificial intelligence. Its legislative intent extends beyond merely addressing potential risks posed by AI technology; it aims to establish a unified legal framework to clear regulatory hurdles for the development of the EU ’ s Digital Single Market, thereby positioning European regulatory standards as a global paradigm. The core regulatory philosophy of the Act is a risk - based four - tier pyramid model. This model categorizes AI systems based on the potential threat they pose to citizens ’ health, safety, and fundamental rights, ranking them from highest to lowest risk as Unacceptable Risk, High Risk, Limited Risk, and Minimal Risk. Corresponding regulatory rules are then established for each tier. From a legal standpoint, the EU Artificial Intelligence Act is a regulation. Pursuant to Article 288 of the Treaty on the Functioning of the European Union, regulations are directly applicable and binding in their entirety across all member states. This means that once its transition period concludes, its legal effect will automatically and L AW AND E CONOMY MAR. 2026 VOL.5, NO.1 43 uniformly extend across the entire EU territory without requiring member states to transpose it through domestic legislation. However, this by no means implies inaction on the part of member state legislatures. The Act itself constitutes a framework legislation, with numerous provisions requiring member state governments to elaborate and implement them through domestic administrative or legislative measures. This characteristic of “ direct applicability requiring domestic coordination ” renders the EU AI Act an incomplete legal framework. Its ultimate effectiveness in implementation heavily depends on “ connecting ” legislation and institutional development at the member state level, thereby reserving crucial space for legislative initiative in countries like Italy. Therefore, the Italian bill is not only the EU ’ s first fully implemented national AI law but also provides an exceptional pioneering case and institutional experiment for observing how EU AI governance transitions from macro - level blueprints to micro - level practices. 2.3 The Connective Role and Legislative Logic of the Italian Bill The enactment and implementation of Italy ’ s AI Act marks a pivotal shift in the EU ’ s AI governance paradigm, transitioning from regional legislative frameworks to domestic legal practices within member states. As the first comprehensive domestic legislation implementing the EU ’ s AI Act, it assumes the pioneering role of “ pioneering and testing, ” a position carrying multiple symbolic implications. From a legal implementation perspective, the Italian Act establishes a crucial legislative precedent. Given the EU AI Act ’ s direct applicability as a regulation, member states ’ domestic legislative scope primarily focuses on developing implementing rules and establishing regulatory bodies. ( Morgan Sullivan, 2025) Italy ’ s legislative exploration within this limited scope provides a crucial reference model for other member states on how to translate EU framework principles into operational domestic rules. Particularly in defining specific criteria for high - risk AI systems, establishing regulatory agency models, and formulating penalty provisions, Italy ’ s legislative choices may serve as templates for other member states to draw upon. From the perspective of governance practices, Italy faces dual pressures. On one hand, as the first country to enact legislation, the effectiveness of its implementation will directly impact the credibility of the EU ’ s overall artificial intelligence governance system. Successful implementation will validate the effectiveness of the EU governance model, while any significant shortcomings could be interpreted as flaws in the institutional design. On the other hand, Italy ’ s enforcement practices will accumulate valuable regulatory experience at the EU level. Its pioneering efforts in interpreting legal provisions, calibrating regulatory standards, and building a body of enforcement cases will provide crucial practical guidance for the subsequent regulatory work of the EU AI Office and other member states. 3. Core Provisions and Institutional Integration of Italy ’ s Artificial Intelligence Act 3.1 Overall Structure and Legislative Purpose of the Bill The full text of the bill comprises approximately 28 articles, structured into three main sections: General Provisions and Fundamental Principles, Regulations for Specific Application Areas, and Strategic and Regulatory Framework Arrangements. The overall design fully reflects Italy ’ s national considerations and institutional characteristics. For instance, while maintaining overall alignment with the EU ’ s Artificial Intelligence Act, the first section introduces specific provisions explicitly prohibiting AI interference in democratic processes and public discourse — a matter not yet explicitly addressed in EU - level legislation. The second section dedicates specific chapters to socially sensitive domains such as healthcare, disability protection, labor and employment, education, justice, and public administration, demonstrating the legislature ’ s particular concern for these issues. The third section further clarifies the national AI strategy, the establishment of competent authorities, funding sources, and mechanisms for criminal and administrative liability. It assigns corresponding regulatory functions to the National Cybersecurity Agency (ACN) and the National Digital Agency (AgID), while continuing to safeguard the independent authority of data protection bodies. The legislative objectives of this bill can be summarized in three key areas: First, establishing a unified system aligned with the EU regulatory framework to ensure Italy does not fall behind in the competition of rules. Second, strengthening legal safeguards in critical areas such as youth protection, judicial fairness, labor rights, and public services based on domestic realities. Finally, promoting the healthy and sustainable development of the artificial intelligence technology ecosystem through strategic guidance and fiscal support. As emphasized in the official explanatory documents, this bill aims not only to regulate but also to promote, with its core intent being to achieve an effective balance between technological innovation and safety and controllability. 3.2 Concrete Institutional Implementation of the “ People - Centered ” Principle The EU AI Act establishes the fundamental principle of “ human - centeredness, ” but leaves the specific implementation mechanisms to member states. ( Herberger, N & Diakopoulos, N, 2023) Through a series of meticulously designed institutional arrangements, the Italian bill transforms this principle into a practical tool for safeguarding rights, particularly in the areas of employment and healthcare — two domains closely tied to L AW AND E CONOMY MAR. 2026 VOL.5, NO.1 44 citizens ’ interests. In the employment sphere, Italian legislators maintain heightened vigilance against potential labor rights infringements stemming from algorithmic management. Article 42 imposes what may be the EU ’ s most stringent “ algorithm transparency ” requirements. Under this provision, employers using AI systems for hiring, performance evaluations, or dismissal decisions must not only inform employees of AI system usage but also provide “ an easily understandable description of the system ’ s functionality ” and “ specific decision - making criteria. ” More significantly, the provision grants employees the “ right to request human review ” of AI decisions, prohibiting employers from subjecting employees to adverse treatment for exercising this right. This provision effectively prevents algorithmic decisions from becoming unchallengeable “ digital arbiters, ” offering crucial safeguards for workers ’ rights. In the healthcare sector, Italy ’ s legislation employs highly practical legislative techniques to implement the “ human oversight ” principle. Addressing the current ambiguity in liability allocation for medical AI applications, Article 28 explicitly establishes a “ physician ’ s final decision - making authority ” system. The provision states that outputs from AI - assisted diagnostic systems “ shall only serve as a reference for healthcare professionals ’ decision - making. ” Final diagnostic conclusions and treatment plans must be independently formulated by licensed physicians, who bear full legal responsibility for such decisions. This clarification not only defines accountability in AI - assisted healthcare but also upholds the core value of the doctor - patient relationship, preventing technological applications from eroding the essence of medical professional judgment. Furthermore, the bill innovatively introduces a “ Fundamental Rights Impact Assessment ” system. It mandates that public institutions and private developers of high - risk AI systems must conduct risk assessments and implement mitigation measures before deploying systems that may impact citizens ’ rights. This system translates abstract rights protection principles into concrete compliance steps, reflecting Italian legislators ’ wisdom in embedding rights safeguards within technological regulation frameworks. The EU AI Act outlines eight high - risk AI application areas in its annex, establishing a baseline scope for member state regulation. The emphasized “ risk - based approach ” prioritizes preemptive intervention, shifting regulatory governance from post - event regulation to comprehensive compliance obligations across the entire lifecycle of AI systems — encompassing design, development, deployment, and application. This is particularly evident in the EU ’ s AI Act ’ s provisions for high - risk AI systems. ( CHAMBERLAINJ, 2023) While this approach enhances the scalable safety of AI, it also increases the overall compliance obligations for market entities. Italian legislators did not merely replicate this list but instead conducted significant localized interpretation and expansion based on the nation ’ s industrial structure and risk characteristics. In the public healthcare sector, the Italian bill demonstrates a stricter stance exceeding EU minimum standards. The bill explicitly classifies all AI software used for diagnostic assistance as high - risk and imposes additional compliance requirements tailored to the characteristics of Italy ’ s healthcare system. For instance, Article 23 stipulates that any AI system employed for tumor screening, pathological analysis, or emergency triage must obtain special approval from the Medical Device Evaluation Committee under the Italian Ministry of Health, in addition to complying with the EU ’ s conformity assessment procedures. This mechanism demonstrates that regulation of medical AI can fully account for unique ethical considerations and patient safety requirements within national healthcare practices. In the judicial and public administration domains, Italy ’ s legislative choices similarly reflect respect for administrative traditions. Addressing the characteristics of its administrative procedural law system, the bill imposes more detailed transparency obligations on AI systems used for administrative decisions such as evaluating social welfare applications and allocating public housing. Under Article 31, entities deploying such systems must disclose the fundamental characteristics of training data, the decision - logic framework of algorithms, and system accuracy metrics. This ensures the “ algorithmic black box ” does not undermine public trust in administration. This provision directly addresses Italy ’ s longstanding transparency deficit within its bureaucracy, demonstrating lawmakers ’ intent to advance administrative modernization through technological regulation. 3.3 Specialized Domain Regulation in the Bill: Innovative Mechanisms for Cultural Heritage Protection As a nation rich in cultural heritage, Italy has established a dedicated regulatory chapter within its legislation specifically addressing AI applications in the cultural heritage sector. ( TOSCO CI, 2014) This constitutes one of the most distinctive institutional innovations in Italy ’ s AI legislation. The Italian legislation innovatively extends the scope of high - risk oversight to encompass specific AI applications within the cultural heritage domain. Article 35 authorizes the Ministry of Culture to establish a dedicated catalog classifying AI systems used for artifact restoration, archaeological site monitoring, and art authentication as “ specific risk systems. ” It mandates that operators possess relevant professional qualifications L AW AND E CONOMY MAR. 2026 VOL.5, NO.1 45 and requires systems to maintain sufficient scope for human intervention in decision - making. This distinctive provision reflects Italy ’ s cautious approach as a cultural heritage powerhouse, preventing immature AI technologies from causing irreversible damage to irreplaceable cultural assets. The bill establishes special protections for so - called cultural heritage data for the first time. Under Article 56, data used to train AI systems related to cultural heritage — including 3D scans of artifacts and digitized images of ancient texts — are not only protected under intellectual property law but also subject to specific ethical review procedures. Any commercial AI model training using such data requires Ministry of Culture authorization and royalty payments, with proceeds earmarked for heritage conservation. This innovative mechanism provides legal grounding to address “ data plundering ” in cultural digitization. For AI applications in artifact restoration, the bill implements a stringent “ precautionary principle ” enforcement mechanism. Article 58 mandates that before deploying AI systems for restoration plans involving fragile artifacts, ethical review by an expert committee is required. Sufficient testing must be conducted on substitute items with similar physical properties to verify reliability before application to genuine artifacts. Additionally, all AI - based restoration decisions must retain complete records of human expert interventions, ensuring prudence and traceability throughout the technological application process. Through these enhanced regulations, Italy ’ s AI legislation transforms the EU ’ s unified framework into a practical yet distinctively national AI governance system. This legislative approach — characterized by “ principle localization, rule refinement, and protection specificity ” — not only provides valuable reference for other member states but also demonstrates national - level innovation and strategic wisdom in implementing international technical standards. 3.4 Allocation of Powers and Responsibilities Among Regulatory and Law Enforcement Agencies Pursuant to Article 57 of the EU Artificial Intelligence Act, EU member states must establish at least one regulatory sandbox within their jurisdictions to provide a controlled environment for the development, training, testing, and validation of AI systems. Through detailed domestic legislation, this framework principle is translated into operationalized specific systems. Regulatory sandboxes aim to enhance legal certainty in regulatory understanding, support regulatory learning, accelerate market access, and assist innovators in comprehending regulatory expectations and fulfilling obligations. The Act does not create a new, centralized super - regulator. Instead, it builds upon existing administrative structures and specialized regulatory capacities to design a multi - tiered, multi - stakeholder collaborative regulatory architecture. This design fully respects Member States ’ autonomy for implementation within the EU legal framework while ensuring regulatory expertise and efficiency. First, it clearly delineates the roles of core national regulatory bodies. The Act explicitly designates two core national agencies with distinct responsibilities: 1 ) The National Cybersecurity Agency (ACN) assumes the core role of market oversight, serving as the enforcement body and the single point of contact with EU institutions. Its powers include inspection authority, monitoring the applicability and safety of AI systems, and enforcing relevant penalties. This positions ACN as the most deterrent “ police ” function within Italy ’ s AI regulatory system. 2 ) The Agency for Digital Italy (AgID) is positioned as the “ notifying authority. ” It handles compliance assessments for high - risk AI systems, manages certification and accreditation for relevant entities, and promotes secure AI applications for citizens and businesses within a stable, cross - departmental coordination framework. 3 ) Existing regulatory bodies such as the Italian Data Protection Authority (Garante) and the Italian Communications Authority (AGCOM) will continue overseeing matters within their original jurisdictions, including personal data protection and media content in AI - related domains. This design avoids duplicating institutions while leveraging the expertise and regulatory experience of existing agencies. Second is the coordinated enforcement between the coordination framework and sectoral regulators. To prevent regulatory vacuums or overlaps in specific sectors such as finance and healthcare, the Italian bill establishes a regulatory model centered on ACN and AgID, with sectoral regulators collaborating. In critical sectors like finance and insurance, existing specialized regulators — such as the Bank of Italy, the Italian Securities and Exchange Commission (CONSOB), and the Italian Insurance Supervisory Authority (IVASS) — will be designated as market supervisors within their respective jurisdictions. This means an AI credit assessment system used by a bank would be overseen simultaneously by ACN (from a general security perspective) and the Bank of Italy (from financial stability and consumer protection angles). This arrangement ensures regulatory expertise and depth, exemplifying Member States ’ typical exercise of autonomy in balancing universal rules with sector - specific characteristics. Finally, the bill establishes reporting, collaboration, and information - sharing mechanisms with the EU level. As a L AW AND E CONOMY MAR. 2026 VOL.5, NO.1 46 domestic extension of the EU AI Act, Italy ’ s regulatory framework is not a closed system but functions as a “ bridge ” to the European AI Office through ACN. ACN is responsible for reporting major security incidents and providing an overview of market surveillance activities to the European AI Office, serving as the interface for receiving EU - level guidance and directives. Simultaneously, in investigations involving general AI models or cases with cross - border implications, ACN and AgID must engage in close collaboration and information exchange with the European AI Office and regulatory authorities from other member states, collectively forming a coordinated regulatory network at the EU level. 3.5 Strengthening the Legal Liability and Penalty System Another notable feature of Italy ’ s AI Act is that it builds upon the administrative penalties established by the EU AI Act, further strengtheni ng and refining the legal liability framework. Specifically, by introducing criminal sanctions and clarifying the interface with civil liability, it establishes a more deterrent “ long - arm ” enforcement effect. The administrative penalty procedures are specified in detail. The EU AI Act sets administrative fines for violations at up to 6% of global turnover or €35 million. Within this framework, the Italian law authorizes the government to issue legislative decrees within the next 12 months to refine specific penalty criteria, consideration factors (such as company size, intent, or negligence), and enforcement procedures. Market surveillance authorities (primarily the ACN and sector - specific regulators) are granted extensive investigative powers, including the right to demand information, inspect business premises, and impose temporary injunctions on suspected non - compliant AI systems. This procedural framework ensures the enforceability of administrative penalties. Second is the significant strengthening of criminal liability. Article 27 stands as one of the provisions most marked by “ criminal policy ” and “ horizontal regulation ” in this bill. By amending the Criminal Code, Civil Code, Copyright Law, and the Consolidated Law on Financial Intermediaries (TUF), it formally integrates artificial intelligence systems into the traditional legal framework. AI systems are regulated both as new criminal instruments and as aggravating factors triggering more severe criminal liability. For addressing Deepfakes, the bill explicitly stipulates that unlawfully disseminating AI - generated or tampered content (such as deepfakes) causing harm to others carries a prison sentence of 1 to 5 years. This provision directly incorporates a novel form of digital harm into the scope of criminal law, demonstrating the legislature ’ s acute responsiveness to emerging risks. This marks Italy ’ s first dedicated criminal offense targeting AI - generated false content within its penal code. For AI - Assisted Traditional Crimes, the bill stipulates that using AI technology to commit existing crimes — such as fraud, identity theft, or market manipulation — constitutes an aggravating circumstance warranting harsher penalties. For instance, market manipulation using AI will incur enhanced penalties under the Consolidated Law on Finance and the Italian Civil Code. These criminal provisions coexist with administrative sanctions, meaning a company may face substantial administrative fines from the ACN for data governance non - compliance, while its employees using the company ’ s AI systems for criminal acts will also face criminal liability. Third, the interface with civil liability and ultimate accountability. Beyond public law liability, the Italian legislation emphasizes integration with private law (civil liability). The bill underscores the principles of human oversight and ultimate accountability across multiple domains. Article 27 amends Article 2637 (market manipulation offenses), stipulating that if the act is committed through artificial intelligence, the prison term is directly increased to two to seven years. This design reflects the legislator ’ s sensitivity to the risks of automation and algorithmic manipulation in financial markets, aiming to prevent AI tools from being misused for large - scale price manipulation and misleading transactions. Through these refined regulatory and liability frameworks, Italy ’ s AI legislation successfully establishes a governance structure characterized by clear accountability, robust enforcement, and a balanced emphasis on deterrence and guidance. It transcends a mere translation of the EU AI Act, representing a legislative practice that integrates national legal traditions and regulatory resources to achieve a delicate equilibrium between compliance and innovation, uniform rules and autonomous implementation. 4 . Implementation Challenges of the Artificial Intelligence Act and Global Lessons Learned As the first EU member state to fully implement the EU Artificial Intelligence Act through domestic legislation, Italy ’ s AI bill reveals the inherent tensions within the EU ’ s ‘ Brussels Effect ’ during its formulation and implementation. ( BradfordA, 2020) It also offers valuable institutional experimentation for global AI governance. This chapter will examine the bill ’ s impact on the development of the EU ’ s Digital Single Market by analyzing the internal coordination and external compliance challenges it faces. Ultimately, it will distill insights and lessons for countries like China seeking to establish their own AI governance frameworks. 4.1 Multidimensional Challenges Facing the Implementation of Italy ’ s AI Act L AW AND E CONOMY MAR. 2026 VOL.5, NO.1 47 Italy ’ s pioneering role in AI legislation has granted it rule - setting authority while simultaneously subjecting it to formidable challenges across three dimensions: internal coordination, external compliance, and industrial development. 4.1.1 Internal Challenges to Regulatory and Enforcement Consistency Italy ’ s AI Act establishes a multi - agency regulatory framework designed to leverage existing institutional expertise. However, this approach risks creating overlapping regulatory responsibilities and fragmented enforcement practices in practice. First, coordinating responsibilities among regulators presents a complex challenge. The Act designates the Agency for Digital Italy (AgID) as the notification authority and the National Cybersecurity Agency (ACN) as the market oversight body. Concurrently, the Italian Data Protection Authority (Garante), the Italian Communications Authority (AGCOM), and sector - specific regulators (such as the Bank of Italy, CONSOB, and IVASS for finance and insurance) retain regulatory duties within their existing mandates. This “ interwoven ” regulatory network, lacking robust coordination mechanisms, is highly susceptible to fragmented governance and inconsistent standards. For instance, an AI system used in insurance operations may simultaneously need to comply with ACN ’ s general security requirements, IVASS ’ s industry - specific compliance standards, and the Data Protection Authority ’ s regulations on data processing. Businesses, particularly SMEs, may see their innovation stifled by overwhelming compliance costs. Second, ensuring uniform enforcement standards presents another significant practical challenge. While the law requires alignment with the EU AI Act in principle, differences may arise in practice among regulators regarding interpretation of legal provisions, risk assessment criteria, and penalty severity. This uncertainty not only undermines legal predictability but may also encourage “ regulatory arbitrage ” — where businesses operate under the jurisdiction of less stringent regulators — distorting market competition. 4.1.2 External Challenges from Dynamic Compliance Pressures with EU Regulations As member state legislation, the core challenge for Italy ’ s AI Act lies in effectively addressing domestic concerns while maintaining high consistency with EU overarching laws. Articles 1 and 3 explicitly mandate that its interpretation must align with the EU AI Act and impose no additional obligations beyond EU law. While this consistency clause legally establishes a subordinate status, it creates significant tension in dynamic compliance. The EU AI Act itself remains in its early implementation phase, with many secondary legislation and implementing rules still under development. Practical guidelines from the EU AI Office and judicial precedents are also evolving. This necessitates that Italian regulators and legislators continuously monitor the latest developments at the EU level, remaining prepared to adjust domestic enforcement practices or even amend laws to maintain synchronization. This dynamic pursuit may impose sustained adaptive pressure on Italy ’ s governance system. Furthermore, certain more protectionist provisions in the Italian legislation — such as explicitly assigning ultimate responsibility to physicians in the medical field and emphasizing safeguards for patients ’ informed consent, or introducing severe penalties for AI - enabled criminal activities in criminal law — while reasonable within the domestic context, must still withstand scrutiny under EU law ’ s principles of proportionality and legal reservation in judicial practice. This is essential to avoid constituting implicit restrictions on fundamental EU freedoms. 4.1.3 Industrial Challenges: Compliance Burdens and Innovation Inhibition Risks for SMEs Italy ’ s economy is dominated by small and medium - sized enterprises (SMEs), which often struggle to compete with large tech companies in terms of technological capabilities, capital scale, and specialized talent. (BECATTINI G, 1990) While Italy ’ s AI Act acknowledges this issue and attempts to provide support through flexible regulatory tools like regulatory sandboxes, its actual effectiveness remains to be seen. The Act ’ s stringent compliance obligations for high - risk AI systems — such as establishing risk management frameworks, maintaining technical documentation, and implementing human oversight — create significant entry barriers for resource - constrained SMEs. These businesses may lack the capacity to bear costly compliance audits or hire specialized legal teams, placing them at a competitive disadvantage and potentially excluding them from the AI - driven digital transformation wave. While the bill articulates objectives to foster SME development, the critical question remains whether these declarative principles can be translated into concrete, accessible, and low - cost support measures. If regulatory sandbox thresholds prove excessively high or administrative procedures become overly cumbersome, the very institutional design intended to incentivize innovation may end up excluding the SMEs most in need of assistance. This outcome would ultimately run counter to the legislation ’ s original intent. 4.2 Implications for Global AI Governance L AW AND E CONOMY MAR. 2026 VOL.5, NO.1 48 Italy ’ s legislative practice transcends national boundaries, offering a valuable paradigm and methodology for the evolving global governance of artificial intelligence. 4.2.1 Providing a National Legislative Model for “ Principle Localization ” Italy ’ s AI Act vividly demonstrates how to transform a regional, relatively abstract regulatory framework (the EU AI Act) into a domestically tailored, operational national law. It offers a vivid example of “ localizing EU standards ” for nations worldwide, particularly civil law jurisdictions. Rather than merely reiterating the EU AI Act ’ s principles, Italy ’ s legislation creatively adapts them by integrating national priorities — such as establishing high - risk lists and sector - specific obligations. For instance, it maintains doctors ’ ultimate decision - making responsibility in healthcare; establishes a “ national observatory ” in labor to monitor AI ’ s impact on employment; and uniquely incorporates cultural heritage protection into its regulatory scope. These measures demonstrate that global AI governance requires both top - level consensus on principles and localized implementation closely integrated with national legal traditions, industrial structures, and sociocultural contexts. Furthermore, Italy opted not to establish an entirely new, centralized super - regulator but instead designed a collaborative regulatory network leveraging existing administrative resources. This model suggests to other nations that effective AI governance need not involve a complete overhaul; it can fully utilize and integrate existing regulatory capabilities and expertise to achieve governance objectives through clear delineation of responsibilities and coordinated mechanisms. However, the Italian legislation also reflects the challenges facing the EU ’ s strategy of exporting its digital rules through the “ Brussels effect ” in the era of artificial intelligence. On one hand, as a major market within the EU, Italy ’ s stringent compliance requirements and hefty penalties will compel foreign tech companies seeking access to its market — particularly those from China and the United States — to adjust their global product strategies, thereby contributing to the globalization of EU regulations to some extent. On the other hand, amid intensifying Sino - American technological competition, the “ European model ” embodied by Italy ’ s legislation is facing dual pressures. The U.S. - led alliance emphasizing “ innovation - first, soft - law governance ” and China ’ s governance approach prioritizing “ security and development in tandem, sovereignty - oriented ” offer nations divergent paths. Many Global South countries may align with either the U.S. or China based on developmental needs and technological cooperation considerations, or adopt hybrid domestic legal frameworks. This uncertainty casts doubt on whether the EU model can emerge as the dominant global paradigm. 4.2.2 Exploring a “ Balance of Rigidity and Flexibility ” in Legislative Techniques The Italian bill demonstrates balanced wisdom in its legislative approach, avoiding an exclusive emphasis on stringent regulation. Instead, it seeks to reconcile the dual values of safety and innovation by combining “ rigid ” baseline requirements with “ flexible ” measures. On one hand, the bill establishes clear regulatory red lines — such as prohibiting social scoring systems and imposing severe criminal penalties for malicious AI abuse — reflecting a firm commitment to risk control. On the other hand, it incorporates flexible tools like regulatory sandboxes and compliance incentives, providing elastic space for technological innovation — particularly for trial - and - error and growth among small and medium - sized enterprises. This “ rigid - flexible ” legislative philosophy offers crucial methodological insights for nations worldwide navigating technological uncertainty: governance should not aim to stifle innovation, but rather guide technology toward good governance through responsible regulation. 5. Conclusion The governance of artificial intelligence remains an ongoing global challenge with no universally applicable solution. The value of Italy ’ s AI Act lies not in providing a perfect legislative blueprint, but in demonstrating a legislative philosophy and methodology that seeks balance within complex governance systems. It teaches us that effective technological governance requires both steadfast value - driven leadership and flexible regulatory tools; it demands unified baseline standards alongside diverse implementation pathways. As AI technology accelerates its evolution, the global governance framework will inevitably undergo continuous adjustment and reconstruction. In this process, Italy ’ s experience reminds us that an open, learning, and adaptive governance ecosystem may prove more crucial than any static legal text. Future AI governance should be a fusion of principles and pragmatism, a dialogue between rules and innovation, and a synthesis of global consensus and local wisdom. Only thus can we navigate the waves of technological transformation and advance toward a future where artificial intelligence serves the common welfare of humanity. References Adinolfi A. (1998). The Judicial Application of Community Law in Italy (1981 - 1997). Common Market Law Review, 35 (6). Bresciani P F, Palmirani M. (2025). AI Act and National Parliaments: How the EU is Regulating Democracy in L AW AND E CONOMY MAR. 2026 VOL.5, NO.1 49 the Digital Era. Ragion pratica , (1) , 249 - 268. Bradford, A. (2020). The Brussels Effect: How the European Union Rules the World . Oxford University Press. BECATTINI G. (1990). Industrial districts and inter - firm co - operation in Italy . International Institute for Labour Studies. Bertomeu J, Lin Y, Liu Y, et al. ( 2023 ) . Capital market consequences of generative AI: Early evidence from the ban of ChatGPT in Italy. SSRN 4452670. Cingolani M, Scendoni R, Fedeli P, et al. (2023). Artificial intelligence and digital medicine for integrated home care services in Italy: Opportunities and limits. Frontiers in Public Health , 10 , 1095001. Corea F, Fossa F, Loreggia A, et al. (2023). A principle - based approach to AI: the case for European Union and Italy . Ai & Society, 38 (2) , 521 - 535. CHAMBERLAIN J. ( 2023 ). The Risk - Based Approach of the European Unions Proposed Artificial Intelligence Regulation : Some Comments from a Tort Law Perspective. European Journal of Risk Regulation, 14 , 1 - 13. Calo, R. (2017). Artificial Intelligence Policy: A Primer and Roadmap. UC Davis Law Review, 51 , 399 . Di Amato A, Fucito F. ( 2020 ). Criminal law in Italy . Kluwer Law International BV. European Commission. ( 2019 ). Political Guidelines for the Next European Commission . https: // www. purple - eu. org/uploads/RO - BUST/EU%20Framework%20Strategy/political - guidelines - next - com - mission_en_0.pdf European Commission. ( 2020 ). White Paper: On Artificial Intelligence - European Approach to Excellence and Trust. https://ec.europa.eu/futurium/en/european - ai - alliance/white - paper - artificial - intelligence - european - approach - excellence - and - trust - 0.html.tze n. Ebers M. ( 2025 ). Truly risk - based regulation of artificial intelligence how to implement the EU ’ s AI Act. European Journal of Risk Regulation, 16 (2) , 684 - 703. Helberger, N. & Diakopoulos, N. ( 2023 ). The European AI Act and How It Matters for Research into AI in Media and Journalism. Digital Journalism, 11 (9), 1751 - 1760. Katzenbach C. ( 2021 ). “ AI will fix this ” — The technical, discursive, and political turn to ai in governing communication. Big Data & Society , (2). Karathanasis T. (2025). The AI Act: Balancing Implementation Challenges and the EU ’ s Simplification Agenda. SSRN 5311501. Laux J, Wachter S, Mittelstadt B. ( 2024 ). Trustworthy artificial intelligence and the European Union AI act: On the conflation of trustworthiness and acceptability of risk. Regulation & Governance, 18 (1) , 3 - 32. Laux J, Wachter S, Mittelstadt B. ( 2024 ). Three pathways for standardisation and ethical disclosure by default under the European Union Artificial Intelligence Act. Computer Law & Security Review, 53 , 105957. Morgan Sullivan . ( 2025 ). The EU AI Act ’ s Implementation Timeline: Key Milestones for Enforcement . https://transcend.io/blog//blog/eu - ai - act - implemen - tation - timeline. Copyrights Copyright for this article is retained by the author(s), with first publication rights granted to the journal. This is an open - access article distributed under the terms and conditions of the Creative Commons Attribution license (http://creativecommons.org/licenses/by/4.0/).