Searchlight AI
Italy

Garante per la Protezione dei Dati Personali - the Italian Data Protection Authority - has issued sector-specific guidance on AI applications, focusing on key areas such as healthcare, web scraping, and AI regulation:

• Healthcare: the Garante has established a set of guidelines for implementing AI-driven healthcare services nationwide. Key requirements include that the legal basis for processing personal data must be rooted in public interest and that data controllers must provide a highly detailed Data Protection Impact Assessment (DPIA), including risk analysis and anti-discrimination measures, closely aligned with the provisions of the EU AI Act.
• Web Scraping: the Garante issued guidance to protect personal data published online by public and private entities from web scraping. Where indiscriminate data collection is used to train generative AI models, the Garante issued a number of recommendations, including restricting access to certain website areas (for example, through user registration) to limit data exposure, incorporating anti-scraping clauses in website terms of service, monitoring web traffic to detect unusual data flows, and implementing anti-bot measures using available technological solutions.
• AI Bill: the Garante expressed its opinion on the proposed AI Bill and recommended introducing a general cross-sector provision to ensure that personal data processing for AI systems complies with existing data protection regulations, and expanding its regulatory role to oversee AI-driven personal data processing, given the extensive use of personal data in AI systems.

The Garante has been active in interacting with AI products: it temporarily blocked OpenAI’s ChatGPT due to data privacy concerns in April 2023, and it blocked the DeepSeek AI product in Italy in January 2025.

In Italy, the Copyright Law (Law No. 633.1941) states that the copyright protection of literary works extends to computer programs that constitute the author's own intellectual creation. Copyright itself is acquired when the creation of work consists of an expression of "intellectual effort" from a human and is sufficiently original.

Regarding patentability, Article 45 of the Industrial Property Code (IP Code) maintains that software, including AI systems, are not considered inventions and therefore not patentable.

The Autorità per le Garanzie nelle Comunicazioni (AGCOM) – the Italian Communications Regulatory Authority – has not issued any guidance on the use of AI yet. However, in January 2024 it established a Committee on AI in the fields of competence of the authority, tasked with conducting analysis and making proposals to AGCOM. The Committee became operational in January 2025, meaning AI-specific guidelines from AGCOM could be expected during 2025, based on its findings.

The Agenzia per la Cybersicurezza Nazionale (ACN) – the Italian National Cybersecurity Agency – has issued, together with other 23 National agencies in other States, Guidelines for secure AI, suggesting considerations and mitigations that will help reduce the overall risk to an organisational AI system development process.

The guidelines are broken down into four key areas:

• Secure design, containing guidelines on risks and threat modelling, and design trade-offs for AI systems.
• Secure development, containing guidelines on supply chain security, documentation, and asset management during the AI development process.
• Secure deployment, containing guidelines on the deployment stage of the AI system development life cycle, including protecting infrastructure and models from compromise, threat or loss, developing incident management processes, and responsible release.
• Secure operation and maintenance, containing guidelines on actions particularly relevant once a system has been deployed, including logging and monitoring, update management, and information sharing.