Italy has a comprehensive statute on artificial intelligence: Law no. 132 of 23 September 2025opens in a new tab, published in the Official Gazette on 25 September and in force since 10 October 2025. It runs to twenty-eight articles in six chapters, covering healthcare, employment, public administration, justice, copyright and the intellectual professions. It does not replace the European regulation, it sits alongside it, and for a professional the part that counts is a single article.
Article 13, and the two conditions it sets
The provision covers the intellectual professions. It says AI systems may be used exclusively for activities that are instrumental and supportive of the professional activity, with the professional’s own intellectual work remaining predominant, and that the client must be informed in clear, plain and complete terms about the use of those systems.
Those are two separate conditions, and it is worth not merging them. The first is about how you work: the tool supports, the intellectual part stays with the person. The second is about what you say: the client has to know.
Who counts as an “intellectual profession”
The provision lists no professions and names no register, and that is deliberate: it uses the category of intellectual professions, which the civil code defines in Article 2229 and which covers both those organised into professional bodies and those that are not. Lawyers, notaries, chartered accountants, employment consultants, architects, engineers and doctors are inside it; so is anybody selling intellectual work without a register behind them.
The practical consequence is that “it does not apply to us, we are not a regulated body” is not an available answer. What is available is a question of proportion: Article 13 asks for information, not a management system, and for a three-person firm it is satisfied by a paragraph in the retainer. The risk in front of a new rule is always the same: building an obligation larger than the rule asks for, and then failing to keep it up.
What “instrumental and supportive” means
The statute does not list the permitted activities, and it could not have done so without going out of date in six months. The test is predominance: if the machine’s contribution is research, summarising, first drafts or formal checking, and the judgement stays with whoever signs, the condition is met.
It is not met when the machine decides. Advice delivered without being read back, a filing built on unverified citations, an answer forwarded to the client because it looked sensible: those are the cases where the intellectual work is not predominant, and it makes no difference that nobody noticed.
How that works in practice is in the piece about human review, together with the Court of Florence order of 14 March 2025, which decided a real case on the same principle.
The duty to inform, which has no prescribed form
The statute does not say how to inform. The timing, the medium and the words are left to the professional: the retainer, the quote, a separate notice. So are the consequences of not doing it, which are not a penalty written into the statute but a problem that surfaces later, in disciplinary terms and in any dispute about professional liability.
What to write in it, with a draft to adapt, is in its own piece.
What else is in it, and why that is worth knowing
The other five chapters do not concern the firm’s daily work, and they do concern its clients. In healthcare the statute governs the use of AI to support diagnosis and treatment, with periodic validation of the algorithms. On employment it covers the use of these systems in managing the employment relationship. There are provisions on public administration and on the justice system, and a part on copyright.
And there is a new criminal offence covering generated or altered content. Article 612-quater of the Italian criminal codeopens in a new tab, “unlawful distribution of content generated or altered with artificial intelligence systems”, in force from the same 10 October 2025, punishes with one to five years’ imprisonment anyone who causes unjust harm to a person by transferring, publishing or otherwise distributing, without their consent, images, video or voices faked or altered with artificial intelligence and capable of deceiving as to their genuineness. Prosecution is on complaint, except where the victim lacks capacity or the act is committed against a public authority because of their functions.
Two elements are worth keeping in mind, because the offence is narrower than it is usually described: it requires unjust harm, so distribution alone is not enough, and the saving clause gives way to more serious offences where they apply. This is the part of the statute that reaches a firm through a different door: not as a question about which tool to use, but as a matter brought by someone who has been credited with something they never said.
Three regimes over one gesture, and the one that bites
Read three pieces on these subjects and you end up with three names in your head: AI Actopens in a new tab, GDPRopens in a new tab, Law 132. And with the feeling of having to comply three times over. They hold together better if you look at what each of them actually asks when a lawyer pastes a document into an assistant.
The AI Act looks at the system and at whoever puts it on the market: for a firm, which is simply a deployer, what is left is staff literacy and not much else. Law 132/2025 looks at the relationship with the client: the tool supports, and the client has to know. The GDPR looks at the document: who receives it, on what legal basis, for how long, under what agreement and under what instrument if it leaves the Union.
Lined up like that it is obvious which of the three bites hardest, and it is not the one people talk about most. The first two are satisfied by one well-written page, once. The third asks for a decision about how to work, and it asks it of every document. The AI Act from the deployer’s side and the GDPR in front of a model each have their own piece.
The part that is not written yet
Articles 16 and 24 delegate powers to the Government: one or more legislative decrees to be adopted by 10 October 2026, on data and algorithms for training, aligning national law with the AI Act, the powers of the authorities, penalties, training, and civil and criminal liability.
Which means the framework is not closed, and that the enforcement side, usually the part that decides how much a rule weighs, arrives later. Anyone reading this a year from now should check which of those delegations became a decree: the structure of the statute will hold, the numbers will not.
What this statute does not touch
Law 132/2025 is not a data protection statute, and it does not amend the GDPR. A client document sent to a supplier is still processing of personal data with everything that follows: legal basis, privacy notice, processor appointment, any transfer outside the Union.
Put another way: telling the client you use artificial intelligence does not authorise you to send their documents out. They are two different obligations answering two different questions, and anyone treating them as one has usually answered the easier one.
The other half of the picture, the European regulation, is in the piece about the AI Act.