By Giacomo Lusardi and Alessandra Faranda

Last April 23, the Italian Council of Ministers passed a bill (AI Bill) aimed at introducing some national Artificial Intelligence (AI) provisions. The main scope is to establish regulatory criteria for balancing the opportunities offered by new technologies with the risks associated with improper and harmful use, supplementing and specifying the European Regulation on Artificial Intelligence (AI Act), approved last March. As a next step, the AI Bill will be subject to discussion and approval by the Chamber of Deputies and the Senate of the Republic.

The AI Bill consists of five parts:

• Principles and purposes
• Sector provisions
• National strategy, national authorities, and promotion actions
• Provisions on users’ protection and copyright
• Criminal law provisions

The principles underlying the AI Bill and the protection of minors

The bill is based on respecting fundamental rights and individual freedoms throughout the AI systems lifecycle and several general principles. Among them are transparency, freedom of information, explainability and knowability, human control (so-called “human-in-the-loop” approach) and human decision-making power, prevention of harm, proportionality, security, protection of personal data, non-discrimination, gender equality, and sustainability, in line with the AI Act. The approach guiding the legislator is anthropocentric, so that technological systems are at the service of human activity and do not replace its essential value in every possible use.

According to the bill, the use of AI should not affect democratic life and its institutions. It emphasizes the importance of cybersecurity throughout the development process and the use of AI systems. The bill also pays special attention to promoting AI in many productive sectors, launching and supporting new economic activities and increasing national competitiveness while respecting competition.

Minors may give consent to access AI systems independently from the age of fourteen, while under that age, they need the authorization of those having parental responsibility.  

Vertical approach and sectoral provisions: Health, labor and intellectual professions

The bill includes some provisions for using AI in specific economic sectors to supplement the AI Act’s more general and horizontal provisions. 

One of these sectors is health. In particular, the bill highlights the importance of an ethical and inclusive use of AI in healthcare. It prohibits discriminatory use of AI systems in access to healthcare services and establishes the obligation of transparent information to patients on their use. Furthermore, the bill clarifies that AI systems aim to support prevention, diagnosis, treatment, and therapeutic choice, leaving healthcare professionals responsible for decisions. 

The introduction of simplifications for experimentation of AI systems in healthcare is a controversial topic among experts. The bill identifies as “public interest” the processing of personal and non-personal data by public and private non-profit entities for research and scientific experimentation in the implementation of AI systems for purposes of prevention, diagnosis and disease treatment, development of drugs, therapies, rehabilitative technologies, and implementation of medical devices (as prostheses and interfaces between the body and instruments supporting the patient’s condition, public health, personal safety, security) insofar as necessary for the implementation and use of databases and basic models. On this point, the bill refers to Article 32 of the Italian Constitution about health protection and Article 9(2)(g) GDPR, thus identifying the relevant legal basis on which the processing of personal data is to be based. It also provides that ‘the secondary use of personal data without direct identifiers’ by public and private non-profit entities is authorized, even where they fall within special categories of data (e.g., health data). For this purpose, a general data protection notice published on the data controller’s website is deemed sufficient, and no further consent to the processing needs to be sought. The processing of personal data must be approved by the relevant ethics committees and notified to the Italian Data Protection Authority, who may block it within 30 days of notification. 

Moreover, the bill introduces provisions concerning the electronic health record (fascicolo sanitario elettronico) and digital health management. Specifically, it envisages the creation of an AI platform managed by the National Agency for Regional Health Services (AGENAS), dedicated to supporting health professionals and users.

Under the bill, the Government is proposing a regulatory framework that not only encourages the use of AI to improve working conditions and increase efficiency and productivity, but also prioritizes the protection of workers’ physical and psychological well-being. This includes respecting their rights as outlined in national and European legislation, as well as the creation of the Observatory on the Adoption of Artificial Intelligence Systems in the Workplace (Osservatorio sull’adozione dei sistemi di intelligenza artificiale nel mondo del lavoro). This observatory will monitor the impact of AI on the labor market, identify the most affected sectors, and promote ongoing training of workers and employers in this area. Importantly, the bill also imposes an obligation on employers to transparently inform workers about the use of AI systems. 

The bill provides that AI is only permitted for the performance of ancillary and support activities related to the main activity in intellectual professions. In addition, professionals must clearly and comprehensively inform their clients about using AI systems. 

Public administrations should use AI to improve the efficiency of services offered to citizens and enterprises, in line with the Italian Strategy for Artificial Intelligence 2024-2026. AI should remain a support tool, while decision-making power and action should remain with people. 

In the judicial environment, the bill states that AI can only be used to simplify the work of judicial offices and support jurisprudential and doctrinal research. Again, humans remain at the center: the final decision on interpretative and judicial issues must always, and in any case, remain a judge’s prerogative. 

National strategy, investments and authorities for Artificial Intelligence: The Italian approach

The Italian AI strategy promotes collaboration between public administration and private entities in developing and adopting AI systems and research and knowledge dissemination in this field. It coordinates administrative activities and guides measures and incentives for entrepreneurial and industrial growth. The strategy’s elaboration and updating are entrusted to the Council’s presidency through the Department for Digital Transformation. 

On the investment side, the bill allocates up to EUR 1 billion for equity investments in innovative SMEs having operational headquarters in Italy and operating in the fields of AI, cybersecurity, quantum computing, telecommunications, Web3, and other technologies, as well as in other companies that could become national champions in these areas. 

As for the national AI authorities, according to the AI Act, the bill identifies them as the Agency for Digital Italy (Agenzia per l’Italia Digitale – AgID) and the National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale – ACN). Specifically, AgID will promote AI innovation and development, defining and exercising functions in the evaluation and monitoring of systems. At the same time, ACN will be responsible for system supervision and, inspection and sanction activities. Both authorities will have to coordinate and cooperate with other public administrations and independent authorities: for this purpose, a Coordination Committee will be created at the Prime Minister’s Office.

Therefore, the Italian approach is different from that adopted by other countries: no specific AI authority has been envisaged (as, for instance, the Agencia Española de Supervisión de la Inteligencia Artificial – AESIA), and the choice has fallen on two already existing governmental authorities (AgID and ACN), that are not independent authorities. In this regard, the Italian Data Protection Authority had asked the Government to act as an AI authority because of the close interrelation between AI and data protection and the expertise already acquired in automated decision-making.

The identification of AI-generated content and the copyright issue

The bill provides for the introduction of provisions concerning the identification of textual, photographic, audiovisual, and radio content generated or altered by AI systems. Providers of audiovisual and radio broadcasting services may generate or alter content by using AI tools and present as actual data facts and information that are not real, provided that they have obtained the consent of the relevant right holders and they identify the content by inserting identification elements or signs that are visible and recognizable by users with the acronym ‘AI.’ The identification must be present at the beginning and end of broadcasts and content, and it is not required for creative, satirical, artistic, or fictitious content unless it is detrimental to the rights and freedoms of third parties. In addition, the Italian Communication Authority (AGCOM) will have to promote forms of co-regulation and self-regulation using a code of conduct with both audiovisual and radio media service providers and video-sharing platform providers.

Moreover, it is essential to note one of the most contentious aspects of the bill: the modification of certain articles of the Italian Copyright Law (Law No. 633/1941 et seq. mm.), starting with Article 1 on protectable works (italics added – unofficial translation): “Protected are […] works of human authorship of a creative character belonging to literature, music, figurative arts, architecture, theatre and cinematography, whatever the mode or form of expression, even where created with the aid of artificial intelligence tools, provided that the human contribution is creative, relevant and demonstrable”. The proposal does not rule out the possibility of copyright protection for works generated with the aid of AI tools, but it does seem to raise the standard for protection. In addition to the usual requirement of originality for intellectual works and its demonstrability, it introduces the criterion of the ‘relevance’ of the human contribution compared to that of the machine. Each case must be assessed on an individual basis, which could have significant implications for AI-generated works.

Finally, the bill also specifies that the reproduction and extraction of works or other material through AI models and systems, including generative AI, is subject to the text and data mining (TDM) exception in Articles 70-ter and 70-quarter of the Italian Copyright Law. 

The tightening of punishments in the case of offenses committed with the aid of AI

As for criminal law, the bill provides for a series of measures to punish crimes committed using AI systems more severely. First, it introduces a specific aggravating circumstance for the use of AI systems: the pubishment is increased when AI is used insidiously, hinders public or private defense, or contributes to aggravating the consequences of a crime. In addition, the bill states that the unlawful dissemination of content generated or manipulated by AI to mislead as to its genuineness (as in the case of so-called deepfake) is punishable by imprisonment from six months to three years and from one to five years if it causes unjust damage. Exceptional aggravating circumstances are then introduced to punish cases in which AI can propagate the offense.