Italy sets out AI adoption guidelines for its public administrations

Italy sets out AI adoption guidelines for its public administrations

10 November 2026: AgID, Italy's digital agency, has issued guidelines that require public bodies to classify their AI systems by the AI Act's risk levels and to run adoption through an ISO/IEC 42001 management cycle, under Determination 169. Vendors selling AI software to Italian public bodies should expect those two frameworks to appear in tender questions.

Not yet independently verified. AgID's page states the determination and the content but no effective date or compliance deadline, and we have not read the full guideline text. We will update this when a date is stated. We will update this when it can be confirmed, and remove this note.

Risk classes first

The starting duty is classification. Each administration has to sort the AI systems it uses according to the risk levels in the European AI Act and apply transparency, human oversight and accountability to high-risk ones. A supplier can expect to be asked for the documentation that lets a public body meet that duty.

The text is issued under Article 71 of the Digital Administration Code, the route Italy uses for technical rules binding on public bodies, and it was foreseen in the 2024 to 2026 Three-Year IT Plan for public administration.

A management system, not a one-off check

AgID models adoption on the Plan-Do-Check-Act cycle and ISO/IEC 42001, the management system standard for AI, with self-assessment tools for bodies to measure where they stand. Data gets its own treatment, with accuracy, consistency, completeness and timeliness listed as quality measures. Cybersecurity is framed around attacks specific to AI: evasion, data poisoning, privacy attacks and abuse.

Beyond the technical controls, the guidelines call for an ethical code of conduct, investment in digital skills and specialist profiles within the Offices for Digital Transition that each public body runs. Procurement teams in those offices are likely to become the first audience for a vendor's compliance pack.

Drafted with the bodies that will buy

The text came out of the concertation table set up under the IT plan. Those at the table include the national cybersecurity agency ACN, the anti-corruption authority ANAC, the municipalities' association ANCI, the Conference of Regions, the central purchasing body Consip, INPS, INAIL, ISTAT, the finance ministry MEF, the enterprise ministry MIMIT, PagoPA and the provinces' union UPI.

The presence of Consip matters to anyone on a framework contract, since it is the body that writes many of the national agreements through which administrations buy IT. A supplier that can already show ISO/IEC 42001 alignment, an AI Act risk classification for each product and evidence of testing against poisoning and evasion will be answering the questions these guidelines put to its customers.

Italian public bodies have not been given a deadline on AgID's page, so the timetable is the open point.

Sources

• AgID: AgID publishes the guidelines for AI adoption in public administration, 9 November 2026