Under the AI Act in Italy, the competent authority depends on your specific request, your role, and, if applicable, your industry. A request for jurisdiction, a complaint about an AI system, and a company incident report are distinct procedures. For data protection issues, the responsibilities and obligations of the General Data Protection Regulation (GDPR) also apply.
Legal status and classification: This article explains how to prepare a request or notification. The current Italian filing procedures and the national division of responsibilities are not definitively verified here. Therefore, this article does not replace official guidance from the authorities or a legal review of a specific case.
As the founder of Berger+Team in Bolzano, I combine over 20 years of experience in digital and branding. When working with SMEs, it's important to me that responsibilities are clear and practical for everyday business. In cases of unusual AI-related processes, the protection of affected individuals and transparent documentation are my top priorities.
AI Act in Italy: Differentiating jurisdiction and reporting procedures
For the AI Act in Italy, you need to distinguish between three levels:
- Legal basis and applicability: Which regulation applies to the process, and does the relevant obligation already apply at the relevant time? Regulation (EU) 2024/1689 Article 113 contains staggered application provisions.
- Responsibility: Which authority is responsible for the system, the industry, and the specific task?
- Submission procedure: Which transmission method is officially prescribed for your request and your role?
An official address is not automatically an official reporting channel. A general email address, certified email address (PEC address), or contact page does not necessarily prove that a specific formal report can be effectively submitted through it.
AgID, ACN and Garante: checking different tasks
The following institutions and areas of responsibility must be distinguished in relation to the EU AI Regulation in Italy. The linked websites serve for official information purposes only and are not confirmed submission channels:
- AgID – Agenzia per l'Italia Digitale: The applicable national responsibilities are decisive for the allocation of a request. notifying authority is specifically responsible for procedures for the evaluation, designation and monitoring of conformity assessment bodies – not automatically for every complaint about AI.
- ACN – Agency for National Cybersecurity: Check the published responsibilities for the specific system. Market Surveillance Authority monitors compliance with relevant requirements; sectoral responsibilities may influence the allocation.
- Guarantor for the protection of personal data: The Italian data protection authority is relevant for data protection issues. Personal complaints and company reports of data breaches have different requirements and procedures.
When contacting a company regarding the AI Act in Italy, do not choose the recipient solely based on the keyword "AI". Especially with regulated products or activities, a specific regulatory authority may be responsible.
Your role: provider, operator, or affected person?
The following descriptions will help with initial classification. The specific system, its deployment, and its actual use remain crucial:
- Providers: You develop an AI system, or have one developed, and then market or put the system into operation under your own name or brand. A paid provision of the system is not strictly necessary for this.
- Betreiber: Your company uses an AI system under its own responsibility. Purely personal, non-professional use does not fall under this operator definition.
- Affected person: An AI-supported process affects you, for example, during a job application. For a data protection complaint, it is crucial whether the processing of your personal data is affected.
Under the AI Act in Italy, your role is not solely determined by who pays for the software. Changes to its intended use, significant system modifications, or distributing it under your own name can alter its legal classification.
Therefore, document who provides the system, who uses the system, and who experiences its effects. This allocation of responsibility is part of AI governance.
AI Act in Italy: prepare five issues separately
The following steps will help you to assess your situation. Mandatory information, deadlines, and permissible methods of submission will depend on the applicable procedure.
1. You look for the responsible authority.
Describe the system, its purpose, the industry, and your role in a few sentences. Then, ask a specific question regarding the responsible contact person, using an officially published contact number.
Please specify the appropriate procedure and the intended recipient. Do not automatically treat a general inquiry as a formal complaint or a notification to meet a deadline.
2. You suspect a violation of the AI Act
Article 85 provides for the right of appeal to the competent market surveillance authority if natural or legal persons have reason to believe that an infringement has occurred. You must check whether this provision is already applicable at the time of your request by consulting the implementing regulations.
To file a complaint regarding the AI Act in Italy, it is best to document:
- System name and responsible company, if known;
- Date and specific observed sequence of events;
- possible effects and selected evidence.
Separate observations from assumptions. "The software issued this decision" is a more helpful statement of fact than the unsubstantiated assertion "The AI is illegal".
3. A potentially serious incident has occurred.
A serious incident is a legally defined event, not every erroneous AI output. In the case of a high-risk AI system , the impact, the potential connection to the system, and the company's role must be examined, among other things.
Under the AI Act in Italy, the information obligations of operators and the reporting obligations of providers are not the same. In the event of potential serious damage, immediately organize a professional assessment and ensure, in particular:
- Time of discovery, sequence of events and system version;
- known effects and potential affected persons;
- Protective measures and previous communication.
In the case of a potentially time-sensitive incident, do not wait for a full investigation before seeking professional support.
4. You wish to complain about the processing of your data.
A data protection complaint concerns the processing of your personal data. According to Article 77 of the GDPR, you can, in particular, contact the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement.
Describe the processing, the company involved, and your complaint. Include any previous correspondence. For submissions to the Italian Data Protection Authority (Garante), its procedural information applies. Any parallel claim under the AI Act in Italy will be assessed separately.
5. Your company suspects a data breach.
A breach of personal data protection can occur, for example, through unauthorized disclosure, unauthorized access, or data loss. Immediately involve the responsible internal personnel and, if applicable, your data protection officer.
According to Article 33 of the GDPR, the controller must report a notifiable data breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it . This reporting requirement does not apply if the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Data breaches must be documented regardless of whether a report is filed with the supervisory authority.
As a data processor, you must inform the data controller without undue delay. These data protection roles are not synonymous with "provider" and "operator." In cases of anticipated high risk, notification of data subjects may also be required in accordance with Article 34 of the GDPR.
Three illustrative cases from South Tyrolean SMEs
The following examples are fictitious. They illustrate how to differentiate between questions concerning the AI Act in Italy and data protection and quality issues; however, these brief descriptions do not constitute a definitive legal assessment.
Confidential data in an AI assistant
An employee uploads names and meeting notes to an unauthorized AI assistant. Stop further uploads, report the incident internally, and clarify data flow, access rights, and storage and deletion options.
Secure evidence is protected without unnecessarily duplicating confidential content. Whether a reportable data breach has occurred depends on the specific circumstances. Our article on the approval of AI tools from a data protection perspective explains preventative measures.
AI-supported applicant selection
Software pre-screens applications; several rejections appear unjustified. Have conspicuous decisions reviewed by a human and document the system's actual influence on the selection process.
Examine potential disadvantages and the high-risk classification based on the intended use and legal criteria. Product advertising alone is not a reliable basis for classification.
Misleading answers from a website chatbot
Your chatbot is displaying incorrect cancellation policies. Save the relevant response, correct the knowledge base, and deactivate the problematic response area if necessary. Also, check whether affected customers need to be notified.
A single incorrect answer does not automatically constitute a reportable serious incident. Clear answer limits and handovers to human personnel help prevent this.
What documents should you prepare?
For matters concerning the AI Act in Italy, organized documentation facilitates the expert review. The following information is intended as a preparatory aid, not as a universally applicable official list of requirements.
System and responsibility
- Contact: Who will answer follow-up questions?
- Role: What is the function of your company?
- System: Product name, version, vendor and participating service providers.
- Usage: What task does the system perform?
Event and reaction
- Schedule: Appearance, discovery, and initial reaction.
- Effects: Known facts, assumptions, and open questions are separated.
- Activities: For example, access is restricted or the process is stopped.
- Proof: Relevant protocols, screen recordings and correspondence.
An audit trail facilitates reconstruction. Keep original evidence securely stored. For initial inquiries, use data-minimizing extracts instead of complete personnel files, access data, or extensive chat histories.
Frequently asked questions about the AI Act in Italy
Is there a separate contact point for South Tyrol?
Having a company headquarters in South Tyrol does not automatically mean there is a dedicated contact point for AI Act matters in Italy. The decisive factors are subject-matter and geographical jurisdiction, as well as the specific procedure. A dedicated filing office in South Tyrol is not confirmed here.
Is AgID or ACN responsible?
For the AI Act in Italy, the specific task is crucial: A question regarding conformity assessment is not the same as a complaint about a system in use. Align the system, role, industry, and concern with the officially published responsibilities.
Can I, as an affected person, file a complaint?
The GDPR provides for a right to lodge a complaint regarding the processing of your personal data. Article 85 of the AI Regulation also provides for a right to lodge a complaint; however, the temporal applicability and the responsible market surveillance procedure must be examined separately.
Do I need to report this as a mere tool user?
The mere fact of using the service does not automatically create a reporting obligation. Your legal role, the system itself, and the process are crucial. Internal communication, communication with the provider, and reporting to the authorities are distinct steps.
Can multiple reporting channels be relevant simultaneously?
Yes. A single action can involve the AI Act in Italy, as well as data protection law or sectoral regulations. A notification to an authority does not automatically fulfill all information and reporting obligations.
What do I do if I can't find a specific form?
Please contact an official information office to confirm the intended procedure. Document your request and, if deadlines apply, seek qualified legal advice concurrently. Not being able to find the form does not invalidate statutory deadlines.
Are German language submissions possible?
The permissible language for the proceedings depends on the responsible authority and the procedure. Before submitting a lengthy document, confirm whether German is accepted and whether translations are required.
AI Act in Italy: next steps for your business
For the organizational preparation for the AI regulation in Italy, I recommend five steps:
- Capturing AI usage: Note the system, purpose, data and responsible person.
- Name a contact person: Determine who will receive tips and organize the audit.
- Save notes: Document objectively, comprehensibly and with minimal data usage.
- Assign procedure: Compare the legal basis, role, industry, and submission method.
- Consult legal counsel: Especially in cases involving potential damage, personal data, and time-sensitive obligations.
At Berger+Team, we support you organizationally and technically: with inventory management, clear processes, and comprehensible system documentation. As a collective of freelancers in Bolzano, we work with direct client contact. Legal advice and the binding assessment of reporting obligations, however, should be handled by qualified legal professionals.
