Italy assigns its artificial intelligence enforcement roles and what compliance teams need to do next

Italy's formal assignment of enforcement roles for the European Union Artificial Intelligence Act means that local market surveillance is now a reality rather than a distant date on a calendar.

What happened

Governments across Europe are designating the national authorities responsible for policing artificial intelligence systems. Italy's decree gives specific regulatory bodies the legal mandate to inspect systems, demand technical documentation, and issue penalties for non-compliance. For companies operating in Italy, this transforms the European Union Artificial Intelligence Act from a set of abstract principles into an active enforcement regime with real inspectors and real budgets.

The governance gap

Many businesses treat artificial intelligence governance as a documentation exercise to be finished right before a deadline. When enforcement authorities are given powers to inspect, they do not ask for a polished policy document. They ask for the underlying evidence, the testing logs, the risk assessments, and the proof that human oversight is actually happening in daily operations. The governance failure here is treating compliance as a static legal project rather than an operational process that can be audited at any moment.

We saw a similar breakdown in the Netherlands in 2021, when an automated fraud-risk system wrongly accused thousands of families and forced the cabinet to resign because the agency could not produce a clear audit trail of how the decisions were made. More recently, cases like Clearview AI showed that scraping data without a lawful basis brings heavy regulatory penalties across multiple jurisdictions. Regulators do not care that an algorithm is complex. They care whether you can explain how it works and prove it stays within legal bounds.

The rules that apply now

Different parts of the European artificial intelligence rulebook take effect at different times. The transparency rules for synthetic content have been in force since August 2026, and companies must ensure machine-readable markings are present on systems already on the market by December 2026. High-risk rules follow in late 2027 and 2028 under the updated timeline set by the Digital Omnibus regulation.

However, national enforcement bodies are already establishing their oversight priorities. If you deploy a system that falls under high-risk categories such as biometric identification, critical infrastructure, or employment tools, you must already have fundamental rights impact assessments and human oversight mechanisms in place under articles 27 and 14 of the European Union Artificial Intelligence Act.

Key risk indicators to track

To know if your organization is ready for an inspection by national authorities, you should track a few practical metrics. First, check your percentage of systems with current applicability mapping to know exactly which category each artificial intelligence tool falls under. Second, track your days of buffer to each statutory deadline rather than assuming you have months left. Third, measure your time to produce a complete evidence pack on request. If it takes your team three weeks to gather the documentation for a single model, your governance process is too slow.

What to do

• Map every artificial intelligence system currently used or built in-house against the specific categories and timelines of the European Union Artificial Intelligence Act.
• Assign clear internal ownership for each system so that engineering, legal, and risk teams know who answers when an inspector calls.
• Build a centralized evidence repository that stores testing results, risk assessments, and human oversight logs in a format that can be exported quickly.
• Run a mock audit to test how long it takes your organization to assemble a complete compliance file for your highest-risk model.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.