In our previous articles in this series, we discussed the Executive Summary of the Italian Strategy on AI for 2024–2026 and the Italian draft law on artificial intelligence.

Under the draft law, the Agency for Digital Italy (Agenzia per l'Italia Digitale, AgID) and the National Cybersecurity Agency (Agenzia per la cybersicurezza nazionale, ACN) are appointed as national authorities for AI, in accordance with article 70 of the AI Act and they will be entrusted with adequate powers and responsibilities to ensure the proper implementation of national and European legislation on AI.

In particular, art. 8 of the draft law—while recognizing their responsibility in fostering AI development—entrusts these bodies with the following powers:

1. The AgID with the powers of setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring, it being understood that conformity assessment bodies are, under the AI Act, those certifying AI systems classified as “high risk;”
2. The ACN with monitoring and enforcement powers, with the view of ensuring the safeguarding of national cybersecurity.

The (not yet final) choice to appoint these governmental agencies has already prompted the Italian Data Protection Authority (Garante per la protezione dei dati personali, Garante) to issue a letter to the Italian Parliament reiterating the importance of having only one AI authority, which should be fully independent.

This letter was sent on 24 March 2024, shortly after the secretary for innovation publicly declared the government’s intention to designate both the AgID and ACN as national authorities for AI, and even before the leak of the text of the draft law on artificial intelligence. It reiterates the official position of the Garante, which has consistently emphasized (e.g. with its position paper of 9 March 2022 addressed to the Italian Chamber of Deputies) the need to have a single supervisory authority in charge of both AI and data protection matters.

The Garante’s position is also aligned with the Joint Opinion 5/2021, previously issued by the European Data Protection Board and European Data Protection Supervisor, which stressed the importance of independent AI authorities and suggested that the data protection authorities would be the better choice as the national authorities under the AI Act. This recommendation arose from the interconnected nature of AI and data protection legislation: According to the Joint Opinion, by leveraging their expertise in enforcing existing laws on AI systems, data protection authorities can ensure a cohesive application of the AI Act and data protection laws.

Accordingly, the Garante noted that it “already possesses the requirements of competence and, at the same time, independence necessary to ensure implementation of the Act consistent with the objective of guaranteeing a high level of protection of fundamental rights in the use of AI,” as also required by article 70 of the AI Act. In fact, the Garante has a significant experience in dealing with innovation, including AI systems and their impact on fundamental rights, even prior to the issuance of the AI Act (see here).

The Garante further noted that:

• Article 74.8 of the AI Act already requires national data protection authorities to be appointed as market surveillance authorities.
• With respect to biometric identification in the context of law enforcement activities, article 5.3 of the AI Act stipulates that this is subject to prior authorization granted by a judicial authority or an independent administrative authority, which are required to verify compliance with, among other things, the constraints imposed by data protection regulations.
• Supervision by national data protection authorities over algorithmic processes that use personal data should in any case be guaranteed.

Considering the above, in the Garante’s view the involvement of data protection authorities is unavoidable, and thus it should be the sole competent authority for AI in order to avoid governance fragmentation and ensure a harmonized regulatory approach.

As the draft law works its way through the legislative process, the debate around the designation of the Italian national AI authority remains open. The ultimate decision will lie with the Italian Parliament, which will soon have its final say.

Monitoring developments in the draft law on AI will therefore important as it will end up being one of the point of reference also for the internal AI governance structure of all the operators involved in the AI systems lifecycle.

This article is updated as of 7 May 2024.