Executive Summary

This article reads the two employment provisions of Italy's Legislative Decree 179/2026, which took effect on October 23, not as a legal summary but as a record-keeping problem. The decree carries the European AI Act into Italian law, and its Article 41 states that decisions on entering into, managing and terminating employment relationships cannot be based solely on automated processes. The final decision belongs to a natural person who exercises effective and autonomous power, and a worker's consent does not release the employer from that duty.

What follows is the part worth sitting with. A worker may ask for an explanation covering whether and to what extent AI influenced the decision-making process, the main factors and parameters considered, and the contribution of human intervention to the decision. All three questions ask about the state of things at the moment the decision was made. They cannot be answered by composing a statement afterwards; they can only be answered if there is a record of what went into the model and what the person changed. A dismissal that breaches these principles is null and void.

Sections 1 through 4 follow the text as published in the Official Gazette and as explained by the law firms and the advisory practice that have analyzed it. Section 5, which reads the explanation right as a question about data retention design, is this article's own interpretation and is not in the statute.

Key Figures

These are the dates and the costs the law has already fixed.

Sources: Law & Technology, Official Gazette analysis · TechTimes, scope of Article 42

October 23

The day the employment provisions began to apply

No transition period. A tool escapes nothing by leaving the word 'AI' off its label

Null and void

The effect of a dismissal that breaches Article 41

A worker's consent does not make a decision taken solely by automated means lawful

€3,557–€9,113

The fine for not holding a proper risk assessment file

Arrest of up to six months can follow, and the National Labour Inspectorate enforces this under powers it already has

December 2, 2027

The day EU AI Act duties for high-risk employment systems apply

Pushed back from August 2, 2026 by the Digital Omnibus. Italy closed that open stretch with its own provisions first

1

What Closed on October 23

The Italian government adopted Legislative Decree 179/2026 on October 7. It appeared in Official Gazette No. 234 on October 8 and entered into force fifteen days later, on October 23. Because its job is to fit the European Union's AI Act (Regulation 2024/1689) into the national legal order, most of its articles deal with supervisory bodies, penalties and regulatory sandboxes. The Agency for Digital Italy handles the notification of conformity assessment bodies, and the National Cybersecurity Agency becomes the market surveillance authority and single point of contact.

Palazzo Chigi, Rome, where Italy's Council of Ministers meets — the site where Legislative Decree 179/2026 was adopted
▲ Palazzo Chigi, Rome — where the Council of Ministers adopted Legislative Decree 179/2026 | Source: Wikimedia Commons (CC BY 4.0, DellaGherardesca)

Two of its articles deal with employment. Article 41 is titled "Protection of workers in decision-making processes assisted by artificial intelligence systems," and Article 42 is titled "Artificial intelligence, health and safety in the workplace." Those two are what this article reads.

The line Article 41 draws fits in one sentence. Final decisions on entering into, managing and terminating an employment relationship cannot be taken solely on the basis of automated processing. Hiring, contract changes, discipline, performance assessment and dismissal all sit inside that scope. The article does not ban the use of AI in human resources work; it bans leaving the last box of the decision empty.

The person who fills that box has conditions attached. The text reserves the final decision to a natural person who exercises effective and autonomous power. PwC Italia renders this as a requirement that the person independently assess the algorithm's output rather than simply adopt it. A name in the approval field does not by itself meet the condition.

A worker's consent does not release the employer from this duty. A clause in the onboarding paperwork saying the employee agrees to automated assessment carries no weight under Article 41. That is a different structure from data protection law, where consent can serve as a lawful basis for processing.

2

The Three Things a Worker Can Ask For

Article 41 does not stop at the prohibition. It hands the worker a right to ask. A worker may request an intelligible explanation of a decision concerning them, and the text itself breaks that explanation into three parts.

  • Whether and to what extent AI influenced the decision-making process
  • The main factors and parameters that were considered
  • What human intervention contributed to the decision

The three items call for different kinds of information. The first asks whether the system was involved and how heavily. The second asks about the inside of the system. The third asks about the person. Answering one of them does not answer the other two.

All Three Have to Arrive Together Missing one leaves no material for the "not solely automated" claim ① Whether AI Influenced It Did it shape the decision, and to what extent ② Factors & Parameters What went into the system Which criteria were used ③ Human Intervention What the person changed What they left alone All three together The basis for "not solely automated" Missing even one leaves the defense empty too
▲ The three explanation elements Article 41 requires — diagrammed by Pebblous from the statute

The cost of getting this wrong is written in as well. A dismissal, and any other decision, adopted in breach of these principles is null and void. This is not a fine attached to a procedural lapse; it erases the effect of the decision itself, so the exposure a company carries is less the money than the prospect of having to undo what it did.

One distinction has to be kept straight. What the statute voids is a decision taken in breach of Article 41's principles, not the bare fact that no explanation was produced. In practice, though, the two travel together. A company that cannot show which factors and parameters were used also has nothing to build an argument from that the decision was not based solely on automated processing. That is where a gap in the explanation becomes a gap in the defense.

A guard against automated decisions is not new here. Article 22(1) of the General Data Protection Regulation (Regulation 2016/679) already gave people the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects. What Article 41 adds on top is the itemized explanation and the nullity. Because the statute now spells out what has to be explained down to factors and parameters, whether an organization can answer turns on what it was keeping all along.

3

By the Time a Person Chooses, the Pool Has Already Shrunk

Article 41 carries one more sentence that narrows its reach. Activities of searching for and selecting applications do not count as final decisions on entering into an employment relationship. The text adds that this holds even where such selection keeps an application from moving to the next stage. Screening and ranking CVs automatically remains permitted under Article 41.

The legal analysis outlet Law & Technology puts the consequence plainly: once a decision reaches a person, the system has already narrowed the candidate pool. If automated ranking worked against women applicants, the recruiter picking from the names at the top is working on a set that has already changed. The European Commission's draft guidelines classify automated job matching and ranking tools as high risk on two grounds. Even though recruiters may override the recommendations, the system's rankings and scores serve as a primary input for decision-making, and the system could lead to low ranking or exclusion of candidates of a certain gender or of candidates with disabilities.

Where Article 41 Draws Its Line Pre-selection is not a final decision, even when it blocks the next stage All applications Automated ranking and filtering Article 41 does not reach Reduced pool Those dropped here have no one to ask for an explanation Article 41 The human final decision A natural person with effective, autonomous power The explanation right starts here If the filtered set has already shifted, the human judgment that follows works on the shifted set
▲ The line Article 41 draws between automated pre-selection and the human final decision, diagrammed by Pebblous from the statute and the Law & Technology analysis

The weight of that gap shows up once a discrimination claim is brought. Article 40 of Italy's Equal Opportunities Code (Legislative Decree 198/2006) shifts the burden onto the employer to prove that no discrimination occurred, once facts that make discrimination plausible are presented, including facts inferred from statistical data on recruitment. Read on its own, that is a provision in the worker's favor. But an applicant who was dropped at the pre-selection stage does not hold that statistical data, and often does not even know an algorithm was used.

Being outside Article 41 does not mean being outside the law. Article 27(1) of the same Equal Opportunities Code prohibits discrimination in access to employment, expressly including selection criteria and conditions of recruitment, and paragraph 2(b) prohibits it even where it is carried out indirectly through pre-selection mechanisms. What the pre-selection stage falls outside of is Article 41's explanation right, not the provisions you would sue under for discrimination that happened there. A prohibition is one thing, though, and a duty to go looking for bias is another. No provision compels bias testing of pre-selection systems until the EU AI Act's high-risk duties apply on December 2, 2027. Until then, a discrimination claim comes down to who holds the distribution from the day the screening ran.

Every precaution the same analysis recommends to employers is about records. Measure and document the gender distribution of the output at every stage that filters or ranks candidates. Secure contractual access to vendor information on training data and bias testing. Place meaningful human intervention ahead of the point where exclusion happens, rather than at the final shortlist. These records serve as defense material in a discrimination claim and, at the same time, as preparation for the high-risk system duties that the EU AI Act brings from December 2, 2027.

4

Work Pace and Task Routing Go Into the Safety File

Article 42 aims at how work is done rather than at personnel decisions. AI systems that affect work organization, production pace, the way tasks are carried out, or other aspects bearing on health and safety must be assessed within the risk assessment required by Legislative Decree 81/2008. The risk assessment document, the DVR that Italian companies already maintain, is where that happens. Workers must be given information and training on the specific risks the system creates.

What decides whether the article applies is a functional criterion rather than the name the vendor chose. A scheduling platform, a workflow automation tool, an algorithmic task-routing engine and a production monitoring system all fall inside it. A system qualifies even when the vendor does not describe the product as artificial intelligence. The article applies from October 23, with no transition period.

Three things have to go into the file: the specific risks the AI system poses, the prevention and protection measures in place, and the training and information program provided to affected workers. Employers and managers who fail to draw up or properly maintain the risk assessment document face fines of roughly €3,557 to €9,113, with arrest of up to six months also possible. Enforcement sits with the National Labour Inspectorate under the powers it already holds.

Set Articles 41 and 42 side by side and their subjects turn out to differ. Article 41 deals with a decision made about one person; Article 42 deals with the working conditions of many. Some tools, such as a task-routing engine, are caught by both. The moment who gets which work, and how much of it, becomes the basis for an assessment or a disciplinary measure, the same system is also being asked for an explanation on the Article 41 side.

Article 41 and Article 42 Protect Different Things Some tools, like a task-routing engine, are caught by both Article 41 One Person's Decision Hiring, Discipline, Dismissal Performance Review Article 42 Many People's Conditions Work Organization, Pace Occupational Safety Task-Routing Engine Ranking feeds both review and discipline Article 41 looks at one person; Article 42 looks at the conditions of many — the two lines overlap
▲ Where Article 41 (individual decisions) and Article 42 (working conditions) apply — diagrammed by Pebblous from the statute
5

Why Pebblous Is Watching This Law

Italian labor law is not a field Pebblous works in. But because Article 41 writes the content of the explanation all the way down to factors and parameters, this provision has become a document the data team needs to read before the legal team does. Every explanation it demands points back to a moment that has already passed. The question is not how the system works now, but what was in place on the day that decision was made.

A written explanation can be produced at any time. What cannot be produced later is the state of things at that moment. Put the statute's three items into the language of records and what is needed becomes clear.

What the statute asks to be explained What has to survive from that moment
Whether and to what extent AI influenced the decision Which system was called for that case, and in what form its output reached the person handling it
The main factors and parameters considered The input values fed to the model at that point, the as-of date of that input, and which version of the model and the criteria was applied
What human intervention contributed What the person changed after seeing the output and what they left alone, and the reasoning they recorded for it

The left column is the wording of Article 41; the right column is this article's own reading of that wording as a set of record-keeping requirements.

Look at the right column and it becomes clear how little this has to do with model performance. Accurate model or not, if the inputs, the versions and the human edits from that day a year ago are gone, there is exactly as much to say either way: nothing. The party actually carrying the risk of a nullity finding is not the model but the retention design.

If you are running a personnel or performance system, four things are worth checking now.

  • Does it keep a snapshot of the input data as of the moment the decision was made? If all you keep is a reference pointing at the source table, the values from that day cannot be recovered once the table is refreshed
  • Is the as-of date of that input recorded alongside it? The same metric computed at a different point is a different number
  • Are the points of human intervention and the changes made there written to a log? The fact that someone clicked approve does not answer the third item
  • Is the distribution of outcomes measured periodically at each stage that filters or ranks candidates? This record cannot be created after a discrimination claim has been filed

What should set the retention period is not operational convenience but when the question arrives. A lawsuit over a dismissal starts long after the decision was made. A retention policy shorter than that interval leaves the question unanswerable, however sincerely the organization meant to comply.

Thank you for reading this far. The descriptions of the provisions in this article were checked against legal analyses and an advisory firm's report on the text as published in the Official Gazette, and the fine amounts and the scope of Article 42 each carry their own source. We tried hard not to write that the statute says something it does not. If you run a personnel or performance system, we would like to hear at what granularity, and for how long, you keep the records of its decisions.

Pebblous Data Communication Team
October 25, 2026

R

References

Legislation

  • 1.Repubblica Italiana. (2026). Decreto Legislativo 7 ottobre 2026, n. 179. Gazzetta Ufficiale n. 234, published October 8, 2026, in force October 23. Article 41 "Protection of workers in decision-making processes assisted by artificial intelligence systems"; Article 42 "Artificial intelligence, health and safety in the workplace."
  • 2.Repubblica Italiana. (2006). Decreto Legislativo 11 aprile 2006, n. 198 — Codice delle pari opportunità, Article 27 (prohibition of discrimination in access to employment, including indirect discrimination through pre-selection mechanisms) and Article 40 (shift of the burden of proof).
  • 3.Repubblica Italiana. (2008). Decreto Legislativo 9 aprile 2008, n. 81 — consolidated act on workplace health and safety. The basis for the duty to maintain a risk assessment document (DVR).
  • 4.European Union. (2016). Regulation (EU) 2016/679 — General Data Protection Regulation, Article 22(1) (the right not to be subject to a decision based solely on automated processing).

Law Firm and Advisory Analysis

Press Coverage