Italy: what the Garante and Law 132/2025 mean for employers using AI

Few European regulators have been as active on generative AI as the Garante per la protezione dei dati personali. In March 2023, the Italian data protection authority imposed a temporary limitation on ChatGPT's processing of Italian users' data, a first for a service of that size. Less than a month later, the service was back in Italy after OpenAI introduced corrective measures.

Italy has since gone further. In 2025 it became the first EU country to adopt a comprehensive national law on artificial intelligence, Law No. 132 of 23 September 2025. For Italian employers, the message is clear: AI at work must be transparent, governed and documented.

2023: the temporary limitation of ChatGPT

On 30 March 2023, the Garante ordered OpenAI to temporarily stop processing the data of people in Italy. The concerns were specific: poor information for users, no legal basis for the mass collection of data used to train the models, and no age verification. A few days earlier, an incident had exposed some subscribers' chat histories and payment details.

OpenAI then published clearer information, gave people a way to object to the use of their data and added an age check. The service was restored at the end of April 2023. The episode taught companies one lesson: an AI tool their staff use every day can be suspended overnight by a regulator.

December 2024: a 15 million euro fine for OpenAI

The investigation ended on 20 December 2024. The Garante fined OpenAI 15 million euros. The decision found, among other things:

• processing of personal data to train ChatGPT without a legal basis identified beforehand;

• breaches of transparency obligations towards users;

• failure to notify the data breach of March 2023;

• age verification mechanisms too weak to protect minors.

The Garante also required a six-month information campaign in Italian media, on radio, television and in newspapers, explaining how ChatGPT uses data. This was not a one-off: at the end of January 2025 the authority ordered a processing limitation against DeepSeek, and in May 2025 it fined the company behind the Replika chatbot 5 million euros.

Law 132/2025: a national framework for AI

Published in the Official Gazette on 25 September 2025 and in force since 10 October 2025, Law 132/2025 complements the EU AI Act without replacing it. It names two national AI authorities, the Agenzia per l'Italia Digitale (AgID) and the Agenzia per la Cybersicurezza Nazionale (ACN), while the Garante remains in charge of everything involving personal data. It also creates criminal offences linked to AI-generated deepfakes.

For companies, the chapter on work is the most practical. Employers must inform workers when they use AI systems, AI must improve working conditions and respect people's dignity, and an observatory on the adoption of AI in the world of work is set up at the Ministry of Labour.

What this means for Italian employers

Italian labour law already strictly regulates employee monitoring, notably through Article 4 of the Workers' Statute on remote controls. Law 132/2025 adds a transparency requirement specific to AI. Three situations deserve close attention:

1. AI used by the employer to recruit, assess or organise work: employees must be informed.

2. AI used by employees themselves, often without approval: contracts, payslips, customer files or health data end up in public chatbots.

3. Monitoring tools set up to govern these uses: they must stay proportionate and respect the rules on remote controls.

The second case is the most common and the least visible. An AI data leak almost always starts with an ordinary copy and paste.

Lessons from the Garante's decisions

The OpenAI decisions target a provider, but they say a lot about what the authority expects from any organisation processing data with AI: a legal basis identified before processing, clear information for individuals, prompt breach notification, and appropriate technical measures as required by Article 32 of the GDPR, covered in our compliance checklist.

Training staff is still necessary, but it is not enough. We explained why in our article on why AI security training falls short. Under deadline pressure, even a well trained employee pastes a codice fiscale or an IBAN into a prompt.

Protecting data without banning AI

ZeusLock works on the device and in the browser, before the data leaves. It recognises Italian identifiers such as the codice fiscale, the partita IVA and IBANs, as well as health data and HR information. It can replace them with realistic placeholders through format preserving anonymization, warn the user or block the upload. Every incident is logged, which provides useful evidence for the Garante and a concrete basis for the information owed to employees.

Key takeaways

• The Garante limited ChatGPT in 2023, then fined OpenAI 15 million euros in December 2024.

• Law 132/2025, in force since 10 October 2025, requires employers to inform workers about their use of AI.

• AgID and ACN are the national AI authorities, while the Garante remains competent for personal data.

• The most common risk comes from employee prompts, not from big projects.

Want to govern AI use in your company in Italy, with evidence to back it up? Book a ZeusLock demo.