Updated August 2026. The rules we meet every day in our line of work, each with the date that actually matters next to it.
⚠️ A preface worth more than the table. In this sector regulatory deadlines get used as a sales lever, often by citing rules that have lapsed or by stretching what they cover. This page exists for the opposite reason: to let you know what actually applies to you and when, so you can plan instead of chasing. Where a rule does not oblige you to buy anything, we say so.
These are Italian and European rules. They apply to operations in Italy; if you operate elsewhere in the EU, the European instruments apply to you directly and the national transpositions will be your own.
Deadlines in order of time
| When | Rule | What changes | It applies to you if |
|---|---|---|---|
| already in force | Italian Law 198/2025, Article 3 — digital construction site card | The identification card must carry an electronically readable unique code and be interoperable with SIISL, the national information system for social and labour inclusion. Penalty of € 100–500 per worker | You work on construction sites. ⚠️ The general extension is waiting on a ministerial decree |
| already in force | Italian Legislative Decree 96/2026 — pay transparency | Pay transparency obligations. Published in the Official Gazette on 1 June 2026, in force from 7 June 2026 | You have employees |
| already in force | Italian Legislative Decree 134/2024 — critical entities (CER) | 17 July 2026 was the deadline for adopting the list of critical entities. The decree has not been published: those who fall within it learn so from their sector authority, not from a list they can consult | You are in a critical sector: energy, transport, water, healthcare |
| already in force since 2 August 2026 | AI Act — Regulation (EU) 2024/1689, general application and Article 50 | The Regulation applies in general, including the Article 50 transparency obligations where the conditions for them are met: direct interaction between a person and an AI system, synthetic or manipulated content, emotion recognition, biometric categorisation, deepfakes. ⚠️ It does not cover every use of AI indiscriminately: the obligations depend on your role and your scenario | You provide or deploy AI systems that interact with people, or that generate or manipulate content |
| 11 September 2026 | Cyber Resilience Act — Regulation (EU) 2024/2847 | The obligations to report actively exploited vulnerabilities and severe incidents start to apply. The remaining obligations follow on 11 December 2027 | You place products with digital elements on the market |
| 31 October 2026 | NIS2 — Directive (EU) 2022/2555, transposed by Italian Legislative Decree 138/2024 | Deadline for implementing the basic measures, among them physical access control, in the itemised list of ACN determination 379907/2025 | You are an essential or important entity |
| 20 January 2027 | Machinery Regulation — Regulation (EU) 2023/1230 | Repeals and replaces the Machinery Directive (Directive 2006/42/EC), with limited transitional provisions. Introduces cybersecurity requirements for components relevant to safety | You buy or place on the market motorised gates, turnstiles or barriers |
| 2 December 2027 | AI Act — Regulation (EU) 2024/1689, Annex III | The obligations for high-risk systems start to apply, among them systems used for workforce management. (Deferred by Regulation (EU) 2026/1744.) | You use AI systems for decisions on recruitment, task allocation, evaluation or termination |
| 2 August 2028 | AI Act — Regulation (EU) 2024/1689, Article 6(1) and Annex I | The obligations start to apply for high-risk systems that are safety components of products covered by Union harmonisation legislation. (Deferred by Regulation (EU) 2026/1744, like the Annex III date.) | You place on the market products that embed AI systems as safety components |
| 30 September 2028 | Italian Law 199/2025 + MIMIT decree of 7/5/2026 — enhanced depreciation | Banded uplift on interconnected capital goods: 180% up to 2.5 million euros, 100% on the part between 2.5 and 10 million, 50% between 10 and 20 million. The window has been open since 1 January 2026 | You are planning an investment in plant and equipment |
Every rule in the table links to the official text: Normattiva for Italian legislation, EUR-Lex for European. The dates are those of the text in force, not those of a sales deadline.
The standing obligations
AI Act, Article 4 — AI literacy. Anyone who provides or deploys AI systems must take measures to support AI literacy among the people who operate them on their behalf. It already applies and it does not depend on the risk level of the system. Regulation (EU) 2026/1744 rewrote the article: it does not require guaranteeing a set level, but the measures should be documented and calibrated to roles.
Consolidated Law on Local Authorities, Article 230(7) — asset inventory. Italian local authorities must update their asset inventory at least once a year. It concerns some eight thousand municipalities and as many schools, and it is one of the most neglected duties precisely because until now it has been done by hand.
Workers’ Statute, Article 4 (Law No. 300/1970). Equipment from which remote monitoring of workers’ activity may result requires a union agreement or an authorisation from the labour inspectorate, and may be installed only for organisational, production, safety or asset-protection needs. It applies to access control systems too, and it has to be dealt with before installation, not after.
GDPR — Regulation (EU) 2016/679. Every processing operation connected to cards, attendance and video surveillance needs a legal basis, a privacy notice, defined retention periods and — where the risk is high — an impact assessment.
What is no longer current
For completeness, because these are still in circulation:
- Deadlines tied to the health emergency and its access protocols no longer have effect.
- References to the original “Transizione 4.0” plan have been superseded by later measures: today the useful reference is Italian Law 199/2025.
- Several commercial materials in this sector still cite Machinery Directive 2006/42/EC as being in force. From 20 January 2027 the reference is Regulation (EU) 2023/1230.
This page is reviewed every three months. If you find an inaccuracy, tell us: we correct it and let you know.