Detect Deepfakesby Resemble AI
Deepfake law · Italy

Deepfake Law in Italy

Italy regulates deepfakes through the EU AI Act, its 2025 national AI law, Garante enforcement, and existing privacy, identity-misappropriation, CSAM, and defamation law.

Status
enacted
Jurisdiction
Italy
Effective
Oct 2025
Statute
EU AI Act + Legge 132/2025 + Codice Penale arts. 494, 595, 600-ter
AI Act transparencyIdentity misappropriationDefamationPrivacy violations
Updated Jul 7, 2026 · 2 min read

Italy regulates deepfakes through the EU AI Act, Legge 132/2025 on artificial intelligence, and existing provisions of the Penal Code, with active enforcement by the Garante (data protection authority). The 2025 AI law creates a national AI governance layer, while deepfake-specific liability still usually turns on privacy, identity, defamation, CSAM, or fraud facts.

Key provisions

EU AI Act. Directly applicable; Article 50 deepfake transparency obligations apply from August 2, 2026. AGCOM and the Garante share supervisory responsibilities depending on context.

Legge 132/2025 — national AI law. Italy's national AI law adds domestic governance principles and enforcement architecture for AI, supplementing the EU AI Act rather than replacing Penal Code analysis for specific deepfake harms.

Penal Code Article 494 — Substitution of persona. Criminalizes impersonation for gain or injury. Applied to deepfake-enabled fraud and impersonation cases. Penalties up to one year.

Penal Code Article 595 — Defamation. Covers deepfakes attributing false statements or actions to real persons. Aggravated forms (via press, repeated) carry up to six years.

Penal Code Article 600-ter (child sexual abuse material). Explicitly includes AI-generated CSAM; penalties up to twelve years.

Italian GDPR implementation (Dlgs. 196/2003). Garante enforces against unauthorized use of biometric or personal data in synthetic media.

Garante enforcement

The Garante has been among the most active European DPAs on AI:

  • 2023 temporary ban on ChatGPT for data-protection concerns (lifted after OpenAI compliance changes).
  • Ongoing guidance on generative-AI use and personal data.
  • Active investigations into deepfake services operating in or accessible from Italy.

Practical implications

For organizations operating in Italy:

  • AI service providers: Garante scrutiny on data-processing practices is intense. Compliance review before launch in Italy is essential.
  • Platforms: cooperation with Garante takedown requests is expected.
  • Enterprises: combined AI Act + GDPR + Penal Code exposure.

Italy is often described as a "watchful" rather than "aggressive" enforcer — significant regulatory action but fewer criminal prosecutions than Germany or Spain.

Sources