Italy Law No. 132/2025 on Artificial Intelligence (Legge 23 settembre 2025, n. 132) — vendor disclosure form

1. Vendor identification

2. AI system identification

3. Provision-specific questions

1. Deepfakes / Synthetic Content. Does the offered system generate or substantially modify audio / video / image / text in ways requiring disclosure or machine-readable provenance under Italy Law No. 132/2025 on Artificial Intelligence (Legge 23 settembre 2025, n. 132) (Art. 26(1)(c) inserts new Criminal Code Art. 612-quater: illicit dissemination of AI-generated or altered images/video/voices, without consent, apt to deceive and causing unjust harm — 1 to 5 years' imprisonment (querela-based; ex officio in aggravated cases).)? Describe the disclosure + provenance mechanisms implemented and their robustness against removal.

   (Cite: Art. 26(1)(c) inserts new Criminal Code Art. 612-quater: illicit dissemination of AI-generated or altered images/video/voices, without consent, apt to deceive and causing unjust harm — 1 to 5 years' imprisonment (querela-based; ex officio in aggravated cases).)

2. AI in Employment. Will the offered system be used in employment-decision contexts within scope of Italy Law No. 132/2025 on Artificial Intelligence (Legge 23 settembre 2025, n. 132) (Art. 11 — workplace AI must be safe, reliable, transparent, non-discriminatory and not contrary to human dignity; employer must inform the worker of AI use (per Art. 1-bis D.Lgs. 152/1997). Art. 12 establishes a national Observatory on workplace AI.)? If yes, identify the specific employment decisions (hiring / monitoring / termination / promotion) and the assessment evidence you will provide.

   (Cite: Art. 11 — workplace AI must be safe, reliable, transparent, non-discriminatory and not contrary to human dignity; employer must inform the worker of AI use (per Art. 1-bis D.Lgs. 152/1997). Art. 12 establishes a national Observatory on workplace AI.)

3. AI in Healthcare. Will the offered system be used in clinical decision-support, diagnostic, or medical-device contexts within scope of Italy Law No. 132/2025 on Artificial Intelligence (Legge 23 settembre 2025, n. 132) (Art. 7 — AI must not condition access to healthcare on discriminatory criteria (¶2); patient right to be informed of AI use (¶3); the therapeutic decision is always reserved to the physician (¶5). Arts. 8–10 add research, data-processing and electronic-health-record provisions.)? Identify regulatory clearances (e.g., MDR / FDA / MHRA) held and any open conformity-assessment items.

   (Cite: Art. 7 — AI must not condition access to healthcare on discriminatory criteria (¶2); patient right to be informed of AI use (¶3); the therapeutic decision is always reserved to the physician (¶5). Arts. 8–10 add research, data-processing and electronic-health-record provisions.)

4. AI in Criminal Justice. Will the offered system be used in law-enforcement, predictive-policing, risk-assessment, or sentencing-support contexts within scope of Italy Law No. 132/2025 on Artificial Intelligence (Legge 23 settembre 2025, n. 132) (Art. 15 — in judicial use of AI, decisions on legal interpretation/application, evaluation of facts and evidence, and adoption of measures are always reserved to the magistrate; AI limited to organisational/administrative support. Art. 24(2)(h) delegates a future regime for AI in policing.)? Provide jurisdictional authorisation evidence + impact-assessment outputs.

   (Cite: Art. 15 — in judicial use of AI, decisions on legal interpretation/application, evaluation of facts and evidence, and adoption of measures are always reserved to the magistrate; AI limited to organisational/administrative support. Art. 24(2)(h) delegates a future regime for AI in policing.)

5. Transparency Obligations. Provide the documentation required under the transparency obligations of Italy Law No. 132/2025 on Artificial Intelligence (Legge 23 settembre 2025, n. 132) (Multiple operative disclosure duties: Art. 4(3) clear-language information on AI data processing + right to object; Art. 7(3) patient information; Art. 11(2) worker notification; Art. 13(2) professional's duty to disclose AI use to the client.) — including (as applicable) model card, system card, training-data summary, evaluation results, and known limitations.

   (Cite: Multiple operative disclosure duties: Art. 4(3) clear-language information on AI data processing + right to object; Art. 7(3) patient information; Art. 11(2) worker notification; Art. 13(2) professional's duty to disclose AI use to the client.)

6. Training-Data Rights. Identify the legal basis for training-data sourcing for the offered system (including copyright, consent, and any text-and-data-mining exemptions relied upon) and confirm consistency with Italy Law No. 132/2025 on Artificial Intelligence (Legge 23 settembre 2025, n. 132) (Art. 25 (new Art. 70-septies l. 633/1941) permits text-and-data-mining reproductions/extractions for AI training from lawfully accessible material (per Arts. 70-ter/70-quater); Art. 16 delegates the Government to enact an organic regime on data, algorithms and mathematical methods for training AI.).

   (Cite: Art. 25 (new Art. 70-septies l. 633/1941) permits text-and-data-mining reproductions/extractions for AI training from lawfully accessible material (per Arts. 70-ter/70-quater); Art. 16 delegates the Government to enact an organic regime on data, algorithms and mathematical methods for training AI.)

7. Technological Sovereignty. Describe the offered system's compliance posture relative to the Italy Law No. 132/2025 on Artificial Intelligence (Legge 23 settembre 2025, n. 132) provisions identified at: Art. 5 — the State must promote AI to raise national competitiveness and the 'technological sovereignty of the Nation' (¶1(a)) and may steer public e-procurement to favour solutions localising strategic data and disaster-recovery/business-continuity in national data centres (¶1(d))..

   (Cite: Art. 5 — the State must promote AI to raise national competitiveness and the 'technological sovereignty of the Nation' (¶1(a)) and may steer public e-procurement to favour solutions localising strategic data and disaster-recovery/business-continuity in national data centres (¶1(d)).)

8. National Security Carveouts in AI Regulation. Identify whether any component of the offered system or its use case falls within the national-security carveouts of Italy Law No. 132/2025 on Artificial Intelligence (Legge 23 settembre 2025, n. 132) (Art. 6 — activities for national-security purposes by the intelligence services, ACN cybersecurity/resilience, national-defence by the Armed Forces, and certain national-security policing are excluded from the law's scope (subject to fundamental-rights respect; further rules by regulation under l. 124/2007 art. 43).) and the resulting compliance posture.

   (Cite: Art. 6 — activities for national-security purposes by the intelligence services, ACN cybersecurity/resilience, national-defence by the Armed Forces, and certain national-security policing are excluded from the law's scope (subject to fundamental-rights respect; further rules by regulation under l. 124/2007 art. 43).)

4. Documentation enclosures expected

Tick each enclosure attached to the vendor response. Missing enclosures should be explained in the “Variances” field below.

• Safety / capability evaluation results
• Copies of submitted regulatory reports / registrations
• Training-data summary / provenance log
• End-user redress + complaint-channel procedure
• Transparency documentation (per-instrument schema)
• Content provenance + watermarking technical description
• Vendor company registration + insurance certificates
• Sub-processor / supply-chain list (including model upstream)

5. Vendor attestation

The undersigned, on behalf of the vendor, attests that the disclosures above are true and complete to the best of their knowledge at the date signed, and undertakes to notify the buyer in writing within 30 days of any material change to those disclosures.