Regulations and deadlines
Updated August 2026. The rules we meet every day in our line of work, each with the date that actually matters next to it.
⚠️ A preface worth more than the table. In this sector regulatory deadlines get used as a sales lever, often by citing rules that have lapsed or by stretching what they cover. This page exists for the opposite reason: to let you know what actually applies to you and when, so you can plan instead of chasing. Where a rule does not oblige you to buy anything, we say so.
These are Italian and European rules. They apply to operations in Italy; if you operate elsewhere in the EU, the European instruments apply to you directly and the national transpositions will be your own.
Deadlines in order of time
Every rule in the table links to the official text: Normattiva for Italian legislation, EUR-Lex for European. The dates are those of the text in force, not those of a sales deadline.
The standing obligations
AI Act, Article 4 — AI literacy. Anyone who provides or deploys AI systems must take measures to support AI literacy among the people who operate them on their behalf. It already applies and it does not depend on the risk level of the system. Regulation (EU) 2026/1744 rewrote the article: it does not require guaranteeing a set level, but the measures should be documented and calibrated to roles.
Consolidated Law on Local Authorities, Article 230(7) — asset inventory. Italian local authorities must update their asset inventory at least once a year. It concerns some eight thousand municipalities and as many schools, and it is one of the most neglected duties precisely because until now it has been done by hand.
Workers' Statute, Article 4 (Law No. 300/1970). Equipment from which remote monitoring of workers' activity may result requires a union agreement or an authorisation from the labour inspectorate, and may be installed only for organisational, production, safety or asset-protection needs. It applies to access control systems too, and it has to be dealt with before installation, not after.
GDPR — Regulation (EU) 2016/679. Every processing operation connected to cards, attendance and video surveillance needs a legal basis, a privacy notice, defined retention periods and — where the risk is high — an impact assessment.
What is no longer current
For completeness, because these are still in circulation:
- Deadlines tied to the health emergency and its access protocols no longer have effect.
- References to the original "Transizione 4.0" plan have been superseded by later measures: today the useful reference is Italian Law 199/2025.
- Several commercial materials in this sector still cite Machinery Directive 2006/42/EC as being in force. From 20 January 2027 the reference is Regulation (EU) 2023/1230.
This page is reviewed every three months. If you find an inaccuracy, tell us: we correct it and let you know.