AI decrees pass final review: automated dismissal is void, CV screening is not
7 min read
At a company that ends an employment relationship with the help of an artificial intelligence system, the question changes: no longer “did the software flag it in time?”, but “who looked at this specific case before it was signed off?”. On 4 August 2026 Italy’s Council of Ministers approved, in final review, two legislative decrees adapting national law to Regulation (EU) 2024/1689 — the AI Act — “in implementation of the delegation under Article 24 of Law no. 132 of 23 September 2025”. The first rewrites policing, civil and criminal liability. The second — the one that concerns an HR director, a CISO, an operations director — rewrites the powers of the authorities and the use of AI in training, professions, employment, healthcare and public administration. Three points in this second decree touch a company as early as tomorrow morning.
Void, not voidable
The official statement puts it without qualification: “decisions concerning the establishment, modification or termination of the employment relationship, including disciplinary measures and dismissals, may not be adopted solely on the basis of automated processing, with the dismissal issued in breach of that ban being void”. Void, not voidable. That is the difference between an act that must be challenged within a deadline, with the burden on the worker, and an act the court declares never to have existed in law, which can be raised by the court of its own motion, with no time limit for doing so. In Italian employment law it is the heaviest sanction available: heavier than ordinary reinstatement, because it leaves no room for a cure. If a system flagged, proposed or ranked a disciplinary risk score — and nobody reviewed that specific case before signing — the dismissal is not merely weak: it is void from the outset.
But CV screening is not a “final decision”
Here the statement introduces a clarification worth reading without either outrage or dismissal. Among the amendments made after the opinions were received, it states: “it has been clarified that the search and selection of candidatures does not fall among the final decisions relating to the establishment of the employment relationship, even where this results in the candidate not being admitted to the following stages of selection”. In other words: the automated filter that screens out hundreds of CVs before a recruiter ever reads a line remains outside the ban on nullity — even when that rejection is, for the candidate, the only act they ever receive. It is the point tomorrow’s headlines will probably miss, and it is the one a company hiring with the help of a system needs to note first. The statement does not say that filter is free of rules: it says only that it does not trigger the nullity reserved for final decisions. Article 22 of the GDPR, on decisions based solely on automated processing, and the AI Act’s obligations for high-risk systems used in personnel selection — Annex III, point 4 — remain applicable in their own right: the statement does not invoke them, and it is not the source from which to infer how they interact with this carve-out. That check has to wait for the text itself.
Who will be checking
The decree also draws the oversight map. The statement puts it this way: the set-up is “centred on the Agency for Digital Italy [AgID] as notifying authority and on the National Cybersecurity Agency [ACN] as market surveillance authority, with supervisory functions held by the Bank of Italy, Consob and IVASS over high-risk systems linked to the provision of financial services, and powers held by the Garante for the protection of personal data over systems used in law-enforcement activities, border management, justice and democracy”. In practice: AgID and ACN form the backbone, the Bank of Italy, Consob and IVASS supervise high-risk financial systems, and the Garante presides over justice, public order, migration and democratic processes. On penalties the statement is equally precise: “the penalty framework is graduated and proportionate, with maximum limits lower than those set by the European regulation and the possibility of non-monetary measures for infringements of low severity” — a softening relative to the EU regulation’s ceilings, not a removal of the risk.
The first decree: a new criminal offence, a reversed civil burden
More briefly, since we already covered it from the video-surveillance angle in Monday’s piece, the first decree inserts Article 437-bis into the Criminal Code, which “punishes the failure to adopt security measures in high-risk artificial intelligence systems and their unlawful alteration”. On the civil side it “strengthens protection for the injured party through access to the system’s technical documentation, a presumption of causal link, an alternative forum close to the injured party’s residence, and a direct action against the insurer”. The presumption of causal link deserves a line of its own: it is not a procedural footnote, it is a reversal of the burden of proof. Whoever built or deployed the high-risk system starts, in litigation, from a weaker position than today — they must dismantle the presumption, rather than wait for the injured party to build it. It is the same principle, applied to AI, that the defective-products liability directive extends to software from 9 December 2026.
One technical detail not to miss: the decree “has also been updated to reflect the amendments made to the AI regulation by Regulation (EU) 2026/1744, with a reference that makes the entry into force of the penalties conditional on the actual entry into force of the corresponding obligations and prohibitions”. The penalties, in other words, do not start running ahead of the obligations they are meant to punish.
The text is not yet published: verified today
This is a press statement, not the legislative text. As of today, the two decrees do not appear to have been published in the Gazzetta Ufficiale (Italy’s Official Journal). Before writing that, we ran a control test: a search for “Law no. 132 of 23 September 2025” — an act that must necessarily appear, having already been in force since 10 October 2025 — correctly returns the reference to Gazzetta Ufficiale no. 223 of 25 September 2025, confirming that the search tools work. Targeted searches on the two 4 August decrees, by contrast, return only press releases and law-firm commentary on a “draft” that was approved: no Gazzetta Ufficiale number, no definitive publication date. That is the distinction we hold ourselves to: not “the text does not exist”, but “the text is not yet verifiable from a primary source”. When it arrives, at least four points will need checking: exactly where the line falls between “assistance” and “solely on the basis of automated processing”; the real scope of the carve-out on candidate selection, and how it interacts with Article 22 GDPR; the actual penalty ceilings, figure by figure; and the precise date from which the penalties take effect, in light of the reference to Regulation (EU) 2026/1744.
How we solve this
For a company, the ban is not met with an internal policy: it is met with a record. Every decision touching an employment relationship — a disciplinary flag, a demotion, a dismissal — needs to leave a written trace of whether there was human involvement, who carried it out, when, and on what basis: with the presumption of causal link and access to technical documentation introduced by the first decree, that trace is the difference between defending yourself and simply absorbing the outcome in court. It is a control we build to run on the client’s own HR systems, not an opinion that ends once the press statement has been read. The same architecture, extended beyond that single check, brings the organisation’s scattered data — HR systems, system logs, documents, sensors — into a single operating model on which AI agents execute decisions with a human operator in command: for large enterprises, defence, public administration and healthcare, always in two delivery modes available together — on-premises, on self-contained machines that do not require deep integration into the client’s network, or CSIDIA’s dedicated cloud, with a data centre in Italy — and always with shared management: whoever does not already have someone in-house administering AI systems does not need to acquire one.
Could you show, for the last decision that touched an employment relationship at your company, who reviewed it before it was signed off? Half an hour with one of our experts is enough for a first check of your HR processes.