NEWS-D: Italy’s drug early-warning regulation arrives 462 days late

A forensic toxicology laboratory identifies a substance never seen before in a seizure, or measures an out-of-range concentration in a sample. From that moment the finding stops being an internal fact of the bench: if it meets the qualitative or the quantitative criterion of Article 6, it has to enter a circuit that DPCM 7 July 2026, no. 156 sets out in twenty-eight articles, carrying the sample through at least six different hands before it comes back as an alert.

The regulation — Official Gazette, General Series no. 204 of 3 September 2026, in force from 18 September — does not establish the system it organises. The National Early Warning System for Drugs, NEWS-D, has existed since 1 January 2025, under Article 14-bis of the consolidated act on narcotics, inserted by the 2025 budget law (Law no. 207/2024). The same paragraph 6 gave ninety days from that date to adopt the decree defining the System’s tasks and organisation: deadline 1 April 2025. The DPCM is dated 7 July 2026, 462 days later — over fifteen months in which no regulation said how a sample should move from one body to another. Part of that time left a trace in the text: the preamble records the Italian data protection authority’s opinion of 12 March 2026 and two Council of State opinions, from its advisory section for legislative acts, of 27 January and 26 May 2026.

A threshold the laboratory cannot calculate on its own

Article 6 sets out two criteria for declaring a non-biological sample anomalous. The qualitative criterion is triggered, among other things, by substances «sequestrate con frequenza atipica rispetto a una specifica zona geografica o mai sequestrate a livello nazionale o unionale» (seized with an atypical frequency for a given area, or never seized nationally or across the EU, paragraph 3, letter d). To know that, a laboratory would already need to know the picture of seizures across Italy and the EU: a dataset no laboratory, however well equipped, holds in its own archive.

The quantitative criterion is even more explicit: it is triggered when the concentration of a substance already listed in the consolidated act’s schedules exceeds the averages «riportate nella più recente relazione al Parlamento sui dati relativi allo stato delle tossicodipendenze in Italia» (reported in the most recent report to Parliament on drug addiction in Italy, paragraph 4). The laboratory measures the concentration; the threshold sits in an annual document sent to Parliament, not in its own laboratory information system.

Timing and data fields also change with the criterion: reporting is immediate for the qualitative one, monthly and aggregated for the quantitative one (art. 7). And the form under Article 8 asks, for a non-biological sample, for the province of the seizure; for a biological one, for the region of the intoxication or death. The same event, read by a different body, changes geographic grain.

From the IT device to three hands, in parallel

Once the form is filled in, the report reaches NEWS-D’s dedicated IT device. From there, the process under Article 9 immediately branches into three fronts that do not share the same archive: the ISS for bio-toxicological aspects, the designated poison control centres for clinical-toxicological aspects, and the DCSA. Only after joint analysis by the three first-level centres does an output document take shape, subject to the Department’s approval. And the outbound path is not uniform: to the collaborating centres the document goes in any case, while it reaches the National Health Service and other specific recipients only «sulla base di una valutazione dell’urgenza e del grado di pericolosità» — on the basis of an assessment of urgency and degree of danger; to police offices and laboratories, Article 9 requires that it pass through the DCSA. In parallel, a fourth channel: Article 13 has the national focal point of the Reitox network ensure, through NEWS-D, the link with two separate European systems — the early warning system on new psychoactive substances and the European drug alert system, under Articles 8 and 13 of Regulation (EU) 2023/1322 — and with other member states’ national alert systems. Four recipients, four access logics, a single originating event.

When the sample itself has to travel

Sometimes data is not enough. Where laboratories cannot run confirmatory analysis, Article 9, paragraph 1, letter b), lets the ISS and the poison centres ask the DCSA to acquire further samples of the reported substance from the same seizure. Transmitting a data point is not enough: the physical exhibit itself has to move, because sufficient analytical capacity does not sit where the sample sits.

And even with the instrumentation, a laboratory can lack the term of comparison. Article 15 puts the centralised acquisition of analytical standards for new psychoactive substances, and their distribution to participating laboratories, on the ISS — but within the limits of the resources under Article 28, the clause that forbids any new cost. Without that standard, itself concentrated in a single body, a peripheral laboratory has nothing to compare its freshly recorded mass spectrum against.

A boundary crossed only with a permit

Not every handover is purely technical. When data destined for NEWS-D comes from a seizure under Article 73 or from investigative activity, Article 19, paragraph 2, requires police offices to obtain the judicial authority’s clearance, where deemed necessary, before reporting the data to NEWS-D. Between the investigative archive and the health archive of the alert system, a technical protocol is not enough: sometimes an act of the judicial authority is required.

Who owns the data, in the end

Ownership too splits in two. Article 24 assigns the data in a report to the collaborating centre that made it; but the data held in the IT device, destined for output documents, also becomes the Department’s. A shared ownership, not a transfer: the reporting body does not lose the data, but no longer controls it alone once it has been used to build an alert. All of it, under Article 25, must travel in anonymised form, in accordance with Regulation (EU) 2016/679.

The interim manager

Not even the system’s nerve centre is settled. Article 11 lets the Department identify a public body to manage NEWS-D; that procedure has not been completed. Article 23 provides for this: pending that choice, the Department relies on the ISS, which in the meantime manages the IT device and coordinates the entire alert process. The regulation that finally organises the system enters into force while whoever actually runs it remains a provisional appointment.

What we could not verify

We found no named list of laboratories already participating in NEWS-D, nor do we know how many poison centres have already been designated first-level centres under the act required by Article 16. We did not verify the status of the procedure for identifying the definitive manager under Article 11, nor whether the Data Protection Authority’s opinion of 12 March 2026, cited in the recitals, raised conditions that were not carried into the final text.

See the service · Talk to an engineer

The two axes, applied to NEWS-D

Complying. The question “has the laboratory reported?” becomes, in our system, a check run per anomalous sample: which criterion triggered the threshold, which body validated it, whether the output document was approved by the Department and dispatched through the right channel — to the National Health Service where the urgency assessment warrants it, through the DCSA for the police forces. Not a form filled in once, but a map that holds together six different archives on the same event.

Deciding. The same system brings the reporting form, the outcome of confirmatory analysis, the standards distributed by the ISS and the approval status together into a single operating model, on which AI agents execute decisions with a human operator in command. Always on-premises, on autonomous machines that need no deep integration into the client’s network, or on dedicated cloud, with a dedicated VPN and a data centre in Italy. It is the method behind our platform.

Could you reconstruct today, for a single anomalous sample, which criterion triggered it, who validated it, and through which channel the resulting alert was dispatched? Half an hour with one of our engineers is enough for the first map.