AI on staff: an Italian rule already requires you to explain how it works

A typical scenario, not the case of a real company. An HR department adopts an AI tool that ranks applications, fills shifts and flags productivity deviations. The question in the room is always the same: when does the AI Act bite? Correct and useless answer — for Annex III high risk, which covers personnel selection, on 2 December 2027, after the postponement by Regulation (EU) 2026/1744. Uncomfortable answer: for four years an Italian rule has required you to put in writing how that system works.

The rule, with the references

The transparency decree — Legislative Decree 104 of 27 June 2022, in force since 13 August 2022 — through article 4(1)(b) inserted into Legislative Decree 152 of 26 May 1997 an article 1-bis: “Further information duties where automated decision-making or monitoring systems are used”. It is not a rule about AI: it is a rule about the employment contract. No size threshold, no risk classification.

The 2023 amendment almost everybody gets wrong

Anyone quoting article 1-bis in its 2022 wording is quoting a superseded rule. The labour decree — Decree-Law 48 of 4 May 2023, converted by Law 85 of 3 July 2023 — through article 26(2)(a) replaced paragraph 1 with effect from 5 May 2023. Today the employer or principal “is required to inform the worker of the use of fully automated decision-making or monitoring systems intended to provide indications relevant to hiring or the award of the engagement, the management or termination of the employment relationship, the assignment of tasks or duties, as well as indications affecting the supervision, evaluation, performance and fulfilment of workers’ contractual obligations”. In 2022 the word “fully” was not there. Letter b) rewrote paragraph 8: the exclusion, previously limited to “the information referred to in article 98” of the Industrial Property Code, now covers “systems protected by industrial and commercial secrecy”.

Two cautions, because the text says no more than it says: “fully automated” is not defined, and article 1(1)(s) — which pulls article 1-bis into the hiring notice — still carries the wording without the adverb. The asymmetry sits in the consolidated text. Concluding that any human step switches the duty off is a legal assessment, to be written and dated like every compliance decision. And paragraph 8 excludes “the information duties under this article”, not those under the GDPR: “it is a secret” is no label a supplier applies, since article 98 of the Industrial Property Code protects only under three cumulative conditions you must prove.

The list, which is the heart of the rule

Paragraph 2 requires you to give the worker, together with the article 1 information and before work begins, six items:

a) the aspects of the employment relationship affected by the use of the systems;
b) the purposes and objectives of the systems;
c) the logic and the functioning of the systems;
d) the categories of data and the main parameters used to programme or train the systems, “including the performance evaluation mechanisms”;
e) the control measures adopted for automated decisions, any correction processes and the person responsible for the quality management system;
f) the level of accuracy, robustness and cybersecurity of the systems, the metrics used to measure them and “the potentially discriminatory impacts of those metrics”.

Then the edges. Paragraph 6: everything goes out “in a transparent, structured, commonly used and machine-readable format”, and also to the company union representatives or the unitary union body — failing those, to the local branches of the comparatively most representative unions; the Ministry of Labour and the National Labour Inspectorate may request it and access it. Paragraph 5: any change altering the conditions under which work is performed must be notified in writing at least 24 hours in advance. Paragraph 3: the worker, including through union representatives, accesses the data, with a written reply due within thirty days. Paragraph 4: risk analysis and an impact assessment, with prior consultation of the data protection authority in the cases under article 36 of the GDPR.

The penalties, with the source

Article 4 of Legislative Decree 152/1997 refers to article 19(2) of Legislative Decree 276 of 10 September 2003: the worker reports “failure, delay, incompleteness or inaccuracy”, the Inspectorate investigates under Law 689/1981 and imposes the penalty. Consolidated text: for breaches of article 1-bis, paragraphs 2, 3 second sentence and 5, from 100 to 750 euro for each month concerned; from 400 to 1,500 euro above five workers; from 1,000 to 5,000 euro above ten, where “payment of the penalty at a reduced amount is not allowed”. For failure to notify the union representatives (paragraph 6, second sentence), from 400 to 1,500 euro for each month. Inspectorate circular no. 4 of 10 August 2022 clarifies that it applies for every month the worker operates in breach and is subject to the formal-warning procedure under article 13 of Legislative Decree 124/2004, except above ten workers. Data protection breaches remain intact (article 83 GDPR, article 166 of the Italian Privacy Code).

Not front-page figures. But they multiply by month and by band, and one report plus an inspection is enough.

The point almost nobody writes: the duty lands on your supplier

Read letters c) and f) again. To comply you must describe the logic of operation and declare accuracy, robustness and cybersecurity with the metrics used to measure them. If a third party sells you the system and the contract does not guarantee that information, compliance is not hard: it is impossible. And before the inspector the party in default is you, not the supplier.

So it is a procurement clause before it is an AI question: anyone buying a tool that touches selection, shifts, evaluation or monitoring demands in writing the logic, the data and parameters, the metrics with measured results, the correction procedure, the person responsible for quality, and contractual notice of every model change — because towards workers that notice is, by law, 24 hours long. One distinction, finally: article 1-bis is an information duty, whereas installing a tool from which remote monitoring may follow requires first a union agreement or Inspectorate authorisation (article 4 of the Workers’ Statute, expressly preserved by paragraph 1). Different duties, often concurrent.

How we solve it

The knowability the rule demands does not come from a supplier’s declaration: it comes when the system is inspectable and its logs are yours. So we build dedicated, closed AI, detached from the open web, in two modes: on-premise in the client’s own environment, or on our dedicated cloud — reserved for the single client, accessed over a dedicated VPN, with the data centre resident in Italy and premises we staff ourselves. In both cases logic, data and metrics stay describable because they stay inside the perimeter, and the trace of every decision is producible: to a worker, to a union body, to an inspector. That is how we keep company AI under demonstrable control: an architectural choice, not a commercial promise.

Could you hand over today, to a worker and their union body, the written description of your system’s logic? Half an hour with one of our experts is enough to see what is missing and who to ask.