IT EN
Start a trial

Operational notes Regulation

Facial-recognition decree: what to check once the text is out

7 min read

A grid window with dozens of small glass panes on a brick façade, with two dark shutters open on each side, in black and white
A grid is read one square at a time. The facial-recognition decree should be read the same way: not a headline, but article by article.

This morning, Monday 3 August 2026, at 6:50am, the official archive of the Council of Ministers on governo.it was still stuck on meeting No. 184 of 29 July. No later meeting published. The press has spent days writing about a Council of Ministers meeting on 4 August, with a “bill to strengthen defence and rules on facial recognition” among the expected items, and about a preparatory meeting today with AI among thirteen dossiers. But that date exists, for now, only in statements reported by newspapers, not in a published act. We already mapped, yesterday, the three authorisation channels the decree provides for biometric identification, and the correction announced verbally by Mantovano that does not specify which of the three it touches. We will not repeat that reconstruction here: we are setting the grid for reading the text once it is out — not the headline the press will give it.

Four checks, not a summary

First check: which instrument the correction is travelling on. Government Bill No. 418 is a draft legislative decree, transmitted to the Chamber of Deputies on 24 June 2026: it follows the procedure under Article 76 of the Constitution, which requires the opinion of the competent parliamentary committees before final adoption. On 30 July 2026 the Joint Committees I (Constitutional Affairs) and II (Justice) concluded their examination with a favourable opinion with observations. The process is not closed, however: Committee XIV (EU Policies), responsible for EU-law compatibility, adjourned without deliberating, and its deadline is 25 August 2026. The deadline for both opinions is 25 August 2026, neither expired nor met by any resolution. If the Council of Ministers resolves something on this draft on 4 August, it cannot be the final adoption: the opinions are still missing. The concrete test, once the text appears: if it cites the enabling law, it is the tail end of Bill No. 418’s procedure and should carry a date after 25 August; if it presents itself as an emergency decree-law, with the formula “given the extraordinary necessity and urgency” under Article 77 of the Constitution, it is a different instrument, in force from the day after publication, and the pending opinions on Bill No. 418 remain a parallel procedure.

Second check: which of the three articles changes. Look for “public prosecutor” (Article 8, real-time identification), “preliminary investigations judge” (Article 359-ter of the Code of Criminal Procedure), or “consults the Garante” (Article 10, after-the-fact recognition on video surveillance). If the text adds a judge only where “prosecutor” is currently written, Article 10 — the one a stadium, an airport or a station would actually use — stays under today’s regime: impact assessment and Garante consultation, no judge.

Third check: paragraph 12 of Article 10. Check whether the current wording survives — venue and event operators install the systems and hand them over “on free loan” to the police headquarters, which acquires “complete and exclusive availability” of them — or whether it is clarified, as the Garante asked in opinion No. 531 of 14 July, who answers as data controller when the installation belongs to a private party.

Fourth check: the two clocks. Seven days for erasing the biometric data collected, five years for the access logs. These are precise figures written into the tabled text: if they change, the technical specification of whoever runs the installation changes too, not just the legal frame.

What I could not verify

The Senate is not reachable from this environment to check for any opinions of its own from Palazzo Madama: the site responds with a block (403 with a default user agent, 202 with an empty body using a browser user agent) that looks like anti-bot protection, not an absence of content. I am not presenting this as “no Senate opinion”: I am presenting it as “not verified against a primary source”. Nor did I find, in this morning’s search, any new Garante privacy measure since opinion No. 531 of 14 July. One last limitation concerns the parliamentary record: the Chamber of Deputies page for Government Bill No. 418 in its usual form is JavaScript-rendered and cannot be read by an automated request; the sittings and deadlines given here come instead from the Chamber’s server-rendered document, updated at 07:31 this morning.

Why the grid matters more than tomorrow’s headline

A newspaper headline — “judge’s authorisation”, or “to examine the footage” — is not enough to know which of the three channels changed: we have already seen this with the two major outlets that headlined the same statement differently on 31 July, after the Garante had already asked for corrections to the tabled draft. Anyone who operates or supplies a video-surveillance system with AI components on behalf of public security — a stadium, an airport, a railway station, a plant under the National Cybersecurity Perimeter — cannot afford to find out, after signing a specification, which article applies to their own case.

What to do today

Do not wait for the final text to put in writing who is the controller and who the processor in your installation: the decree, whatever version arrives, will not do it for you. Keep the fundamental-rights impact assessment required by Article 27 of the AI Regulation ready. And once the 4 August text — or whatever follows it — is public, apply the four checks above before updating a contract: the difference between a prosecutor authorising within fifteen days and an officer designated by the police commissioner who merely consults the Garante is the difference between two models of accountability, and you carry it, not the decree.

How we solve it

The problem is not reading the decree once: it is rereading it every time it changes, and knowing at once which paragraph was touched without redoing the analysis from scratch. We build the control that runs on your installation’s own logs — not an opinion that ends once the text has been read — one that tells the seven days of the data apart from the five years of the logs on its own, flags a missing or expired authorisation against whichever version of the decree is in force at that moment, and keeps the file ready for a Garante inspection or a request from police headquarters.

The same system holds together, in a single operating model, the data that today stays scattered between venue operator, police headquarters and Ministry — who installed it, who authorised it, who looked at that image — so that an AI proposes the match while an operator in command always remains the one who confirms it. We do this for government and defence bodies as much as for large operators of plants and infrastructure, always in two modes available together: on-premise, on self-contained machines that stay inside your own perimeter without deep integration into your existing network, or CSIDIA dedicated cloud — access over a reserved VPN, data centre in Italy, premises we staff ourselves. Shared management: you do not need to already have someone in-house who administers these systems.

Do you run an installation that could fall under Article 10 of the decree? Half an hour with one of our experts is enough to apply the grid to the text today, whichever version comes out of the Council of Ministers.

Sources

The dates of the 3 August preparatory meeting and the 4 August Council of Ministers meeting are as reported by the press cited above: at this morning’s 6:50am check of the official archive, neither meeting had yet been published. The status of Government Bill No. 418 (sittings, deadlines) is verified against the Chamber’s server-rendered document, which states «Aggiornata alle ore 07:31:03 del giorno 03/08/2026».