A conditional yes, not a rubber stamp
On July 29, 2026, Italy's data protection authority, the Garante per la protezione dei dati personali, issued its opinion on the legislative decree that will translate the EU AI Act into Italian law. The verdict was a qualified approval: the Garante found the text "substantially coherent" with both the AI Act (Regulation (EU) 2024/1689) and the enabling statute, Law 132/2025, which entered into force on October 10, 2025 as the EU's first standalone national AI law. But the authority attached a specific, pointed objection: as drafted, the decree's rules for police use of biometric data go further than the AI Act allows, and Parliament needs to fix that before final adoption.
The decree in question is actually two decrees, given preliminary approval by the Council of Ministers on June 10, 2026. The first sets up Italy's AI governance architecture — AGID as the notifying authority, the National Cybersecurity Agency (ACN) as market surveillance lead and EU contact point, and the Garante itself as the watchdog for high-risk AI in justice, law enforcement, immigration, border control and democratic processes. The second, more contentious decree governs AI use by police and courts, and it is this text that triggered the Garante's biometric objection, as ANSA reported.
Where the line actually falls
The Garante's objection is narrower than it might sound. It is not opposed to facial recognition as a police tool — it accepts the decree's real-time identification regime, which under Article 8 permits live biometric scanning only for specific, serious threats (terrorism, imminent danger to life, searches for missing persons or trafficking victims), requires prior judicial authorization, and caps that authorization at 15 days, per an analysis of the decree text. It also accepts Article 10's separate, narrower channel for retrospective matching against footage already collected during an investigation, with local data deleted within seven days, as ANSA's technical breakdown confirms.
What the Garante rejects is a gap between those two carefully bounded channels: provisions that would let automated, generalized biometric scanning run on people simply entering a public place or attending an event — a screening dragnet rather than a targeted, judicially authorized search. The authority's own language is precise: such processing "is not consistent with the AI Act," which permits facial recognition only ex post, on recordings already acquired, and only where there is a specific operational need. It also wants explicit language banning biometric databases assembled through indiscriminate web scraping, and clearer rules on human oversight of any AI system feeding police decisions.
The case the Garante is making — and where it's right
The strongest version of the regulator's position deserves to be stated plainly. Biometric identifiers are irrevocable — you cannot reset your face the way you reset a password — and a database built from unconsented, ambient scanning of public spaces creates a standing surveillance capability that persists long after whatever justified its creation has passed. Europe's own courts have treated mass biometric monitoring with particular wariness for exactly this reason, and the AI Act itself, in Article 5, was written to draw a bright line against generalized, untargeted collection. A national implementing decree that quietly widened that line through drafting ambiguity, rather than open debate, would be a bad outcome regardless of one's views on AI policy generally — it would invite legal challenge, chill legitimate deployment, and hand critics of the AI Act a genuine grievance rather than a manufactured one.
Why proportionate still beats maximalist
That said, the Garante's intervention is worth welcoming rather than resisting, and it cuts against the narrative that AI regulation is inherently anti-innovation. This is not Brussels imposing a blanket moratorium; it is a domestic regulator doing precision editing on a decree that otherwise gives Italian police a real, usable biometric-identification power — time-boxed, judicially supervised, and paired with a distinct retrospective channel for investigators working from evidence already in hand. That is a workable operational toolkit, not a ban. The fix the Garante is asking for — close the gap that would allow preventive mass scanning outside those two channels — is exactly the kind of narrow, technical correction that keeps a framework both usable and durable. A decree that survives its first constitutional or Court of Justice of the EU challenge is worth more to law enforcement, and to the AI vendors building for this market, than one that ships fast and gets struck down eighteen months later.
What happens next
The decrees now move to the parliamentary committees and the Unified Conference (the body coordinating state and regional governments) for further scrutiny, with final adoption due by October 2026 — the twelve-month deadline set by Law 132/2025's delegation, as legal analysis from noze.it and Il Sole 24 Ore both note. Italy is moving first among EU member states to operationalize a national AI Act enforcement framework, and how cleanly it resolves this biometric gap will be a template other capitals watch closely. Getting it right — narrow, judicially checked, time-limited — is the difference between a framework that gives police a durable tool and one that becomes the AI Act's first big domestic court fight.