Italy's Garante: AI and PII Compliance
Updated for 2026
The Garante's AI Enforcement Record
Italy's data body is the Garante. It is the EU's most active AI regulator. Two big actions define its approach.
March 2023 — ChatGPT ban: The Garante told OpenAI to stop ChatGPT for users in Italy. It found no valid legal basis for the data use. It also found no age check for minors. OpenAI added age checks, an opt-out for training, and a privacy notice in Italian. Service came back in April 2023.
December 2024 — €15M fine: The Garante fined OpenAI €15 million. Three failures caused the fine. First: no valid legal basis. Second: poor clarity about training use. Third: no age check for minors.
Open probes (2024–2025): The authority launched probes against Replika, Worldcoin, and several AI startups.
Italy is the EU's highest-risk place for AI tool use. Any tool that handles personal records without clear conformance steps creates legal risk. Act early.
What the Garante Requires
The enforcement actions clarify what organizations must do when they use AI tools.
Legal basis: Every AI tool needs a documented legal basis under GDPR Article 6. The authority doubts "legitimate interest" for AI training. Explicit consent or contract need are the preferred grounds.
Data Processing Agreements: Firms using third-party AI tools as processors must have GDPR-compliant DPAs. The authority checked whether vendor DPAs covered data use limits. Gaps here draw scrutiny.
Input controls: The authority's focus on unlawful processing demands input controls. Technical filters that strip personal records before they reach an AI model fix the core problem. See our compliance guide for what to document.
Age checks: AI systems open to consumers must verify the age of minors. This rule followed from the ChatGPT ban.
Clear notices: Privacy notices must be in Italian. They must explain how the AI uses personal records, including training use.
The 63% Enterprise Gap
A 2024 Garante survey found that 63% of firms lack GDPR-aligned AI usage policies. This gap grows as the authority expands its AI program.
DPO sign-ups rose 340% after the ChatGPT ban. Firms saw that AI use without a DPO created legal risk. But a DPO alone is not enough. A written policy without technical controls is hard to enforce. The authority targets this gap: firms that rely on staff to self-police. Our protection overview shows how controls back up policy.
Technical Setup for Conformance
For firms with users in Italy, the Garante-aligned setup includes the following.
Pre-submission PII filtering: A Chrome Extension or MCP Server sits between the user and the AI model. It strips personal records before they reach the model. No personal data in equals no unlawful processing. This is the core fix.
Italy-specific entity types: Standard PII tools miss local ID types. Your tool must detect these:
- Codice fiscale — 16-character national ID code
- Partita IVA — 11-digit business number
- Carta d'identità — national ID card
- Tessera sanitaria — health card that holds the codice fiscale
- Italian IBAN formats
The codice fiscale is the main national ID. Missing it leaves a key gap. See our entity guide for full coverage. Run tests on real local data.
Audit trail: Garante inspections ask for proof of technical controls. A central log showing that pre-submission filtering ran gives inspectors the evidence they need.
DPA records: For each AI vendor: keep a completed DPA review. Note data use limits and training terms. Store these where they are easy to find. See our FAQ for common DPA questions.
Sector Focus Areas
The Garante targets specific sectors.
Healthcare: Health records are high-risk under GDPR Article 9. Any AI tool handling patient records needs explicit legal basis, a DPA, and strong safeguards. AI diagnostic and clinical tools require DPIAs.
Finance: Consumer profiling using AI has drawn scrutiny. Banks and finance firms using AI for credit or marketing must run DPIAs and add explainability controls.
HR: AI tools for hiring, reviews, and staff monitoring require DPIAs. The Garante issued guidance on staff monitoring in 2023.
Education: School AI tools face added rules under 2024 Garante guidance on student records.
Firms in these sectors need sector-specific records beyond the base requirements. See our case studies to learn how peers handle conformance. Our founder's perspective on building for regulated markets is at our founder statement. Our plans and rates cover all sectors and firm sizes.
When This Approach Has Limits
Putting a pre-submission filter between the user and the AI model — so no personal data goes in, and no unlawful processing follows — is the core fix the Garante's enforcement actually points to, but limits remain worth stating plainly.
The filter only stops what it detects, and Italian formats need work to detect. A codice fiscale written in an unusual case, a partita IVA without spacing, or a tessera sanitaria number that embeds the codice fiscale can slip past a generic engine and reach the model. The codice fiscale is the main national ID; missing it leaves the exact gap that produces the unlawful processing the Garante fines. These Italian formats need configuration and held-out testing on real local data before you rely on the filter. Multilingual detection accuracy also varies. Document the residual false-negative rate; "no personal data in" is only true to the extent detection is.
The filter addresses input processing, not the legal basis or the other duties the Garante checks. The OpenAI fine turned on three failures — no valid legal basis, unclear training disclosure, and no age check for minors — none of which a PII filter resolves. The Garante doubts legitimate interest for AI training, requires Italian-language notices, and inspects vendor DPAs for data-use limits. A filter supports compliance; it does not constitute it. The authority audits the whole posture, and human and legal review of basis, consent, age verification, and DPA terms remain required regardless of how good the input control is.
Stripped output can still be re-identifiable, keeping records in scope. Removing a codice fiscale and a name does not remove quasi-identifiers — role, town, dates, sector — that can re-identify a person in combination, especially in high-risk healthcare and HR files the Garante targets. That output is pseudonymized, which stays personal data under GDPR with DPIA and Article 9 consequences for special-category records. If the filter uses reversible tokens, the data remains in legal scope and the burden moves to key custody. Decide deliberately whether each use needs true anonymization, and record it alongside the DPIA.