What does Italian law say about AI in primary care?
The Italian rule is Law 132 of 2025, in force since 10 October 2025. Article 7 is about healthcare and sets four points, which apply to your local health authority, your community health centres and your GPs.
- AI cannot select or condition access to care on discriminatory criteria.
- Patients have the right to be told when AI is being used.
- AI supports prevention, diagnosis and treatment. The decision always stays with the doctor.
- Systems and data must be reliable, checked and kept up to date over time.
An example case, not a real body. A community health centre wants an assistant that prepares an admin summary of chronic patients before their visits and sends appointment reminders. No clinical advice goes to patients automatically. Let's see what it needs, step by step.
Which uses are low-risk, and which are not?
- Admin: bookings, reminders, case summaries, sorting the mail. These are not among the AI Act's high-risk uses, but they handle health data, so GDPR applies in full.
- Clinical: suggestions on diagnosis and treatment. Under Law 132 they are a support and the decision stays with the doctor. You start with trials, a protocol and trained doctors.
- High-risk under the AI Act: systems that assess whether a person is entitled to public health services, and those that classify emergency calls or triage patients.
Our read: the line depends on the use. The same assistant is low-risk when it reminds someone of an appointment, and moves into another category if it decides who is seen first.
What does the Italian data protection authority ask for?
In 2023 the Garante, Italy's data protection authority, published ten guidelines for national health services built on AI. They are not binding, but they show what the authority looks at. It asks for a clear, specific legal basis to process health data, a data protection impact assessment before starting, and qualified human oversight. For a national system, the impact assessment has to be done at national level.
What changes for cybersecurity?
Local health authorities are on the list of entities covered by the NIS rules, Italy's Legislative Decree 138 of 2024. They must adopt security measures and report incidents to the national cybersecurity agency. An AI assistant brings one more supplier, who has to be part of the incident plan: who alerts whom, and how fast.
Is there already a real example?
Yes, the MIA platform from AGENAS, Italy's national agency for regional health services, funded by the national recovery plan. It gives primary care doctors non-binding suggestions on basic diagnosis, chronic care and prevention. According to AGENAS the trial plans for 1,500 doctors, dedicated training and agreements with the regions, and ends by the close of 2026. The MIA website says the platform is open to the doctors in the first phase. The AGENAS pages show no published results yet.
Where does a health authority start, in practice?
- Keep admin uses separate from clinical ones, with different rules and owners.
- For clinical uses, run only trials with a written protocol and trained doctors.
- Tell patients when AI is being used, as Law 132 requires.
- If the system is regional or national, do the impact assessment once, at that level.
- Put AI suppliers in the incident plan required by the NIS rules.
What about us?
Since 2014 we have built software for healthcare and life sciences. The largest case is Oncologica's cloud LIMS, which validated over 6 million genetic samples. Our Security page says we deliver aligned to the standards of the sector, including ISO 27001 and IEC 62304.
In the example community health centre, this is how we would use it. The assistant prepares the admin summary and the reminders, a staff member checks them, and every access to the data stays in the log. No clinical message goes out without a doctor.
So what do you do?
- If AI handles bookings and reminders, start with GDPR, the impact assessment and the incident plan in order.
- If AI suggests diagnoses or treatments, start with a trial and a protocol, and the decision stays with the doctor.
- If AI decides access to services or emergency priorities, prepare for the high-risk obligations and involve your data protection officer from day one.
“In healthcare, AI prepares the work. Diagnosis and sign-off stay with the doctor.”
DBrothers — on AI in Italian primary care
Frequently asked questions
Does the patient have to consent?
Law 132 talks about the right to be informed. The legal basis for processing health data has to be assessed case by case with your data protection officer.
Is a booking assistant high-risk?
Usually not, if it handles appointments and information. People using it must still be told they are talking to an AI system, unless that is obvious.
Can the rules change?
Yes. The AI Act dates have already been moved once, and the European Commission's guidelines on classifying high-risk systems are still in draft. This may change; we will update this page.
If your district has an admin task that repeats every day, such as reminders for chronic patients, that's the place to start. We map the steps with you, and clinical decisions stay with your doctors.
