Ing. Calogero Bono
The Italian Digital Agency (AgID) has adopted the Guidelines for the adoption of AI in the Public Administration, with Determination no. 169 of 9 November 2026. The text was foreseen by the Three-Year Plan for ICT in the Public Administration 2024-2026. It gives operational guidance to offices and bodies on how to introduce artificial intelligence systems while respecting European and national rules. It also matters for vendors and developers who work with the public sector.
A few terms before we get into the facts. AI Act is the European regulation that classifies AI systems by risk level. PDCA stands for Plan-Do-Check-Act, a four-stage continuous improvement cycle. ISO/IEC 42001 is the international standard for AI management systems. UTD refers to the Digital Transition Offices present in administrations. Poisoning and evasion are attacks that corrupt training data or deceive the model.
What are the AgID guidelines on AI?
According to AgID, they are a document that supports administrations in the conscious, effective and responsible use of AI-based technologies. They follow the procedure set out in Article 71 of the Digital Administration Code (CAD).
They incorporate the European and national regulatory framework and give guidance on compliance and organisational impact. Those who want to frame the context can read our guide to the EU AI Act.
Who worked on the document?
The text was drafted within the concertation table of the Three-Year Plan. Participants included ACN, ANAC, ANCI, the Conference of Regions, Consip, the Department of Public Function, the Department for Digital Transformation, INAIL, INPS, ISTAT, IPZS, MEF, MIMIT, PagoPA and UPI.
The fact that central bodies, agencies, regions and municipalities sit together suggests a document meant to be applied at very different levels. This is our reading, the source does not say it.
How must the PA classify risk?
Administrations are required to classify AI systems according to the AI Act risk levels. They must then apply requirements for transparency, human oversight and accountability, especially for high-risk solutions.
The adoption model is based on the PDCA cycle and the ISO/IEC 42001 standards, with self-assessment tools for organisational and technological maturity. For those who develop software, our coverage of the AI Act obligations for developers is also a useful complement.
What do they say about data, security and skills?
Data management is indicated as an essential prerequisite for reliable systems. The document recalls four principles, accuracy, consistency, completeness and timeliness, and pairs them with cybersecurity measures against evasion, poisoning, privacy and abuse attacks.
On the human side it promotes a human-centred model of AI, with a code of ethical conduct, investment in digital literacy and the enhancement of specialised profiles within the UTDs. On the technical front, our guide to jailbreaks and prompt injection is also useful.
Limits to know
The source is AgID's official news release, not the full text of the Guidelines, which we have not analysed here. We do not know what deadlines, sanctions or economic tools accompany the adoption. It is unclear how the requirements placed on vendors in tenders will change. The text could be updated with the next Three-Year Plan.
What changes for those working in digital
If you sell software or services to public bodies, expect requests on risk classification, documentation and data quality. It is worth having human oversight processes and AI-specific security measures ready. For professionals the same principle applies on a smaller scale, and our guide to AI for small businesses helps you start without wasting resources. Those who design custom solutions will need to think about data and traceability from the outset.
Our take
The document goes in the right direction because it puts data and skills ahead of technology. The risk is that it remains a list of compliance obligations for small bodies, with few offices and little trained staff. The PDCA cycle only works if someone has the time to really check. Without resources and training, compliance can become a paper exercise.
Frequently asked questions
Who adopted the Guidelines?
The Italian Digital Agency, with Determination no. 169 of 9 November 2026. The text was foreseen by the Three-Year Plan for ICT in the Public Administration 2024-2026.
Who are they addressed to?
To public administrations that adopt AI systems. They give operational guidance on regulatory compliance and organisational impact.
What must the public administration do about risk?
It must classify AI systems according to the AI Act. For high-risk systems, transparency, human oversight and accountability are required.
What is the PDCA cycle?
It is a continuous improvement model in four stages, Plan-Do-Check-Act. The Guidelines combine it with the ISO/IEC 42001 standard and self-assessment tools.
Which security threats do they cite?
Evasion, poisoning, privacy and abuse attacks. The document addresses them with cybersecurity measures combined with data quality.
What to watch after the adoption of the Guidelines
The text is adopted, but the real test is its application within bodies. There are three points to follow in the coming weeks.
- Read the full text published by AgID and mark the requirements that affect your work.
- Check whether upcoming public tenders cite the Guidelines or the ISO/IEC 42001 standard.
- Watch how the UTDs respond, since they will be your contacts on the technical side.
