Italy's AI decree voids any dismissal or performance review decided by AI alone

Say your product uses an AI model to grade customer support conversations and gives every agent a monthly quality score. A support lead at a retailer in Milan sees one agent at the bottom of the table three months running and signs off the dismissal, without opening a single conversation behind the scores. Since 23 October 2026, Article 41 of Legislative Decree 179/2026, the decree that adapts Italian law to the AI Act, says an employer that uses AI in decisions about staff must leave every final decision on hiring, changing or ending someone's employment to a person with "effective and autonomous" power to decide, and that a dismissal made without one is void 1. It names performance reviews and disciplinary measures outright. My reading is that a lead who only confirms the score is unlikely to count as that person, which would make this dismissal void.

Void usually means the worker gets the job back, plus at least five months' pay in damages 6. The rule binds the employer, who here is your customer, and it has applied since 23 October 2026, while the AI Act's high-risk rules for employment AI start only on 2 December 2027 5. Records from your product are the easiest evidence your customer has that a person reviewed the score, and of what the AI contributed, so expect Italian customers to ask about both before they sign. The same rule binds any founder who uses AI tools to review their own staff in Italy.

What does Article 41 require of employers in Italy?

It applies to an employer that uses AI in decisions about its staff (a later section covers which tools count as AI). Such an employer must leave every final employment decision to a person, and each worker gets a right to an explanation. The main points of Article 41 1:

• A person makes the final decision. This covers decisions to hire, to change and to end employment, including disciplinary measures and performance reviews. The decree reserves the final decision "in any case" to a person who exercises effective and autonomous power.
• The worker cannot sign it away. A worker's consent does not let the employer leave the decision to the AI.
• Screening candidates is outside it. Searching for and screening applicants does not count as a final decision, even when it removes someone from the next round.
• Workers are told before the system is used. The employer must give each worker a set list of information about the system before the processing starts. I go through it below.
• Workers can ask why. On request, and through a person, the worker gets an intelligible reason for the decision about them, including how far AI influenced it and the main parameters considered.
• A decision the AI made is void. A dismissal or other decision that no person with real power finally made is void. That consequence attaches to the first rule only; failing to inform or explain does not void a decision on its own.

What does a void dismissal cost the employer?

Usually the job back plus damages. The court orders the employer to reinstate the worker and to pay damages measured on their last salary, from the dismissal to the day they return, minus anything they earned elsewhere in between. The damages are never less than five months' pay, and the employer also pays social security contributions for the period. The worker can choose 15 months' pay instead of returning to work. This is the rule for employees other than executives whose permanent contracts started on or after 7 March 2015 6.

When a dismissed worker challenges a decision made with your scores, the worker's lawyer and the court will ask who decided and what the tool did. Your product's records are the easiest way for the employer to answer.

Does a manager's approval step count as a person deciding?

Probably only if the manager really reviews the case. The decree does not define "effective and autonomous power". It does borrow the GDPR's test of a decision taken "solely" on automated processing, and it applies without prejudice to GDPR Article 22, so the GDPR guidance on that test is the natural place to look. Guidelines on automated decisions endorsed by the European Data Protection Board, the body in which the EU's data protection regulators coordinate, say an organisation cannot avoid the GDPR's rule on automated decisions by fabricating human involvement 3. The review has to be meaningful, carried out by someone with the authority and competence to change the decision, who considers all the relevant data.

My reading is that an Italian court will ask a similar question. A manager who opens a dashboard, sees a low score and signs the dismissal letter without reading a single conversation behind it is the token gesture those guidelines describe. A reviewer who looks at the underlying records, and who can and sometimes does disagree with the score, is much closer to what the decree asks for.

Is a review step built for GDPR enough in Italy?

Not always, because the GDPR lets a company leave some decisions to software and Article 41 does not. GDPR Article 22 allows a decision made solely by automated processing where it is necessary for a contract, authorised by law, or based on the person's explicit consent 2. For final employment decisions in Italy, none of those routes exists: Article 41 reserves them to a person "in any case". I wrote about how Article 22 works in practice in the post on Uber's 825 million euro fine for blocking drivers by software.

Both rules can apply to the same decision, and the employer has to meet both.

Which software features does Article 41 reach?

Any AI feature whose output an employer can use to review, discipline or let go of a worker in Italy. Examples:

• Support quality scoring, where a model grades each agent's conversations.
• Sales performance scoring, where a model ranks reps or predicts who will miss target.
• Drafted performance reviews, where an AI writes the assessment a manager then sends.
• Conduct flags, where a model decides which behaviour opens a disciplinary process.

A dashboard that counts tickets closed or hours logged by fixed rules is probably not an AI system under the AI Act's definition, so Article 41 does not reach it. GDPR Article 22 still covers a decision made solely by such software, AI or not.

Your Italian customers likely already run some of these tools: in a 2025 employer survey on algorithmic management by the Organisation for Economic Co-operation and Development, 76% of Italian managers said their firm uses at least one tool that instructs, monitors or evaluates workers.

The AI Act also lists these systems as high-risk 4, and my post on the AI Act's high-risk list covers what that adds from 2 December 2027.

What will employers in Italy ask their software vendors for?

They will ask for what they must tell their workers before the system is used. Article 41 borrows that list from an older Italian law on informing workers, and the new decree reproduces it in full 1. I will call it the six disclosures. The employer must tell each worker:

1. which aspects of the employment the system affects;
2. what the system is for;
3. its logic and how it works;
4. the categories of data and the main parameters used to program or train it, including how it evaluates performance;
5. the controls on automated decisions, any correction process, and who is responsible for managing the system's quality;
6. its accuracy, robustness and cybersecurity, the metrics used to measure them, and any discriminatory impact of those metrics.

The numbering is mine; the law letters the items a to f. The six disclosures go to workers and their union representatives in a structured, machine-readable format. Workers must get written notice at least 24 hours before a change to this information that alters their working conditions, and a worker who asks for more gets a written answer within 30 days. The same law also asks the employer for a data protection impact assessment of the system.

Disclosures 3, 4 and 6 describe how the system works inside, and an employer that bought the software cannot write them without the vendor's help. Whether every item applies to AI that only assists a person is not settled, so I would plan for customers asking for all six.

Does a vendor's trade secret excuse the employer?

Whatever a vendor keeps secret, its customers still need enough from it to explain any individual decision. A trade secret may excuse the six disclosures: the older law exempts systems protected by trade secrets, and the new decree adds training data, algorithms and model architectures to what Italian law can protect as one 1. As of November 2026, no court has ruled on how far that reaches. The worker's right to an explanation in Article 41 has no such exemption, and Article 41 also keeps the worker's GDPR right of access to their data.

What should you change in your product?

If you sell software that scores, ranks or flags workers, and any of your customers employs people in Italy, a review or dismissal made with your product is void unless a person with real authority makes the final decision, and your customer owes each worker an explanation of the AI's part in it. This is what I would do.

1. Make every score an input to a person's decision. Remove any path where a score turns into a rating, a warning or a termination flag on its own. Put the records behind a score next to the number, so the reviewer can check it.
2. Record each decision. Store who decided, when, what the AI suggested and whether they changed it. That record is your customer's evidence that a person made the call.
3. Store why each score came out as it did. Keep the main factors behind every individual score, so a customer can tell a worker how far the AI influenced the decision and which parameters it weighed.
4. Write the six disclosures for each feature. Put them in one machine-readable document, and tell customers before you change the scoring logic, because their workers are owed 24 hours' written notice of changes that alter their working conditions. A change to scoring logic usually ships in a pull request that nobody reads as a legal event. Lawcel, the compliance tool we build, reads each pull request and flags the legal documents it puts out of date.
5. Check your own team. If you use AI to draft reviews or rank people who work for you in Italy, you are the employer, and the same rules bind you.