Hiring and firing: AI does not get the final say

Artificial intelligence can help organise work, prepare documents and evaluate information. But it cannot become the subject to which the most delicate decisions are delegated. From 23 October 2026, legislative decree 179/2026, which adapts Italian legislation to the European AI Act and intervenes on supervision, sanctions, training and worker protection, is in force. This concerns not only those who develop algorithms but also organisations that use them in their activities.

The key word is responsibility. The adoption of software does not erase that of the employer, and the intervention of an algorithm cannot turn a business choice into a verdict without possibility of discussion. However, note: 23 October is not the day from which every professional use of AI suddenly becomes subject to rules. The decree fits into an already existing European and national framework, defining further tools to make it operational in Italy. Let’s see what changes.

And let’s say at once that for hiring and dismissals, the last word belongs to a person. One of the most important chapters therefore concerns personnel management. Article 41 of the decree excludes that final decisions on the establishment, modification and termination of the employment relationship depend solely on automated processing based on artificial intelligence. The principle also concerns disciplinary measures and performance evaluations: a person with effective and autonomous power must decide.

The difference is not only formal. Using a program to collect useful elements for evaluation and judgement is one thing; leaving it to decide the result, with a manager only called to confirm it, is another. The human control described by the legislation must make it possible to challenge the outcome, correct errors and make a different decision. AI, then, can assist those who manage personnel. It must not become a screen behind which to hide the responsibility for the choice.

Work safety, algorithms enter risk assessment

The decree, it should be emphasised, also introduces an explicit link between artificial intelligence and workers' health. Article 42 establishes that the use of systems capable of affecting work organisation, production rhythms, the methods of performing tasks, or decision-making processes relevant to safety must be considered in the risk assessment provided for by legislative decree 81/2008.

The point is not to automatically update the Risk Assessment Document for any use of a chatbot. It is necessary to understand what the system concretely does and what consequences it may produce. A programme that suggests a phrase for commercial communication does not pose the same issues as an algorithm that distributes workloads or influences the timing of an operational activity.

Technology, in other words, should not only be evaluated for its capacity to increase productivity. When it influences work organisation, it must also be examined for possible effects on people.

Another central issue is the preparation of those who use these tools. The initial text recalls the AI literacy provided for by Article 4 of the AI Act: knowing the limits of systems, recognising errors, protecting information and knowing when control is necessary. This does not mean imposing the same course on every employee, nor requiring a universal certificate that automatically shields the company from disputes. Preparation must be related to the activities performed: those who use an assistant to write a first draft have different needs from those who employ a system to assess candidates or performances.

The Italian decree also dedicates specific provisions to training, including in the professional world. The aim is to strengthen the skills needed to use AI consciously, not to replace professional judgement with software output.

But what controls and sanctions are there? The measure also clarifies the structure of the competent authorities. The Agency for Digital Italy is responsible for the functions of national notification authority, linked to conformity assessment bodies. The National Cybersecurity Agency exercises general market surveillance powers, while for specific areas the interventions come from the Bank of Italy, Consob, Ivass and the Data Protection Authority.

The decree provides, for breaches of prohibitions relating to forbidden AI practices, sanctions of up to 35 million euros or, if higher, up to 7% of the previous financial year's global turnover. Different maximum limits are established for other categories of infringements. It is therefore incorrect to associate the highest amount with any irregularity in the use of a digital assistant. The regulation also includes specific criteria for small and medium-sized enterprises and, for violations characterised by low offensiveness or danger, the possibility of adopting non-monetary measures, such as an order to eliminate the infringement.

The real turning point is knowing who controls the machine

For companies, the change is not measured only by the number of new documents to prepare. The problem is making the path that leads from the information produced by software to the company decision recognisable: which elements are used, who verifies them and who can stop or correct the process. It is especially in employment relationships that this distinction becomes decisive. An algorithm can provide an indication, but it must not make the decision-maker invisible. The new Italian framework strengthens precisely this approach: innovation and automation must remain compatible with the protection of people, common sense, human respect.