Artificial Intelligence: DDL 1146, AI Act and ISO/IEC 42001

In the increasingly complex framework of Artificial Intelligence regulation, a coherent regulatory and operational triangle is emerging today between three fundamental instruments: the Italian Bill 1146, the European AI Act Regulation, and the international standard ISO/IEC 42001:2023.

Each of them approaches the topic of AI from a different, but profoundly complementary, perspective.

DL 1146 – The value and institutional foundation

Bill No. 1146 proposes a comprehensive intervention that, while still in progress, marks an important step in building public governance of AI in Italy. It:

• establishes general principles that the use of AI must adhere to : human-centeredness, transparency, non-discrimination, privacy protection, human supervision, inclusion;
• provides for delegation to the Government to adopt legislative and regulatory measures in strategic sectors (justice, healthcare, labor, public administration);
• Strengthens the role of AgID and ACN as public bodies responsible for promoting and overseeing the responsible use of AI.

In this sense, the DDL acts as an ethical-legal guide , offering a value-based orientation on which to base technical standards and management systems.

AI Act – The binding European regulatory framework

Regulation (EU) 2024/1684, known as the AI Act, represents the first global attempt to regulate Artificial Intelligence through horizontal and binding legislation.

The AI Act:

• adopts a risk-based approach , classifying AI systems into 4 levels: unacceptable, high, limited, minimal;
• imposes specific obligations for high-risk systems , including: risk management, data governance, transparency, traceability, human oversight and post-market surveillance;
• provides for significant penalties for failure to comply with the requirements (up to 35 million euros or 7% of annual turnover).

The regulation defines in detail what must be done to ensure safety, reliability and respect for fundamental rights.

ISO/IEC 42001 – The operational framework for compliance and excellence

ISO/IEC 42001:2023 , the first of its kind to define an AI Management System (AIMS), is the practical tool that enables organizations to:

• transform the principles of DDL 1146 into policies, roles, operating procedures and measurable indicators;
• implement all AI Act requirements in a structured and scalable manner, with a focus on: risk assessment, oversight, transparency, technical documentation, and continuous improvement;
• map and control the entire AI lifecycle , through 38 controls organized into 11 control objectives (Annex A).

In this context, ISO/IEC 42001 provides the “how” to do it , enabling native integration with other ISO standards ( ISO/IEC 27001 , ISO/IEC 23894, ISO/IEC TR 24027), in an integrated management logic.

_______________________________________________________________________________________

CSQA TRAINING OFFER

ON DEMAND COURSE: AI ACT – ARTIFICIAL INTELLIGENCE LITERACY

ONLINE COURSE: LEAD AUDITOR ISO/IEC 42001:2023 - ARTIFICIAL INTELLIGENCE