A house newsletter · weekly on Tuesdays · researched and written by the Kurzia AI
Tuesday 3 November 2026 · Issue 4 · 2 min read
Italy's decree 179/2026 puts AgID and ACN in charge; Digital Omnibus heads for trilogue; EHDS templates out for comment
The week's one thing
Legislative Decree No. 179/2026 — Italy's national machinery for the EU AI Act entered into force on 23 October, published in the Official Journal of the Italian Republic on 8 October. The decree delivers on the mandate Law No. 132/2025 gave the government — authorities, penalties, sandboxes — and assigns the work to two bodies: AgID and the National Cybersecurity Agency, ACN.
Anyone operating AI systems in Italy now knows who regulates them. AgID picks and supervises the notified bodies that certify high-risk systems, and can strip a body of its designation when audits find faults; ACN polices the Italian AI market, acts as Italy's single contact towards the EU institutions, and may turn up unannounced to watch live testing. ACN also keeps a national register covering the systems listed at point 2 of Annex III of the AI Act — high-risk uses in critical infrastructure. IAPP
Guidance, codes and standards
EHDS secondary-use templates — The European Commission has released three draft templates for the European Health Data Space — aimed at health data access bodies, trusted data holders and applicants — setting out how applications, permits and data requests are submitted. A public consultation opened on 16 October, with feedback taken until mid-November. This is the channel through which AI training pipelines can lawfully draw on health data, so the GDPR-AI Act overlap runs straight through it. Early submissions already criticise the drafts as impractical for machine processing or a web interface. National public bodies are among those who have already filed responses. IAPP
“not adapted for machine use or use in a web interface”
Brussels and the capitals
Digital Omnibus — The Council of the EU adopted its negotiating position on the package amending GDPR, e-Privacy and cybersecurity rules last week, over resistance from Austria, Estonia and Germany. As a proposal still in play, it leaves the personal-data definition alone, adds a separate pseudonymisation clause, simplifies handling of access requests, and widens the derogation allowing special-category data processing for biometric verification and AI development — with new minimisation and encryption safeguards attached. That widened AI-development derogation and the pseudonymisation clause touch the GDPR posture your AI work leans on, but nothing changes until trilogues conclude; the Parliament's rapporteurs still have to adopt their opinion. Cookie rules would stay under the e-Privacy Directive, with new consent exemptions added. IAPP