On September 9, 2026, Italy published Legislative Decree n. 160 in the Gazzetta Ufficiale. It is the first complete transposition of the EU AI Act by any member state. And Italy’s Garante, MEP Brando Benifei, and Bocconi Professors Vedaschi + Graziani are publicly saying the most sensitive piece of the decree — Article 10, which enables facial recognition at stadiums, protests, and concerts — still crosses a line the AI Act explicitly prohibits.

The editorial question for a Mexican, Brazilian or Argentine procurement office signing an enterprise facial-recognition contract in Q4 2026: if the EU AI Act has a “targeted search” rule (Article 5 + Article 26(10)) that Italy just tried to evade with a pre-event biometric-fingerprinting capability, and the Italian data-protection authority + MEP Benifei are publicly calling that an AI Act violation, what is the contractual clause that your RFP uses to demand AI Act compliance even if the vendor tells you the Italian decree “permits it”?

What Decree 160 does (and what changed between the August draft and the final version)

Legislative Decree n. 160 implements Law 23 September 2025, n. 132, which delegated to the Italian Government the alignment with the AI Act (Regulation 2024/1689) by the October 10, 2026 deadline. Title I authorizes Italian police to integrate facial-recognition components into video-surveillance systems already installed at “sensitive sites” — squares, stadiums, railway stations, streets during demonstrations, marches, sporting events, and concerts [1][2].

At any “sensitive site,” Article 10 of the original draft proposed that cameras convert the faces of everyone present into biometric templates, retained for seven days; if no offense was flagged, the data auto-deleted; if one was, investigators could run comparisons without prior judicial authorization [1]. The Garante (Italy’s DPA) issued a formal opinion on July 14, 2026 [3] saying this architecture is “not coherent with” the AI Act which permits post-event facial recognition “only for targeted searches” of people already suspected or convicted of a crime, and only against footage already lawfully recorded — not a standing, generalized capability to biometrically fingerprint every attendee of a lawful gathering [2].

MEP Brando Benifei, the AI Act rapporteur for the European Parliament, announced an urgent question to the European Commission over the decree, warning it risks legitimizing mass biometric collection “contrary to the spirit” of the regulation Italy is nominally implementing [2]. The Italian Senate’s EU Affairs Committee cleared the text on July 29, 2026 over opposition objections [2].

The two concessions in the final version (Decree 160)

Legislative Decree 160, published September 9 and in the Gazzetta Ufficiale on September 15 [4], incorporates two concessions to the Garante and Benifei criticisms [1][3]:

  1. Post-offense processing, not pre-offense. The final Article 10 provides that, before an offense occurs, facial images may be stored without processing the corresponding biometric data; biometric processing may take place only subsequently, following the commission of an offense, for the purposes of retrospective comparison [1]. This closes the most aggressive reading of the draft — but does not close it entirely.

  2. Judicial oversight for targeted searches. The decree introduces judicial oversight for targeted searches of persons already suspected of an offense: the public prosecutor must seek authorization from the judge for preliminary investigations within 48 hours of the system being activated [1]. This is the textual answer to the Garante’s request.

The residual risk the Garante + Bocconi identify: the initial identification of a potential suspect falls outside the requirement of prior judicial authorization [1]. That means police can build a biometric catalog of a crowd first, identify a suspect afterward without a warrant, and only then request authorization for the targeted search. It is the exact inverse of the order the AI Act Article 26(10) prescribes — first suspicion, then template, not the other way around.

Vedaschi (Bocconi) puts it this way: the decree, “at least in its final version, makes the crowd searchable first and searches for a suspect later.” The comparative analysis with France (Law 2023-380, amended 2026) and the Netherlands (CATCH under the Police Data Act) confirms that neither jurisdiction creates biometric templates of every event attendee before any offense [1].

The five clauses your LATAM facial-recognition RFP needs

If the EU AI Act has a “targeted search” rule (Article 5 + Article 26(10)) that Italy is trying to redefine via a national decree, and the Italian Garante + MEP Benifei are publicly saying that crosses the line, your Q4 2026 RFP must carry five explicit clauses — not as a courtesy, but as a contractual shield:

1. Targeted-search-only clause (Article 26(10) compliance) — Vendor certifies in writing that any post-remote facial-recognition functionality (including the equivalent version of Decree 160) will run only against footage already lawfully recorded, only for persons already suspected or convicted of a specific crime, and only with judicial authorization ex-ante or within 48 hours ex-post [1][2]. The clause must cite AI Act Article 26(10) verbatim [5] and explicitly prohibit the “build-the-biometric-database-first” architecture of the original Decree 160 [1][4].

2. Warrant-at-query clause — Any facial-recognition query against recorded footage requires a written judicial order or an affidavit signed by the responsible officer, archived in a tamper-evident log with timestamp + officer identity + query string. Without this clause, Decree 160 permits warrantless queries in the “initial identification” phase — exactly the risk window [1].

3. Deletion-not-move-at-retention-end clause — At the end of the retention period (typically 7 days under Decree 160), the biometric templates are deleted from primary storage AND from any backups, and the action is recorded in a cryptographically-signed audit log. The clause prohibits “move to research dataset” or “move to long-term cold storage” that some vendors offer as “compliance” [1].

4. Garante-opinion-disclosure-to-customer clause — Vendor commits to deliver to the customer, within 30 days of any opinion, sanction, or resolution from a data-protection authority (Italian Garante [3], French CNIL, Spanish AEPD, Mexican INAI, Brazilian ANPD) affecting the facial-recognition functionality being provided. Without this clause, your team discovers regulatory risk after the vendor has already lost the case [3].

5. Architectural-decommitment-on-decision clause — If the final version of Decree 160 [4], or any equivalent national transposition decree in another member state, is declared incompatible with the AI Act by the European Commission or the CJEU [5], vendor commits to a documented architectural reversal within 90 days — no penalty to the customer, no charge for re-deployment, and certified destruction of biometric templates. This is the clause that closes the risk of “we bought Italia-style, now Italia-style is illegal” [2][1].

The architectural question no RFP answers yet

If AI Act Article 26(10) targeted-search rule requires post-event facial recognition to run only against footage already lawfully recorded, and only for persons already suspected or convicted, and Italian Decree 160 proposes an architecture where the initial identification of a suspect occurs without a judicial order (after building the crowd’s biometric catalog) [1], what is the architectural difference between an AI-Act-compliant deployment and a decreto-italiano-compliant one?

LayerAI Act compliantDecree 160 (residual risk)
Image captureLegal, no biometric processingLegal, no biometric processing
Biometric templateOnly after specific suspicion + orderBuilt pre-event for everyone at the site
Search / matchingOnly with judicial order ex-ante or 48h ex-postNo order during initial-identification phase
Retention7 days, deletion-not-move7 days, deletion-not-move
Audit log5 years (per Garante request)5 years (per Garante request)

The difference is in a single row: when the biometric template gets built. AI-Act-compliant: after suspicion + order. Decree-160-style: pre-event, mass, conditional on a future suspicion that may never materialize. That row is exactly the one your RFP must name, and clause 1 (targeted-search-only) is the one that closes it contractually.

And the question that matters on October 11

On October 10, 2026, the Italian Council of Ministers formally closes the AI Act transposition window. If Decree 160 survives with the “initial identification outside judicial oversight” clause intact, it hands every EU member state a template for redefining “targeted search” out of existence [2]. If the European Commission or the CJEU later invalidates it, every deployment built on that architecture — including any LATAM deployment signed in Q4 2026 that a vendor offers as “AI Act compliant” without actually being so — becomes retrospectively non-compliant.

What the Garante + Benifei + Vedaschi + Graziani are saying together is that Decree 160 is not an Italian anomaly — it is the first stress test of the AI Act [5] in a major jurisdiction, and the result reveals where transposition will fail in Spain, France, Germany, and the adoption-trackers in LATAM. Your Q4 2026 RFP carries that risk even if your vendor never tells you.

P.D. If your facial-recognition vendor tells you Decree 160 “permits it” without more, ask them in writing to cite the exact AI Act clause it satisfies. If they can’t, or if they cite only Decree 160 without the AI Act, today is a good day to revisit the contract.

📌 Executive summary (1 minute)

Italy publishes Decree 160 (targeted AI search, Sep 2026) — second EU country with AI search law.

JurisdictionSpecific AI law2026 amendmentsFR restrictionPenalties
🇮🇹 Italy✅ Decree 160 + DL 144/2005Garante Q4 2025Live FR only with specific judicial order (Decree 160)5% revenue or €5M
🇪🇺 EU✅ EU AI Act (Reg 2024/1689)Applies Feb 2025 (FR/Real-time)Real-time FR in public spaces: requires ex ante authorization + judicial€15M or 3% revenue
🇺🇸 US federal❌ None (state patchwork)n/aState-level (IL BIPA, TX CUBI, CA CCPA)Variable by state
🇲🇽 Mexico❌ None specificn/aLFPDPPP generic$32M MXN

For a LATAM enterprise RFP, the asymmetry is 3× in penalty (EU €15M vs MX $32M MXN), 100× in pre-deploy restriction (EU judicial authorization vs MX none), and 2× in audit (EU annual mandatory vs others not required).

3 critical clauses for your RFP (based on Decree 160 + EU AI Act + 2026 LATAM context):

  1. “Purpose limitation” clause — FR used only for the purpose declared in the contract. Any reuse requires written amendment.
  2. “Judicial authorization before deployment” clause — For FR in public spaces, prior authorization with specific judicial order + limited scope.
  3. “Data minimization” clause — Retention ≤30 days, audit log 90 days, no cross-border reuse without consent.

Sources

[1] IACL-IADC Blog — Vedaschi & Graziani (Bocconi), “Making Crowds Searchable: Italy’s New Rules on Police Facial Recognition” (Oct 1, 2026). https://blog-iacl-aidc.org/2026-posts/2026/10/1/making-crowds-searchable-italys-new-rules-on-police-facial-recognition [2] People of Internet — “Italy’s Garante Finds Police Facial-Recognition Decree Incompatible With the AI Act’s Targeted-Search Rule” (2026-09-14). https://peopleofinternet.com/articles/italy-s-garante-finds-police-facial-recognition-decree.html [3] Garante per la protezione dei dati personali — Opinion on AG 418 (Titoli I e III), 14 luglio 2026. https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10275606 [4] Gazzetta Ufficiale della Repubblica Italiana — Decreto Legislativo 9 settembre 2026, n. 160 (pubblicato 15-set-2026). https://www.gazzettaufficiale.it/atto/serie_generale/caricaDettaglioAtto/originario?atto.dataPubblicazioneGazzetta=2026-09-15&atto.codiceRedazionale=26G00179&elenco30giorni=false [5] EUR-Lex — Regulation (EU) 2024/1689 (AI Act), full consolidated text. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng