Artificial Intelligence in Public Administration under Law No. 132/2025
Abstract
This paper examines the legal framework governing artificial intelligence within the public administration following Law no. 132 of 23 September 2025 and recent administrative case law. The study develops along three interrelated dimensions: the systematic interpretation of Article 14 of Law no. 132/2025 in conjunction with Regulation (EU) 2024/1689, addressing the tension between the universal human decision-making reserve and the prohibition of gold plating; the procurement of automated solutions under Articles 30 and 35 of Legislative Decree no. 36/2023, coupled with cybersecurity and national security requirements under the Prime Ministerial Decree of 30 April 2025; and the judicial protection of digital legitimate expectations against algorithmic malfunctions, contrasting administrative revocation under Article 21-nonies of Law no. 241/1990 with the restitution of undue payments, alongside access to source code versus trade secrets. The analysis concludes that algorithmic legality strictly subordinates automated tools to constitutional principles of transparency and administrative accountability.
Key Legal Takeaways
- Universal human decision-making reserve: Article 14 of Law no. 132/2025 extends the principle of non-exclusivity and the strictly ancillary function of artificial intelligence to every administrative proceeding, going beyond the risk-based classification laid down by the European AI Act.
- Algorithmic legality and internal rules: Deploying automated systems requires a specific statutory basis; internal administrative regulations and operational guidelines act as instruments of organisational self-restraint whose breach vitiates the final administrative measure on grounds of misuse of power ( eccesso di potere ).
- Public procurement and strategic security: Article 30 of Legislative Decree no. 36/2023 mandates the availability of source code and the intelligibility of the computational model, whereas the Prime Ministerial Decree of 30 April 2025 introduces minimum cybersecurity requirements (SBOM) and award bonuses for European and allied technological supply chains.
- Defective formulas and digital legitimate expectations: Rectifying a flawed algorithm cannot circumvent the participatory safeguards and statutory forfeiture time-bars set out in Article 21- nonies of Law no. 241/1990, nor may a public authority invoke proprietary software rights or IT outsourcing to evade its burden of proof in judicial proceedings.
