Law 132/2025 and AI in healthcare: what changes for hospitals, pharmacies and pharmaceutical companies

What Law 132/2025 provides

Law 132/2025 does not transpose the European AI Regulation (AI Act, Regulation (EU) 2024/1689), which like any regulation applies directly: it accompanies and supplements it within the Italian legal framework, without adding obligations beyond the regulation (Art. 1(2), Art. 3(5)). For AI in healthcare it sets its own principles (Arts. 7-10); classifying systems as high-risk remains a matter for the AI Act (Art. 6 and Annexes I and III), not the Italian law.

For healthcare organisations with high-risk systems, the AI Act's key points include: documenting the entire lifecycle of the AI system (from design to deployment), keeping risk management up to date, and effective human oversight of the outputs. The Italian law adds that in clinical settings the decision always rests with the doctor (Art. 7(5)).

Implications for those buying AI in healthcare

For hospitals, local health authorities (ASL), pharmacy chains and pharmaceutical companies, Law 132/2025, read together with the AI Act and GDPR, raises three operational questions:

• Data residency, a choice rather than an obligation: the law does not require data to reside in Italy or the EU. The only related provision is a preference criterion for public-sector e-procurement platforms (Art. 5(1)(d)). GDPR rules on transfers outside the EU still apply: you still need to know, and document, where health data is processed.
• Output governance: in a clinical setting AI is a support and the decision stays with the doctor (Art. 7); for high-risk systems the AI Act requires logs (Art. 12) and human oversight (Art. 14). A disclaimer is not enough: you need an architecture that implements these controls by design.
• Secondary use of data: Art. 8 allows research to make secondary use of data without direct identifiers without new consent, after notifying the Garante; a legal basis and documented anonymisation or pseudonymisation measures are still required.

How Nexus MDS Core addresses these requirements

Nexus MDS Core was designed with these regulatory constraints as architectural requirements, not as features added after the fact. In practice:

• Controlled perimeter: Indexing, retrieval, identity and audit run inside your perimeter. Generation runs on a local model or on a replaceable EU endpoint — your choice per workload. No hyperscaler lock-in.
• End-to-end audit trail: every interaction with the system — query, response, source used, model invoked — is recorded in an tamper-evident log, available for regulatory inspections.
• Pipeline designed around GDPR requirements: anonymisation of personal data at ingestion, encryption at rest and in transit, Zero-Trust authentication with Keycloak OIDC/PKCE.
• Grounded RAG: the RAG system uses only curated and verified document sources, reducing the risk of hallucination on clinical content.

Timeline and deadlines

Law 132/2025 lands in an already crowded regulatory calendar. Healthcare and pharmaceutical organisations have to find their way through overlapping deadlines:

• February 2025: the AI Act's outright prohibitions take effect (prohibited AI practices, Art. 5).
• August 2025: compliance obligations for general-purpose AI (GPAI) models under the AI Act (Arts. 51-56).
• September-October 2025: Law 132/2025 is published in the Gazzetta Ufficiale (Italy's official journal) no. 223 of 25 September 2025, and comes into force on 10 October 2025.
• December 2027: the obligations for high-risk AI systems under Annex III of the AI Act apply, including some healthcare uses such as emergency triage (from 2 December 2027: Regulation (EU) 2026/1744 moved the date, previously August 2026).
• August 2028: deadline for compliance with the AI Act's requirements for AI systems embedded in medical devices and in vitro diagnostics (Annex I, from 2 August 2028 after Regulation (EU) 2026/1744).

The message for healthcare organisations is clear: even with the dates moved, the window to adapt is measured in months, not years. Anyone starting an AI project in healthcare today has to design it for compliance from the outset, not plan to retrofit it later.

How it compares with the European framework

Law 132/2025 does not replace the AI Act — it embeds it in the Italian context. The distinction matters: the AI Act sets the general framework (risk classification, obligations for providers and deployers, governance of GPAI models), while the Italian law adds national specifics.

The main Italian additions concern:

• National authorities: AgID (Agenzia per l'Italia Digitale, the Agency for Digital Italy) is the notifying authority and ACN (Agenzia per la Cybersicurezza Nazionale, the National Cybersecurity Agency) the market surveillance authority and single point of contact (Art. 20); the Bank of Italy, CONSOB and IVASS remain competent in their sectors. The Garante Privacy (the Italian data protection authority) keeps its powers but is not an AI authority under the law: Legislative Decree 179/2026 gives it supervision only for Art. 74(8) of the AI Act.
• Public healthcare: principles for AI systems used in the SSN (Servizio Sanitario Nazionale, Italy's national health service): the decision rests with the doctor, patients are informed, systems and data are checked periodically (Art. 7), and an AI platform run by AGENAS supports community care (Art. 10).
• Professional training: the AI Act already provides for AI literacy measures (Art. 4, softened by Regulation (EU) 2026/1744). The Italian law delegates to the Government; the concrete obligations, such as an AI share of continuing medical education (ECM) for healthcare staff, arrive with Legislative Decree 179/2026.

For pharmaceutical companies, the combination of the AI Act, Law 132/2025, GDPR and NIS2 creates a regulatory framework that makes sovereign AI infrastructure the most direct way to know, and show, where data runs and who controls it. None of these rules requires data residency; but organisations on public cloud that do not know where health data is processed struggle to document transfers and controls. For more on the specific implications for healthcare, see our focus on on-premise AI for healthcare.

Conclusion

Law 132/2025 is not an obstacle to AI innovation in healthcare — it is a framework that makes explicit requirements that AI architectures should have met anyway. For organisations evaluating AI platforms, the question to ask is no longer "which language model should we use" but "which infrastructure lets us use it in a compliant, sovereign and verifiable way".