In recent years several Italian municipalities trialled “points-based citizenship” schemes that closely echoed the much-criticised Chinese social-control model: virtuous-citizen wallets, digital licences, scorecards. Today that debate has a new legal frame: since 2 February 2025, social scoring is an AI practice prohibited by Article 5 of the AI Act. What remains of those projects, and what should local authorities know?
A number of Italian municipalities, over the past few years, were drawn to the idea of measuring citizens’ reliability in their dealings with public administrations, so as to nudge them towards virtuous choices — futuristic projects strongly reminiscent of the criticised Chinese social-control model. This seems the right moment to pick up that thread again, since the legal framework has meanwhile changed profoundly.
The season of “points-based citizenship”
It is worth revisiting the most significant cases of that season. In Bologna two singular projects stood out. The first, project Pollicino, under the patronage of the European Commission and in cooperation with SRM and Tper — “digital crumbs dropped by citizens as a trace of their movements around the city, as in the tale of Tom Thumb” — was promoted by the National Observatory on Sharing Mobility. The second, the Smart Citizen Wallet, introduced a “digital licence” for virtuous citizens using administrative services in the fields of energy, road traffic and waste sorting.
In Rome, the Citizen Wallet was presented — a wallet full of rewards for citizens reaching certain positive behavioural levels. In Fidenza, the allocation of public housing (ERP) fell within the “Assignee Card” project, with families’ conduct scored and rewards or penalties following — up to termination of the tenancy. In Bergamo, nudging techniques encouraged citizens to move more and be greener (“the more you pedal, the more you are rewarded”, the opt-in of the Pin Bike programme). And, last but not least, Ivrea, with the Smart Ivrea Project presented in 2020 by the Agency for Digital Italy (AGID) as a national landscape community for the governance of smart communities.
The first warning: the Garante’s investigations
As early as 2022 the Italian Data Protection Authority (Garante) had deemed troubling the social-scoring mechanisms rewarding “virtuous” citizens, opening three investigations into the municipalities of Bologna and Fidenza. In its statement the Authority noted that its intervention was made necessary “by the risks connected to profiling mechanisms entailing a sort of ‘points-based citizenship’, from which negative legal consequences may follow for the rights and freedoms of data subjects, including the most vulnerable”, and called on “all local authorities to assess with the utmost care any future adoption of ‘social scoring’ schemes or derivations thereof”, stressing “the need for such initiatives always to be preceded by careful impact assessments”. At the time, the Authority urged everyone to await the finalisation of the AI Act. That wait is over.
The turning point: Article 5 of the AI Act
Regulation (EU) 2024/1689 — the AI Act — has placed social scoring among the prohibited AI practices. Article 5(1)(c) bans the placing on the market, putting into service or use of AI systems “for the evaluation or classification of natural persons or groups of persons over a certain period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics, where the social score leads to” detrimental or unfavourable treatment in social contexts unrelated to those in which the data were originally generated, or treatment that is unjustified or disproportionate to the social behaviour.
As to timing, Article 113 leaves no room for doubt: the Regulation “applies from 2 August 2026. However: (a) Chapters I and II apply from 2 February 2025.” Chapter II is precisely the one on prohibited practices: the ban on social scoring is therefore already fully applicable since 2 February 2025, and was not touched by the deferrals introduced by the so-called Digital Omnibus, which concerned the obligations for high-risk systems, not the prohibitions.
This point is crucial for local authorities: the line drawn by the norm does not strike down every reward mechanism, but those systems whose score produces detrimental treatment in contexts disconnected from that of data collection, or disproportionate to the behaviour. This is exactly the terrain on which the most problematic experiences of the points-based-citizenship season operated — think of a behavioural score leading to the loss of public housing, where detached from the original collection context or disproportionate.
Conclusions
The parabola of Italian “points-based citizenship” is, on closer inspection, a textbook case: projects born under the banner of innovation and gamification found themselves, within three years, first under the Garante’s scrutiny and, today, before a directly applicable European ban backed by the most severe sanctions of the entire AI Act. For municipalities the lesson is twofold: every reward mechanism based on AI systems must be tested, first, against Article 5 and, in any case, preceded by careful data-protection impact assessments.
In the light of the above, one wonders whether the season of “deserving” citizens can truly be considered closed, or whether it risks re-emerging in new and more sophisticated guises; it falls to local authorities to distinguish the lawful incentive from the prohibited social score, without letting a given conduct entail prejudicial consequences detached from the context of collection or disproportionate to it.