On 8 October 2026 Legislative Decree No 179 of 7 October 2026 was published in Official Gazette (Gazzetta Ufficiale) No 234; it is the second of the decrees implementing Law No 132 of 23 September 2025 and enters into force on 23 October 2026 (Official Gazette (Gazzetta Ufficiale)). Article 41(1) requires an employer that makes use of artificial intelligence systems to ensure that “final decisions concerning the establishment, modification or termination of the relationship, including disciplinary measures and performance assessments, are not adopted solely on the basis of automated processing” (our translation). The same paragraph specifies: “Activities of searching for and selecting applications do not fall within the final decisions concerning the establishment of the employment relationship, even where they entail non-admission to the subsequent stages of the selection.” The clarification was inserted after the opinions on the draft, as reported in press release No 185 of the Council of Ministers on its meeting of 4 August 2026 (Italian Government). We dealt with the overall framework in examining the Italian implementation of the AI Act; our concern here is solely the clarification on selection, which leaves outside the prohibition the stage in which the gender biases of automated systems produce their effects.
The scope of the prohibition: the final decision and the stages that precede it
Article 41 reserves the definitive decision “to a natural person exercising effective and autonomous power” and establishes that “The worker’s consent does not constitute an exception to the prohibition laid down in this paragraph”. Paragraph 3 grants the worker the right to obtain, on request and through the intervention of a natural person, “an intelligible statement of reasons for the decision concerning them”, including the influence of the artificial intelligence systems and the main parameters considered; paragraph 4 provides that “Decisions taken by the employer in breach of paragraph 1 are null and void.” (Official Gazette (Gazzetta Ufficiale)).
Everything that precedes the final choice remains outside the prohibition: the search for profiles, the screening of applications, exclusion from the subsequent stages. A person rejected by a system that ranks CVs does not receive, for the purposes of the national provision, a decision on the establishment of the relationship, even though for that person the procedure ends there. In our view, since the right to a statement of reasons belongs to the “worker” and nullity attaches to breaches of paragraph 1, neither of the two safeguards reaches the candidate excluded at pre-selection.
The choice has a formal coherence, because the decision to hire is a single one. The practical result is that the human reservation comes into play when the pool of candidates has already been reduced by the system. If the automated ranking has penalised female candidates, the recruiter choosing among the top names operates, in our view, on a set that has already been altered, and their decision, formally human, inherits the effect.
Automated rankings in the Commission’s draft guidelines: a high-risk use
The European Commission described this dynamic in the draft guidelines on the classification of high-risk systems, put out to consultation from 19 May to 23 July 2026; according to the Commission, the final guidelines will be adopted by the end of 2026 (European Commission). Among the examples relating to point 4(a) of Annex III to Regulation (EU) 2024/1689 (AI Act), the summary published by the AI Act Service Desk examines an automated job matching and ranking tool: even though recruiters may override the recommendations, “the system’s rankings and scores serve as a primary input for decision-making”, and the system “could lead to low ranking or exclusion of candidates of a certain gender or of candidates with disabilities”. For this reason it is classified as high-risk (AI Act Service Desk). In its general part the draft adds that human involvement does not affect classification, because it does not change the intended purpose of the system, and that the filter in Article 6(3) does not cover systems that attribute a score or ranking to the data relevant to the decision (paragraphs 70 and 93) (AI Act Service Desk). As Nicola Fabiano observes (NicFab), human oversight is a requirement of the high-risk system, not a way out of the category; in our view, therefore, the reservation of the final decision provided for in Article 41 does not change the classification of the system that ranks the candidates.
The text of Annex III is, moreover, explicit: systems intended for recruitment or selection are high-risk, “in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates”; Article 6(3) adds that an Annex III system “shall always be considered to be high-risk where the AI system performs profiling of natural persons” (EUR-Lex). Union law locates the risk precisely in the stage that the Italian decree excludes from the prohibition.
The AI Act’s data obligations: application deferred to 2 December 2027
The AI Act governs this stage through data obligations. Article 10(2) requires providers to adopt governance practices which include “examination in view of possible biases that are likely to […] lead to discrimination prohibited under Union law” (point (f)) and “appropriate measures to detect, prevent and mitigate possible biases” (point (g)); Article 26(4) places on the deployer, to the extent that it exercises control over the input data, the obligation to ensure that such data are relevant and representative (EUR-Lex).
These obligations are not yet applicable. Regulation (EU) 2026/1744, the Digital Omnibus on AI, amended Article 113 of the AI Act: Chapter III, Sections 1, 2 and 3, applies from 2 December 2027 to systems classified as high-risk under Annex III (EUR-Lex). Until that date the data quality obligations do not bind providers of selection systems.
The new Article 4a, which also allows deployers to process special categories of data in order to detect biases, “does not create any obligation to conduct such bias detection and correction” (EUR-Lex); and since sex does not appear among the categories in Article 9(1) of Regulation (EU) 2016/679 (EUR-Lex), checking for gender bias does not, in our view, require that derogation.
The safeguards already in force: data protection and the Equal Opportunities Code
Until December 2027 automated pre-selection is nonetheless not without rules. Article 22(1) of Regulation (EU) 2016/679 grants the right not to be subject to a decision “based solely on automated processing, including profiling”, which produces legal effects or similarly significantly affects the person; recital 71 mentions among the examples “e-recruiting practices without any human intervention” (EUR-Lex). The clarification on selection does not restrict this safeguard, because Article 41 opens with the clause “Without prejudice to Article 22 of Regulation (EU) 2016/679”. We therefore consider that the automated exclusion of a candidate must be assessed under Article 22 according to the way in which it is actually produced, as we observed in commenting on the fine imposed on Uber for automated deactivations.
The oldest safeguard, however, is a national one. Article 27(1) of Legislative Decree No 198 of 11 April 2006 (Code of equal opportunities between men and women) prohibits any discrimination in access to employment, “including selection criteria and conditions of recruitment” (our translation); paragraph 2(b) prohibits it even where carried out indirectly “through pre-selection mechanisms” (Normattiva). Article 25(2) defines as indirect discrimination a provision, criterion or practice, “apparently neutral”, which puts or may put “candidates in the selection stage” of a given sex at a particular disadvantage (Normattiva). The provisions cited make no mention of algorithms or automated systems. We nonetheless consider that an algorithmic ranking is, to all intents and purposes, a pre-selection mechanism based on apparently neutral criteria.
Article 40 completes the picture: where the claimant provides factual elements, “inferred also from statistical data relating to recruitment”, capable of grounding in precise and consistent terms the presumption of discriminatory conduct on grounds of sex, the burden of proving that there has been no discrimination lies with the respondent (Normattiva). For the employer, proof to the contrary depends on the documentation of the pre-selection system.
Critical aspects: the scope of the prohibition, the timing of application and information to candidates
The first aspect is the misalignment between rule and risk. The national prohibition protects the final decision, whereas gender biases arise in the stages that precede it.
The decree itself confirms this. Article 48, which according to Nicola Fabiano’s reconstruction (NicFab) did not appear in the draft, allows employment services, whether public, authorised or accredited, to use artificial intelligence also for “matching labour supply and demand”, making its use subject to the “guarantee of human oversight” and of the transparency of decisions (Official Gazette (Gazzetta Ufficiale)). The result, in our view, is an asymmetry: human oversight accompanies the entire use of the system if pre-selection is carried out by an employment service, but only the final decision if it is carried out by the employer.
The second aspect is temporal: until 2 December 2027 only Article 22 of the data protection Regulation and the Equal Opportunities Code remain, safeguards that can be invoked once the exclusion has already occurred.
The third aspect concerns information. The reversal of the burden under Article 40 requires factual elements, including statistical ones, which the excluded candidate does not as a rule possess; the candidate is often unaware even that an automated ranking has been used, and the statement of reasons under Article 41(3) is reserved to the worker. Without information on how the system works, the reversal of the burden of proof remains difficult to trigger. For platform work, by contrast, Directive (EU) 2024/2831 requires candidates to be informed of the automated systems used before the procedure starts, as we noted in discussing algorithmic management in platform work. Added to this is a split between subjects: compliance with the data requirements of Article 10 is ensured, under Article 16(a), by the provider, whereas discrimination in access to employment is attributed to the employer. The person who answers for the discrimination does not necessarily coincide with the person who governs the data on which the system was trained.
Conclusions
From 23 October 2026 Article 41 of Legislative Decree No 179/2026 reserves to a natural person the final decisions on the employment relationship, but not the search for and selection of applications; the AI Act obligations for selection systems run from 2 December 2027. In the meantime the pre-selection stage is covered by Article 22 of Regulation (EU) 2016/679 and by Articles 25, 27 and 40 of the Equal Opportunities Code. In our view, employers would be well advised to measure periodically the distribution by sex of the results of every stage in which a system filters or ranks candidates, to document it for the purposes of proof under Article 40, to obtain contractually from the provider information on the data and on bias checks, and to place an effective human intervention before exclusion, not only on the final shortlist.
Author: Valentina Grazia Sapuppo
