Artificial Intelligence in health care: Impact of the new draft law approved by the Italian Council of Ministers

The Italian Council of Ministers approved^[1] a draft law on principles governing artificial intelligence, designed to provide an initial national framework for artificial intelligence systems. The draft law comes in the wake of the European Regulation on AI—known as the AI Act—which is expected to be published in the coming weeks. The text will then have to be approved by both houses of parliament.

Specific areas 

The draft law has impact on specific areas, including the national strategy for AI, national authorities, promotional actions, and copyright protection. It introduces provisions for certain sectors, including the healthcare sector.

One provision provides a proxy for the Italian government to shape national legislation to the AI Act by adopting one or more legislative decrees on the basis of guideline criteria. Those include providing literacy and training courses on the use of AI systems for citizens and professionals, with the involvement of university institutions and appropriate professional organizations.

In the healthcare sector, the draft law touches on issues of accessibility and transparency of AI systems used in research and care. However, the draft law provisions don’t seem to add much to the AI Act, although the AI Act provisions are more general and unrelated to specific sectors.

The passages on data processing in research and treatment activities for development of AI systems used in the healthcare context are more interesting. However, this information is not consistent with the very recent amendment of Article 110 of the National Privacy Code^[2] by the law converting what is known as the NRRP decree.^[3]

Also worth noting is the intention to establish an artificial intelligence platform to support treatment and regional assistance. Design and implementation of the platform will be the responsibility of the National Agency for Regional Health Services (Agenas).

Transparency and treatment accessibility

Article 7 of the proposal focuses on the use of artificial intelligence systems to improve treatment and access to care, especially for people with disabilities, while ensuring that there is no discrimination of any kind. The article also establishes the rights of individuals to be informed about the use of these technologies, their relative diagnostic and therapeutic benefits, and the logic they employ to make decisions.

Some provisions restate transparency obligations for high-risk AI systems previously provided in the AI Act, tailoring them to the healthcare field.

For example, Article 13 of the draft law requires users to be informed of “the characteristics, capabilities and performance limitations of the AI system.” Also, under the GDPR, data controllers must inform data subjects of the possible existence of an “automated decision-making process” and its underlying operating logic when personal data are not collected directly from the data subject.^[4] Similarly, issues of accessibility to AI systems and non-discrimination were generally addressed by the AI Act.

Moreover, Article 7 of the draft expressly assigns AI systems in the healthcare context to support prevention, diagnosis, treatment, and therapeutic choice processes; physicians and other healthcare professionals remain responsible for final decisions about specific treatment.

On the subject of human intervention and interaction between natural persons and artificial intelligence, the AI Act^[5] provides broader “human oversight” obligations with bearing throughout the lifecycle of high-risk AI systems, before and after they are placed on the market, to ensure human control over system operation and the opportunity for humans to intervene at any time, including acting on system-generated output.

Research and scientific experimentation

Article 8 is key to this healthcare sector draft. It covers processing of data, “including personal data,” for research and scientific experimentation in the implementation of AI systems for the prevention, diagnosis, and treatment of disease and development of new drugs and therapies.

When such processing operations are necessary for the creation and use of databases and basic models and are carried out by public and private nonprofit entities, they are expressly declared to be of “substantial public interest” under Article 9 g) of the GDPR. That article authorizes processing health data when “necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.” Such processing may occur without the consent of data subjects, provided that specific security measures are taken and appropriate information is provided to the data subjects. This provision essentially concerns data, including patients’ personal data, used to train AI algorithms for scientific research.

Moreover, the same parties may make secondary use of personal data “devoid of direct identifying elements” (meaning it is pseudonymized) for the same research purposes. This is always authorized without the further consent of the data subjects, even where required by law, without prejudice to the obligation to provide information, which may also be discharged by providing data subjects with a general information notice on the data controller’s website.

In both cases, data processing must:

• be subject to approval from the relevant ethics committees;
• be communicated to the Data Protection Authority (Garante per la Protezione dei Dati Personali – “Garante”), including all the information provided in Articles 24, 25, 32, and 35 GDPR and express indication, where necessary, of the parties identified pursuant to Article 28.

Processing may begin thirty days after such communication, unless the Garante intervenes. It is not clear how these provisions can be coordinated with existing legislation, which provides exceptions to the consent rule in medical, biomedical, and epidemiological research. The solution contained in the draft law appears simplistic to say the least, and changes are to be expected once the Garante is called upon to express an opinion on the text during the approval process.

New procedure

A new authorization procedure covers processing personal data for research purposes and in relation to artificial intelligence. However, it does not appear to be fully consistent with either the GDPR or the Italian Privacy Code, which do not require a national authority to get involved when the processing is deemed to be in the public interest.

For secondary use of the data, this procedure and the involvement of the Garante are not in sync with the current provisions that provide very rare exceptions to consent, nor are they consistent with the very recent and long-awaited amendment of Article 110 of the Privacy Code by Law Decree 19/2024, commonly known as the PNNR decree.^[6]

As for the secondary use of data for biomedical and epidemiological medical research, the decree has eliminated the need to consult the Garante in advance if informing data subjects proves impossible or involves disproportionate effort, or risks making it impossible to achieve the research purposes or at least seriously impedes those goals. The decree covers compliance with guarantees the Garante will adopt under the deontological rules for processing for research purposes^[7] in the Personal Data Protection Code. In all cases, the appropriate ethics committee still needs to issue approval.

The provisions of Article 8 of the draft law concern only public and private nonprofit entities. This means that without clear justification—and demonstrating a lack of knowledge of how research (including medical research) is carried out in Italy—for-profit businesses, such as pharmaceutical companies that conduct experimental activities at research centers in Italy as sponsors, are excluded.

New platform for artificial intelligence

Article 9 of the draft law assigns Agenas to design, implement, and commission a national artificial intelligence platform that can support care and assistance activities on the ground. Services provided will assist:

• health professionals in taking care of patients;
• doctors in their daily practice with “non-binding suggestions”;
• users to access health services.

Subject to the opinion of other authorities (the National Cybersecurity Strategy Agency – ACN, the Ministry of Health, and the Garante), Agenas shall determine the types of data processed and the operations performed on the platform and also shall establish technical and organizational measures to ensure a level of security calibrated to the risk. Acting as data controller, it shall protect the rights of data subjects.

According to the current text of the draft, the platform shall be created under a financial invariance clause that states it must not cause a greater burden for public finance. If that text remains in place, it is certain to hinder effective and prompt implementation of the platform.

Moreover, Agenas previously committed to creating an artificial intelligence platform to support primary care as part of the objectives of the NRRP,^[8] but the ongoing competitive bidding for the work was suspended at the beginning of this year after the Garante pointed out that there was no legal basis for the data processing to be carried out through the platform. This may prove to be the right time for that to proceed.

Prospects

This legislative initiative certainly offers great potential for AI development in Italy in various sectors, including the healthcare sector. However, it is still too early to predict what its actual impact will be.

First, we will have to wait for the proposal to work its way through the legislative process. That may result in substantial modification of the text—hopefully also eliminating some of the inconsistencies pointed out above—and issuance of implementing ministerial decrees. The latter will be of fundamental importance, because some of the bill’s provisions are very general and not yet fully formed. The path to actual implementation can be expected to be long and winding.

[1] On April 23, 2024.

[2] Legislative Decree No. 196/2003.

[3] National Recovery and Resilience Plan decree, i.e. the Decree Law No. 19/2024.

[4] Article 14 p.2 g).

[5] Article 14.

[6] The amendment was introduced by Law 56 of 29 April 2024.

[7] Article 106 p.2 letter d.

[8] Mission 6 “Health,” sub-investment 1.2.2.4.