Italy's new AI law: A milestone for synthetic data in healthcare

On 17 September, Italy made history by becoming the first EU country to formally recognize synthetic data in national law. The newly approved Disposizioni e deleghe al Governo in materia di intelligenza artificiale establishes a pioneering framework for the use of artificial intelligence in sensitive sectors, with a special focus on healthcare.

At its core are Articles 8 and 9: Article 8 explicitly legitimizes synthetic data as a tool for scientific and medical research, while Article 9 sets out governance mechanisms to support innovation under strong oversight. This marks a milestone for privacy-preserving healthcare AI and sets a precedent likely to shape Europe’s broader regulatory landscape.

Below are some of the new law’s key points.

Public interest status and streamlined oversight

Most importantly, the new law declares the processing of personal data for AI systems in healthcare research as a matter of “relevant public interest.” This designation removes the case-by-case justifications that previously slowed innovation and provides a clear legal basis for the use of AI in healthcare. It also aligns with:

• Article 6(1)(e) of the GDPR (public interest legal basis for data processing);
• Article 9(2)(j) of the GDPR (exceptions for scientific research involving sensitive data);
• Articles 32 and 33 of the Italian Constitution (protection of health and promotion of scientific research).

Article 8 also streamlines oversight. Instead of requiring ethics committee approval, projects can now begin 30 days after notifying the Data Protection Authority (Garante), unless objections are raised. This silent-assent mechanism accelerates research, allowing projects to move forward while maintaining regulatory safeguards.

The law further reduces bureaucracy and encourages collaboration through additional procedural changes:

• Simplified consent requirements: individual consent will no longer be required for specific research projects, reducing bureaucratic barriers.
• Expanded range of authorized entities: public institutions, non-profit private entities, IRCCS (Italian research hospitals), and private healthcare organizations collaborating with public or non-profits will be authorized to conduct AI research using synthetic data. This expansion is designed to foster robust public-private collaboration while ensuring appropriate oversight.

Explicit legal recognition for synthetic data

The new law marks the first explicit legal endorsement of synthetic data generation in Italy and the first legal recognition of synthetic data anywhere in the EU, setting a precedent that may shape future regulatory frameworks across Europe.

Article 8 authorizes the “processing for the purpose of anonymization, pseudonymization, or synthesis of personal data.” This explicitly recognizes data synthesis as a legitimate method of data processing, bridging the gap between innovation and privacy protection.

This law paves the way for synthetic data to be used in a wide range of healthcare applications, including:

• disease prevention and epidemiological studies;
• diagnosis and treatment optimization;
• drug development and clinical trials;
• medical device innovation;
• public health and policy studies.

Regulatory sandboxes for AI research

Article 9 mandates the creation of regulatory sandboxes – controlled environments where AI systems can be tested under real-world conditions, with regulatory supervision. A decree from the Minister of Health, expected within 120 days, will establish a new regulatory healthcare sandbox. This will aim to use the most simplified means allowed under the GDPR to facilitate research and experimentation, including via artificial intelligence and machine learning.

The sandboxes allow organizations to:

• Test AI models in safe, legally authorized settings.
• Document compliance with data protection and ethical standards.
• Benefit from temporary derogations or waived penalties for violations occurring during sanctioned experimentation.

Oversight will be shared between AGENAS (the Italian National Agency for Regional Healthcare Services), which will define technical standards, and the Garante (the Italian Data Protection Authority), which will ensure compliance with data protection rules.

Technical standardization

The law also mandates that AGENAS issue technical guidelines for synthetic data generation. These guidelines are expected to include:

• minimum sample sizes for training datasets;
• validation protocols for assessing the fidelity of synthetic data;
• interoperability standards to secure cross-institutional data sharing.

What this means for AI-driven healthcare research

This legislation marks a significant step forward in enabling privacy-preserving AI in healthcare. By explicitly recognizing synthetic data as a valid tool, Italy is becoming a leader in responsible AI adoption. The role of AGENAS in defining technical standards will also ensure that synthetic data generation adheres to robust privacy and security guidelines.

At Aindo, we see this as a validation of synthetic data’s crucial role in the future of medical and clinical research. For researchers, policymakers, and healthcare innovators, synthetic data is no longer just a promising technique, but a legally recognized enabler of healthcare AI. It offers a secure, scalable, and privacy-preserving way to unlock new insights in medicine – insights that will increasingly shape healthcare AI research in Europe.

Looking ahead

With the law expected to take effect in October, Italy has positioned itself at the forefront of ethical AI adoption. At Aindo, we are proud to support this transition by offering synthetic data solutions that meet the highest standards of safety, compliance, and scientific utility.

This is only the beginning. As Italy’s framework comes into force, we will continue to share insights on how synthetic data is transforming AI-driven healthcare research and shaping the future of responsible innovation across Europe.