Law 132/2025: What Accountants and Lawyers Must Do Now

Since October 10, 2025, using artificial intelligence in a professional firm without informing clients is no longer just a reputational risk — it is a violation of Law 132/2025, the first national law on AI in the European Union. Accountants, lawyers and HR consultants need to understand these obligations and act now.

What is Law 132/2025

Law no. 132 of September 23, 2025 — "Provisions and delegations to the Government on artificial intelligence" — was published in the Official Gazette (Gazzetta Ufficiale) General Series no. 223 on September 25, 2025 and entered into force on October 10, 2025.

It is not a simple ratification of the EU AI Act: it is a framework law with 28 articles across 6 chapters covering the sectors where AI's impact is most significant — healthcare, justice, public administration, employment, professions, security and national competitiveness.

Structure and key articles for professionals

The law sits alongside the obligations already in force since February 2, 2025 on AI literacy (Art. 4 AI Act) and the prohibition of banned practices (Art. 5 AI Act). Anyone who has not yet complied has outstanding requirements to address at the same time.

Who is affected

The short answer: all professionals who use AI, with no exceptions based on size or practice area.

The complete answer includes a trap that many firms overlook: management software with integrated AI features counts. If your accounting, payroll or document preparation software includes artificial intelligence functions — even ones you have not deliberately activated — you are subject to transparency obligations.

Practice areas directly affected include:

• Accountants and statutory auditors
• Lawyers and trainees
• HR and labour consultants
• Notaries
• Engineers and architects
• Doctors (in private practice)
• All members of national professional regulatory bodies

There is no size threshold. A sole practitioner who uses ChatGPT to draft client newsletters is subject to the law in exactly the same way as a 20-partner firm.

Art. 13 — Client disclosure

Art. 13 is the central provision for professionals. The text establishes two principles:

Paragraph 1 — The use of artificial intelligence systems in the intellectual professions is intended for the sole exercise of instrumental and support activities to the professional activity, with the intellectual work taking precedence over the service being delivered.

Paragraph 2 — To ensure the fiduciary relationship between professional and client, information about the AI systems used must be communicated to the recipient of the intellectual service using clear, simple and comprehensive language.

In practical terms, this means:

1. AI remains instrumental — it cannot replace the professional's intellectual work, only support it
2. Disclosure must be given in advance — before or at the start of the engagement, not after
3. The language must be accessible — a technical reference is not enough; the client must understand what is being used and why

Here is an example of a clause to include in an engagement letter:

"In carrying out this engagement, the Firm may use artificial intelligence tools for activities such as: drafting document templates, regulatory research, analysis of legal and financial texts, preparation of communications. The use of such tools always takes place under the supervision and direct responsibility of the professional in charge, who verifies and validates every output before use. Tools currently in use include: [list here]. The Client has the right to request that specific activities be performed without the assistance of AI systems, by notifying the Firm in writing."

This clause must be updated whenever a new AI tool is adopted or an existing declared tool is retired.

Disclosure templates already available

Several professional bodies and associations have published reference templates:

• CNDCEC (October 2025): standard contractual clause in Appendix D of the Guide
• CNF (October 13, 2025): standard disclosure template (non-binding, operational support)
• COA Florence: 3 alternative formulations (A = broad, B = narrow, C = concise)
• Confprofessioni/ANF (October 6, 2025): first national disclosure form for all professionals, with checkboxes for AI type, origin and usage mode

Sanctions regime

Direct sanctions under Law 132/2025

The law immediately introduces two relevant criminal provisions:

• Art. 612-quater of the Criminal Code (new): unlawful dissemination of deepfakes, punishable by imprisonment of 1 to 5 years
• Art. 61, no. 11-decies of the Criminal Code (new aggravating factor): for crimes committed through insidious AI or AI that has hindered the defence

Sanctions for professionals: the dual track

Art. 13 does not provide its own direct sanctions, but activates the pre-existing sanctioning system:

Disciplinary sanctions — Individual professional bodies are required to update their codes of conduct. As of March 2026, the CNDCEC is the only body to have done so with AI-specific provisions:

Civil liability — A professional dispute in which it emerges that AI was used undisclosed to draft an opinion or a contract can expose the professional to civil liability for damages. According to the C3I document (Italian Committee for Information Engineering), current professional indemnity insurance policies may not cover damages arising from undisclosed use of AI, with potential exclusion from coverage on grounds of gross negligence.

Administrative sanctions — The full administrative sanctions framework is delegated to the Government (Art. 24) within 12 months, i.e. by October 2026. It will grant AgID and ACN powers of oversight, inspection and sanctions in accordance with Art. 99 of the AI Act (up to EUR 35 million or 7% of global turnover for the most serious violations).

3 steps to comply immediately

Compliance does not require months. A firm starting from scratch can cover the essential obligations in two weeks if it follows a structured approach.

Step 1 — Audit AI tools in use

Before drafting any documents, you need to know what you are using. Involve all colleagues and ask: which AI tools do you use, for which activities, with which data? Include ChatGPT, Copilot, Gemini, AI functions embedded in management software, voice assistants — everything. The result is your starting register.

Step 2 — Draft the standard disclosure

Based on the register, prepare the contractual clause (as in the example above) and the separate form to deliver to clients with ongoing engagements. Existing clients must be informed if AI has already been used on their matter.

Step 3 — Update engagement letter templates

Revise your standard engagement letter template to include the AI clause. From this point forward, every new engagement starts already compliant. For ongoing engagements, deliver the separate form.

What remains to be done: the implementing decrees

Law 132/2025 is a framework law that delegates operational details to the Government through implementing decrees:

The decrees will define oversight procedures, detailed sanctions and the operational structure of AgID-ACN governance. Until then, Art. 13 obligations are already fully in force and enforceable.

---

Complying with Law 132/2025 is not a bureaucratic exercise to be delegated: it is an opportunity to formalise the AI use that is probably already happening in your firm, transforming it from a latent risk into a declared competitive advantage.

Explore our AI Act Ready service designed for professional firms, or download the free compliance guide from the Resources section. For the EU regulatory framework that Law 132/2025 builds upon, consult our AI Act guide. For questions about your specific situation, contact us.