Italian banks answer to Banca d'Italia and insurers to IVASS, and neither has issued an AI agent training rule. Both expect sound organisation, qualified staff and accountable management, while the EU AI Act adds literacy and human oversight duties. Staff who review agent work in Italy must show they can judge it, stop it and explain it.
What do the Italian supervisors expect, in substance?
Both supervisors start from governance. A bank or insurer must be organised to manage its risks, with clear responsibilities, internal controls that operate, and people qualified for the roles they hold. Outsourcing does not move responsibility, and the board answers for the business model, including the parts automated by technology.
For insurers, IVASS also oversees how products are distributed and how claims are handled, both areas where agents are useful. Insurance distribution rules already require people who sell insurance to keep their professional knowledge current through ongoing training. An agent that drafts product explanations or renewal letters does not remove that duty from the person who sends them.
The cross-border layer is the same as elsewhere in the EU, but it bites hard in Italian insurance. The EU AI Act lists risk assessment and pricing for life and health insurance, and credit scoring of individuals, as high-risk. For those uses, Article 14 requires human oversight by people able to understand the system, notice automation bias, interpret its output and intervene, and Article 26 requires deployers to assign that oversight to people with the necessary competence, training and authority. Article 4 asks every provider and deployer to take measures for sufficient AI literacy among staff. DORA covers ICT risk, including training, for both banks and insurers.
Who does this reach?
Banks, payment institutions and other intermediaries supervised by Banca d'Italia, with the largest banks under ECB banking supervision. Insurers and insurance intermediaries supervised by IVASS. Many Italian groups sell insurance through bank branches, so the same staff can sit under both supervisors at once, and an agent drafting a policy summary in a branch touches both regimes.
The Garante, Italy's data protection authority, oversees personal data use across all of them. It has shown it will act on AI services that process personal data without a clear basis, which makes GDPR literacy part of oversight competence, not an extra.
What does oversight skill mean when the agent acts?
Agents in Italian financial firms tend to work in four places, each at a different depth and each asking a different skill of the person overseeing it:
- Customer letters and policy summaries, usually depth 2: the agent drafts and a person sends, so the overseer checks accuracy and suitability before anything leaves.
- Claims file preparation, depth 2 or 3: the overseer spots missing evidence and external claims, such as an emailed repair estimate, being treated as fact.
- Credit file assembly, depth 1 or 2: the overseer recognises that a high-risk use needs active review, not a glance.
- Routine payment operations, depth 3 or 4: the overseer approves or declines held payments within the firm's limits.
Across all four, staff need the same core, set out in our guide to AI literacy and certification for people who work with agents: knowing which depth applies, reading the verdict, knowing that refused and withheld actions are not theirs to override, and expecting the agent's certificate to lapse after 90 days. A run that clears no depth drops the agent to depth 1 the same day, and the team must be ready to absorb its work.
The skills matrix for an AI agent team is the simplest way to see who holds which of these skills, and where one absence would leave a capability without a qualified approver.
How do you meet these expectations?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Qualified staff for each role | Role-specific training and an expiring credential for every reviewer | Credential register with issue and expiry dates |
| Human oversight for high-risk uses | Approval rights for credit and life or health pricing limited to certified staff | Approvals in the agent's record matched to current credentials |
| AI literacy across staff | Foundation-level training for everyone who uses agent output | Completion records by department |
| Distribution competence | Advisers trained to check agent-drafted product explanations | Review decisions with edits and reasons |
| Data protection | GDPR checks built into the review of any draft using personal data | Decline reasons citing data use; DPIA updates |
Expiry matters more than it looks. Agents change, and their certificates lapse on a fixed cycle; staff credentials that never expire describe a system that no longer exists. The reasoning is set out in why certificates for AI agent skills should expire.
What will an inspector ask?
Banca d'Italia and IVASS inspectors work from the organisation outwards. Expect: show the governance for this agent and who approved its use; list the staff who can approve held actions and their qualifications; sample decisions and show the reviewer's competence at the time; explain what happens when the agent drops to depth 1; show how the board was informed. The Garante, if it looks, will ask about the lawful basis, the DPIA and how a person can contest a decision. The practical approach to answering is covered in how to show AI literacy to a regulator, and the Dutch equivalent in De Nederlandsche Bank and AFM expectations.
What is outside these expectations?
They do not set a curriculum, hours or an approved provider. They do not say which uses outside the AI Act's high-risk list need human approval; that remains a risk decision. They do not settle employment questions about using review records to assess staff. And supervisors will not accept training evidence as a substitute for a working control: a certified reviewer who approves everything without reading it fails the test as surely as an untrained one.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy builds oversight skill on the real product rather than in slides: every lab runs in a free Build workspace, and module tests are set in the learner's own industry and role, so an Italian claims handler practises on claims. Certificates are issued through VerifyDoc.ai, show their expiry, and can be checked at source by an inspector by number or QR code.
Questions people ask
Is a bank branch adviser who sends an agent-drafted letter overseeing an AI system?
In practice, yes. They are the last person before the letter reaches the customer. Whether formal Article 14 duties apply depends on whether the use is high-risk, but the competence needed to check the draft is the same.
Do IVASS and Banca d'Italia coordinate on AI?
Both work within EU frameworks set through EIOPA and the EBA, and groups that sell insurance through banks face both. Plan training so one credential record can answer both supervisors.
How often should oversight skills be reassessed?
At least yearly, and whenever an agent gains a capability or a higher depth. Reassessing when the agent changes keeps human competence aligned with what the agent actually does.