AG 421 is a draft Italian scheme intended to align national rules with the EU AI Act. In practice, it represents a move from broad AI policy toward enforceable oversight: assigned authorities, supervisory powers, human review duties, and compliance expectations for organizations that build or deploy AI systems.
For cyber security teams, AG 421 matters because AI governance is also a controls problem. Risk-based rules can require human oversight, staff with enough AI literacy to spot failure modes, and traceability through logs and documentation. Those measures help prevent unsafe automation, support incident investigation, and show who could stop or override a system when needed. In real defenses, the draft points to concrete work: mapping AI use cases, naming responsible owners, and proving that oversight is not symbolic. In attacks or misuse, the same controls can limit harm from manipulated outputs, poor escalation, or blind trust in advisory AI.