Skip to content

What is Italy's golden power?

Special powers letting Italy's government screen deals in strategic sectors, including cloud providers and critical tech.

Golden power is the set of special powers the Italian government can exercise to impose conditions, prescriptions, or block corporate transactions (acquisitions, mergers, resolutions) involving companies active in sectors considered strategic for national security and interests: defense and national security, energy, transport, communications and, since 2019, broadband networks using 5G technology. The instrument was introduced by decree-law 21/2012, converted with amendments by law 56/2012, which replaced the earlier golden share regime. The mechanism is triggered by a prior notification to the Prime Minister's Office filed by the companies or acquirers involved: without notification, or in case of breach of the imposed conditions, the government can oppose the transaction, impose conditions or, in the most serious cases, void it. The scope has expanded over the years to include technologies deemed critical, including artificial intelligence, semiconductors, cybersecurity and cloud infrastructure.

See also: Digital sovereignty · An organization's effective control over its data, infrastructure and technology: who can access it, who can compel disclosure, who it depends on.

Why it concerns buyers of technology, not only sellers of companies

Golden power is almost always told from the point of view of whoever sells or acquires a stake: legal advisors, M&A bankers, press releases announcing the government's green light. Less told is the side of whoever buys and uses the technology: a company selecting a cloud provider, or evaluating the acquisition of an Italian technology scale-up to integrate its data platform, needs to understand that that provider's ownership is not a stable fact over time. DPCM 179/2020 already flagged intellectual property on critical technologies in healthcare and on artificial intelligence, robotics, semiconductors, cybersecurity, nanotechnology and biotechnology as relevant to golden power's application. The Pirelli case, with the 9 April 2026 golden power decree protecting its "Cyber Tyre" technology, shows the scope keeps widening toward specific technology assets, not only entire sectors.

The practical angle: due diligence and vendor evaluation

For anyone acquiring an Italian technology scale-up, golden power adds a concrete line item to due diligence: checking whether the target's activity falls within notifiable sectors or technologies, and whether the deal requires prior notification before closing, with the timeline that entails for the deal calendar. For anyone choosing or re-evaluating a cloud provider, the useful question differs from the one about digital sovereignty: not "where is my data" but "can control over this provider change hands, and if it does, what happens to service continuity." A change of control at a strategic cloud provider can, in theory, trigger the same scrutiny applied to an industrial acquisition: an operational risk worth writing into supply contracts and exit clauses, not only into the deal's legal file.

This entry is informational and does not constitute legal advice: for transactions subject to golden power, involve your corporate counsel or an M&A regulatory advisor.

Frequently asked questions

In principle yes: the scrutiny concerns the transaction and the sector, not the provider's nationality, so a change of control at a foreign cloud provider operating critical infrastructure in Italy can fall within scope just as an Italian one would.

The government can oppose the deal after the fact, impose retroactive conditions, or void it in the most serious cases, leaving an already-closed transaction in limbo: this is why the check belongs before closing, not after.
  • Digital sovereignty · An organization's effective control over its data, infrastructure and technology: who can access it, who can compel disclosure, who it depends on.
  • Sovereign cloud · Cloud offerings built to guarantee control over data and operations: residency, staffing, isolation. The critical point remains jurisdiction.
  • CLOUD Act · US law compelling American providers to hand over data under US legal orders, even when it is stored in Europe.
  • ACN Cloud Qualification (QC/QI) · The ACN process classifying cloud services (QC1-QC4, QI1-QI4) as fit to host Italian public-sector data by level of assurance.
  • Data residency · The physical location where data is stored and processed. It says where data resides, not who can be compelled to hand it over: it is not sovereignty.

See it in the universe

If it touches your company's data, getting that data in order is the first thing I do.

SEE DATA FOUNDATIONS

Or write to me.