Self check-in in Genoa: keybox, smart lock and 2026 rules

A year of regulatory upheaval, one firm principle: what really changes for short-term rental managers in Genoa

Between November 2024 and November 2025, Italy’s short-term rental sector experienced one of the most uncertain regulatory periods in its recent history. First came a circular from the Interior Ministry that seemed to ban self check-in entirely, then a ruling from the Lazio Administrative Court that annulled it, and finally a definitive pronouncement from the Council of State that restored order. For those managing one or more apartments in Genoa — or considering doing so — understanding where the operational boundaries lie today is not an academic exercise: it’s a concrete matter of compliance, reputation, and management costs.

This article analyzes the regulatory framework in effect in June 2026, the practical differences between keyboxes and smart locks, the notification obligations via the Alloggiati Web portal, and the implications for anyone managing short-term rentals in Genoa’s territory.

The regulatory issue: what article 109 TULPS says

The starting point is a regulation that has existed since 1931: article 109 of the Consolidated Text of Public Safety Laws (TULPS). Managers of hotel facilities and other accommodation structures, including owners or managers of holiday homes and apartments and guest houses, may provide lodging exclusively to individuals carrying an identity card or other suitable document attesting their identity according to applicable regulations.

For years this regulation remained in the background of short-term rental practice, where self check-in with keyboxes had become the dominant method. The turning point comes on November 18, 2024, when the Chief of Police issues circular no. 38138: the Interior Ministry reaffirmed the general principle of providing lodging exclusively to individuals carrying suitable identity documents and reiterated the obligation for managers to verify guests’ identities, avoiding “remote identification” procedures.

The circular clarifies its public safety objective in clear terms: automated check-in management and building access without face-to-face identification of guests constitutes a procedure that risks disregarding the purpose of the regulatory provision, as it cannot be ruled out that, after documents are submitted electronically, the property could be occupied by one or more individuals whose identities remain unknown to the competent Police Headquarters.

The 2025 judicial saga: Administrative Court vs Council of State

The circular triggers a wave of appeals. With ruling no. 10210/2025, filed on May 27, 2025, the Lazio Regional Administrative Court annulled the November 18, 2024 circular, reintroducing the use of tools for remote self check-in. Temporary relief for operators, but it doesn’t last.

The Council of State, with ruling no. 9101 of November 21, 2025, confirms that guest identification must be face-to-face, but can also take place remotely if it occurs in real time and uses tools that allow verification of correspondence between face and document. The ruling overturns the Administrative Court’s decision and reestablishes the primacy of the visual identification requirement. But anonymous self check-in based solely on submitting a photo of the document is ruled out.

The decisive point, which distinguishes what is lawful from unlawful, is clearly contained in the ruling: self check-in is legal when it includes real-time visual identity verification, in person or by video. The regulation does not require a return to a hotel reception desk. It requires that the person entering is genuinely the one indicated on the document, and that verifiable proof of that passage exists.

«The ruling makes clear what the security obligations are, ones we have always supported, but recognizes the possibility of fulfilling them using the tools available in 2025. So video calls, or online video doorbells.»

— Matteo Sarzana, Country Manager Italy and Southeast Europe at Airbnb, statement reported by Tgcom24, November 2025

On the industry associations front, AIGAB commented on the decision, noting that it «confirms the possibility of using certain guest recognition technologies provided they demonstrate that guests have entered the apartment». The association calls for a technical meeting with the Interior Ministry to clearly define which tools are permitted. As of June 2026, that technical meeting has not yet produced definitive ministerial guidelines — a gap that maintains a margin of implementation uncertainty.

Keybox vs smart lock: two tools, two risk profiles

The distinction between keybox and smart lock is not merely technological: the two devices have profoundly different regulatory profiles, and confusing them can be costly.

The keybox: convenient, but high compliance risk

A keybox is a secure container for holding keys to accommodations without a reception desk. It is typically located outside to allow key retrieval using a code provided either by phone or email. For years it was the preferred “entry-level” solution for small property owners precisely because of its simplicity and low cost.

The problem is structural: a keybox that opens with a code delivered remotely allows entry before any identity verification. The requirement for face-to-face identification set out in the TULPS and reaffirmed by the Council of State mandates that recognition occur before the keys are handed over.

The issue, therefore, is not the device itself, but the operational sequence in which it is used. Simply transmitting the document and sending the keybox code is insufficient. Conversely, the Council of State’s ruling no. 9101/2025, filed on November 21, 2025, permits the use of technological tools if they allow effective and contemporaneous verification of correspondence between guest and identity document, for example through video call or suitable entry device, excluding only less reliable methods such as photo submission without verification.

In summary: a keybox paired with a preventive identification system featuring biometric verification or video call can still be used. A keybox used alone, with a code sent to the guest without any visual verification, violates the TULPS.

Then there is the condominium issue, which is relevant in a city like Genoa where much of the residential property is located in historic condominiums in the city center: the administrator must verify regulations, decorum and security, especially if common keys are kept in the keybox. Assembly regulations are advisable to set clear rules and reduce disputes between condominium owners.

The smart lock: more expensive, but more compliant by design

A smart lock, or intelligent lock, is an electromechanical or electronic lock that can be unlocked or locked by an authorized digital device. Unlike traditional locks that require physical keys, smart locks use digital technologies such as smartphones, Bluetooth, WiFi, PIN codes or biometric systems to control access.

The distinctive feature of smart locks is the possibility of remote and programmable access management. This means being able to generate temporary codes valid only for specific periods, unlock the door remotely even from kilometers away, monitor all accesses with precise timestamps and immediately revoke permissions when necessary.

The difference from the keybox, from the perspective of regulatory compliance, is that the smart lock naturally integrates into a flow where visual verification precedes the generation of the access code. Keybox and smart lock remain valid operational tools, as long as they do not represent the only step in the check-in. The smart lock, however, allows you to log the exact time of each access — data that, in case of dispute, represents documentary evidence of the procedure followed.

On the technical risks side, the device requires a stable Internet connection: if the line is often absent, other solutions are better. Some locks manage this problem thanks to Bluetooth protocols that work offline too thanks to symmetric cryptographic algorithms that ensure maximum security, with the advantage of operational continuity: the lock remains operational even without an internet connection, avoiding blocks due to network issues.

Alloggiati Web: the obligation you cannot forget

Regardless of the access technology chosen, there is an obligation that applies to everyone, without exception: the communication of guest data to the Police Headquarters through the Alloggiati Web portal of the State Police.

The management of guests in accommodation facilities, including tourist rentals, is regulated by article 109 of the Consolidated Text of Public Safety Laws (TULPS). This article establishes that each operator is required to register the personal data of guests and send it within 24 hours of their arrival through the Alloggiati Web Service, the official portal of the State Police.

The timelines are strict: the details of the guests must be communicated to the competent Police Headquarters through the Alloggiati Service within 24 hours of arrival; for stays not exceeding 24 hours the deadline is reduced to 6 hours. The telematic transmission of guest data is an obligation consolidated for years, therefore accommodation facilities are required to register with the Alloggiati Web service well in advance before starting their activity.

Who must register and how

The obligation applies to a very broad range. This applies to both traditional accommodation facilities and short-term rentals of less than 30 days, including those managed through platforms such as Airbnb or Booking. The regulation also applies in case of free accommodation or if you rent a single room: the obligation is not linked to the tax aspect, but to public safety.

To obtain access credentials, it is necessary to submit a formal request to the Police Headquarters competent for the territory — in the Genoa case, the Genoa Police Headquarters — attaching documentation on the property. The procedure involves filling out the official form available on the State Police website or directly at the police headquarters, sending the signed form together with an identity document of the applicant and, in some cases, a declaration of commencement of activity.

An important aspect for those managing multiple properties on behalf of third parties: real estate agencies that manage rentals of private apartments for tourism purposes for periods of less than 30 days can register and make communications on behalf of the landlords.

What to communicate and how to preserve data

To register a guest, you must fill out an online form with all the required information, including name, surname, date and place of birth, citizenship, identity document number, date of arrival and length of stay. Attention: for the purpose of data communication via Alloggiati Web, all guests must be registered individually, including minors and infants, without distinctions related to age.

On the preservation side: receipts must be kept for at least 5 years, both in digital and paper format, available to the authorities in case of inspections. Finally, a warning about the severity of omissions: the failure to communicate guests to the Police Headquarters is considered a criminal violation under article 109 TULPS.

The obligation to verify the identity of guests de visu — checking the correspondence between the guest and the identity document provided — is reiterated by current regulations and circulars from the State Police: therefore, the so-called remote check-in without any form of visual recognition is not permitted.

The compliant operational flow: how to structure check-in in 2026

Putting together the regulatory framework, the compliant check-in flow — both for those using a keybox and those who have installed a smart lock — is always articulated in three sequential and non-compressible phases.

Phase 1 — Collection of documents before arrival. The guest transmits personal data and a copy of the identity document in advance, through pre-check-in links, email or integrated PMS systems. This phase does not replace visual verification: total automation “upload document, receive code, enter” is what today exposes to disputes.

Phase 2 — Real-time visual identification. The State Council has definitively confirmed the legitimacy of self check-in procedures, clarifying that guest identification must always occur “in person visually”. This can be done in person or via video; what matters is that the manager can verify, at that moment, that the guest’s face and document actually match. The tools permitted by administrative case law include: video intercoms, digital peepholes or verification systems via QR code, as well as direct video calls. The underlying logic is clear: verification must be contemporaneous with arrival. The obligation is to perform the check when the guest is actually at the door or a few moments before entering.

Phase 3 — Provision of access and submission to Alloggiati Web. Only after visual verification does the guest receive the keybox access code or smart lock. Simultaneously — and in any case within 24 hours of arrival — the registration forms must be transmitted to the Alloggiati Web portal of the Genoa Police Headquarters.

Edge cases and critical situations

Some situations merit particular attention. Guest without smartphone: video call is not the only permitted tool; the manager or a delegate can perform the identification in person, even by sending someone on-site. Technical problems with Alloggiati Web: in case of technical problems, temporary submission of data via certified email to the police headquarters is permitted, but this method is accepted only in emergency situations and must be justified. Very short stays (less than 24 hours): for stays not exceeding 24 hours the notification deadline is reduced to 6 hours. Early departure: in case of early departure, it is not possible to update the form already submitted and no further action is required. Extended departure: a new entry for the additional period is necessary.

The CIN and the overall framework of obligations: what cannot be missing

Self check-in and Alloggiati Web do not exhaust the regulatory landscape of short-term rentals. Among the obligations that every owner must have already satisfied is the National Identification Code (CIN), introduced by Decree Law 145/2023.

It is mandatory for all owners of properties intended for short-term rentals to register in a national database and obtain a National Identification Code (CIN). This code must be displayed on the exterior of the accommodation and included in every listing on online portals and booking websites.

The sanctions for those who have not yet complied are concrete. The sanctions provided for by Decree Law 145/2023 vary depending on the type of irregularity: lack of CIN results in a substantial fine; the same applies to failure to display the CIN, with amounts proportional to the size of the property. If the property does not have the necessary safety requirements (gas detectors, carbon monoxide detectors and fire extinguishers), not only will the CIN not be assigned, but the owner may be subject to additional sanctions provided for by current safety regulations.

The CIN also acquires direct tax relevance: in Form 730/2026 and Form Income PF 2026 (tax year 2025) the indication of the CIN is mandatory for those who have received income from short-term or tourist rentals.

Implications for Genoa property owners: why professional management makes the difference

For an owner who independently manages one or two apartments in Genoa, the 2026 regulatory framework presents concrete complexity: visual identification with documentary proof, submission within 24 hours on Alloggiati Web, displayed and updated CIN, certified safety requirements, management of edge cases. Each of these obligations is individually manageable; the difficulty lies in maintaining all of them simultaneously, for every arrival, throughout the year.

The operational challenge is particularly acute for those who chose the self check-in model precisely to reduce the time dedicated to management. Guest reception now requires the presence of the manager or a delegate, with a consequent change in the organization of one’s days. This innovation means a significant increase in the commitments associated with managing a vacation rental, eliminating the possibility of opening without a key.

Those managing a distributed property portfolio — as happens with the properties managed by genovabb.it in Genoa’s historic center — must guarantee a uniform operating standard: a single operating standard and a documentary record for every arrival: who verified, when, with which method and where the data is archived.

Technology helps contain the costs of this model, but does not eliminate the manager’s responsibility. Technology does not replace identity verification: it makes it simpler and more sustainable, especially for those managing B&Bs, vacation homes, short-term rentals or a distributed property portfolio. And this is where the choice between DIY and professional management becomes economically significant: making a mistake on an obligation is not a bureaucratic oversight, it is a violation with criminal consequences or very high penalties.

For those who are beginners or don’t have time to follow a regulatory framework in constant evolution — and which, as we have seen, can change radically within a few months — entrusting an expert operator means transforming a management complexity into an automatic and traceable process.

If you own a property in Genoa and are considering putting your apartment to income with short-term rentals, contact us: we handle every operational and regulatory aspect, from guest identification to submission on Alloggiati Web, from the CIN to the stay tax.