The interesting part is that neither the AGCOM nor Cloudflare quite understand how each other really work. Also they both believe they got more leeway than they truly have.

AGCOM is an institutional apparatus, they operate separately, but not independently, from whatever leftwing or rightwing government in charge for the most part (past Berlusconian interests aside) and everything they do is entirely subject to not getting out of the guidelines imposed by the EU, no matter what they want anyone else to believe.

Frankly the best course of action for Cloudflare would be getting in touch with the Board of European Regulation pointing them out that AGCOM is, probably for the hundreth time I guess, overstepping their authority. And they should stop right there, otherwise they're the ones that will be actually fined.