Italy expands AI liability and workplace safeguards

Italy has expanded its AI regulatory framework through Decrees 160/2026 and 179/2026, introducing criminal offences, corporate liability, civil remedies and supervisory powers. Both are in force, but delayed EU AI Act obligations remain subject to their phased application dates. National penalties do not accelerate those deadlines.

The criminal provisions target security failures, missing human oversight and unauthorized tampering involving high-risk systems where conduct endangers life, safety or national security. Actual harm is not required, although a causal link to the risk must be established. Companies also face liability for specified AI-related offences, including unlawful deepfake dissemination. Businesses should inventory and classify their systems, strengthen controls and review compliance procedures.

People seeking compensation gain access to court-ordered evidence disclosure and direct claims against liability insurers. A rebuttable presumption can connect breaches of enforceable AI Act obligations to damages, while regulatory compliance alone does not eliminate liability. The supervisory framework assigns responsibilities to AgID, ACN and sectoral regulators. Penalties for prohibited practices can reach €35 million or, if higher, 7 per cent of annual global turnover for the year preceding the breach.

Employers cannot base final employment decisions solely on automated processing: an independent human decision-maker must exercise effective authority. Violating decisions, including dismissals, are void. Employers must also address AI-specific workplace risks. Training data, algorithms and model architectures can qualify for trade-secret protection, provided existing secrecy, economic-value and confidentiality requirements are met.