What happened
The Italian Government's D.Lgs. 9 September 2026, n. 160 (Gazzetta Ufficiale no. 214 of 15 Sept 2026, act 26G00179) was published, adapting national law to the EU AI Act (Regulation (EU) 2024/1689) in the areas of police use of AI and civil/criminal liability. It introduces a new Criminal Code article 437-bis punishing, with 1-5 years' imprisonment (2-8 years where State security is endangered), the omission of the technical security measures or human-oversight measures required for high-risk AI systems where that creates danger to life or public/individual safety. It inserts article 25-vicies into the D.Lgs. 231/2001 corporate-liability decree (pecuniary sanctions of 600-1,000 quotas plus disqualification-type sanctions), creates civil-law disclosure of technical documentation, a presumption of causality between violation and damage, and insurer direct-action rights. New provisions enter into force 30 September 2026.
Why it matters
This is the first EU Member State to attach criminal penalties and D.Lgs. 231 administrative liability of entities directly to high-risk AI governance failures under the AI Act. Any company deploying or supplying high-risk AI systems in Italy now faces individual criminal exposure for missing security/human-oversight measures and 231 corporate liability, dramatically raising the cost of AI compliance failure.
Action needed
Organisations operating high-risk AI systems in Italy should map AI Act high-risk coverage against the new art. 437-bis and art. 25-vicies by the 30 Sept 2026 in-force date, ensure documented safety measures and human-oversight processes (with audit trails), and review D.Lgs. 231 organisational models to cover the new AI predicate offence and its 600-1,000-quote sanctions.