What happened
Italian Legislative Decree 160 of 9 September 2026, in force since 30 September 2026 (reported in-window, 5 Oct), creates a dedicated national AI regime complementing the EU AI Act: (1) a police-AI framework requiring qualified human review and prior judicial authorisation for real-time/post-hoc biometric identification; (2) a new Art. 437-bis Criminal Code offence for omitting mandatory safety safeguards and human-oversight measures for high-risk AI systems or unlawfully altering them, with corporate liability under Legislative Decree 231/2001 (new Art. 25-vicies; fines of 600-1,000 quotas plus disqualification sanctions); and (3) civil-procedure/civil-liability tools (evidence disclosure, rebuttable presumption of causation, direct action against AI liability insurers).
Why it matters
This converts AI Act high-risk obligations into criminal liability in Italy — beyond most EU regimes — and arms private litigants with strengthened evidence and causation tools against AI providers and deployers. Corporate 231/2001 exposure means AI governance failures can trigger disqualification from public contracts and licence suspension.
Action needed
Audit high-risk AI systems for mandated safeguards (risk management, documentation, logging, human oversight) and ensure corporate compliance programmes (Modelli 231) cover the new AI predicate offences; document human-review processes for law-enforcement and biometric AI outputs.