From 30 September 2026, what happens in Italy when an artificial intelligence system causes harm changes. Legislative Decree No. 160 of 9 September 2026, published in the Official Gazette No. 214 of 15 September 2026, creates a new crime for those who neglect the security of high-risk systems, extends corporate liability under Decree 231 and gives injured parties procedural tools that shift the burden of proof. For companies, the question is no longer "are we compliant?" but "can we prove it in court?".
What Decree 160/2026 is and when it applies
The decree implements the delegation in Art. 24 of Law No. 132 of 23 September 2025 (Italy's AI law) and aligns national law with Regulation (EU) 2024/1689 (the AI Act) on two fronts: the use of AI by police forces (Title I) and civil and criminal liability (Title II). It is the second of these titles that concerns businesses.
The Council of Ministers approved it in preliminary reading on 10 June 2026 and definitively on 4 August 2026, after opinions from the Data Protection Authority, the Unified Conference and the parliamentary committees. In the same session it also approved the twin decree on national authorities (AgID and ACN), market surveillance, sanctions and regulatory sandboxes: at the time of writing it has not yet appeared in the Official Gazette. The delegation expires on 10 October 2026.
The new crime: Art. 437-bis of the Criminal Code
Art. 12 of the decree inserts Art. 437-bis into the Criminal Code ("Failure to adopt security measures in artificial intelligence systems and unlawful alteration of systems"). In short:
| Conduct | Penalty (danger to life or safety) | Penalty (danger to State security) |
|---|---|---|
| Failing to adopt the technical security measures required for the design, training, production or placing on the market of high-risk systems, or failing to adopt human-oversight measures | 1 to 5 years' imprisonment | 2 to 8 years' imprisonment |
| Altering high-risk AI systems (outside the previous cases) | 2 to 6 years' imprisonment | 3 to 10 years' imprisonment |
Three details matter for businesses:
- It is an endangerment offence: the harm need not have occurred; it is enough that the omission creates a danger to life or safety.
- If the conduct in the first paragraph is committed through gross negligence, the penalty is reduced by one third to one sixth: the offence is not limited to intentional conduct.
- The professional user of high-risk systems who intentionally omits human-oversight measures faces the same penalties as under the first paragraph. The deployer is therefore expressly within scope.
The provision refers to high-risk systems as defined by Art. 6 and Annex III of the AI Act. The text does not refer to the application dates of the high-risk obligations (2 December 2027 for Annex III after the Digital Omnibus): how the two will be reconciled is for practice and scholarship to clarify. As a matter of prudence, anyone designing or using a high-risk system should treat it as operative from 30 September.
Corporate liability: new Art. 25-vicies of Decree 231/2001
Art. 15 of the decree adds the new Art. 25-vicies ("Crimes committed through the use of artificial intelligence systems") to the catalogue of predicate offences for the administrative liability of entities:
- for Art. 437-bis of the Criminal Code: a fine of 600 to 1,000 units;
- for Art. 612-quater of the Criminal Code (unlawful dissemination of content generated or altered with AI, i.e. deepfakes, introduced by Law 132/2025): 200 to 700 units;
- in both cases, the disqualifying sanctions of Art. 9(2)(b) to (e): suspension or revocation of authorisations and licences, a ban on contracting with public administrations, exclusion from subsidies and financing, and a ban on advertising goods or services.
Since one unit ranges from EUR 258 to EUR 1,549, the fine alone for Art. 437-bis can exceed EUR 1.5 million. For entities with a 231 model, AI now belongs fully in the crime-risk map.
On the civil side: evidence, causation and insurance
Chapter II of Title II (Arts. 16-20) does not create a new "AI liability" as such, but equips injured parties with procedural tools that lighten their burden of proof. The protections of Art. 82 GDPR and the rules on defective products remain unaffected.
Access to evidence (Art. 17)
In any action for damages — contractual or non-contractual — for harm caused in the use of an AI system, the court may order the other party (or a third party) to disclose the evidence on how the system works, provided the claimant makes the claim plausible. The list is precise and matches the AI Act documentation:
- the logs referred to in Art. 12 of the Regulation;
- the risk management system documentation (Art. 9);
- the relevant information in the technical documentation (Art. 11);
- the parameters and arrangements for human oversight (Art. 14).
The order is limited to what is necessary and protects trade secrets. But if the party fails to comply without good reason, the court may draw inferences and, where the listed documents themselves are missing, treats the facts alleged by the claimant as admitted. A non-cooperating third party pays EUR 1,500 to 10,000.
Presumed causal link (Art. 18)
Where the harm stems from a breach of one or more obligations under Regulation (EU) 2024/1689, the causal link between the breach and the harm is presumed, unless proven otherwise. This applies to obligations already in force: AI literacy (Art. 4), prohibited practices (Art. 5), transparency of chatbots and generated content (Art. 50, from 2 August 2026), obligations on general-purpose models; and it will apply to high-risk systems once those obligations kick in.
Compliance is no shield (Art. 19)
The system's compliance with the Regulation's obligations, even if certified, does not in itself exclude liability. It is a robust defence — above all to rebut the Art. 18 presumption — but not an immunity.
Direct action against the insurer (Art. 20)
Before suing, the injured party may ask the company whether it is covered by a civil-liability policy for that harm: the company must reply within thirty days, giving the contract details and the insurer's name, otherwise the court may draw inferences. The injured party may then sue the insurer directly, within the policy limits. Consumers may sue in the court of their own residence.
What to do now: the checklist
- Inventory and classification. Knowing which systems are high-risk is the starting point: that is where Art. 437-bis and the presumed causal link bite.
- Documentation as defence. Logs, risk management, technical documentation and traces of human oversight are exactly what the court will order you to produce. If you are a deployer, require them from your supplier by contract.
- Real human oversight. Designated, trained people with the power to intervene and a record of their interventions: intentional omission is a crime for users of the system too.
- Update the 231 model. AI-related crime-risk mapping, protocols, reporting flows to the supervisory body, documented training.
- Insurance check. Verify whether existing policies cover AI-related harm and be ready to answer the Art. 20 request within thirty days.
- Supplier contracts. Clauses on access to documentation, cooperation in litigation and indemnities.
Where to start
The decree turns compliance documentation from a formality into evidence. The starting point is an honest check: which systems we use, how they are classified, which documents actually exist and who oversees what. An independent gap assessment finds the holes — a log that doesn't exist, oversight that lives only on paper, a supplier that won't hand over the technical documentation — before a judge asks for them.