On 30 September 2026, Legislative Decree No. 160/2026 (“Legislative Decree No. 160/2026”) came into effect.

The decree was adopted in accordance with Article 24 of Law No. 132 of 23 September 2025, with the aim of aligning the Italian legal framework with Regulation (EU) 2024/1689 (the AI Act), which establishes the European regulatory framework for artificial intelligence.

The measure addresses three distinct areas:

1. It establishes the regulatory framework for the utilisation of artificial intelligence systems in law enforcement operations, delineating the principles, conditions and safeguards that govern the research, testing, training and deployment of AI systems, with a focus on biometric systems and high-risk AI systems.
2. It introduces new criminal law provisions designed to combat the unlawful development and use of artificial intelligence systems. These include specific criminal offences, together with amendments to the rules governing criminal proceedings and the administrative liability of legal entities under Legislative Decree No. 231/2001.
3. It addresses the legal responsibility for any damage that may be caused by the use of AI systems. It introduces procedural mechanisms designed to overcome evidentiary challenges arising from the opacity and technological complexity of these systems.

The measure is broadly consistent with the principles set out in the AI Act and with Italy’s Law No. 132 of 23 September 2025. Under this law, Parliament empowered the Government to adopt one or more legislative decrees. These decrees will regulate the use of data and algorithms in AI system establish guidelines for the use of AI in the justice, security sectors, criminal law and civil liability.

The principles reflected in Legislative Decree No. 160/2026 include the protection of fundamental rights, proportionality, transparency, non-discrimination, human oversight and a risk-based approach. The objective is to reconcile technological innovation and public security with the effective protection of individual rights.

In accordance with the provisions outlined in Legislative Decree No. 160/2026, Articles 16 to 19 stipulate the specific regulations pertaining to civil liability and procedural safeguards for claims relating to compensation for damage caused by AI systems. The purpose of these provisions is to address the information imbalance between claimants and AI developers or operators, and the difficulties of establishing causation in relation to complex and often opaque technological systems.

Article 16 – Scope and consumer jurisdiction

Article 16 defines the scope of the new civil procedural rules, which apply to all disputes seeking compensation for damage caused by AI systems, regardless of whether liability is contractual or non-contractual.

Article 16(2) limits the application of the evidentiary mechanisms introduced by the subsequent articles – namely, the presumption of causation and the relevance of compliance – to cases where the damage results from a breach of one or more obligations imposed by the AI Act. Therefore, access to these benefits does not automatically arise from damage involving an AI system, but requires the establishment of a specific breach of the applicable European requirements.

Article 16(3) preserves the remedies available under other existing legal frameworks, including, in particular, Article 82 of the General Data Protection Regulation and the European product liability regime. The new provisions therefore complement, rather than replace or restrict, the remedies otherwise available to injured parties.

Finally, Article 16(4) introduces a special jurisdictional rule for consumers, allowing injured individuals acting outside their professional or business activities to bring proceedings before the court of their place of residence or domicile. The objective of this initiative is to enhance access to justice, particularly in relation to claims against prominent technology companies and AI providers.

Article 17- Access to Evidence

Article 17 introduces the principal procedural mechanism established by the decree to address the information asymmetry and technological opacity that may characterise algorithmic systems.

It empowers the Court to order the disclosure of documents and information relating to the operation of an AI system where the claimant demonstrates that their claim for damages is plausible. The disclosure order may be directed either at the opposing party or at third parties holding relevant information. The claimant must present sufficient facts and evidence to make a plausible connection between the system’s operation and the damage suffered , without having to establish the causal link in full.

The provision identifies several categories of documents and information that may be particularly relevant, including:

• Logging records and event-tracking logs;
• Documentation relating to risk management;
• Technical documentation required under the AI Act;
• Information concerning the parameters and procedures governing human oversight of the system.

These documents play a central role in reconstructing the system’s decision-making process, the data used, the methods employed in training the system, and the checks carried out by human operators.

However, access to evidence is subject to the principles of necessity and proportionality. The court must balance the interest of the injured party with the need to protect trade secrets, industrial property rights and the operator’s confidential information. In this regard, Article 121-ter of the Italian Industrial Property Code provides for protective measures, including the partial redaction of documents and restrictions on access.

The provision also introduces significant procedural consequences for failure to cooperate. In the event that a party does not comply with a disclosure order, the court is permitted to draw evidentiary inferences in accordance with Article 116 of the Italian Code of Civil Procedure. In more serious cases, where the undisclosed documents fall within the categories specified by the provision, the court may treat the facts alleged by the claimant as admitted, after considering the other evidence available. Third parties who fail to comply without justification may be subject to a financial penalty ranging from €1,500 to €10,000.

Article 18 – Presumption of Causation

Article 18 introduces a rebuttable presumption (iuris tantum) of a causal link between a breach of the obligations imposed by the AI Act and the damage suffered by the injured party.

In the event that an operator is found to have breached a duty stipulated within the EU regulation, and if the resulting damage is deemed to be consistent with that breach, the law will presume a causal link between the conduct in question and the subsequent harm. The burden is on the defendant to disprove this presumption by demonstrating that the damage was caused by other factors.

The provision does not introduce any presumption of fault, nor does it presume that a breach of the relevant obligation has occurred.

The evidentiary benefit therefore applies exclusively to causation, which has traditionally been difficult to establish where damage results from the complex and opaque decision-making processes characteristic of machine learning systems.

The provision is specifically intended to address the so-called “black box” effect, namely the practical difficulty faced by injured parties in reconstructing the technical process linking the input, the algorithmic processing and the harmful output.

Article 19 – Relevance of Compliance with Regulation (EU) 2024/1689

Article 19 clarifies the relationship between regulatory compliance and civil liability.

It provides that compliance of an AI system with the requirements of the AI Act, including where such compliance has been formally certified, does not automatically exclude the operator’s liability.

The objective is to ensure that adherence to European regulatory standards does not  automatically provide civil liability immunity.

Nevertheless, evidence of compliance and certification may remain relevant in civil proceedings. It may support the defendant’s position when the court assesses whether the operator acted with the degree of care and diligence required in the circumstances. The Court retains the power to undertake a comprehensive assessment of the relevant facts and to establish liability where the applicable legal requirements are met and the use of the AI system has caused compensable damage.

Final Remarks

Against this background, several considerations emerge regarding the practical implications of the new framework.

The involvement of an AI system does not, in itself, trigger the new evidentiary mechanisms, whose application depends on the conditions established by law. Access to evidence and the rebuttable presumption of causation may nevertheless play a significant role in AI-related litigation, while the claimant remains responsible for establishing the underlying breach. Compliance with the AI Act may inform the court’s assessment but does not automatically exclude civil liability.

Accordingly, for businesses developing, providing or deploying AI systems, robust documentation, traceability and evidence-preservation practices are increasingly important, extending beyond regulatory compliance to litigation preparedness and risk management.