Crawls the web, in Italy

Codice Penale, art. 615-quater, as amended by Legge 28 giugno 2024, n. 90 · Read the law's page

• Do not obtain, hold, produce, reproduce, distribute, or supply codes, passwords, devices, or other means suited to accessing a computer or telematic system protected by security measures, or instructions enabling that access, without authorization.

Codice Penale, art. 615-ter, as amended by Legge 28 giugno 2024, n. 90 · Read the law's page

• Do not access, or remain within after being excluded, a computer or telematic system protected by security measures without the right-holder's consent.

Legge 22 aprile 1941, n. 633, artt. 102-bis, 102-ter, inserted by Decreto Legislativo 6 maggio 1999, n. 169 · Read the law's page

• Do not extract or re-utilize the whole or a substantial part of a database's content without the database maker's authorization, for the fifteen years (renewable on a substantial new investment) following the database's completion or first making-available.
• As a legitimate user of a publicly available database, you may extract or re-utilize insubstantial parts of its content for any purpose, but not repeatedly and systematically in a way that conflicts with the database's normal exploitation or unjustifiably prejudices its maker.
• A contract clause purporting to override these database-right rules is void.

Regulation (EU) 2016/679, Art. 9; D.Lgs. 196/2003, Art. 167(2) · Read the law's page

• Obtain an explicit GDPR Article 9(2) legal basis before processing biometric, genetic, or health data of a person in Italy.
• Do not treat a publicly posted photograph or recording as freely processable for identification purposes; the Garante's Clearview AI decision found no valid legal basis for exactly that.

Garante Provvedimento n. 146 del 5 giugno 2019 · Read the law's page

• Apply Provvedimento 146/2019's security measures (documented access controls, encryption or pseudonymization, controlled transmission) before processing genetic data of a person in Italy.
• Do not scrape or process publicly posted facial images to build a biometric identification database without a valid GDPR Article 9 basis.

Legge 22 aprile 1941, n. 633, artt. 70-ter, 70-quater, inserted by Decreto Legislativo 8 novembre 2021, n. 177; art. 70-septies inserted by Legge 23 settembre 2025, n. 132, art. 25 · Read the law's page

• You may reproduce and extract text and data from lawfully accessible works, databases, or other materials for text-and-data-mining purposes, including through AI models and systems, whether for scientific research (art. 70-ter) or general and commercial use (art. 70-quater/70-septies).
• Honour an express reservation of rights by the rightholder over the works or database used: Article 70-quater's general TDM permission, which art. 70-septies extends to AI training, does not apply where the rightholder has expressly reserved the use.
• Keep any copy made under Article 70-quater only for as long as needed for text and data mining, and secure it to at least the level Article 70-ter requires.
• Reproducing or extracting text or data in violation of these exceptions, including through an AI system, is a separate criminal offence under Article 171, comma 1, lettera a-ter.

D.Lgs. 7 ottobre 2026, n. 179, artt. 4-6 e 21-23 · Read the law's page

• Do not engage in a practice that Article 5 of the EU AI Act prohibits.
• Comply with the obligations in Articles 16, 22 to 26, 31, 33, 34, 50, 73 and 80 of the EU AI Act that Article 23 of the decree backs with a fine.
• Give accurate and complete information to notified bodies and national competent authorities when they ask for it.

Schema di decreto legislativo recante attuazione della direttiva (UE) 2024/2853, Atto del Governo n. 434 · Read the law's page

• The draft treats software as a product, except free and open-source software that you develop or supply outside a commercial activity (Art. 115(2)(d) as proposed).
• If you develop, produce or make a product, software included, or have it designed or made, or present yourself as its manufacturer by putting your name, trade mark or another distinguishing feature on it, you answer as its manufacturer for the damage a defect in it causes (Arts. 115(3)(i) and 116(1)(a) as proposed).
• Keep supplying the software updates and upgrades needed to maintain safety while the product is under your control: a defect due to software, a related service or a missing safety update is not excused because it arose after you placed the product on the market (Art. 118(2) as proposed).
• Meet the product safety requirements that apply to your product, cybersecurity requirements relevant to safety included: they count in deciding whether it is defective (Art. 117(2)(f) as proposed), and failing a mandatory safety requirement meant to protect against the damage suffered presumes it defective (Art. 120(2)(b) as proposed).
• Account for what your product learns or acquires after release: the effect of its ability to keep learning or to acquire new functions is weighed in deciding whether it is defective (Art. 117(2)(c) as proposed).
• Be ready to produce the relevant evidence you hold when a court orders it on a plausible claim: failing to do so presumes the product defective (Arts. 119(1) and 120(2)(a) as proposed).
• If you manufacture outside the Union, the importer, your authorized representative or, failing both, the logistics service provider answers for the product alongside you (Art. 116(1)(c) as proposed).
• If you substantially modify a product outside its original manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 116(2) as proposed).
• If you distribute a product, or provide an online platform that lets consumers conclude distance contracts with traders, identify the economic operator or your own supplier within one month of the injured person's written request, or you answer for the defective product (Art. 116(3) to (5) as proposed).
• Be able to show that you did not place the product on the market or put it into service, or that it is probable the defect did not exist then (Art. 118(1)(a) and (c) as proposed).