Trains models, in Italy

Legge 22 aprile 1941, n. 633, artt. 102-bis, 102-ter, inserted by Decreto Legislativo 6 maggio 1999, n. 169 · Read the law's page

• Do not extract or re-utilize the whole or a substantial part of a database's content without the database maker's authorization, for the fifteen years (renewable on a substantial new investment) following the database's completion or first making-available.
• As a legitimate user of a publicly available database, you may extract or re-utilize insubstantial parts of its content for any purpose, but not repeatedly and systematically in a way that conflicts with the database's normal exploitation or unjustifiably prejudices its maker.
• A contract clause purporting to override these database-right rules is void.

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Garante Provvedimento 30 marzo 2023 · Read the law's page

• Give a person in Italy a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.
• Do not subject a person in Italy to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
• Do not base a solely automated decision with legal or similarly significant effects on a person in Italy on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).
• If you make solely automated decisions about a person in Italy of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Legge 22 aprile 1941, n. 633, artt. 70-ter, 70-quater, inserted by Decreto Legislativo 8 novembre 2021, n. 177; art. 70-septies inserted by Legge 23 settembre 2025, n. 132, art. 25 · Read the law's page

• You may reproduce and extract text and data from lawfully accessible works, databases, or other materials for text-and-data-mining purposes, including through AI models and systems, whether for scientific research (art. 70-ter) or general and commercial use (art. 70-quater/70-septies).
• Honour an express reservation of rights by the rightholder over the works or database used: Article 70-quater's general TDM permission, which art. 70-septies extends to AI training, does not apply where the rightholder has expressly reserved the use.
• Keep any copy made under Article 70-quater only for as long as needed for text and data mining, and secure it to at least the level Article 70-ter requires.
• Reproducing or extracting text or data in violation of these exceptions, including through an AI system, is a separate criminal offence under Article 171, comma 1, lettera a-ter.

Legge 23 settembre 2025, n. 132, art. 8 · Read the law's page

• If you process data for research and experimentation in building AI systems for health purposes within Article 8 of Law 132/2025, communicate the processing to the Garante with the information required by GDPR Articles 24, 25, 32 and 35 and any processor named under Article 28, and start only thirty days after the communication unless the Garante has blocked it (Article 8, paragraph 5).
• If you reuse personal data without direct identifiers for that research without further consent, still inform the data subject, which a general notice on your website can satisfy, unless knowing the data subject's identity is inevitable or necessary to protect their health (Article 8, paragraph 2).
• Inform the data subject under GDPR Article 13 before processing personal data to anonymize, pseudonymize or synthesize it (Article 8, paragraph 3).

Codice Penale, art. 437-bis, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 12 · Read the law's page

• Adopt the technical safety measures provided for the design, training, production and placing on the market of high-risk AI systems, suited to prevent malfunctions or alterations of how the systems work, and adopt human-oversight measures, where omitting them would endanger life or public or individual safety, or the security of the State (Codice Penale art. 437-bis, first paragraph).
• If you are a professional user of a high-risk AI system, do not deliberately omit human-oversight measures where the omission would endanger life or public or individual safety, or the security of the State (Codice Penale art. 437-bis, last paragraph).
• Do not alter a high-risk AI system where danger to life or to public or individual safety, or to the security of the State, results (Codice Penale art. 437-bis, second paragraph).

D.Lgs. 8 giugno 2001, n. 231, art. 25-vicies, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 15 · Read the law's page

• This article binds entities covered by Decreto Legislativo 231/2001: it adds the offences in articles 437-bis and 612-quater of the Codice Penale to those for which the entity itself answers with financial and disqualification sanctions (art. 25-vicies).

Schema di decreto legislativo recante attuazione della direttiva (UE) 2024/2853, Atto del Governo n. 434 · Read the law's page

• The draft treats software as a product, except free and open-source software that you develop or supply outside a commercial activity (Art. 115(2)(d) as proposed).
• If you develop, produce or make a product, software included, or have it designed or made, or present yourself as its manufacturer by putting your name, trade mark or another distinguishing feature on it, you answer as its manufacturer for the damage a defect in it causes (Arts. 115(3)(i) and 116(1)(a) as proposed).
• Keep supplying the software updates and upgrades needed to maintain safety while the product is under your control: a defect due to software, a related service or a missing safety update is not excused because it arose after you placed the product on the market (Art. 118(2) as proposed).
• Meet the product safety requirements that apply to your product, cybersecurity requirements relevant to safety included: they count in deciding whether it is defective (Art. 117(2)(f) as proposed), and failing a mandatory safety requirement meant to protect against the damage suffered presumes it defective (Art. 120(2)(b) as proposed).
• Account for what your product learns or acquires after release: the effect of its ability to keep learning or to acquire new functions is weighed in deciding whether it is defective (Art. 117(2)(c) as proposed).
• Be ready to produce the relevant evidence you hold when a court orders it on a plausible claim: failing to do so presumes the product defective (Arts. 119(1) and 120(2)(a) as proposed).
• If you manufacture outside the Union, the importer, your authorized representative or, failing both, the logistics service provider answers for the product alongside you (Art. 116(1)(c) as proposed).
• If you substantially modify a product outside its original manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 116(2) as proposed).
• If you distribute a product, or provide an online platform that lets consumers conclude distance contracts with traders, identify the economic operator or your own supplier within one month of the injured person's written request, or you answer for the defective product (Art. 116(3) to (5) as proposed).
• Be able to show that you did not place the product on the market or put it into service, or that it is probable the defect did not exist then (Art. 118(1)(a) and (c) as proposed).