Makes housing decisions, in Italy

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Garante Provvedimento 30 marzo 2023 · Read the law's page

• Give a person in Italy a path to obtain human intervention, express their view, and contest a decision made solely by automated processing that produces a legal or similarly significant effect on them.
• Do not subject a person in Italy to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
• Do not base a solely automated decision with legal or similarly significant effects on a person in Italy on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).
• If you make solely automated decisions about a person in Italy of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Legge 23 settembre 2025, n. 132, artt. 4, 11, 13 · Read the law's page

• If your AI service can be accessed by a minor under fourteen, obtain the consent of whoever holds parental responsibility before processing their personal data; a minor between fourteen and eighteen may consent alone if the required information is easily accessible and understandable (art. 4).
• If you are an employer or client deploying AI in the workplace, inform workers of the AI's use as required by Article 1-bis of Decreto Legislativo 152/1997, and keep the AI's use in employment safe, reliable, transparent, non-discriminatory, and respectful of workers' dignity and personal data (art. 11).
• If you provide services within a regulated intellectual profession using AI systems, use them only for instrumental and support tasks that leave your own intellectual work predominant, and clearly tell the client which AI systems you used (art. 13).

Regulation (EU) 2024/1689, Art. 26 and Annex III — directly applicable in Italy

• Perform a fundamental-rights impact assessment before deploying a high-risk AI system.
• Ensure meaningful human oversight of the high-risk AI system.
• Inform workers when a high-risk AI system is deployed in their workplace.
• Register the high-risk AI system deployment in the EU database for high-risk AI systems.

Regulation (EU) 2024/1689, Arts. 5, 50 — directly applicable in Italy as EU Member State

• Do not place on the market, put into service, or use an AI system for social scoring.
• Do not use real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, except within narrow exceptions the law allows.when it serves a public body
• Do not place on the market, put into service, or use an AI system that exploits individuals' vulnerabilities.
• Tell users, before or at the start of an interaction, that they are communicating with an AI system.
• Mark generated image, video, audio and text output in machine-readable form as artificially generated.

Codice Penale, art. 437-bis, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 12 · Read the law's page

• Adopt the technical safety measures provided for the design, training, production and placing on the market of high-risk AI systems, suited to prevent malfunctions or alterations of how the systems work, and adopt human-oversight measures, where omitting them would endanger life or public or individual safety, or the security of the State (Codice Penale art. 437-bis, first paragraph).
• If you are a professional user of a high-risk AI system, do not deliberately omit human-oversight measures where the omission would endanger life or public or individual safety, or the security of the State (Codice Penale art. 437-bis, last paragraph).
• Do not alter a high-risk AI system where danger to life or to public or individual safety, or to the security of the State, results (Codice Penale art. 437-bis, second paragraph).

D.Lgs. 8 giugno 2001, n. 231, art. 25-vicies, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 15 · Read the law's page

• This article binds entities covered by Decreto Legislativo 231/2001: it adds the offences in articles 437-bis and 612-quater of the Codice Penale to those for which the entity itself answers with financial and disqualification sanctions (art. 25-vicies).

D.Lgs. 9 settembre 2026, n. 160, artt. 16-20 · Read the law's page

• If you are sued for damage caused in the use of an AI system, and the claimant presents facts and elements that make the claim plausible, produce on the court's order the evidence specifically relevant to how the system works, including the logs under Article 12, the risk-management documentation under Article 9, the relevant technical documentation under Article 11 and the human-oversight information under Article 14 of Regulation (EU) 2024/1689; the order is limited to what is necessary and proportionate, and the court protects trade secrets and confidential information (art. 17, commi 1 to 4).
• If you hold such evidence as a third party to the action, produce it on the same terms (art. 17, comma 1).
• If the damage derives from a breach of an obligation under Regulation (EU) 2024/1689 and you contest the causal link between the breach and the damage, prove the contrary, because the link is presumed (art. 18, comma 1).
• Do not treat compliance with Regulation (EU) 2024/1689, even if certified under Chapter III, Section 5, as of itself excluding your liability (art. 19).
• If a person intending to sue asks whether liability insurance covers the damage, answer within thirty days with the existence and particulars of the contract and the insurer's name (art. 20, comma 1).

D.Lgs. 7 ottobre 2026, n. 179, artt. 4-6 e 21-23 · Read the law's page

• Do not engage in a practice that Article 5 of the EU AI Act prohibits.
• Comply with the obligations in Articles 16, 22 to 26, 31, 33, 34, 50, 73 and 80 of the EU AI Act that Article 23 of the decree backs with a fine.
• Give accurate and complete information to notified bodies and national competent authorities when they ask for it.

Schema di decreto legislativo recante attuazione della direttiva (UE) 2024/2853, Atto del Governo n. 434 · Read the law's page

• The draft treats software as a product, except free and open-source software that you develop or supply outside a commercial activity (Art. 115(2)(d) as proposed).
• If you develop, produce or make a product, software included, or have it designed or made, or present yourself as its manufacturer by putting your name, trade mark or another distinguishing feature on it, you answer as its manufacturer for the damage a defect in it causes (Arts. 115(3)(i) and 116(1)(a) as proposed).
• Keep supplying the software updates and upgrades needed to maintain safety while the product is under your control: a defect due to software, a related service or a missing safety update is not excused because it arose after you placed the product on the market (Art. 118(2) as proposed).
• Meet the product safety requirements that apply to your product, cybersecurity requirements relevant to safety included: they count in deciding whether it is defective (Art. 117(2)(f) as proposed), and failing a mandatory safety requirement meant to protect against the damage suffered presumes it defective (Art. 120(2)(b) as proposed).
• Account for what your product learns or acquires after release: the effect of its ability to keep learning or to acquire new functions is weighed in deciding whether it is defective (Art. 117(2)(c) as proposed).
• Be ready to produce the relevant evidence you hold when a court orders it on a plausible claim: failing to do so presumes the product defective (Arts. 119(1) and 120(2)(a) as proposed).
• If you manufacture outside the Union, the importer, your authorized representative or, failing both, the logistics service provider answers for the product alongside you (Art. 116(1)(c) as proposed).
• If you substantially modify a product outside its original manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 116(2) as proposed).
• If you distribute a product, or provide an online platform that lets consumers conclude distance contracts with traders, identify the economic operator or your own supplier within one month of the injured person's written request, or you answer for the defective product (Art. 116(3) to (5) as proposed).
• Be able to show that you did not place the product on the market or put it into service, or that it is probable the defect did not exist then (Art. 118(1)(a) and (c) as proposed).