Distributes a software product, in Italy

Decreto legislativo 6 settembre 2005, n. 206 (Codice del consumo), artt. 114-127 · Read the law's page

• The Codice defines a product as any movable good and adds electricity, and whether software supplied on its own is a movable good is not settled (Art. 115(1) and (2)).
• If you make a finished product or a component, or produce a raw material, you answer as producer for the damage a defect in it causes (Arts. 114(1) and 115(2-bis)).
• If you supply a product and the producer is not identified, or the importer into the Union is not identified, tell the injured person, within three months of a written request, who the producer or your own supplier is, or you answer as the producer (Art. 116(1), (2) and (6)).
• Offer the safety that can legitimately be expected, taking account of how the product was put into circulation, its presentation, instructions and warnings, its reasonably foreseeable use and when it was put into circulation (Art. 117(1)).
• Be able to prove that you did not put the product into circulation, that the defect probably did not exist then, that it results from compliance with a mandatory rule or binding measure, or that the state of scientific and technical knowledge then did not yet allow the product to be considered defective (Arts. 118(1)(a), (b), (d) and (e), 120(2)).
• Be ready to advance the cost of a court-appointed technical expert where it is plausible that a defect in the product caused the damage (Art. 120(3)).
• Do not rely on a contract term to exclude or limit your liability to the injured person in advance (Art. 124(1)).

Artt. 3, 39 e 46, Decreto legislativo 22 giugno 2016, n. 128 · Read the law's page

• If you manufacture or import radio equipment in a category or class that a delegated act of the European Commission specifies, make it meet the Article 3(3) essential requirements that the delegated act applies to it: that it does not harm the network or misuse network resources, that it contains safeguards for personal data and privacy, and that it supports features that protect against fraud (Legislative Decree 128/2016, Article 3(3)(d), (e) and (f) and Article 3(4)).
• Make radio equipment available on the market only if it meets the Article 3 essential requirements and has been through the conformity assessment procedure of Article 17 (Article 46(1)).

Art. 10, Decreto legislativo 3 agosto 2022, n. 123 · Read the law's page

• If you take part in the EU cybersecurity certification scheme as a manufacturer or supplier of an ICT product, ICT service, ICT process or managed security service, as a holder of a European cybersecurity certificate, as a conformity assessment body or as an applicant for certification, Article 10 sanctions your breaches of the certification framework; joining the scheme is voluntary unless Union or national law says otherwise (Legislative Decree 123/2022, Article 6, paragraph 3 and Article 10).
• Do not issue an EU declaration of conformity that does not conform, and revise or revoke a non-conforming declaration within thirty days of the Agency's finding, telling the Agency and ENISA (Article 7, paragraph 3 and Article 10, paragraph 3).
• Where an EU declaration of conformity or a cybersecurity certificate is mandatory, do not make an ICT product, ICT service or managed security service available on the market without it (Article 10, paragraph 4).
• If you hold a European cybersecurity certificate, notify the vulnerabilities or irregularities you find in the certified products or services, as Article 56, paragraph 8 of Regulation (EU) 2019/881 requires (Article 10, paragraph 8).
• Do not give false data or leave out information needed for certification (Article 10, paragraph 12).

D.Lgs. 27 maggio 2022, n. 82, artt. 1(2), 3(1), 6, 7, 13-16 e 25 · Read the law's page

• If you manufacture a product listed in Article 1(2) of Legislative Decree 82/2022 (general-purpose consumer hardware systems and their operating systems, self-service payment terminals and terminals for the covered services, consumer terminal equipment for electronic communications and audiovisual media access, e-readers) and place it on the market from 28 June 2025, make it comply with section I of Annex I and, except for self-service terminals, section II (Articles 1(1), 3(1) and 25(1)). These provisions and Articles 6, 7, 13 to 16 implement Articles 4(1) and (2), 7, 8, 14, 15, 16, 17 and 18 of Directive (EU) 2019/882.
• Certify that the product was designed and made in conformity with Article 3, prepare the technical documentation under Annex III, carry out the conformity assessment procedure, and, if it is positive, draw up the EU declaration of conformity and affix the CE marking (Article 6(1) and (2)).
• Draw up the EU declaration of conformity also in Italian, stating which accessibility requirements do not apply where you rely on Article 13, and update it when the design, characteristics or referenced standards change (Article 15(1) and (2)).
• Keep the technical documentation and the EU declaration of conformity for five years from placing the product on the market, keep series production in conformity, and mark the product with a type, batch or serial number and with your name, trade name or trade mark and contact address (Article 6(3) to (6)).
• Supply the product with instructions and safety information in Italian or English (Article 6(7)).
• If a product does not conform, take the corrective measures at once or withdraw it, inform the Ministry and the authorities of the Member States where you made it available, and keep a register of non-conforming products and complaints (Article 6(8)).
• On request, give the Ministry or the authorities of the Member States the information and documentation showing conformity in Italian or English, and cooperate in the measures taken to make the products conform (Article 6(9)).
• If you rely on Article 13(1) (a substantial modification that changes the nature of the product, or a disproportionate burden), assess it on the criteria of Annex V and document the assessment for not less than five years from the last time a product was made available; a microenterprise that deals in products need not document the assessment but must give the facts of it if the Ministry asks (Article 13(2) to (4)).
• Unless you are a microenterprise, inform the market surveillance authority when you rely on Article 13(1) for a specific product (Article 13(7)); Article 13(1)(b) does not apply to an operator that receives public or private funding to improve accessibility (Article 13(6)).
• A product that conforms to harmonised standards published in the Official Journal of the European Union, or to technical specifications, or to parts of them, is presumed to conform to the accessibility requirements those standards or specifications cover (Article 14(1) and (2)).
• If you are an authorised representative, your written mandate lets you at least keep the EU declaration of conformity and the technical documentation for five years from the mandate, give the Ministry and the market surveillance authorities on reasoned request the information and documentation showing conformity, and cooperate with them in making the products conform; the duties of Article 6 and drawing up the technical documentation cannot be part of your mandate (Article 7(1) and (2)).

D.Lgs. 27 maggio 2022, n. 82, artt. 1(3), 3(2)-(3), 12-14 e 25 · Read the law's page

• If you provide a consumer service listed in Article 1(3) of Legislative Decree 82/2022 (electronic communications, access to audiovisual media, the passenger transport elements, consumer banking, e-books and dedicated software, or e-commerce), design and provide it in conformity with the accessibility requirements of sections III and IV of Annex I, which the decree applies to urban, suburban and regional transport services as well (Articles 3(2) and 12(1)); the decree has effect from 28 June 2025 (Article 25(1)). These provisions implement Articles 4(1), 4(3), 4(5), 13, 14, 15 and 32 of Directive (EU) 2019/882.
• Prepare the information required by Annex IV of the decree on how the service meets the accessibility requirements, include it in your general conditions or an equivalent document, make it available to the public in written and oral form in a manner accessible to persons with disabilities, and keep it while the service is operating (Article 12(2) and Annex IV, point 1).
• If you provide an audiovisual media service, ensure where possible that it is available through more than one sensory channel (Article 12(1)).
• If your website or mobile application gives information on local public transport routes, show also the routes accessible to persons with disabilities (Article 12(3)).
• Put in place the measures needed to keep the service in constant conformity as its features, the applicable requirements and the harmonised standards or technical specifications change (Article 12(4)).
• If the service does not conform, take the corrective measures needed and inform the Agenzia per l'Italia Digitale and the national authorities of the Member States where you provide the service immediately, stating the requirements not met and the measures taken (Article 12(5)).
• On reasoned request, give the Agenzia per l'Italia Digitale and the competent authorities of the Member States the information needed to show conformity, and cooperate in the measures taken to bring the service into conformity (Article 12(6)).
• If you rely on the exceptions of Article 13(1) (a substantial modification that changes the nature of the service, or a disproportionate burden), assess them on the criteria of Annex V, document the assessment, keep the results for not less than five years from the last supply of the service, and give a copy of it on request of the Ministry or the competent authorities of the Member States (Article 13(2) and (3)).
• Renew a disproportionate-burden assessment when the service is changed, when the supervising authority asks, and at least every five years (Article 13(5)).
• Unless you are a microenterprise, inform the competent supervisory authority when you rely on Article 13(1) for a specific service (Article 13(7)); Article 13(1)(b) does not apply to an operator that receives public or private funding to improve accessibility (Article 13(6)).
• A service is presumed to conform to the accessibility requirements that harmonised standards published in the Official Journal of the European Union cover when it conforms to them or to parts of them, and to the requirements that technical specifications cover when it conforms to those specifications or parts of them (Article 14(1) and (2)).
• A transport service that meets the accessible-information requirements of Regulations (EC) 261/2004, 1107/2006, 1371/2007, 1177/2010 and 181/2011 and of the acts under Legislative Decree 57/2019 is deemed to conform to the corresponding requirements of the decree, unless the decree sets further requirements that it must then also meet (Article 4(1)).
• The decree does not apply to pre-recorded time-based media or office file formats published before 28 June 2025, online maps and mapping services (where navigation maps give essential information in an accessible digital mode), third-party content you neither fund, develop nor control, or archive content not updated after 28 June 2025 (Article 1(5)).
• Contracts for services concluded before 28 June 2025 may continue unchanged until they expire, for not more than five years from that date, and until 28 June 2030 you may keep providing your services using products you lawfully used before that date to provide similar services (Article 25(1)).
• Self-service terminals lawfully used before 28 June 2025 may stay in use for similar services until the end of their economically useful life, for not more than twenty years from entry into use (Article 25(2)).

D.Lgs. 27 maggio 2022, n. 82, artt. 17-20 e 24(2)-(3) · Read the law's page

• If a product you made available is found non-conforming, take the corrective measures the Ministry of Economic Development requires within the reasonable and proportionate period it sets, and ensure that corrective measures are taken for all such products you made available on the Union market (Article 18(1) and (4)).
• If you do not take adequate corrective measures in time, the Ministry sets a further period for withdrawal and takes provisional measures to prohibit or restrict making the product available on the national market or to withdraw it (Article 18(1) and (5)).
• End a formal non-conformity (a CE marking affixed in breach of Article 14 or of Article 30 of Regulation (EC) 765/2008, a missing marking, a missing or incorrect EU declaration of conformity, unavailable or incomplete technical documentation, missing, false or incomplete identification data, or another unmet administrative requirement of Articles 6 or 8) within the period the Ministry sets, failing which the product is restricted, prohibited or withdrawn (Article 20). Articles 17 to 20 implement Articles 19 to 22 of Directive (EU) 2019/882.
• Cooperate with the Ministry, and give it the assessment and documentation it requests, in the activities of Articles 6(9), 7(1), 8(8), 9(5), 11 and the last sentences of 13(3) and 13(4); a failure to cooperate is fined, save a reasoned refusal where the information could expose you to punitive administrative sanctions or a criminal offence (Article 24(3)).

D.Lgs. 27 maggio 2022, n. 82, artt. 8-11 e 25 · Read the law's page

• If you import a product listed in Article 1(2) of Legislative Decree 82/2022 from a third country, place on the market only products that conform to Article 3, and verify first that the manufacturer carried out the conformity assessment, prepared the Annex III technical documentation, affixed the CE marking and complied with Article 6 (Article 8(1) and (2)); the decree has effect from 28 June 2025 (Article 25(1)). Articles 8 to 11 implement Articles 9, 10, 11 and 12 of Directive (EU) 2019/882.
• If you consider a product non-conforming, inform the manufacturer and the supervisory authority and do not place the product on the market until it conforms (Article 8(3)).
• Put your name, trade name or trade mark and contact address on the product, packaging or accompanying document, with contact data in Italian and English, and supply instructions and safety information in Italian (Article 8(4) and (5)).
• While the product is under your responsibility, ensure that its storage or transport conditions do not jeopardise its conformity (Article 8(6)); keep a copy of the EU declaration of conformity for five years from placing the product on the market, make the technical documentation available on request, take corrective measures or withdraw a non-conforming product at once, inform the national authorities, and keep a register of non-conforming products and complaints (Article 8(7)).
• On request, give the Ministry or the authorities of the Member States the information and documentation showing conformity in Italian or English, and cooperate in removing the non-conformity (Article 8(8)).
• If you distribute such a product, verify before making it available that it bears the CE marking, comes with the required documents and with instructions and safety information in Italian or English, and that the manufacturer and importer complied with Articles 6 and 8 (Article 9(1)).
• As a distributor, ensure that while the product is under your responsibility its storage or transport conditions do not jeopardise its conformity (Article 9(3)).
• If you find or have reason to believe a product is non-conforming, do not place it on the market until it conforms, inform the manufacturer or importer and the Ministry, see that corrective measures are taken or the product withdrawn, and give the Ministry and the authorities of the Member States the information and documentation they request (Article 9(2), (4) and (5)).
• If you place a product on the market under your own name or trade mark, or modify a product already on the market in a way that affects conformity, you are treated as the manufacturer and bound by Article 6 (Article 10(1)).
• On request, identify to the supervisory authorities each operator that supplied you with a product and each operator you supplied, and keep that information for five years from the supply in each direction (Article 11).

Codice Penale, art. 437-bis, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 12 · Read the law's page

• Adopt the technical safety measures provided for the design, training, production and placing on the market of high-risk AI systems, suited to prevent malfunctions or alterations of how the systems work, and adopt human-oversight measures, where omitting them would endanger life or public or individual safety, or the security of the State (Codice Penale art. 437-bis, first paragraph).
• If you are a professional user of a high-risk AI system, do not deliberately omit human-oversight measures where the omission would endanger life or public or individual safety, or the security of the State (Codice Penale art. 437-bis, last paragraph).
• Do not alter a high-risk AI system where danger to life or to public or individual safety, or to the security of the State, results (Codice Penale art. 437-bis, second paragraph).

D.Lgs. 8 giugno 2001, n. 231, art. 25-vicies, inserted by D.Lgs. 9 settembre 2026, n. 160, art. 15 · Read the law's page

• This article binds entities covered by Decreto Legislativo 231/2001: it adds the offences in articles 437-bis and 612-quater of the Codice Penale to those for which the entity itself answers with financial and disqualification sanctions (art. 25-vicies).

Schema di decreto legislativo recante attuazione della direttiva (UE) 2024/2853, Atto del Governo n. 434 · Read the law's page

• The draft treats software as a product, except free and open-source software that you develop or supply outside a commercial activity (Art. 115(2)(d) as proposed).
• If you develop, produce or make a product, software included, or have it designed or made, or present yourself as its manufacturer by putting your name, trade mark or another distinguishing feature on it, you answer as its manufacturer for the damage a defect in it causes (Arts. 115(3)(i) and 116(1)(a) as proposed).
• Keep supplying the software updates and upgrades needed to maintain safety while the product is under your control: a defect due to software, a related service or a missing safety update is not excused because it arose after you placed the product on the market (Art. 118(2) as proposed).
• Meet the product safety requirements that apply to your product, cybersecurity requirements relevant to safety included: they count in deciding whether it is defective (Art. 117(2)(f) as proposed), and failing a mandatory safety requirement meant to protect against the damage suffered presumes it defective (Art. 120(2)(b) as proposed).
• Account for what your product learns or acquires after release: the effect of its ability to keep learning or to acquire new functions is weighed in deciding whether it is defective (Art. 117(2)(c) as proposed).
• Be ready to produce the relevant evidence you hold when a court orders it on a plausible claim: failing to do so presumes the product defective (Arts. 119(1) and 120(2)(a) as proposed).
• If you manufacture outside the Union, the importer, your authorized representative or, failing both, the logistics service provider answers for the product alongside you (Art. 116(1)(c) as proposed).
• If you substantially modify a product outside its original manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 116(2) as proposed).
• If you distribute a product, or provide an online platform that lets consumers conclude distance contracts with traders, identify the economic operator or your own supplier within one month of the injured person's written request, or you answer for the defective product (Art. 116(3) to (5) as proposed).
• Be able to show that you did not place the product on the market or put it into service, or that it is probable the defect did not exist then (Art. 118(1)(a) and (c) as proposed).