ItalyDecreto Legislativo 160/2026, Civil Damages Actions for Harm Caused by AI Systems (Artt. 16-20)
D.Lgs. 9 settembre 2026, n. 160, artt. 16-20
In force since .
An AI governance rule binding public and private bodies.
As of .
What it requires
- If you are sued for damage caused in the use of an AI system, and the claimant presents facts and elements that make the claim plausible, produce on the court's order the evidence specifically relevant to how the system works, including the logs under Article 12, the risk-management documentation under Article 9, the relevant technical documentation under Article 11 and the human-oversight information under Article 14 of Regulation (EU) 2024/1689; the order is limited to what is necessary and proportionate, and the court protects trade secrets and confidential information (art. 17, commi 1 to 4).
- If you hold such evidence as a third party to the action, produce it on the same terms (art. 17, comma 1).
- If the damage derives from a breach of an obligation under Regulation (EU) 2024/1689 and you contest the causal link between the breach and the damage, prove the contrary, because the link is presumed (art. 18, comma 1).
- Do not treat compliance with Regulation (EU) 2024/1689, even if certified under Chapter III, Section 5, as of itself excluding your liability (art. 19).
- If a person intending to sue asks whether liability insurance covers the damage, answer within thirty days with the existence and particulars of the contract and the insurer's name (art. 20, comma 1).
If you get it wrong
Private right of actionYes
Penalty structure
Fine the court imposes on a third party to the action that fails without good reason to comply, even in part, with an order to produce evidence under article 17. It does not apply to a party to the action, which instead faces adverse inferences and, for the Regulation's documentation, the facts alleged by the applicant being treated as admitted.
- Rule
- Fixed only
- As of
- Minimum
- 1,500
- Currency
- EUR
- Fixed cap
- 10,000
What it makes you log
Who may demand the log
Court
Logging duty
Article 17, comma 2 names the logs under Article 12 of the Regulation among the evidence a court may order produced, which cannot be done without a record. The article creates no separate duty to keep a log and sets no retention period.
- Kind
- Implicit
- As of
- Provision
- art. 17, commi 1 and 2
- Trigger
- all_systems
What this law does
Article 17 applies to actions for damages, in contract or in tort, for harm caused in the use of an AI system. Articles 18 and 19 apply to those actions when the harm results from breach of one or more obligations of Regulation (EU) 2024/1689.
Article 17 requires the court, on the application of the party alleging harm, to order the other party or a third party holding it to produce the evidence specifically relevant to how the AI system works, where the applicant presents facts and elements that make the claim plausible.
That evidence includes the logs under Article 12, the risk-management documentation under Article 9, the relevant technical documentation under Article 11 and the information on human-oversight parameters under Article 14 of the Regulation. The order is limited to what is necessary and proportionate, and the court takes into account the interests of all parties, particularly the protection of trade secrets and confidential information.
A party that fails without good reason to comply with the order, even in part, exposes itself to the court drawing inferences from the evidence under Article 116 of the Codice di Procedura Civile (Code of Civil Procedure), and where the failure concerns the Article 12, 9, 11 or 14 material the court, after weighing all other evidence, treats the facts alleged by the applicant as admitted.
A third party that fails without good reason to comply with the order, even in part, is sentenced by the court to a fine of EUR 1,500 to EUR 10,000. Article 18 presumes the causal link between the breach and the harm, unless the contrary is proved, where the harm results from breach of one or more obligations of the Regulation.
Without prejudice to the national law transposing Directive (EU) 2024/2853, Article 19 provides that conformity of the AI system with the obligations of the Regulation, even if certified under Chapter III, Section 5, does not of itself exclude the defendant's liability. A person who intends to sue may ask in advance the person to whom the harm is attributed whether liability insurance covers it.
The person asked must answer within thirty days of receipt with the existence of the contract, its particulars and the name of the insurer. The injured person has a direct action for damages against the insurer providing the defendant's liability cover, within the sums for which the insurance contract is made. Article 82 of the General Data Protection Regulation (GDPR) and the national law transposing Directive (EU) 2024/2853 on defective products remain unaffected.
Where the injured person is a natural person acting for purposes outside any business, commercial, craft or professional activity, the court of the injured person's place of residence or domicile is also competent.
When LexLint raises it
When your app profile says your app generates content with AI, deploys a chatbot, makes high-risk automated decisions, processes biometric data or processes voice recordings.