Italy D.Lgs. 160/2026
Legislative Decree No. 160 of 9 September 2026: use of AI systems in police activities and civil and criminal liability (implementing Article 24 of Law 132/2025 and Regulation (EU) 2024/1689)
First of two legislative decrees implementing Italy's AI law (Law 132/2025) and adapting national law to the EU AI Act. Title I sets the first organic rules for police use of AI systems on a human-oversight basis, including exceptional, time-limited and judicially authorised real-time biometric identification and a ban on biometric databases built by untargeted mass scraping of the web. Title II introduces Penal Code Article 437-bis, punishing failure to adopt security measures in high-risk AI systems and their unlawful alteration, and gives claimants procedural tools for damages caused by AI systems: access to the system's technical documentation, a presumption of causal link, an alternative forum near the claimant's residence and direct action against the insurer.
Jurisdiction
Italy
Enacted
Sep 9, 2026
Effective
Sep 30, 2026
Enforcement
Police forces for their respective competences; Garante per la protezione dei dati personali; criminal courts (Article 437-bis) and civil courts (damages)
Approved by the Council of Ministers in preliminary examination on June 10, 2026 (communiqué n. 177) and, after opinions from the parliamentary committees, the Conferenza unificata and the Garante per la protezione dei dati personali, in final examination on August 4, 2026 (communiqué n. 185). Signed September 9, 2026 and published in Gazzetta Ufficiale n. 214 of September 15, 2026 (26G00179). Entered into force September 30, 2026 (Normattiva: "Entrata in vigore del provvedimento: 30/09/2026"). Title III contains transitional and financial provisions (Articles 21 and 22).
Normattiva: Decreto Legislativo 9 settembre 2026, n. 160 (Gazzetta Ufficiale n. 214, 15 September 2026)Why It Matters
First national instrument in the EU to pair AI Act adaptation with a dedicated criminal offence for unsecured high-risk AI systems and with civil-procedure rules (documentation access, presumed causation, direct insurer action) that lower the burden on people injured by AI systems. It also gives Italy its first statutory framework for police AI, including judicial authorisation for real-time biometric identification.
Recent Developments
In force from September 30, 2026. The companion decree, Legislative Decree 7 October 2026, n. 179 (Gazzetta Ufficiale n. 234, October 8, 2026; in force October 23, 2026), sets the national authorities, fines at the AI Act Article 99 levels, the regulatory sandbox, and rules on AI in work, training, the professions and health (tracked as it-dlgs-179-2026).
At a Glance
Applies to
Harms addressed
Who Must Comply
- Police forces researching, developing, training, testing and using AI systems
- Providers and deployers of high-risk AI systems (criminal liability under Penal Code Article 437-bis)
- Parties to civil claims for damage caused by the use of AI systems, including insurers
Safety Provisions
- Police use of AI founded on human oversight and responsibility: decisions remain with the operator and no decision producing adverse legal effects may be taken solely on the basis of automated processing
- Real-time biometric identification admitted only in exceptional cases, for limited periods and with prior authorisation of the judicial authority
- Prohibition on building biometric databases through mass, untargeted collection of information from the web
- Minimum requirements for the reference database used in retrospective facial recognition from video surveillance, with explicit deletion obligations and safeguards (added after the committee and Garante opinions)
- New Penal Code Article 437-bis: failure to adopt security measures in high-risk AI systems, and unlawful alteration of such systems, punished with penalties graded by the legal interest endangered
- Civil remedies for damage caused by AI systems: access to the system's technical documentation, presumption of the causal link, an alternative forum close to the injured party's residence, and direct action against the insurer
- Explicit powers of the Garante per la protezione dei dati personali, including involvement in regulatory sandboxes and rules for processing sensitive operational data in research and experimentation
Compliance & Enforcement
Key Dates
Sep 30, 2026
Decree enters into force
Penalties
criminal liability
Private Right of Action
Individuals can sue directly without waiting for regulatory action.
View on map
Italy
Focus Areas
Cite This
APA
Italy. (2026). Legislative Decree No. 160 of 9 September 2026: use of AI systems in police activities and civil and criminal liability (implementing Article 24 of Law 132/2025 and Regulation (EU) 2024/1689).
Related Regulations
Italy D.Lgs. 179/2026
Second of the two legislative decrees implementing Italy's AI law (Law 132/2025). It designates the national authorities under the EU AI Act, sets national administrative fines for AI Act breaches, creates the Italian AI regulatory sandbox, and adds rules on AI in schools, work, the professions, health and public administration, including a bar on employment decisions taken solely by automated processing.
Italy AI Act
First EU member state comprehensive national AI law complementing the EU AI Act. 28 articles covering AI governance principles, sector-specific rules for healthcare, employment, justice, and public administration, criminal provisions, copyright protections, and a EUR 1 billion AI investment fund.
Poland AI Systems Act
Polish national law implementing the EU AI Act. It creates the Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji (KRiBSI, AI Development and Safety Commission) as market surveillance authority and single point of contact, and sets the procedure for inspections, enforcement proceedings and administrative fines for breaches of Regulation (EU) 2024/1689.
EU PLD
Modernized product liability framework explicitly covering AI systems and software as products. Shifts burden of proof in complex AI cases, allows disclosure orders for technical documentation, and addresses liability for AI-caused harm including through software updates.
DE Digital Violence Bill (GgdG)
German government bill creating a standalone Digital Violence Act (GgdG) that gives victims court-ordered disclosure of anonymous offenders' identities, data preservation, content removal and temporary account suspension against platforms, and adding Criminal Code offences for sexualised deepfakes, reputation-damaging deepfakes, identity misuse and covert tracking.
CA SB 947
Adds Labor Code Part 5.5.5 on employers' use of automated decision systems (ADS). Bars using an ADS to violate labor or civil rights law, to infer an employee's protected status, or to predict and act against workers exercising legal rights; bars relying solely on an ADS for disciplinary or termination decisions and requires human corroboration where an ADS output is the primary basis; and requires a written post-use notice and, on request, a description of the employee's data used. Operative July 1, 2027.
Last updated October 18, 2026. Verify against primary sources before relying on this information.