Source: Altalex

The D.Lgs. 9 September 2026, n. 160 implements a substantial portion of the delegation under art. 24 L. 23 September 2025, n. 132 to align Italian law with EU Regulation 2024/1689 (the AI Act). It focuses specifically on two domains: the use of AI systems by police forces (Title I) and a package of substantive and procedural rules in civil and criminal law addressing the illicit design and use of AI systems and compensation for the harm they cause (Title II), rather than a general horizontal transposition of the AI Act.

The decree declares a “non‑aggravation” clause denying new obligations beyond the AI Regulation while introducing detailed procedural regimes (notably the authorization framework in art. 8). Capo I sets principles—anthropocentrism, proportionality, non‑discrimination and human oversight—and adds a definition of “non‑targeted” scraping, forbidding mass collection of images to populate biometric databases. Capo III (arts. 7–10) distinguishes biometric treatments (labeling/categorization, remote real‑time biometric identification, and post‑hoc facial recognition) and prescribes tailored authorization and operational rules. Art. 8 implements the AI Act derogation for prevention of specific threats to life or locating victims through an ex‑ante authorization entrusted to the public prosecutor, with a maximum 15‑day duration, urgent activation by police and strict convalidation deadlines, raising questions about the prosecutor’s independence vis‑à‑vis requesting law‑enforcement bodies. The decree mandates “non‑incremental” reference databases created ad hoc per authorization and deleted after use, but effective verification of deletion depends on a ministerial implementing decree not yet adopted. Art. 10 establishes a dual regime for post‑hoc facial recognition: judge‑authorized targeted searches for an identified suspect and a judge‑free mode for initial identification after a crime, leaving the operational boundary between the two for interpretation by courts. A two‑phase surveillance model for high‑risk places allows image collection without real‑time biometric processing and activation of facial recognition only after a crime, contingent on ministerial criteria. Title II inserts art. 437‑bis into the Criminal Code criminalizing omission of required safety measures for high‑risk AI systems and illicit alteration of such systems, including a provision for professional‑user liability and an aggravating clause for dangers to state security. Procedurally, art. 13 adds art. 359‑ter c.p.p. mirroring administrative authorizations within criminal proceedings but assigns that authorization to the judge for preliminary investigations, creating a dual‑track system requiring close interpretive coordination. Capo II of Title II (arts. 16–20) introduces procedural civil instruments for damages from AI‑related unlawful conduct, opting for processual tools over new substantive liability rules and referencing Directive 2024/2853 on defective products.