Policing and civil liability: Italy's law implementing the AI Act

The European AI regulation now reaches into the fine grain of Italian law on two matters that had gone uncovered. The Official Gazette of 15 September 2026 carried legislative decree no. 160 of 9 September 2026, implementing the delegation granted by law 132/2025. The text runs to 22 articles across three titles, aligns national rules with EU regulation 2024/1689 and sets its entry into force at 30 September 2026, tackling two of the thorniest questions: the use of these systems by police forces, and the regime of criminal and civil liability.

On public security, real-time remote biometric identification is tied to judicial authorisation, available for tracking fugitives or people suspected of offences carrying a maximum sentence of four years or more (according to accounts in the specialist press), while retrospective facial recognition is confined to the phase after an offence has been committed. Building biometric databases by indiscriminately scraping images from the web is expressly forbidden, and the requirement of qualified human involvement in AI-assisted decisions is confirmed. On the liability side, the decree inserts article 437-bis into the criminal code — headed "Failure to adopt security measures in artificial intelligence systems and unlawful alteration of systems" — and extends the administrative liability of organisations under legislative decree 231/2001. In civil matters, the framework establishes that compliance with the European regulation does not in itself rule out the defendant's liability, and introduces a key principle: "the causal link between the breach and the damage is presumed, unless proven otherwise".

One limit has to be stated plainly: consulting the Official Gazette portal directly returned the structural index, the metadata and the breakdown of the 22 articles, but not the full text of the individual provisions. The specific details on the length of custodial sentences, the tables of financial penalties calculated in quotas, the four-year threshold and the procedural deadlines (such as automatic deletion of biometric data after 7 days, or the 30-day term for insurance information) come from accounts in specialist outlets — among them Il Sole 24 Ore NT+ Diritto, Paradigma and Diritto.it — which largely converge, though a few summaries report different sentencing bands. Fully verifying these operational details, and the exact wording of the cross-references to the codes, has to wait for the complete text and for future administrative guidance.

The way the debate has moved on — from excitement about generative tools to procedural presumptions and limits on policing — shows what artificial intelligence really amounts to: not an abstract entity, but a field where ordinary law applies and individual protections have to be balanced against security needs. — Olya