News · Civil law · – October 2026

Damage caused by AI systems: under Legislative Decrees 160 and 179/2026 documentation becomes evidence

TOPIC
From 30 September 2026 d.lgs. 160/2026 presumes the causal link between an AI Act breach and the damage and opens access to logs and documentation; from 23 October d.lgs. 179/2026 sets the authorities and penalties.

Regulation (EU) 2024/1689 (AI Act), as amended by Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), in force from 27 July 2026, applies in stages under Article 113. The prohibitions in Article 5 (except those added by the Omnibus, which apply from 2 December 2026) and the duty of providers and deployers to support the AI literacy of their staff (Article 4, as recast by the Omnibus) have applied since 2 February 2025; the obligations of providers of general-purpose AI models (Article 53) since 2 August 2025; the transparency obligations of Article 50 on interaction with the system, marking of synthetic content and deep fakes since 2 August 2026. Chapter III, Sections 1 to 3, on high-risk systems, including the deployer obligations in Article 26 and the impact assessment in Article 27, applies from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems. Implementing Law No 132 of 23 September 2025, Legislative Decree (d.lgs.) No 179 of 7 October 2026 (Official Gazette No 234 of 8 October 2026, in force from 23 October 2026) designates AgID (Agency for Digital Italy) as notifying authority and ACN (National Cybersecurity Agency) as market surveillance authority and single point of contact, assigning to the Bank of Italy, CONSOB and IVASS the high-risk systems used in financial services (Articles 4 to 6); Article 23 penalises prohibited practices with fines of up to EUR 35 million or 7 per cent of worldwide annual turnover and breaches of, among others, the Article 50 obligations with fines of up to EUR 15 million or 3 per cent, with a more favourable criterion for SMEs. Civil liability is governed by another implementing decree, d.lgs. No 160 of 9 September 2026 (Official Gazette No 214 of 15 September 2026, in force from 30 September 2026): Articles 16 to 20 lay down procedural tools for actions for damages, contractual and non-contractual, for harm caused in the use of an AI system (Article 16(1)).

At the request of the party alleging the damage who shows the claim to be plausible, including as regards the link between the system’s output and the harm, the court orders the other party or the third party holding them to disclose the relevant evidence on the functioning of the system, including the logs under Article 12 of the Regulation, the risk management documentation under Article 9, the technical documentation under Article 11 and the human oversight parameters under Article 14 (Article 17 of d.lgs. 160/2026). The order is proportionate and protects trade secrets through the measures of Article 121-ter of the Industrial Property Code (c.p.i.); from 23 October 2026 Article 98(1-bis) c.p.i., inserted by Article 52 of d.lgs. 179/2026, includes among them data, algorithms and mathematical methods for training, where the requirements of paragraph 1 are met. If the party fails to comply without justification, the court may draw inferences from it (argomenti di prova) and, where the failure concerns the listed documentation, having assessed all other evidence, it deems the facts alleged to be admitted; a non-complying third party is ordered to pay a pecuniary penalty of EUR 1,500 to 10,000. Where the damage results from a breach of obligations under the Regulation, the causal link is presumed unless proven otherwise (Article 18), and compliance, even if certified, does not in itself exclude liability (Article 19). The injured party may ask the person allegedly liable whether it is insured, with a reply due within thirty days, and has a direct action against the insurer within the limits of the sum insured, with the liable person as a necessary party (Article 20); consumers may also sue before the court of their place of residence or domicile (Article 16(4)). Article 82 of Regulation (EU) 2016/679 and the national rules transposing Directive (EU) 2024/2853 remain unaffected; the Directive includes software among products and applies to those placed on the market after 9 December 2026. In our view, until Chapter III applies, the presumption in Article 18 will mainly concern breaches of Articles 4, 5 and 50 and of the obligations on general-purpose models.

IN PRACTICE
The business draws up an inventory of the AI systems it uses or develops, recording for each its role (provider or deployer, Article 3 of the Regulation) and risk class, and documents the AI literacy measures for staff (Article 4). For chatbots, synthetic content and deep fakes it prepares the information and disclosures required by Article 50; providers of generative systems placed on the market before 2 August 2026 complete the marking by 2 December 2026. Contracts with suppliers should provide for access to logs, technical documentation and instructions for use and for cooperation in the event of litigation; civil liability insurance cover should be checked, as its details must be disclosed within thirty days to anyone requesting them (Article 20 of d.lgs. 160/2026). Logs and documentation under the business’s control should be kept in a form that can be produced in court, with adequate secrecy measures for data and algorithms to be protected under Article 98 c.p.i. An employer using AI in employment decisions reserves the final decision to a natural person and provides the information required by Article 1-bis of d.lgs. 152/1997 before processing begins (Article 41 of d.lgs. 179/2026). For Annex III high-risk systems the deadline is 2 December 2027.

Summary note by the CommercialistiAvvocati network, based on specialised legal and practice sources. The text does not reproduce original contributions and does not constitute professional advice.

← Back to news Contact the network