What changed on 30 September
Legislative Decree 160/2026, dated 9 September 2026, appeared in the Gazzetta Ufficiale (General Series no. 214) on 15 September and applies from 30 September, according to the Osborne Clarke summary and Noze's reading of the Gazette entry. It implements the delegation in Law 132/2025, Italy's framework AI statute. The decree has 22 articles. Its civil chapter, Articles 16 to 20, sets out how a person harmed by an AI system can build and win a damages claim in an Italian court.
One caveat first. The commentary we reviewed agrees on the substance, but the figures below come from law-firm and trade summaries. The decree text itself should be the reference for anything litigated.
The five mechanisms
- Evidence disclosure (Art. 17). If a claimant presents facts that make the claim plausible, a court can order a party or a third party to produce the AI system's logs, risk-management documentation, technical documentation and human-oversight information. Trade secrets stay protected under the industrial property code. Unjustified refusal lets the court draw adverse inferences, and for those four documents it can treat the claimant's alleged facts as admitted. A non-complying third party faces a fine of EUR 1,500 to EUR 10,000.
- Presumed causation (Art. 18). If the damage results from a breach of AI Act obligations, the causal link is presumed, unless the defendant proves otherwise.
- Certification is no shield (Art. 19). AI Act compliance, including certification, does not by itself exclude liability. A court may weigh a certificate, but it is not an automatic defence.
- Direct action against the insurer (Art. 20). The injured person can sue the liable party's liability insurer, within the policy limit. The insurer can raise only contractual defences that predate the loss, and the insured must be joined as co-defendant. Before suing, the claimant can ask whether the party is insured, and the party has 30 days to answer. CMS notes that silence or an incomplete answer can count as evidence.
- Consumer forum. A natural person acting outside a trade or profession can sue where they live. GDPR compensation rules and the national rules implementing the revised EU Product Liability Directive (2024/2853) still apply, and claimants may combine regimes.
The strongest case for the decree
The case for acting is serious. AI systems are opaque, and the people harmed by them usually cannot see inside the system that hurt them. Ordinary civil procedure asks a claimant to prove fault and causation using evidence held entirely by the defendant. That is a real asymmetry, and a rebuttable presumption plus targeted disclosure is a measured way to correct it. It is the same logic the European Commission proposed in the 2022 AI Liability Directive.
That directive is gone. The Commission listed it as withdrawn in its February 2025 work programme, citing "no foreseeable agreement", and a spokesperson confirmed the withdrawal to Euronews in July 2025. Italy has now enacted a national version of what Brussels set aside.
Where the design is better than feared
Credit is due. The presumption is rebuttable, not a reversal of the burden of proof. Disclosure is gated by a plausibility threshold, so fishing expeditions are harder. The orders cover four specific AI Act artefacts rather than every internal document, and trade secrets are expressly preserved. The insurer's liability is capped at the policy limit. These are the features that separate a proportionate regime from a litigation lottery.
Where the risks sit
Fragmentation. The AI Act was meant to give Europe one rulebook. Civil liability now differs by member state. A provider selling a high-risk system across the EU may face disclosure and presumption rules in Italy that do not exist in Germany or France. For startups and open-source developers this is a compliance cost that scales with the number of jurisdictions, and it falls hardest on firms without in-house counsel.
The presumption is only as clean as the AI Act obligations behind it. Much of the AI Act's technical detail depends on harmonised standards that are still being developed. When the underlying duty is vague, whether a breach occurred, and therefore whether causation is presumed, becomes a contested factual question. That favours well-funded litigants.
Certification offers no safe harbour. Article 19 means a provider can do everything the regulator asks and still be liable. There is a principled argument for this: certification is a snapshot, and harm is real regardless. But a regime that gives no credit for demonstrated compliance weakens the incentive to invest in it. A rebuttable credit for conformity, as the product-safety tradition often provides, would have preserved the incentive without closing the door to claimants.
Insurers will price the uncertainty. CMS points out that, because compliance does not exclude liability, a policy cannot sensibly limit cover to cases where the AI Act was breached. CMS also flags the lack of a mandatory insurance requirement and of rules on policy content. Without those, the direct action may deliver less for victims than headlines suggest, and may push premiums up for small AI developers while larger firms self-insure.
What to watch
The first Italian disclosure orders will show how courts read "plausible". Narrow orders aimed at logs would validate the design. Broad orders that treat the plausibility test as a formality would not. A second decree, on national authorities, sandboxes and judicial training, had not been published as of the Noze report, and it will matter for how consistently judges apply the new tools.
The better path for Europe is an EU-level instrument that keeps the decree's careful features, namely the rebuttable presumption, the narrow disclosure and the insurer cap, while giving compliance some weight. Italy has filled a real gap. Whether it becomes a model or a patchwork depends on whether other capitals converge on something similar or go their own way.