Italy has published Legislative Decree 160 of 9 September 2026 in the Gazzetta Ufficiale of 15 September, and from its 30 September commencement it would set prosecutor and judge authorisation routes for police real-time biometric identification, insert art. 437-bis into the Criminal Code and give AI damages claimants a rebuttable presumption of causation

What was published on 15 September, and what was not

Gazzetta Ufficiale Serie Generale n. 214 of 15 September 2026 opens with Decreto legislativo 9 settembre 2026, n. 160. The heading gives the full subject: adaptation of national law to Regulation (EU) 2024/1689 in the matter of the use of artificial intelligence systems for police activity and of civil and criminal liability. The execution formula on printed page 10 is dated at Rome, 9 September 2026, and carries the signatures of Mattarella, Meloni, Foti, Piantedosi, Nordio, Tajani, Crosetto and Giorgetti, with Nordio's countersignature as Keeper of the Seals. The GU record page for the act states entry into force on 30 September 2026. The decree itself has no commencement clause; art. 22 is a financial invariance clause.

The preamble records the route. A preliminary Council of Ministers deliberation on 10 June 2026, the opinion of the Garante per la protezione dei dati personali, the opinion of the Conferenza unificata given on 20 July 2026, the opinions of the competent parliamentary committees, and the final Council deliberation of 4 August 2026. That August deliberation is the event our July article covered from the government's communique, and that article said in terms that it had not read the decrees and had not located a gazette publication. This piece reads the enacted text.

One thing the issue does not contain. The August communique described two decrees, the second allocating supervisory roles to AgID and ACN. The contents list of GU n. 214 shows a single legislative decree, this one, and we read the full issue's contents without finding a second. Art. 2(1)(m) of this decree refers to AgID and ACN as the national AI authorities under art. 20(1) of Law 132/2025, but a definition that names them is not a publication of the decree that assigns them their powers. We did not locate the companion decree and we did not check other gazette issues.

The text runs to 22 articles. Title I, arts. 1 to 10, governs police use of AI, with a general chapter, a chapter on research, training and use, and a chapter on biometrics. Title II, arts. 11 to 20, carries the criminal provisions and the civil procedural tools. Title III, arts. 21 and 22, holds the transitional and financial clauses. Art. 1(3) states that Title I entails no new obligations beyond those in the AI Act for police AI systems and models, a framing repeated at art. 3(7).

Real-time biometric identification: two routes, two authorisers

The decree splits real-time remote biometric identification in public places into two regimes, and they have different gatekeepers. Art. 8 covers prevention and searches for missing persons or victims of kidnapping, trafficking or sexual exploitation, citing art. 5(1)(h)(i) and (ii) of the AI Act. Here the request goes from the questore, the provincial commander of the Carabinieri or Guardia di finanza, or the heads of the central services named at art. 12 of Decree-Law 152/1991, to the procuratore della Repubblica at the district capital tribunal. Under art. 8(5), once in force, the prosecutor's authorisation would cover a specific event or the strictly necessary time, in any case no more than fifteen days, renewable by reasoned decree for further fifteen-day periods, and could be granted only after the assessments at art. 5(2) of the AI Act.

Art. 13 inserts art. 359-ter into the Code of Criminal Procedure for the investigative use, and it would operate only once the decree is in force on 30 September 2026. The trigger is a person against whom there are sufficient indications of an offence listed in Annex II to the AI Act punishable by a maximum of not less than four years, a fugitive sought under a coercive precautionary order or a non-suspended custody order for such an offence, or, under paragraph 4, specific victims of abduction, trafficking or sexual exploitation. Here the public prosecutor would ask the giudice per le indagini preliminari, and the judge would authorise by reasoned decree with the same fifteen-day cap and the same art. 5(2) precondition.

Both routes have urgency provisions, neither operative before 30 September 2026, and they are not the same. Under art. 8(6) and (7), where delay risks serious and irreparable prejudice, the police authority may start the system on the order of the questore or commander after communication to the prosecutor, which may be oral; the authorisation request then goes within twenty-four hours of the start and the prosecutor decides in the following twenty-four. Under art. 359-ter(7), the prosecutor may order use by reasoned decree, communicated to the judge within twenty-four hours, with judicial validation in the following forty-eight; and where even the prosecutor cannot be awaited, judicial police officers may activate the system, send the request to the prosecutor within twelve hours, the prosecutor seeks validation within twenty-four hours of the start, and the judge has forty-eight hours. So the version of this decree in which real-time identification needs a judge's prior approval in every case is not the text. Once in force, it would be prosecutor authorisation for prevention, judge authorisation for investigation, and post-hoc validation in urgency.

The comparison database is constrained in the same words in both places. From 30 September 2026, under art. 8(3) and art. 359-ter(3), the biometric comparison would be run only against a reference database formed specifically for each use, holding only the biometric data relevant to that purpose, deleted at the end of the authorisation's validity, and not capable of incremental feeding from earlier authorisations. Both provisions would then prohibit in any case the use of biometric databases fed, wholly or in part, by untargeted scraping, which art. 2(1)(l) defines as the automated, indiscriminate, large-scale extraction of facial images from the internet or from closed-circuit footage using an AI system in order to create or expand facial recognition databases. That is a prohibition on a defined input to a defined activity, not a general web-scraping ban.

Art. 9 adds the paperwork. Before either use, the controller would complete a fundamental rights impact assessment under art. 27 of the AI Act and a data protection impact assessment under arts. 23 and 24 of Legislative Decree 51/2018. Once in force, every use would be logged automatically in unmodifiable files kept for five years. After use, the controller would notify the Garante, but only with the clearance of the competent judicial authority, which may defer the notification for up to three months, renewable once, for secrecy reasons. Art. 9(5) leaves the technical floor, minimum accuracy and reliability requirements, bias monitoring, database security and deletion arrangements, to a decree of the Minister of the Interior with the Minister of Justice, after the Garante and the national AI authorities. That decree is not in this issue.

Post-hoc facial recognition and the seven-day rule

Art. 10 is the venue provision, and like the rest of the decree it commences on 30 September 2026. Where a specific legal provision already permits a video surveillance system, that system could, once the decree is in force, be integrated with AI components. Facial recognition components could be activated only in the cases and on the conditions at paragraphs 2 and 3, and only after the images have been captured, with an interval that keeps the use out of the AI Act's real-time category. Paragraph 11 would forbid any untargeted activation with no link to an offence or criminal proceeding, and any generalised or indiscriminate biometric identification.

Paragraph 2 is the judge route, again from 30 September 2026. To run post-hoc recognition against a person under targeted search as a suspect, the prosecutor, on the application of the judicial police officers who started the system, would ask the giudice per le indagini preliminari for authorisation without delay and within forty-eight hours of the start; the judge would decide by reasoned decree within the following forty-eight. Missing the deadline or refusal would mean immediate stop and deletion of the data, results and outputs, unless they constitute the corpus delicti. Paragraph 3, citing art. 26(10) of the AI Act, carves out one case where no authorisation is needed: use exclusively after an offence has been committed, solely for the initial identification of a potential suspect on objective and verifiable elements directly connected to the offence, under the direct and exclusive responsibility of the designated public security officer or the proceeding judicial police officer.

The seven-day figure belongs to paragraph 7, and it reaches one thing. Under paragraph 4, at places and events with particular public order needs identified under criteria a ministerial decree will set, the system would process face images of people entering, without biometric processing, and store them locally in a reference database together with the identity data and any assigned seat scanned from the access ticket. Only after an offence would facial recognition be activated to extract biometrics from those stored images and compare them with the suspect. Paragraph 7 provides that the personal data processed in that reference database would, from 30 September 2026, be kept for seven days from collection and deleted automatically when the term runs out. Paragraph 8 would then require five-year unmodifiable logs of every access and operation, and paragraph 9 preserves the police retention periods at art. 10 of Presidential Decree 15/2018. Read together, the rule is seven days for the venue image store, five years for the logs, and the police-purpose retention periods of Presidential Decree 15/2018 for the rest of the data. A reader who takes the seven-day figure as the rule for all police biometric data is reading one paragraph as if it were the article.

Two further details set the ownership, on the same commencement. Paragraph 5 would make the Ministry of the Interior, Department of Public Security, the data controller. Paragraph 13 lets venue managers, event organisers or promoters install and maintain the AI and biometric components at no cost to public finances, after which the systems are lent free of charge to the questura, which takes complete and exclusive control of them. Paragraph 10 provides that no decision producing negative legal effects on a person may be based solely on the results of the facial recognition application.

Art. 437-bis and the entity fine, with their conditions attached

Art. 12 inserts art. 437-bis into the Criminal Code, an offence that does not exist until the decree commences on 30 September 2026, under the heading of omitted adoption of security measures in AI systems and unlawful alteration of systems. The first paragraph reaches whoever omits to adopt the technical security measures required for the design, training, production or placing on the market of high-risk AI systems, being measures suited to prevent malfunction or alteration, or omits to adopt human oversight measures. Once in force, the penalty would be one to five years' imprisonment, and it would attach only when those omissions cause danger to life or to public or individual safety. Where the danger is to the security of the State, the range would be two to eight years.

The second paragraph is the alteration offence, on the same 30 September 2026 commencement. Outside the first-paragraph cases and unless the fact is a more serious offence, whoever alters high-risk AI systems would be punished with two to six years where the fact causes danger to life or public or individual safety, and three to ten where the danger is to State security. Two more limbs follow. Where a first-paragraph fact is committed through gross negligence, the penalty would be reduced by one third to one sixth. And a professional user of high-risk AI systems who intentionally omits to adopt human oversight measures would face the first-paragraph penalties, again only where the omission produces the specified danger.

Those danger conditions are the structure of the offence, not a footnote to it. The text does not make an AI Act compliance failure a crime as such; it would criminalise specified omissions and alterations that produce specified dangers, with different mental-state limbs and a negligence mitigation. That is also how the delegation at art. 24(5)(b) of Law 132/2025, reprinted in the notes, framed the mandate: offences centred on omitted security measures where concrete danger to life, safety or State security follows.

Art. 15 adds art. 25-vicies to Legislative Decree 231/2001, the entity liability regime. Once in force, for the art. 437-bis offence the entity would face a pecuniary sanction of six hundred to one thousand quote; for the art. 612-quater offence, two hundred to seven hundred. Those are quota units under the 231 system, not euro amounts, and the decree does not restate how a quota is valued. Paragraph 3 attaches the interdictive sanctions at art. 9(2)(b) to (e) of the 2001 decree in both cases. Art. 14, for completeness, amends art. 104(1)(e-bis) of the criminal procedure implementing rules on preventive seizure of online content so that it reads content generated also with AI systems.

The civil toolkit: evidence orders, a rebuttable presumption, and the insurer

Title II Chapter II is short, arts. 16 to 20, and each article carries a limit. From 30 September 2026, art. 16(1) would apply the evidence-access rule at art. 17 to damages actions, contractual and non-contractual, for harm caused in the use of an AI system. Art. 16(2) would apply arts. 18 and 19 only where the damage arises from breach of one or more AI Act obligations. Art. 16(3) would leave art. 82 GDPR and the national transposition of the product liability directive 2024/2853 untouched. Art. 16(4) would add a forum: where the injured party is a natural person acting outside any business or professional activity, the court of the claimant's residence or domicile is also competent. The word is altresi, in addition, so the forum is an option for consumers and not an exclusive home court for every claimant.

Art. 17 is an evidence order, once in force, and the court controls it. On the application of the party alleging damage, the court would order the other party, or a third party holding them, to produce the specifically relevant evidence on how the AI system functioned, but only where the applicant presents facts and elements that make the claim plausible, including as to the link between the system's output and the harm. Paragraph 2 lists what counts: the logs under art. 12 of the AI Act, the risk management documentation under art. 9, relevant information from the technical documentation under art. 11, and information on human oversight parameters under art. 14. Paragraph 3 limits the order to what is necessary and proportionate with particular regard to trade secrets, and paragraph 4 adds protective measures and applies art. 121-ter of the industrial property code.

Non-compliance, once the decree is in force, is where the teeth are, and they differ by who fails. Under paragraph 5, a party that fails without justification to comply, even partly, exposes itself to adverse inferences under art. 116 of the Code of Civil Procedure; where the failure concerns the paragraph 2 documentation, the court, having weighed all other evidence, treats the applicant's alleged facts as admitted. Under paragraph 6, the court would fine a third party between 1,500 and 10,000 euros for failing, even partly and without justified reason, to comply with the production order.

Art. 18(1) is the presumption, operative from 30 September 2026, in one sentence: where the damage arises from the breach of one or more AI Act obligations, the causal link between the breach and the damage is presumed, unless proven otherwise. Editorial translation of the Italian, which is quoted in full below. Two things follow from the wording. The presumption needs an AI Act breach as its starting point, and it is rebuttable. Art. 19, on the same commencement, provides that the system's conformity with AI Act obligations, even if certified under Chapter III Section 5 of the regulation, does not of itself exclude the defendant's liability, without prejudice to the product liability transposition.

Art. 20 is the insurance article, it commences with the rest of the decree on 30 September 2026, and it does not mandate insurance. A prospective claimant would be able to ask the person it holds responsible whether a liability policy covers the damage; the request is expressly not a condition of admissibility. The addressee would have thirty days to disclose the existence of the contract, its particulars and the insurer's name, and an omitted or incomplete answer can ground adverse inferences. Paragraph 2 would give the injured party a direct action against the insurer providing the defendant's liability cover, within the limits of the sums for which the contract was written. Paragraph 3 makes contractual defences opposable to the claimant if they predate the loss event, paragraph 4 gives the paying insurer recourse against the insured to the extent it could contractually have refused or reduced payment, paragraph 5 makes the person identified as responsible a necessary party, and paragraph 6 subjects the direct action to the same limitation period as the action against the responsible party.

When it bites: 30 September, one year, and the AI Act clock

The GU record page gives 30 September 2026 as the entry into force. Nothing in the decree operates before then, and a reader who takes any of the above as current law on 18 September is early by twelve days.

Art. 21(1) is the transition, and it is narrow. AI systems that at commencement are the subject of contracts, are in development or testing for police purposes, or are already in police use are to be made compatible with the provisions of Title I Chapter II, the research, training and use chapter, by each police force within one year of that date. Counting from 30 September 2026 gives 30 September 2027; that arithmetic is ours. The clause names Chapter II only. It does not defer Chapter III, the biometrics chapter, and it does not defer Title II.

Art. 21(2) adds a second clock. For the Title I provisions whose application is provided directly by, or depends on, the AI Act, the entry into force and full implementation dates of that regulation govern. The decree does not list which provisions those are, and we do not supply the list. Several articles also wait on secondary instruments: the coordination regulation for police sandboxes under art. 5(4), the technical decree for real-time identification under art. 9(5), and the Interior decree on venues and image processing under art. 10(12). None appears in this issue, and we make no claim about whether any has been drafted.

Art. 22 closes with the standard clause that the administrations act within existing human, instrumental and financial resources and without new or greater burdens on public finances.

What we did not verify

What we opened: the full text of Legislative Decree 160/2026 as printed on pages 1 to 10 of Gazzetta Ufficiale Serie Generale n. 214 of 15 September 2026, read in full from the issue PDF in two extractions, a raw-order text and a layout-preserving text, the second used to resolve the two-column interleave on printed pages 9 and 10 where arts. 14 to 22 appear out of sequence in the raw file. We read all 22 articles, the preamble, the execution and signature block, and the explanatory notes where they reprint art. 24 of Law 132/2025 and the amended art. 104 of the criminal procedure implementing rules. We read the contents list of the issue. We read the GU record page for the act, which carries the field Entrata in vigore del provvedimento: 30/09/2026. Codex Gate 5 recorded that the live issue PDF and the file on disk share the SHA-256 5da3dde091e115ec02a9275ad13455f83c478d4eb256d912d9f8e132c7779e75; we rely on that record for the byte match and did not recompute it.

What we did not open: the AI Act provisions the decree cites, including arts. 5(1)(h), 5(2), 9, 11, 12, 14, 26(10), 27, 57 and 59 and Annex II; Legislative Decree 51/2018 and Presidential Decree 15/2018; art. 612-quater of the Criminal Code; art. 9(2) of Legislative Decree 231/2001; art. 116 of the Code of Civil Procedure; art. 121-ter of the industrial property code; Directive 2024/2853 and any Italian transposition; the Garante, Conferenza unificata and parliamentary committee opinions; the regulation by decree of the President of the Council of Ministers under art. 5(4) and the ministerial decrees under arts. 9(5) and 10(12), whose absence from this issue says nothing about their status elsewhere; and any gazette issue other than n. 214. We describe every one of those only as this decree describes it.

What we refuse to claim: we do not say the decree is in force, because the GU record page dates commencement to 30 September 2026. We do not say the companion national-authorities decree has been published, because it is not in this issue and we did not look elsewhere. We do not say all police biometric data is deleted after seven days, because art. 10(7) reaches the venue reference database and arts. 9(2) and 10(8) require five-year logs. We do not say real-time identification always needs a judge's prior approval, because art. 8 gives the authorisation to the prosecutor and both art. 8 and art. 359-ter have urgency routes with later validation. We do not say facial recognition is post-crime only, because art. 8 permits real-time use for prevention and for missing-person and victim searches. We do not say any AI Act breach is a crime or automatically founds damages, because art. 437-bis requires specified omissions producing specified dangers and art. 18 is a rebuttable presumption confined to AI Act breaches. We do not say claimants get an exclusive home forum, unrestricted access to technical files or guaranteed recovery from an insurer, because art. 16(4) is an additional consumer forum, art. 17 is a court-controlled and proportionate order, and art. 20 stops at the policy limit and preserves pre-loss defences. We do not say the decree mandates AI liability insurance, because it does not. We do not convert the 231 quote figures into euros. We do not say this is the first or only such regime anywhere. The quotation reproduces art. 18(1) with its printed line breaks joined by single spaces; no word or character is otherwise changed. Italian words elsewhere in this piece are printed without their accents as a house typesetting convention.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• Italy's Council of Ministers gives final approval to the Law 132/2025 implementing decrees
• The Garante's opinions on Italy's draft AI Act decrees
• EU digital omnibus and the deferred AI Act deadlines
• Europe AI regulation tracker
• AI Regulation News hub