The new department is an integrated and highly-specialised practice dedicated to technological innovation, artificial intelligence, telecommunications, cybersecurity, the data economy and the regulation of emerging technologies, including cutting-edge fields such as quantum technologies, robotics and the space economy. Its aim is to support businesses and public authorities in their digital transformation processes and in navigating the evolving European and international regulatory landscape, combining the firm’s established expertise with that of the leading professionals who have recently joined ADVANT Nctm.

The department is led by partnersPaolo Gallarati and Raffaele Giarda. Paolo Gallarati continues to drive the development of the firm’s practice in the digital economy and telecommunications sectors, while Raffaele Giarda – who joined ADVANT Nctm last July – further strengthens the firm’s standing through his extensive experience in the telecommunications, media and technology sectors, as well as in the regulation of digital infrastructure.

Working alongside them are of counsel Edoardo Raffiotta – who recently joined the firm to strengthen its offering in digital regulation and artificial intelligence, drawing on his extensive experience in academic, professional and institutional settings – and Antonio Corda, whose extensive managerial experience in the telecommunications and digital sectors supports the department’s strategic development.

The project also builds on the firm’s established expertise in the digital economy and telecommunications, developed over the years by Paolo Gallarati together with counsel Marco Cappa and Giulio Uras, professionals with significant experience in digital regulation, privacy and cybersecurity, with partnersVittorio Noseda, Carlo Grignani, Jacopo Arnaboldi and Marco Cosa also contributing their expertise in the telecommunications and information technology sectors.

The Digital, Tech and Data initiative has been launched against the backdrop of a rapidly evolving regulatory landscape, marked by the entry into force of legislative measures such as the AI Act or the launch of proposals such as the DNA (Digital Network Act), as well as by the implementation of EU regulations on data, digital resilience and cybersecurity. 

This evolution is making an integrated approach to technological, regulatory and data management issues increasingly crucial. According to ISTAT, in 2025 the adoption of artificial intelligence by Italian businesses doubled, but almost 60 per cent of companies cited a shortage of skills as the main obstacle to investment, while over 47 per cent pointed to regulatory uncertainty as a factor holding back investment.

“The launch of the Digital, Tech and Data department represents a further step in ADVANT Nctm’s development strategy. We will continue to invest in specialist expertise in the sectors that are transforming the economy, in order to offer clients multidisciplinary support capable of anticipating market and regulatory developments”, said Paolo Montironi, Senior Partner at ADVANT Nctm.

“The digital economy is redefining industrial models, markets and rules across all industrial sectors. This is why businesses need expertise that is increasingly integrated across the fields of law, technology and business. With this department, we are consolidating a growth path that enables us to offer clients an increasingly comprehensive service in an area set to have a far-reaching impact on their operations”, commented Paolo Gallarati, partner at ADVANT Nctm and co-head of the department. 

“The TMT sector and digital infrastructure are undergoing a period of profound technological and regulatory change. The launch of the department responds to the need to provide businesses with highly specialised and integrated expertise on issues relating to telecommunications, connectivity, digital infrastructure and the technology ecosystem, within an increasingly complex and constantly evolving landscape”, noted Raffaele Giarda, partner at ADVANT Nctm and co-head of the department. 

Areas of focus

The resolution identifies eleven thematic areas that will be the focus of the ex officio inspection activities, i.e. inspections conducted independently of complaints or reports:

1. processing of personal data in connection with geomarketing and neuromarketing activities;
2. processing activities included in electronic health records and carried out through medical apps;
3. continuation, within the interdepartmental task force, of checks into data breaches affecting particularly significant public databases, with a focus on security systems and database accessibility, in order to counter unauthorised access and the resale of confidential information;
4. processing carried out by entities providing public bodies with external Data Protection Officer (DPO) services;
5. processing carried out by municipalities for the management of social and welfare services, including with regard to the providers of the relevant software applications;
6. periodic checks on processing activities carried out within the Visa Information System;
7. verification of the implementation of the Guidelines issued by the Authority on 17 April 2026 concerning tracking pixels in email communications;
8. processing activities related to the use of artificial intelligence systems by municipalities and Local Health Authorities (ASLs);
9. continuation of checks on processing activities carried out within the Customs Information System;
10. checks and technical assessments concerning personal data breaches notified to the Authority, with particular regard to the most extensive and sensitive cases, in both the public and private sectors;
11. fact-finding and verification activities concerning processing activities related to dynamic pricing.

These areas are supplemented by a catch-all provision allowing for further ex officio inspections in cases of particular urgency or following reports and complaints.

Numbers and operational arrangements

The Data Protection Authority has established that the inspection activities relating to the areas identified will cover at least 35 inspection proceedings, also carried out with the support of the Guardia di Finanza pursuant to the memorandum of understanding between the two authorities. The Office will inform the Authority’s Board on a monthly basis of the entities inspected in the first eight thematic areas and will report, at the end of the six-month period, on the overall progress of the inspection and investigative activities carried out.

One point is worth noting: some of the priorities confirm lines of action already initiated under the inspection programme for the previous six-month period (Resolution No. 797 of 30 December 2025), such as checks concerning the Customs Information System and data breaches involving public databases. Others, by contrast, appear to be new or strengthened, particularly scrutiny of the use of artificial intelligence systems by municipalities and Local Health Authorities and the verification of the implementation of the Guidelines on tracking pixels in email communications, which were adopted only a few months before the resolution.

Implications for the organisations concerned

The resolution is programmatic in nature and does not identify the individual entities that will be inspected; their identification remains confidential until the relevant proceedings are initiated. Organisations operating in the sectors identified – particularly geomarketing and neuromarketing, digital health, external DPO services for public administrations, the management of municipal social and welfare services, email communications involving tracking technologies, artificial intelligence systems used in healthcare and by local authorities, and dynamic pricing – therefore have a clear indication of the areas on which the Data Protection Authority will focus its attention in the coming months. This provides them with an opportunity to assess in advance the compliance of their respective processing activities.

Over the past twenty years, the role of public data re-use has progressively evolved. Initially developed in a context in which opening up public information was closely linked to the need for transparency and public scrutiny of administrative action, re-use is now increasingly regarded also as a tool for innovation, economic growth and the development of new services. In general terms, “re-use” refers to the further use of data acquired or generated in the performance of public functions for purposes other than those for which they were originally collected or generated. It is precisely this possibility of giving data a “second life” that makes re-use particularly attractive to businesses: information collected to perform a public task can become a raw material for applications, services, research activities or business initiatives.

There are now numerous examples. Public data can be combined to develop tools that help identify employment opportunities accessible by public transport, platforms that make financial statements easier to understand, applications for monitoring air quality, or projects that use satellite data and open data to identify deforestation. The point, therefore, is not merely to make data accessible. The challenge is to create the conditions under which data can actually be found, understood, combined and re-used. It is at this stage that the issue of re-use moves beyond the sphere of mere transparency and into the broader field of the data economy: public information assets become a resource capable of generating social and economic value without losing their original public character.

This evolution has been accompanied by the progressive expansion of the European regulatory framework: from Directive 2003/98/EC of the European Parliament and of the Council of 17 November 2003 on the re-use of public sector information, subsequently amended by Directive 2013/37/EU of the European Parliament and of the Council of 26 June 2013, to Directive (EU) 2019/1024 of the European Parliament and of the Council of 20 June 2019 on open data and the re-use of public sector information, and Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act).

What changes with the Digital Omnibus?

The proposal starts from a relatively straightforward premise: in recent years, the European Union has developed a regulatory framework for the data economy through a plurality of legislative instruments, each addressing specific aspects of data circulation. This regulatory layering has created new rights and new data-sharing mechanisms, but it has also resulted in overlaps, compliance costs and difficulties in applying the rules for both public administrations and businesses. The Digital Omnibus seeks to address this issue through a consolidation exercise. In particular, the proposal provides for the rules of the Open Data Directive and those of the Data Governance Act concerning the re-use of certain categories of protected data to be incorporated into the Data Act. The latter would thus become the main framework for the European rules governing access to, sharing and re-use of data in the digital economy.

With regard to the re-use of data held by public-sector bodies, the change is not merely editorial: the proposal establishes a new, unified chapter within the Data Act, bringing together rules that currently fall under two separate regimes: on the one hand, open government data, traditionally governed by the Open Data Directive; on the other, certain categories of protected data, currently governed by the Data Governance Act.

The new framework maintains an important distinction between the two categories. For open data, the general principle of re-usability remains in place, subject to the limitations laid down by the applicable rules. For certain categories of protected data, by contrast, no general obligation is imposed on public administrations to permit re-use: instead, minimum conditions are established for cases in which a public-sector body decides to make such data available. Alongside the relocation of the existing rules, however, the proposal also introduces new elements. It extends and harmonises common principles, such as non-discrimination, the prohibition of exclusive arrangements and certain rules on fees. Most importantly, it allows public bodies to impose specific conditions and higher fees for re-use by very large businesses and, in particular, by gatekeepers designated under the Digital Markets Act, provided that such conditions are proportionate and based on objective criteria.

This is a significant development because it shows that re-use is no longer viewed solely in terms of the indiscriminate opening up of public information assets. The regulatory framework is beginning to take into account the economic position of the re-user and the risk that entities with significant market power could appropriate, on the same terms applicable to smaller operators, the value generated by data collected by the public sector. In other words, the question is no longer simply whether public data can be re-used, but also under what conditions, by whom and with what effects on the market. This is where the data economy perspective becomes particularly evident. The Digital Omnibus on data therefore appears to seek a balance between two objectives: simplifying access to public information assets while, at the same time, governing their economic use in a market characterised by significant asymmetries between market participants.

This approach does not, of course, eliminate the traditional limitations on re-use. The protection of personal data, intellectual property rights, trade secrets and other protected interests continue to affect both the possibility of making data available and the conditions governing their subsequent use.

The issue of personal data

The relationship between re-use and the protection of personal data remains one of the most sensitive aspects. The very concept of re-use presupposes that information collected for a specific purpose may also be used for additional purposes. The GDPR, by contrast, bases an essential part of its regulatory framework on the principle of purpose limitation and on the need to assess the compatibility of subsequent uses. The tension is clear: open-data policies seek to make information available precisely so that it can be used in ways that may not have been foreseeable at the time of collection, whereas data protection rules require that further processing not be incompatible with the original purpose and that the other safeguards laid down by the Regulation be respected. This means that accessibility and re-usability are not synonymous. The fact that information is publicly accessible does not, in itself, mean that it may be freely used for any purpose. The assessment of the re-use of personal data therefore continues to require an approach based on accountability, an appropriate legal basis, compatibility of purposes and, where necessary, measures such as anonymisation or pseudonymisation.

Within the framework of the Digital Omnibus, this issue assumes even greater significance because the proposal also affects the definition of personal data, placing greater emphasis on the contextual dimension of identifiability. In practical terms, the same information could constitute personal data for one party that has reasonable means of linking it to a natural person, while not constituting personal data for another party that does not have access to such means. If this approach were retained in the final text, the implications for re-use could be significant. Whether data qualify as personal data would not be an immutable characteristic of the information itself, but would also depend on the recipient and the resources available to that recipient. For public administrations, this could mean the need to assess even more carefully who the re-user is, what additional data that party could reasonably use, and what safeguards are necessary to prevent re-identification.

The result is a framework in which regulatory simplification does not necessarily translate into a simplification of the practical assessments required. Bringing multiple regulatory regimes together within the Data Act may make the system easier to understand, but it does not eliminate the need to balance data openness, the protection of individuals and the safeguarding of the other interests involved.

The shift in values underway: what opportunities for businesses?

The question raised in the title can be translated into very concrete terms: are data held by public administrations increasingly becoming a resource that businesses can also use? The answer is yes, but with some important qualifications. Transparency continues to be a fundamental function of making public data available. Much of this information is published to enable citizens to understand and scrutinise the activities of public administrations and, in the Italian system, a significant proportion of re-usable data derives precisely from the publication obligations established by Legislative Decree No. 33/2013 or from access mechanisms.

Alongside this traditional function, however, a second perspective is becoming increasingly prominent: public data can become a resource for developing new services, products and business models. This is the aspect of greatest interest to businesses. Data relating, for example, to mobility, land and territory, the environment, energy, public procurement, economic activities or public services can be used to develop applications, digital services, analytical tools or artificial-intelligence-based solutions.

The proposed Digital Omnibus on data appears to reinforce this trend. Incorporating the rules on re-use into the broader framework of the Data Act brings data held by the public sector even closer to the European rules governing the circulation and sharing of data within the economy.

For businesses, this means that the information assets held by public administrations should no longer be viewed merely as something to consult, but increasingly also as a potential source of data to be integrated into their own activities. The change is above all cultural and systemic: public administrations are no longer merely entities that collect and publish information, but also actors within the European data ecosystem. Naturally, not all public data can be freely used. The limitations relating to the protection of personal data, intellectual property and security remain central.

For businesses, however, the overall direction is clear: understanding what data are available, under what conditions they can be re-used, and through which mechanisms they can be obtained is becoming increasingly important from a competitive standpoint as well. The re-use of public data is increasingly being recognised for its economic function. This creates a genuine opportunity for businesses, which may transform data already collected by the public sector, through re-use, into new services, knowledge and innovation.

The legal debate has focused predominantly on the obligations introduced by the AI Act and on the classification of systems according to their respective level of risk. For corporate bodies, however, the issue is broader. The adoption of artificial intelligence tools is not merely a technological or regulatory compliance choice, but a decision that affects the organisation of the company, its decision-making processes and its control system.

Artificial intelligence therefore represents a new test of the adequacy of organisational, administrative and accounting arrangements and raises questions directly connected with the duties and liabilities of directors, the board of statutory auditors, the Supervisory Body (Organismo di Vigilanza) and other control functions. The issue is not to identify new forms of liability, but to assess how established duties – relating to organisation, information and oversight – should be applied in a technological context characterised by greater complexity, speed and opacity.

A governance choice, not merely a technological one

Article 2086 of the Italian Civil Code requires an entrepreneur operating in corporate or collective form to establish organisational, administrative and accounting arrangements appropriate to the nature and size of the business.

As is known, the adequacy of such arrangements cannot be assessed in the abstract, but must be assessed in light of the business carried on, the complexity of the organisation and the risks actually assumed. From this perspective, the introduction of artificial intelligence systems into business processes may make it necessary to update existing arrangements.

It is worth emphasising that there is a circular relationship between organisational arrangements and information flows: information flows function effectively if the arrangements are adequate, but, in order to be adequate, the arrangements must in turn ensure an effective exchange of information within the company. Artificial intelligence systems are relevant from both perspectives: they fall within the notion of technical arrangements – and, as such, are subject to the duty of adequacy – even when they are used exclusively to facilitate the flow of information among corporate bodies.

This approach now finds significant support in positive law. The recent reform of the Consolidated Law on Finance (Testo Unico della Finanza -TUF) expressly brought the use and monitoring of artificial intelligence systems within the scope of the administrative, organisational and accounting arrangements of listed companies. New Article 123-bis requires companies to describe the policies adopted concerning the use and monitoring of new technologies – including AI systems – as well as their policies for managing cyber risks and cybersecurity. New Article 149-ter, from the internal control perspective, requires verification that continuous, automated and predictive monitoring systems are adequate and proportionate to the nature and size of the company. Although these provisions apply to listed companies, they reflect a broader trend: the use of artificial intelligence is no longer merely a technological or regulatory issue, but has become an integral part of corporate governance and enterprise risk management.

The first step should be to identify the AI systems used within the organisation. In many companies, these tools are in fact adopted autonomously by individual functions, sometimes through general-purpose applications, without a centralised decision and without their use being adequately mapped.

This may give rise to a form of “shadow AI” comparable, in certain respects, to the phenomenon of shadow IT: tools that are often used outside the company’s authorisation and control processes, with resulting risks relating to the confidentiality of information, the protection of personal data, intellectual property, cybersecurity and the reliability of outputs.

Adequate arrangements should instead enable the company to know at least:

• which AI systems are being used;
• for what purposes and within which processes;
• which data are entered or processed;
• who is authorised to use them;
• which individuals are responsible for their selection, configuration and supervision;
• which controls are in place over the outputs produced;
• how decisions taken with the support of such systems are documented.

This does not necessarily require the creation of new structures or functions. Rather, AI governance should be integrated into existing safeguards, with responsibilities, decision-making procedures and information flows defined consistently with the characteristics of the company.

The role of the board of directors

The adoption of artificial intelligence systems may, within certain limits, fall within management decisions entrusted to the discretion of directors. The decision, however, must be preceded by an informed and reasonable process.

The business judgment rule protects entrepreneurial discretion and prevents the merits of management decisions from being reviewed solely on the basis of a negative outcome. It does not, however, remove from judicial scrutiny the process through which the decision was taken, nor does it protect manifestly irrational decisions adopted in the absence of the necessary information or without an adequate assessment of the relevant risks.

Where a decision has been taken with the support of an artificial intelligence system, the business judgment rule can operate only provided that the directors have adequately substantiated their decision. The reasoning is relevant in both directions: both where the intention is to follow the algorithm’s recommendation and where the decision is to depart from it. In the absence of an explicit and reasoned justification, there is a risk that the decision may amount to mere uncritical adherence to the machine’s output – making it impossible to reconstruct ex post the reasoning followed by the directors and to verify the methodological soundness of the decision. From this perspective, the reasoning constitutes the principal safeguard against decision-making becoming overly dependent on the system’s output and is a necessary condition for management discretion to be regarded as having been effectively exercised.

Before introducing an AI system into a material business process, directors should therefore verify, including with the support of the relevant functions:

• the purpose pursued and the benefits reasonably expected;
• the reliability of the system and the quality of the data used;
• the legal, operational, reputational and security risks;
• the possibility of explaining and verifying the results produced;
• the existence of effective human oversight;
• the adequacy of the contractual terms applied by the provider;
• the possibility of conducting audits and controls;
• the arrangements for monitoring following implementation.

Ultimate responsibility for the decision cannot be transferred either to the artificial intelligence system or to the technology provider. Similarly, reliance on AI should not result in a substantially uncontrolled delegation to IT functions or external consultants.

The greater the extent to which the system is intended to affect strategic decisions, the exercise of corporate powers or the rights of employees, customers and other stakeholders, the greater the level of involvement of the corporate bodies and the degree of formalisation of the relevant decision-making process should be.

Delegation, information flows and the duty to act on an informed basis

AI governance also intersects with the rules governing delegations and information flows under Articles 2381-bis and 2381-ter of the Italian Civil Code.

Delegated bodies are required to ensure that the organisational, administrative and accounting arrangements are adequate to the nature and size of the business. On the basis of the information received, the board of directors assesses their adequacy; all directors are also required to act on an informed basis.

The use of AI should therefore be reflected in the periodic information flows addressed to the board, at least where it concerns significant processes. The information should include not only a list of ongoing projects, but also the risks identified, any incidents or malfunctions recorded, the results of the checks carried out and any corrective measures adopted.

With specific reference to the artificial intelligence systems adopted, the information provided by the delegated bodies to the board should cover at least: the origin of the system and the identity of the provider; the data used for its development and training; how it operates; the reasons for choosing it over the alternatives available on the market; and the degree of transparency and the main reliability parameters. Only on the basis of such information can the board be regarded as adequately informed and effectively perform its function of assessing the adequacy of the organisational arrangements.

In this context, it may be appropriate to appoint an internal officer or establish an interdisciplinary committee involving, depending on the size and structure of the company, the legal, compliance, risk management, IT, cybersecurity, privacy, internal audit and human resources functions.

Some companies have adopted more structured solutions, establishing a board committee dedicated to technological matters – with preparatory, proposal and advisory functions vis-à-vis the full board – or appointing a specific algorithm officer responsible for continuously assessing the transparency, adequacy and proper functioning of the algorithmic systems employed. The latter role is particularly useful in view of the self-learning capabilities of algorithms, which may cause them to modify their behaviour over time, making continuous and systematic oversight necessary rather than merely episodic supervision.

The objective is not to bureaucratise innovation, but to ensure that decisions are taken by individuals with the necessary expertise and on the basis of sufficient, verifiable and documented information.

Oversight by the Board of Statutory Auditors

The board of statutory auditors is likewise required to address the use of artificial intelligence within the corporate organisation.

The duty to oversee the adequacy of the organisational arrangements and their actual functioning does not entail a technical assessment of individual algorithms. It does, however, require the board of statutory auditors to verify the existence of a corporate process capable of identifying, assessing and managing the risks associated with the use of AI.

The board may therefore request information, inter alia, on the existence of an internal policy, the allocation of responsibilities, training activities, the systems considered to present the greatest risks, the results of audits and any incidents that may have occurred.

The complete absence of information flows concerning tools already used in significant business processes could be an indication that the organisational arrangements are inadequate or, at the very least, that they need to be updated.

Artificial Intelligence and Model 231

The introduction of AI systems also requires an assessment of their possible implications for the organisational, management and control model adopted pursuant to Legislative Decree No. 231/2001 (the “Model 231”). AI, in fact, does not merely add new risks to the catalogue of risks already mapped: it may substantially alter the risk assessment of sensitive activities – changing the probability, manner and scale of potentially unlawful conduct – and thereby put the adequacy of the existing model to the test in practice.

AI may affect the risk of committing various predicate offences. By way of example, this includes the manipulation of information and documents, cyber offences, copyright infringements, corporate offences, corrupt practices and the improper use of confidential information.

Technology can certainly strengthen controls by making it possible to analyse large volumes of data and identify anomalies that would be difficult to detect through traditional checks. At the same time, however, it may increase the speed, scale and difficulty of tracing unlawful conduct.

The Model 231 risk assessment should therefore consider which sensitive activities involve the use of artificial intelligence systems and assess whether the existing protocols remain adequate. It may be necessary to update procedures concerning authorisations, segregation of duties, data management, traceability of operations, supplier selection and document retention.

Particular attention should be paid to the allocation of responsibilities. The presence of an automated process cannot create a control-free area in which it is impossible to establish who authorised the use of the system, verified the result or took the final decision.

The Supervisory Body is not required to replace directors or technical functions in managing AI systems. Within the scope of its duties, however, it should receive sufficient information to assess the impact of such tools on Model 231 risks and on the effective implementation of the model. Information flows to the Supervisory Body could concern, inter alia, the introduction of AI systems into sensitive activities, any incidents, anomalies or unauthorised uses, and the results of audits and monitoring activities. The use of artificial intelligence may, in turn, support certain of the Supervisory Body’s control activities, provided that it does not replace critical assessment of the results and that the principles of proportionality, confidentiality and reliability are respected.

AI in Internal Investigations

A further area of particular interest concerns the use of artificial intelligence in internal investigations.

AI tools can facilitate the analysis of large volumes of documents, communications and corporate data, identifying connections, anomalies or recurring patterns that may be useful for investigative purposes. Their use nevertheless requires specific safeguards: the origin and quality of the data must be verified, discriminatory or misleading results must be prevented, the confidentiality of information must be ensured and the rights of the persons involved must be protected.

An algorithmic output should never, on its own, be regarded as conclusive evidence of unlawful conduct. It must be possible to reconstruct the method followed and subject the results to effective human review. The decision to take disciplinary measures, make a report or pursue further action must remain entrusted to competent individuals, on the basis of verified elements and in compliance with the applicable safeguards.

The interface with the AI Act

> Regulation (EU) 2024/1689 – the AI Act – establishes a framework based on the level of risk associated with different systems and provides, as applicable, for obligations concerning risk management, data quality, documentation, record-keeping and traceability, transparency, human oversight and monitoring.

These obligations do not exhaust the issue of corporate governance of AI, but they help define the substantive content of the safeguards that companies must adopt. Even where a system does not fall within the category of high-risk systems, its use may nevertheless be relevant to the proper organisation of the company and to the duties of its corporate bodies.

Compliance with the AI Act and the adequacy of organisational arrangements therefore operate on distinct but interconnected levels: the former concerns compliance with the obligations laid down by European legislation; the latter requires a broader and proportionate assessment of the ways in which the company governs its activities and the associated risks.

Towards integrated artificial intelligence governance

Artificial intelligence does not automatically give rise to new forms of directors’ liability. It does, however, require existing duties to be applied to a technological context characterised by greater complexity, speed and opacity.

For corporate bodies, the point is not to know in detail how every system works technically, but to ensure that the company has the expertise, procedures and controls necessary to use it in an informed manner.

Effective governance should systematically consider which artificial intelligence systems are being used and for what purposes, who authorises their introduction and assumes responsibility for them, which risks are assessed before implementation and what forms of human oversight are actually provided for. It is also necessary to verify that outputs are traceable and verifiable, that contractual relationships with providers adequately regulate matters relating to data, confidentiality, auditing, security and liability, that corporate bodies and control functions receive adequate information flows, and that the Model 231 and corporate procedures have been updated in light of the new risks.

Innovation should not be hindered, but properly governed. Precisely the ability to integrate artificial intelligence responsibly and with a greater awareness of its potential and risks into corporate organisational arrangements and control systems will be one of the most significant indicators of the quality of corporate governance in the years to come.

1>^ “Shadow AI” refers to the use of artificial intelligence systems or tools that are not authorised, inventoried or otherwise governed by the organisation. The expression derives from the concept of “shadow IT”, which refers to the use of IT applications, services or infrastructure outside the company’s approval and control processes.

Comparison with the Italian DPA’s template

But what, in concrete terms, changes compared with the template used by the Italian Data Protection Authority?

In terms of content, relatively little changes. The main differences concern the classification of the breach and its causes, risk assessment, the cross-border dimension and certain simplifications – such as the scale used to assess the severity of the impact on data subjects – which remains more detailed in the Italian DPA’s template.

First, the EDPB template introduces a structured sub-classification of breaches. For confidentiality breaches, it distinguishes between data that have actually been exfiltrated or disclosed; exfiltration or disclosure considered likely despite the absence of evidence; exfiltration or disclosure reasonably ruled out in light of the available evidence; and cases in which an assessment is not yet possible. It also includes a specific question on whether the data are intelligible to unauthorised third parties, reflecting the condition for exemption from notifying data subjects under Article 34(3)(a) GDPR. For integrity breaches, by contrast, it distinguishes between data alteration with no evidence of unlawful use; alteration with evidence of unlawful use but with the possibility of restoration; and alteration with evidence of unlawful use and no possibility of restoration. Finally, for availability breaches, it distinguishes between temporary and permanent unavailability.

The EDPB also replaces the free-form description of the breach with a closed taxonomy of twenty-five types of incident, including ransomware, phishing and social engineering, likely exploitation of a security vulnerability (known CVE or zero-day), unauthorised access, data exfiltration, misconfiguration or incorrect access permissions, lost or stolen devices, personal data displayed to the wrong recipient, unintended publication, and personal data deleted or destroyed. Similarly, it replaces free-form descriptions of pre-existing technical and organisational measures and of measures planned to prevent future breaches with structured lists. This approach reduces the heterogeneity of notifications and facilitates their comparative analysis by supervisory authorities.

As regards risk assessment, the proposal expressly provides for the scenario in which the breach is “unlikely to result in a risk” to the rights and freedoms of data subjects. This option is absent from the Italian DPA’s template, where the choice is between high risk, no high risk, and the need for further assessment, without distinguishing between a risk that exists but is not high and a risk that is unlikely within the meaning of Article 33(1) GDPR. This distinction has significant legal significance, since it reflects the condition under which the GDPR permits the notification to the supervisory authority to be omitted altogether. The template also requires the methodology used and the main factors taken into account in the assessment to be expressly stated. Under the Italian DPA’s template, this requirement gave rise to a free-form explanation, whereas under the EDPB proposal it takes on a more formalised character.

Further additions concern the cross-border dimension. The template requires the approximate number of data subjects concerned in each country involved – information not provided for in the Italian DPA’s template – as well as a list of the other supervisory authorities in the European Economic Area to which the breach has been notified or is expected to be notified. The Italian DPA’s template, by contrast, merely asks which authorities have already received the notification. A separate section is then devoted to controllers not established in the European Economic Area but subject to the GDPR pursuant to Article 3(2), whereas in the Italian DPA’s template the position of such entities is addressed only indirectly, through the section concerning the representative under Article 27.

Conversely, the EDPB template simplifies certain aspects that the Italian DPA’s template retains. The scale for the severity of the potential impact on data subjects comprises four levels (minor, moderate, severe and to be determined), compared with the five provided for in the Italian template (negligible, low, medium, high and not yet determined). As a result, intermediate positions – particularly the distinction between low and medium impact – are less clearly defined and could lead to a precautionary upward adjustment of the assessment. For a controller not established in the European Economic Area that is required to designate a representative under Article 27 GDPR, the template merely requires the representative’s name and contact details, whereas the Italian DPA’s template provides for a dedicated section containing full identification and contact details. Finally, as regards the cross-border dimension, the EDPB distinguishes only between countries where the controller has an establishment and countries where affected data subjects are located, whereas the Italian DPA’s template identifies a third dimension, namely the establishments actually involved in the breach. This may not coincide with the first category and provides a more granular representation of the geographical scope of the incident.

Some critical considerations 

The first issue concerns the relationship between the content of the template and the minimum content of the notification laid down by the GDPR. Article 33(3) GDPR sets out four minimum elements: the nature of the breach, including, where possible, the categories and approximate number of data subjects and personal data records concerned; the contact details of the data protection officer or another point of contact; the likely consequences; and the measures taken or proposed to address the breach. With approximately 120 fields and conditional completion rules, the EDPB template goes significantly beyond this core. This is not in itself unlawful, given that it is a soft-law instrument, but its operational implementation through national portals risks turning into a de facto obligation something that the GDPR does not require: in enforcement proceedings, a field left blank or completed only in general terms could be treated as an indication of inadequate accountability, even in the absence of an explicit legal basis requiring that level of detail.

The requirement to expressly state the methodology and factors considered in the risk assessment, while consistent in the abstract with the principle of accountability, nevertheless presents a delicate aspect. The notification – prepared under the pressure of the seventy-two-hour deadline and with no real opportunity for a considered review of its wording – becomes key documentary evidence in any subsequent administrative sanctioning proceedings and civil litigation concerning damage caused by a data breach. The focus of the authority’s assessment could thus shift from the incident itself to the quality of the procedural compliance reflected in the notification, which is then read ex post with the benefit of hindsight.

The requirement to describe the systems, software, services and infrastructure involved, together with their location, also raises a further issue concerning the controller’s own operational security. The transmission to the authority of even a general map of the controller’s IT infrastructure should at least be accompanied by the possibility of identifying certain information as confidential or security-sensitive, similarly to what is provided for under NIS2 in dealings with CSIRTs. The introduction of a confidentiality flag, or of a structural distinction between public information and technical information subject to confidentiality, appears to be a reasonable request to put forward during the consultation process.

The harmonising effect of the template must, however, also be assessed in light of the broader framework of incident notification obligations to which controllers are typically subject today. In addition to the GDPR, parallel notification obligations are provided for under the NIS framework, DORA for financial entities, the CER framework, and so on. From this perspective, the template does not appear to have been designed to enable a “report once, share many” approach, consistent with the architecture of the Digital Omnibus, which proposes a single reporting point at European level coordinated by ENISA. A model that operated alongside existing national portals without replacing them and without interacting with NIS2 and DORA would risk becoming yet another format, adding a further layer of fragmentation rather than reducing it.

Finally, it should be emphasised that the document adopted by the EDPB for public consultation defines a common template, but does not in itself establish a single European portal for breach notifications, nor does it automatically provide for the replacement of national procedures.

Against this background, the balance between the seventy-two-hour deadline and the level of detail required regarding the nature of the incident, the root cause and the infrastructure involved appears difficult to sustain in practice, particularly for smaller organisations. The foreseeable outcomes are precautionary over-notification, the systematic submission of incomplete notifications followed by follow-ups that are effectively never closed, or defensive drafting characterised by generic wording. None of these scenarios genuinely serves either the authority or the data subjects. It would be consistent with the structure of Article 33 GDPR to draw a clearer distinction between the minimum content that can reasonably be required within seventy-two hours and the technical post-mortem, the latter to be submitted at a later stage within more realistic timeframes.

This is compounded by the absence of genuine proportionality between the model applicable to large controllers and the model usable by micro and small enterprises. In the field dedicated to the type of organisation, the template distinguishes between micro-enterprises, SMEs, large enterprises and other categories, but this classification does not trigger any simplification of the subsequent fields. This approach sits uneasily with the logic of Article 30(5) GDPR, which exempts micro and small enterprises from maintaining records of processing activities under certain conditions, and with the Helsinki Statement, through which the EDPB itself undertook to promote proportionate tools for smaller organisations. It would be desirable for the final template to provide for a simplified completion process for micro-enterprises and SMEs, centred on a minimum set of information corresponding to Article 33(3) GDPR.

Assessment and proposals

The simplification and harmonisation pursued therefore do not amount to a reduction in the information required; on the contrary, in certain areas, the greater granularity actually requires more detailed completion. The potential advantage of the EDPB’s proposed scheme lies primarily in the standardisation of the categories used, the greater predictability of the information required, and the possibility of adopting a common language in internal data breach management procedures and in dealings with the various European supervisory authorities.

From a constructive perspective, three course corrections appear particularly useful: the introduction of a principle of no adverse inference in favour of a controller that submits an incomplete notification in good faith and supplements it within the prescribed timeframe; the provision of a confidentiality flag for security-sensitive information transmitted to the authority; and the automatic activation of a simplified completion process for micro-enterprises and SMEs, calibrated to the minimum content of Article 33(3) GDPR.

GEMA, the German collecting society (the equivalent of SIAE in Italy), challenged Suno – a platform that enables users to generate musical works from text prompts – over its use of works in GEMA’s repertoire for training purposes and for generating songs that were very similar to well-known tracks (including hits such as “Mambo No. 5” and “Daddy Cool”), arguing that such activities constituted acts of reproduction and memorisation of copyrighted works without authorisation.

The judgment found that Suno’s model had in fact been trained using works from GEMA’s repertoire and that it operated by retaining copies necessary to generate the content requested by users, characterising such conduct as copyright infringement. The Court ordered Suno to cease such uses and to disclose documentation relating to the platform’s use of the works and its revenues for the purposes of assessing damages.

Of particular interest is the Court’s territorial approach: the fact that the training had taken place in the United States did not exclude the unlawful nature of the conduct, given that its effects occurred in the EU through a platform accessible to European users. The Court excluded the exculpatory effect of the so-called “fair use doctrine” under US law (even if it were considered applicable), as well as that of the European text-and-data-mining (TDM) exception, particularly on the ground that the scraping of content (which Suno had apparently carried out on platforms such as YouTube) had resulted in the acquisition of the works in their entirety, rather than merely the extraction of data relating to them.

The German judges also addressed the issue of the concept of a “copy” in the context of generative AI. According to the Court, the storage of a work constitutes an unlawful copy even where the work is not displayed “in plain view” to the user, provided that its entire content can nevertheless be retrieved through a simple open-ended prompt. This legal interpretation of the concept of a copy in the new context of generative AI is of particular interest because, for example, it differs from the approach taken in November 2025 by the High Court of England and Wales in another high-profile case, Getty Images v. Stability AI, concerning an image-generation platform (High Court of England and Wales, [2025] EWHC 2863 (Ch)).

The German decision under discussion is also particularly significant because it applies these principles for the first time to the music sector, where the assessment of similarities between works is traditionally more sophisticated than in other creative fields. From this perspective, the judgment is of greater interest than the precedent obtained by GEMA in Germany in 2025 against OpenAI concerning the reproduction of song lyrics alone.

Suno has already announced its intention to appeal the decision. Nevertheless, this is a precedent that provides extremely relevant guidance on the application of the EU legal framework to AI and model training, adding an important layer of protection from an intellectual property perspective, beyond those already implemented  at the regulatory level through the transparency obligations introduced by the AI Act. The European approach increasingly appears to be aimed at ensuring adequate remuneration for rights holders, while encouraging models based on fair and transparent licenses, terms and conditions.

It is certainly significant that, immediately following the publication of this decision, a sort of international “chain reaction” has already been triggered over the past few weeks. On the one hand, major companies such as BMG and Warner have announced a new licence with Suno aimed at “regularising” the platform’s future use of copyrighted content; on the other hand, Sony promptly brought proceedings against Anthropic over the platform’s use of copyrighted content in connection with Claude. Meanwhile, the US administration filed, in another set of proceedings pending against OpenAI before the Southern District of New York, a Statement of Interest in which it strongly argues that the use of third-party works to train GenAI platforms does indeed constitute “fair use” (contrary to the position taken in the GEMA judgment discussed here) and should therefore, in its view, be broadly tolerated rather than sanctioned.

This intensification of the debate and litigation is likely to have significant implications in Italy as well, where a growing number of similar claims and disputes are likewise expected, such as the proceedings, still pending, brought late last year by RTI and Medusa Film before the Court of Rome to protect their original audiovisual content against the Perplexity AI platform. More generally, rights holders and owners of protected content (as well as collecting societies) are becoming increasingly active worldwide in an effort to prevent not only works, but also performances, artistic interpretations and distinctive identifying elements, from being unlawfully and freely exploited by these platforms.

The Court held that, in online contracts between businesses concerning goods or services of the information society, the specific approval required for the terms listed under Article 1341(2) must be expressed by means of an electronic signature. The mere selection or ticking of a checkbox corresponding to the relevant term is not, in itself, sufficient.

For contracts that are not subject to a written form ad substantiam, the requirement may also be satisfied by means of a simple electronic signature. By way of example, the Court referred to the use of a One-Time Password (OTP) sent to the signatory by SMS or email and subsequently entered on the platform.

The decision is particularly relevant for businesses using online onboarding and contracting processes based on acceptance of standard terms and conditions through checkboxes, especially where a separate checkbox is provided for the specific approval of the terms falling within Article 1341(2) of the Italian Civil Code.

The background of the case

The dispute arose from an electricity supply agreement entered into electronically between two companies.

Following the action brought by the customer before the Court of Viterbo, the supplier raised an objection asserting the exclusive jurisdiction of the Court of Rome, on the basis of the relevant jurisdiction clause contained in the standard terms and conditions.

According to the supplier, the contract had been concluded through a touch-point procedure: the customer had accepted the offer by completing an online form and selecting the relevant checkboxes, while the jurisdiction clause had allegedly been specifically approved by means of a separate flag.

The Court of Viterbo held that the jurisdiction clause was ineffective, noting, among other things, that no evidence had been provided that the clause had been specifically approved in accordance with the procedure described by the supplier.

The issue subsequently came before the Italian Supreme Court of Cassation in proceedings concerning the allocation of jurisdiction.

The principle established by the Supreme Court 

The Court’s reasoning starts from Article 13(1) of Legislative Decree No. 70/2003, pursuant to which the ordinary rules governing the conclusion of contracts also apply where the recipient of an information-society good or service places an order electronically.

Accordingly, the Supreme Court held that the requirements under Article 1341(2) of the Italian Civil Code, including the requirement of specific written approval of the contractual terms falling within that provision, also apply to contracts concluded online.

The Court then examined how this requirement may be satisfied in a digital environment.

Referring to its previous case law concerning electronic documents and electronic signatures, and departing from more recent decisions of lower courts that had accepted point-and-click mechanisms as sufficient for the specific approval of terms under Article 1341(2), the Supreme Court held that, for contracts not subject to a written form ad substantiam, specific approval may validly be given by means of a simple electronic signature.

The online platform should therefore provide a dedicated process enabling the contracting party to specifically approve the relevant terms by means of an electronic signature, since, according to the Court, the mere selection of the relevant checkbox is not sufficient to satisfy this requirement.

By way of example, the Order identifies the use of an OTP sent by SMS or email as a possible means of obtaining such an electronic signature, without, however, necessarily limiting the technical means that may be used to this particular solution.

Specific approval in the digital environment

The Order provides an opportunity to transpose into the digital environment the traditional requirement of specific approval under Article 1341(2) of the Italian Civil Code. This provision dates back more than eighty years, to a period in which electronic contracting was not even foreseeable, and its application to digital contracting therefore requires an evolutionary interpretation capable of preserving its protective function without imposing formalities that are incompatible with the underlying rationale of the provision.

In paper-based contracting, this requirement is traditionally satisfied through the so-called double signature: the signature relating to the contract as a whole is followed, usually immediately below the first signature block, by a second and separate signature specifically approving the terms falling within Article 1341(2).

The transition to online contracting does not eliminate that requirement. What changes is the technical means by which the separate manifestation of consent is obtained and documented.

According to the approach adopted by the Supreme Court, it is therefore not sufficient for an online interface to distinguish general acceptance of the contractual terms from specific approval of the relevant terms merely by means of two separate checkboxes.

The specific approval must instead be obtained through a mechanism that qualifies as an electronic signature.

While this approach is understandable in light of the Court’s objective of ensuring effective protection for the contracting party, it may also result in a degree of formal rigidity that is not entirely consistent with the way digital contracting processes are ordinarily designed and operated.

The architecture of the signing process is therefore of particular importance. Businesses should ensure that their digital contracting flows clearly distinguish between acceptance of the contractual terms as a whole and the separate manifestation of consent specifically relating to the terms covered by Article 1341(2) of the Italian Civil Code.

Simple electronic signature and digital signing mechanisms

In identifying the applicable standard, the Order refers to the concept of an electronic signature under the eIDAS Regulation (Regulation (EU) on electronic identification and trust services for electronic transactions in the internal market).

For contracts that are not subject to a written form ad substantiam, the Court considers a simple electronic signature sufficient. The reference to an OTP represents one example of a mechanism through which the contracting party’s manifestation of consent may be obtained and documented.

The issue therefore concerns not merely the graphical interface through which the user expresses consent, but the entire electronic process underlying the signing transaction. This includes, in particular, user identification, attribution of the declaration to the relevant individual, recording of the transaction and preservation of the related evidence.

In practical terms, following the Supreme Court’s decision, the specific approval of terms falling within Article 1341(2) in an online contract should be obtained through a mechanism qualifying, at a minimum, as a simple electronic signature under the Italian Digital Administration Code (Codice dell’amministrazione digitale, or CAD) and the eIDAS Regulation. Businesses may therefore consider using, for example, basic electronic-signature solutions offered by established market providers or, as a relatively straightforward alternative, an OTP sent to the signatory by SMS or email. It remains to be seen whether future judicial decisions will further clarify the technical and procedural features that electronic signing systems must incorporate in order to satisfy the standard identified by the Supreme Court.

Implications for businesses

The decision is not limited to clauses derogating from territorial jurisdiction, which were at issue in the case before the Court.

The principle may be relevant to all clauses falling within Article 1341(2) of the Italian Civil Code, including, for example, limitations of liability, forfeiture clauses, restrictions on the right to raise defences, tacit extensions or renewals, and arbitration clauses.

For businesses using websites, portals or digital platforms to enter into B2B contracts, the decision therefore calls for careful consideration of both the content of their standard terms and conditions and the procedures through which those terms are presented to users and approved. The issue is particularly relevant in an increasingly global market, where the principal legal systems generally do not impose equivalent formal requirements for the specific approval of onerous contractual terms in contracts between business operators.

A further aspect concerns the proof of specific approval.

The case decided by the Supreme Court highlights the importance, for a party seeking to rely on a particular contractual term at a later stage, of being able to reconstruct and document the signing process followed by the individual contracting party.

It is therefore not sufficient to consider how consent is obtained at the point of contracting. Businesses must also assess whether their systems are capable of reliably preserving evidence of that consent over time.

What should businesses do?

Order No. 20945/2026 represents a recent development, and it remains to be seen whether, and to what extent, the principle established by the Third Civil Division will be confirmed and further clarified by subsequent case law.

In the meantime, however, it would nevertheless be appropriate for businesses entering into contracts online to adopt a prudent approach and review their digital contracting processes.

Such a review should focus, in particular, on the standard terms and conditions currently in use, the correct identification of the terms requiring specific approval under Article 1341(2) of the Italian Civil Code, the mechanisms through which such specific approval is obtained and the systems used to document and preserve evidence of the relevant signature.

Businesses should also assess whether existing procedures based solely on the selection of dedicated checkboxes should be updated by introducing electronic-signature mechanisms consistent with the indications contained in the Order, and review existing contracts to determine whether, in contracts of particular significance, the clauses requiring specific approval under Article 1341(2) were approved merely through a checkbox, with the risk that the relevant clauses may be held ineffective.

Pending further clarification from the courts as to the scope and practical application of the decision, the Digital, Tech & Data team at ADVANT Nctm is available to assist businesses in reviewing their standard terms and conditions, online signing processes and procedures for preserving electronic evidence, as well as in assessing the potential impact of the Order on existing contractual relationships.

The most controversial issue, and the one from which the proposal derives its name, concerns detection orders, i.e. the possibility for an authority to require a communications service provider, including providers of end-to-end encrypted communications services, to deploy technologies that scan content exchanged by users for CSAM or signs of grooming. Negotiations on this issue have been deadlocked for years, while the voluntary regime that has meanwhile allowed platforms to continue scanning has itself gone through a period of significant institutional instability in recent months.

The framework of the proposal

The proposal applies to hosting service providers, providers of interpersonal communications services and operators of app stores, which are required to assess the risk that their services may be used to disseminate CSAM or for the grooming of minors and to adopt proportionate mitigation measures, such as age-verification or parental-control tools. Where such measures prove insufficient, the Commission’s proposal allows the national coordinating authority to request that an independent judicial or administrative authority issue a detection order requiring the provider to deploy scanning technologies, subject to a number of safeguards: a limited duration (up to 24 months for CSAM and 12 months for grooming), targeted application, the least intrusive technologies available, and rights of appeal for providers and users.

Alongside these orders, the proposal maintains a system of removal orders addressed to hosting providers, blocking orders directed at internet access providers in respect of content hosted outside the EU, and an exemption from criminal liability for providers that, in good faith, process CSAM for the purposes of its detection, reporting and removal.

The encryption issue 

In its negotiating position of 22 November 2023, the European Parliament excluded end-to-end encrypted communications from the scope of detection orders. In the Council, successive Presidencies have explored intermediate solutions, including detection obligations limited to high-risk services and a scanning mechanism on the user’s device before encryption, subject to the user’s consent, but without securing sufficiently broad agreement among the Member States.

On 30 October 2025, the Danish Presidency acknowledged that the prospects of reaching a balanced compromise had been exhausted, owing to persistent concerns relating to users’ fundamental rights, cybersecurity and the reliability of the technologies available, and proposed removing mandatory detection orders from the text, thereby making permanent the currently temporary derogation provided for by Regulation (EU) 2021/1232.

The collapse and return to the voluntary regime

While negotiations on the permanent proposal remained deadlocked on this issue, the transitional regime introduced in 2021, which allows providers of interpersonal communications services to voluntarily scan content for CSAM in derogation from the ePrivacy Directive, reached a genuine breaking point. On 20 March 2026, the European Parliament rejected, by a single vote (307 to 306), an extension of the regime, which therefore expired on 3 April 2026 without replacement. On 9 July, the Parliament voted again, with an equally negative outcome: 311 against, 228 in favour and 92 abstentions.

Despite the two rejections, on 23 July 2026 the Council nevertheless finally adopted an interim Regulation reinstating the voluntary regime until 3 April 2028, with only Hungary voting against and Belgium abstaining. Its reactivation, without the Parliament’s consent, has reignited the debate over the institutional legitimacy of the procedure followed.

The state of the trilogue negotiations on the permanent proposal

In parallel, the three-way negotiations between the Commission, the Council and the Parliament on the permanent text are continuing. On 13 February 2026, the institutions reached a provisional agreement on certain provisions relating to the EU Centre, while detection obligations remain the main outstanding issue. According to the most recent accounts of the trilogue negotiations held in summer 2026, the negotiators appear to have moved towards protecting end-to-end encryption and substantially scaling back age-verification obligations, while the fundamental question remains open: namely, whether detection should remain mandatory or voluntary, targeted or generalised.

The next trilogue session, the sixth, is expected to take place on 29 September 2026, the first under the Irish Presidency of the Council, which has historically been close to Member States in favour of detection.

Fundamental rights safeguards

The underlying legal issue concerns the balancing of the protection of children, enshrined in Article 24(2) of the Charter of Fundamental Rights of the European Union, against the rights to respect for private life and communications (Article 7) and to the protection of personal data (Article 8) of all users of the services concerned.

In Joint Opinion 4/2022, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) had already pointed out that measures providing for general and indiscriminate access to the content of communications risk interfering with the very essence of the rights guaranteed by Articles 7 and 8 of the Charter, and that technologies for detecting previously uncategorised material still have significant error rates. In its subsequent Statement 1/2024, the EDPB observed that the definition of “reasonable grounds for suspicion” adopted by the Parliament does not, in itself, yet guarantee that detection orders will remain genuinely targeted rather than general and indiscriminate.

These concerns are consistent with the established case law of the Court of Justice of the European Union, according to which general and indiscriminate retention of traffic and location data, without distinctions or limitations linked to the objective pursued, is incompatible with Articles 7, 8 and 52(1) of the Charter, save in exceptional circumstances relating to serious and present threats to national security (see Digital Rights Ireland and Seitlinger, Joined Cases C-293/12 and C-594/12; Tele2 Sverige, Joined Cases C-203/15 and C-698/15; La Quadrature du Net, Case C-470/21). Although these judgments concern the retention of metadata rather than the scanning of content, the same principles of strict necessity and proportionality are the benchmark against which the EDPB and EDPS assess the compatibility of detection orders with the Charter.

What happens next

The issue is now playing out along two parallel tracks. On the one hand, the voluntary regime remains in force until 3 April 2028, but its legal basis has been called into question by the manner in which it was reactivated, bypassing two negative votes by the Parliament, and it cannot be ruled out that the matter may ultimately be brought before the courts. On the other hand, the outcome of the permanent proposal will depend on the next trilogue negotiations, starting with the session scheduled for 29 September 2026, and in particular on the choice, which remains entirely open, as to whether the detection obligations should be mandatory or voluntary.

We will continue to monitor developments in the negotiations and will provide further updates as soon as the proposal moves further forward.

A broader scope than expected

The proposal is based on Article 114 TFEU and builds on the framework of the Digital Services Act, specifying and complementing its provisions, while also complementing the AI Act with specific safeguards for minors. Its scope is significantly broader than that of the individual national measures announced to date (including Italian Bill No. 1136) and covers, in particular:

• providers of online social networking services and video-sharing platform services;
• providers of online games and video gaming platform services;
• providers of AI companions and general conversational chatbots;
• providers of software application stores and operating systems.

The exclusions are limited to a small number of categories of services (non-profit encyclopaedias and scientific repositories, purely educational services operated by educational institutions, open-source platforms, scientific research services and public administration services). SMEs and micro-enterprises, by contrast, are not granted any substantive exemptions.

The access restriction: a European threshold of 15

Chapter II of the proposal introduces a harmonised age threshold of 15 for the independent creation of accounts with online social networking services and video-sharing platform services, thereby overcoming the national divergences that have dominated the debate in recent months. The framework, however, goes beyond the access restriction itself:

• minors below the age of 13 are subject to an absolute prohibition on creating an account with online social networking services and video-sharing platform services;
• minors between 13 and 15 may access such services only through accounts created and supervised by a guardian, with limited and age-appropriate functionalities;
• minors aged 15 or over may access the services independently, but remain subject to stringent safety-by-design requirements.

The Italian framework under Bill No. 1136 (based on a threshold of 15 and verification through a digital mini-wallet) is broadly aligned with the European model, but constitutes only a subset of it: if the EU KIDS Act is adopted, Italian legislation will have to be brought into line with it and, for matters covered by the Regulation, replaced by the directly applicable Union framework. Chapter IV lays down detailed rules on the verification of parental responsibility, which is a prerequisite for the creation of accounts for users aged 13 to 15 and for activating the derogations provided for video-sharing platform services specifically designed for minors below the age of 13. In particular, Article 26 requires providers to use, in order of preference, signals from public databases of the Member States, signals already held by the provider as a result of previous interactions with the user and, on a transitional basis – until the delegated act is adopted –, the adult’s self-declaration, which the provider must nevertheless make reasonable efforts to verify. Member States are also required to make available at least one free, privacy-preserving electronic tool enabling a guardian to obtain and present evidence of parental responsibility.

Service design: safety by design becomes hard law

Chapter III turns a substantial part of the content of the Commission’s Guidelines adopted pursuant to Article 28(4) of the DSA into binding requirements. For online social networking services, video-sharing platform services, online games, AI companions and general conversational chatbots, these include, in particular:

• a prohibition on manipulative design practices that induce compulsive use of the service, including infinite scrolling, autoplay, notifications designed to re-engage users’ attention, intermittent reward mechanisms and penalties for failing to interact periodically;
• the default disabling of recommendation systems based on implicit behavioural signals, with explicit user choices to be preferred instead, accompanied by simple and immediate reset tools, consistently with Article 38 of the DSA;
• privacy, safety and visibility settings that are protective by default, together with a prohibition on particularly harmful functionalities, such as filters that distort minors’ appearance or social-comparison metrics;
• specific safeguards concerning contacts, including private profiles by default, the invisibility of information concerning minors to non-contacts, a prohibition on sharing contact details, the ability to block other users and the default disabling of livestreaming;
• rules on the transparency of financial transactions, including a prohibition on variable reward systems and on designs that exploit minors’ limited commercial literacy by inducing impulsive or unintended spending;
• a prohibition on sending push notifications during school time and during “core sleep hours”, defined as at least eight consecutive hours between 22:00 and 08:00, except for safety alerts or interactions with a guardian;
• for AI companions, the default disabling of persistent conversational memory, a prohibition on functionalities that simulate emotional dependency, and specific testing and post-market monitoring requirements;
• for software application stores, an obligation to put in place an age-rating system and prevent minors from accessing or purchasing software applications that are inappropriate for their age.

These requirements are complemented by tools designed to strengthen the ability of minors and guardians to exercise control over the service (the agency of minors referred to in Article 18). These include child-friendly reporting channels, with priority handling of complaints submitted by minors; tools for controlling content and settings with lasting effects; tools for guardians which VLOPs  (Very Large Online Platforms) will have to make interoperable with third-party solutions pursuant to Article 6 of the DMA; and the right to lodge a complaint with the competent authority, including through designated organisations. VLOPs will also be required to periodically monitor the effectiveness of the measures adopted and to adopt sectoral codes of conduct.

Age verification: the EU Age Verification Solution becomes the single reference framework

Chapter V makes mandatory the European age-verification solution anticipated by Recommendation (EU) 2026/1035. For the purposes of complying with the access restrictions, providers will be required to use exclusively the EU Age Verification Solutions and EU proof of age attestations included in the relevant EU lists and compliant with the EU Age Verification Scheme, based on zero-knowledge-proof technology. Self-declaration is expressly excluded. 

For the purposes of safety-by-design requirements, other age-assurance solutions may instead be used, provided that they meet the requirements of accuracy, reliability, robustness, security, non-intrusiveness, privacy protection and non-discrimination. Member States are required to ensure, within their territory, the free availability of at least one EU Age Verification Solution and of tools suitable for attesting parental responsibility.

A particularly sensitive issue concerns existing accounts. Providers will have to re-verify the age of existing users through an EU Age Verification Solution, unless they are able to demonstrate, with a high degree of confidence, that the user has already reached the minimum age required to access the service. VLOPs will have to submit to the competent authority a dedicated plan setting out the modalities and timetable for this retrospective verification. This is one of the Regulation’s most significant operational burdens.

Supervision, sanctions and representative actions

The Regulation does not establish a standalone supervisory framework, but builds on the institutional arrangements already established by the DSA and the AI Act, drawing on their competent authorities and procedural mechanisms. The allocation of responsibilities is calibrated to the type of service and designed to prevent overlaps. Supervision is entrusted to the Digital Services Coordinators designated pursuant to Article 49 of the DSA for online social networking services, video-sharing platform services, video gaming platform services and software application stores, and to the market surveillance authorities designated pursuant to Articles 70 and 74 of the AI Act for AI companions and general conversational chatbots. The Commission retains exclusive competence over VLOPs and AI systems falling within its competence, with an expedited enforcement procedure under which the Commission is to communicate preliminary findings to the provider concerned within 30 working days from the opening of proceedings and endeavour to adopt a final decision within 90 working days.

The sanctions regime varies according to the type of addressee:

• for online social networking services, video-sharing platform services, video gaming platform services and software application stores, the sanctions provided for under the DSA apply, including fines of up to 6% of worldwide annual turnover;
• for AI companions and general conversational chatbots, the proposal refers to Article 99 of the AI Act and provides for a specific ceiling of up to 6% of the provider’sworldwide annual turnover in the event of intentional or negligent infringements;
• for video games that do not qualify as video gaming platforms, sanctions are left to the Member States, following the model set out in Article 52 of the DSA;
• for infringements of the rules on the protection of personal data under Articles 27, 28 and 29 of the Regulation, supervisory authorities under the GDPR remain competent, with sanctions of up to the maximum amounts provided for in Article 83(5) GDPR.

In addition, Article 36 of the proposal establishes an annual supervisory fee, structured as a top-up to the fee already provided for under Article 43 of the DSA, the principles of which the Commission must also follow when applying the new provision. The entities liable for the fee do not coincide with all entities falling within the scope of the Regulation. The fee is payable only by providers of online social networking services, video-sharing platform services, software application stores, AI companions, general conversational chatbots and video gaming platforms which, having been designated as VLOPs under Article 33 of the DSA or otherwise falling within the Commission’s exclusive competence, are subject to its direct supervision. The amount is fixed annually and shall not exceed 0.03% of the provider’s worldwide annual net income in the preceding financial year. It must be assessed together with the ceiling provided for under the DSA, so that the overall burden remains proportionate to the economic capacity of the individual operator. On the expenditure side, the fee is intended to cover the costs incurred by the Commission in the preceding year for supervisory, monitoring, investigative and enforcement activities, including dedicated human resources, the development of the expertise and capabilities referred to in Article 37 and, in particular, the set-up, maintenance and operation of the EU Age Verification Scheme, including the financing of the deployment of the European age-verification solution across the Union. The methodological details – including cost estimates, the calculation of individual fees, the maximum ceiling and payment arrangements – are deferred to subsequent delegated acts.

As regards litigation, Article 41 is particularly significant. It amends Annex I to Directive (EU) 2020/1828 by adding the Regulation to the list of Union acts whose infringement may give rise to representative actions for the protection of minors. This choice is likely to have significant operational consequences. Over the medium term, a substantial increase in collective litigation in this area may reasonably be expected, with a corresponding expansion of the risk profile for providers.

Compliance plan, independent audit and national strategies

VLOPs designated under Article 33 of the DSA will be required to notify the Commission of a detailed compliance plan, setting out how they intend to comply with the obligations laid down in Chapters II to V of the Regulation, and to submit that plan, at their own expense, to an independent audit conducted by one or more external auditors. The auditors shall have, or shall retain experts with proven expertise in six specific areas relevant for the protection of minors: (i) protection and rights of the child; (ii) paediatric medicine and child psychiatry; (iii) developmental science; (iv) age assurance; (v) the design of online interfaces and recommender systems; and (vi) personal data protection and security. This is the only obligation under the Regulation that, pursuant to Article 5, will apply from the date of its entry into force, by way of derogation from the general deferred application regime.

Chapter VI, by contrast, requires Member States to adopt national strategies to ensure that minors and their guardians have free, confidential and accessible access to dedicated support channels, including for cyberbullying and unwanted contact; adequate information about the risks addressed by the Regulation and the available means of protection; and structured digital-literacy initiatives, drawing on the experience and expertise of the Safer Internet Centres. The strategies must be communicated to the Commission within 12 months of the Regulation’s entry into force.

Entry into force and application

Article 43 establishes a staggered application regime. The Regulation will enter into force on the twentieth day following its publication in the Official Journal of the European Union and will generally become applicable six months later. There are two exceptions. Article 5, concerning the compliance plan and independent audit for VLOPs, will apply from the date of entry into force, while Articles 33, concerning national strategies, and 35, concerning the expedited enforcement procedure, will apply 12 months after entry into force. The Commission will be required to review the Regulation by 31 August 2030, followed by four-yearly reports.

Preparing for the EU KIDS Act: an agenda for businesses

The legislative process is only just beginning and the final text may depart, even significantly, from the proposal currently under consideration. The policy trajectory reflected in the proposal, however, is sufficiently clear to enable businesses to start shaping their product-design choices now. The codification of safety by design into binding law, the central role of the EU Age Verification Solution as a common verification infrastructure, the emergence of verification of parental responsibility as an autonomous mechanism and the opening of the door to representative actions constitute structural elements of the proposed framework that are unlikely to disappear from the legislative debate. From an operational perspective, the relevant question is therefore not so much which measures will have to be implemented once the Regulation enters into force, but rather which design choices should already be made for services intended to operate within that regulatory environment.

The first area for action concerns product design. Many solutions still treated as commercial trade-offs  – recommendation systems based on behavioural signals enabled by default, persistent conversational memory for AI companions, push notifications without protected time windows, livestreaming accessible to minors, aesthetic filters and social-comparison metrics – are likely to become, under the European framework, binding design constraints. Downstream adaptation of architectures that were not originally designed in accordance with the regulatory framework will generally entail significantly higher costs than incorporating those requirements ex ante as design parameters. From this perspective, the proposal –although not yet in force –  can already usefully be read as a technical specification against which products currently on the roadmap should be assessed.

The second area concerns age verification as an infrastructure layer, distinct from product functionalities. The emergence of the EU Age Verification Solution as the common infrastructure for the purposes of access restrictions, as well as the central technical reference point for safety-by-design requirements, calls for age-assurance components to be treated according to a modular model, decoupled from the remainder of the application stack. Providers that currently rely on proprietary age-assurance solutions, or that structurally integrate self-declaration into the onboarding funnel, should already consider appropriate exit clauses and interoperability requirements enabling those solutions to be replaced by the European infrastructure as soon as it becomes available. This is accompanied by a separate area of significant operational complexity: the re-verification of age for existing accounts. Planning for this process – including user communications and the management of cases in which re-verification is unsuccessful – should begin now, given that the period between entry into force and full application of the Regulation leaves little room for late implementation.

The third area concerns the contractual chain and internal governance. Compliance under the proposal cannot be handled solely by the legal function. It involves, jointly, the product function – responsible for supporting safety-by-design requirements and contributing to the compliance plan –; the risk function, which must map the new exposures; the network of third-party providers – for age assurance, recommendation systems, interoperable tools for guardians under Article 6 of the DMA, and independent auditing – whose contractual arrangements will need to be renegotiated or reviewed from a compliance-by-design perspective; and, finally, the data function, with regard to Articles 27-29 of the Regulation and the GDPR framework. For VLOPs, the compliance plan and related independent audit under Article 5, which will apply immediately upon entry into force, presuppose an internal ownership structure that, at present, has not yet been fully defined in a number of groups.

The fourth area concerns the risk profile, understood in a broad sense. The combined effect of sanctions of up to 6% of the worldwide annual turnover, the Commission’s expedited enforcement procedure and the inclusion of the Regulation in Annex I to Directive (EU) 2020/1828 creates a dual exposure. On the one hand, there is administrative and sanctioning exposure, in continuity with the frameworks already established by the DSA and the AI Act. On the other, there is exposure to collective litigation, for which the digital sector does not yet have an established body of European case law but which, following this legislative development, may emerge relatively quickly. This makes it appropriate to incorporate the issue into regulatory and reputational risk assessments already at this stage, with particular attention to disclosures to the market by listed issuers.

Ultimately, uncertainty surrounding the legislative process is not, in itself, sufficient reason to defer preparations for compliance. The overlap between the EU KIDS Act, the DSA, the AI Act, the GDPR and national rules already in force or at an advanced stage of development – first and foremost Bill No. 1136 – makes early compliance, from an implementation perspective, substantially indistinguishable from compliance with obligations that are already in force. Many of the requirements that the Regulation would make binding are already grounded, wholly or in part, in instruments currently applicable. Adopting a compliance-by-design approach now therefore serves not only to prepare for the future regulatory framework, but also to bring greater systemic coherence to a regulatory landscape that, despite its fragmentation, is progressively converging towards a unified model of accountability for providers of digital services accessible to minors.

One need only look at the United States. At the federal level, President Trump continues to sign executive orders aimed at freeing AI from regulatory constraints in order to promote global competition; at the opposite end, individual States, which retain residual powers in the absence of federal pre-emption, continue to introduce state-level regulations with a high degree of differentiation. These range from California – the jurisdiction that has undoubtedly developed the most layered regulatory framework – which has adopted the Artificial Intelligence Training Data Transparency Act and the Transparency in Frontier Artificial Intelligence Act, to Texas, with its Responsible Artificial Intelligence Governance Act. The list could go on for some time – Colorado, Illinois, New York, Tennessee, Utah – with a highly complex set of policy choices, in some cases divergent from one another.

That the alternative between regulating and not regulating AI has now been superseded is most recently confirmed by Dario Amodei’s appeal, We Must Pace the Frontier: a text which, it should be noted, places the responsibility for slowing the frontier primarily on voluntary coordination among laboratories and on independent evaluators integrated into the process, and which, precisely for this reason, has been criticized by those who believe that the speed limit should be set by the State, rather than by industry.

The US experience nevertheless clearly demonstrates what is best avoided: differentiated rules at state level, lacking a uniform framework, merely increase the costs of navigating the regulatory landscape for citizens and businesses alike.

Against this backdrop, the European Union, which through the AI Act has sought to establish common rules, must contend with its own institutional structure and, in particular, with the fact that it is not a federal state. The impact of artificial intelligence extends across many areas falling within national competence. For this reason too, Regulation (EU) 2024/1689 leaves the regulation of important legal institutions to the Member States. Law No. 132 of 2025 falls within the implementation of those provisions. Indeed, in implementing the AI Act, the national legislature has identified the governance authorities responsible for applying AI regulation within the national territory, including supervising compliance and sanctioning unlawful conduct. Article 20 accordingly identifies the “National Authorities for Artificial Intelligence”, entrusting the Agenzia per l’Italia Digitale (AgID) with promoting innovation and defining compliance and certification processes for high-risk systems; supervisory powers and, where appropriate, the power to impose sanctions are instead entrusted to the Agenzia per la Cybersicurezza Nazionale (ACN), in coordination with the powers of the Bank of Italy, Consob and IVASS within their respective sectors.

Even at this stage, one might criticize the excessive fragmentation resulting from the number of authorities called upon to apply the Regulation. On closer examination, however, that fragmentation is already inherent in the AI Act and could hardly have been overcome. Moreover, for those involved in digital regulation, the real problem is not so much the enforcement of the AI Act as the overlap among the many authorities responsible for enforcing the many sector-specific regulations: the DSA, entrusted to AGCOM; the DMA, to the Italian Competition Authority (AGCM); and the GDPR, to the Italian Data Protection Authority.

Apart from the provisions required by the references contained in the AI Act, Law No. 132 otherwise seeks to formulate policy responses to highly significant social demands, some of which are difficult for the law to resolve but which the law nevertheless seeks, at least, to steer. This is the case, for example, of the provisions requiring AI systems to “improve” the National Health Service (Article 7) or to “increase the efficiency” of public administrations (Article 14): objectives that are indisputable and cannot be postponed, but whose achievement does not depend on a legal provision.

Almost confirming the difficulty of regulating such a complex field, Law No. 132 establishes certain rules and principles while delegating the regulation of crucial aspects to the Government (Article 24). In implementation of that delegation, on 4 August 2026 the Council of Ministers definitively approved two legislative decrees: one, currently pending publication, “concerning the powers of national authorities and the use of artificial intelligence in education”; the other, already published – Legislative Decree No. 160 of 9 September 2026 – ”concerning the use of artificial intelligence systems for police activities and civil and criminal liability”.

Without going into detail, the point of particular interest within the multilevel regulatory framework is the need to govern this field through instruments capable of providing technical detail to the principles laid down in the enabling legislation and of adapting rapidly to technological developments. This is a task for legislative decrees, but even more so for secondary legislation and the soft law of the regulatory authorities.

Regardless of the opportunities and critical issues that national legislation may introduce, the conclusion is that, insofar as part of it was required, the Italian legislature could otherwise, in a context of over-regulation, have limited itself to implementing the AI Act, avoiding additional provisions. It should nevertheless be acknowledged that many of those provisions are principles, and it will be for the legal system to implement them appropriately, without adding obstacles and restrictions to innovation, which has by now become a decisive factor in the country’s competitiveness.

This is where the role of legal professionals – and, in particular, in-house counsel and private-practice lawyers – becomes crucial: to develop and support, both in courtrooms and through compliance, an interpretation capable of making the balance between innovation and the protection of rights a reality, so that the opportunities offered by these technologies are not held back by unreasonable and, in some cases, self-referential regulation. While awaiting the simplification that should come with the Digital Omnibus, which is still under discussion in Brussels, what is at stake is the competitiveness of both the country and the European Union.

The Decree introduces new criminal and procedural provisions concerning the unlawful use of AI.

Entities and companies will need to pay particular attention, as the Decree also amends Legislative Decree No. 231 of 8 June 2001 (“Legislative Decree 231/2001”), introducing a new criminal offence concerning the security of AI systems and expanding the list of predicate offences giving rise to the liability of entities.

New Article 437-bis of the Italian Criminal Code, concerning the “Failure to adopt security measures for artificial intelligence systems and unlawful alteration of systems”, punishes:

• failure to adopt the technical security or human oversight measures required for high-risk AI systems where such failure gives rise to a danger to life or to public or individual safety;
• unlawful alteration of high-risk AI systems;
• professional users of high-risk AI systems who intentionally fail to adopt human oversight measures where such failure gives rise to a danger to life or to public or individual safety, or to a danger to national security.

As regards Legislative Decree 231/2001, new Article 25-vicies provides for the liability of entities for the above-mentioned offence, with pecuniary sanctions of up to €1,549,000, in addition to disqualifying sanctions.

The offence under Article 612-quater of the Italian Criminal Code (introduced in 2025) will also become punishable (as a predicate offence) under Legislative Decree 231/2001. This provision applies to anyone who causes unjust harm to a person by transferring, publishing or disseminating, without that person’s consent, images, videos or voices that have been falsified or altered through the use of AI systems and are capable of misleading others as to their authenticity. In this case, the pecuniary sanction may amount to approximately €1,000,000, again in addition to disqualifying sanctions.

From an application standpoint, it should be noted that the Decree does not make the application of the new criminal offences or of the administrative liability of entities contingent upon completion of the transitional regime under Regulation (EU) 2024/1689 (the “AI Act”) concerning high-risk systems. The new provisions will therefore apply as of 30 September 2026. This is particularly relevant in light of the recent Regulation (EU) 2026/1744 (“Digital Omnibus on AI”), which entered into force on 27 July 2026 and postponed the application of the substantive provisions of the AI Act concerning risk management and human oversight to 2 December 2027 for “stand-alone” high-risk systems referred to in Annex III, and to 2 August 2028 for high-risk systems embedded in products referred to in Annex I. Companies will therefore need to monitor developments in the interpretation of this temporal misalignment between the applicability of the new Italian offences and the full enforceability of the substantive European obligations which, in practice, constitute the reference framework for those offences.

The impact on Legislative Decree 231/2001 requires entities, particularly those that develop, place on the market or use AI systems classified as “high-risk”, to verify whether their respective organisational, management and control models adequately address the processes relating to the development, implementation, maintenance and use of AI systems, with particular regard to the technical security and human oversight measures required under the AI Act.

Beyond the strictly sanction-related aspects, the new legislation confirms the urgency for companies that develop or use AI systems (particularly in the sensitive sectors identified in Annex III to the AI Act, such as HR, credit scoring, insurance and education) to establish robust and documented AI governance measures, including the mapping of AI systems in use and their respective risk classification, qualified and traceable human oversight procedures, management of technical documentation, and targeted training for the personnel involved.

Furthermore, every entity and company that has adopted an organisational model pursuant to Legislative Decree 231/2001 should conduct an assessment, starting with the business processes that use AI and, in particular, those involving the design, acquisition, configuration or use of AI systems that may be classified as high-risk, verifying the existence and adequacy of specific protocols concerning system security, human oversight and risk management.

An AI compliance framework established in advance of the full applicability of the AI Act represents not only a regulatory requirement, but also the most effective preventive measure against the criminal and 231-related risks introduced by the Decree.

1. > ^ Pursuant to Article 437-bis of the Italian Criminal Code: “Anyone who fails to adopt the technical security measures required for the design, training, production or placing on the market of high-risk artificial intelligence systems, suitable to prevent malfunctions or alterations in the operation of such systems, or fails to adopt human oversight measures, shall be punished by imprisonment for a term of one to five years where such omissions give rise to a danger to life or to public or individual safety. Where the act gives rise to a danger to national security, the penalty shall be imprisonment for a term of two to eight years. Unless the act constitutes a more serious offence, anyone who, outside the cases referred to in the first paragraph, unlawfully alters high-risk artificial intelligence systems shall, where the act gives rise to a danger to life or to public or individual safety, be punished by imprisonment for a term of two to six years. Where the act gives rise to a danger to national security, the penalty shall be imprisonment for a term of three to ten years. Where any of the acts referred to in the first paragraph is committed through gross negligence, the penalty shall be reduced by one-third to one-sixth. A professional user of high-risk artificial intelligence systems who intentionally fails to adopt human oversight measures shall be punished by the penalties provided for in the first paragraph, first and second sentences, where such omission gives rise, respectively, to a danger to life or to public or individual safety, or to a danger to national security.”

2. > ^ In very brief terms, high-risk AI systems are: (i) those used as safety components of certain products, including, for example, toys, recreational craft, lifts, protective systems intended for use in potentially explosive atmospheres, radio equipment, etc. (Article 6(1) and Annex I to the so-called AI Act); and (ii) those that pose significant risks to health, safety or fundamental rights in certain sensitive areas, including, for example, biometrics, critical infrastructure, education, worker management, essential public services, etc. (Article 6(2) and Annex III to the so-called AI Act).

For an initial assessment, just ask three questions.

Does the product contain digital elements?

Is it made available on the European Union market in the course of a commercial activity?

Can it exchange data with another device or a network?

If the answer to all three questions is yes, then the CRA applies.

Raffaele Giarda’s arrival further strengthens the Firm’s Technology, Media, Entertainment and Telecommunications (TMT) practice, which will benefit from his extensive experience gained over more than three decades in sector-specific regulation, including matters relating to foreign direct investments in Italy (FDI).

The appointment of Raffaele Giarda is part of ADVANT Nctm’s ongoing strategy to further enhance its professional capabilities in support of clients, reinforcing the Firm’s TMT expertise at a time when innovation and digital transformation represent key drivers for businesses and their growth.

“Raffaele Giarda’s arrival is a source of great pride for us. He is a highly regarded professional with a strong reputation built over decades of experience, including internationally, in the TMT sector and in advising on complex transactions. His experience further enhances our offering in this area while strengthening the Firm’s ability to support clients in a rapidly evolving and constantly changing market environment”, commented Paolo Montironi, Senior Partner at ADVANT Nctm.

“Joining ADVANT Nctm represents a new and important stage in my professional journey, within a Firm that combines a European dimension, the quality of its professionals and a clear vision for growth. I bring with me extensive experience in the TMT sector, with the aim of contributing from the outset to the further strengthening of the Firm’s position in its market”, said Raffaele Giarda.

Following Raffaele Giarda’s arrival, ADVANT Nctm’s total number of Partners reaches 88.

AI and new technologies: from experimentation to accountability

Unsurprisingly, given current developments, the most prominent chapter of the Report is the one on artificial intelligence (AI). The Garante continued to pursue an approach that is not solely enforcement-driven but aimed at addressing risks to data subjects at an early stage: from oversight of deepfakes to enforcement measures concerning deepnude applications and the non-consensual generation of intimate images. From this perspective, the processing of personal data has become the principal point of tension between computational power, model opacity and the protection of individual dignity.

The same approach is reflected in initiatives concerning web scrapingfor the training of generative AI systems and in the favourable opinion on the ministerial guidelines for the introduction of AI in schools. The point is not to halt innovation, but to ensure it is properly governed through a valid legal basis, meaningful transparency, data minimisation, impact assessments where necessary, and documented governance throughout the entire lifecycle of the system. For businesses and public administrations, AI cannot be regarded purely as a technological project: it is, in every respect, also a regulatory issue.

Digital healthcare, public administration and biometrics: innovating, but by design

In the healthcare sector, the Authority issued 28 opinions on draft decrees and regulations, reiterating that the digitalisation of care pathways must incorporate privacy by design, data minimisation, lawfulness, transparency and accountability from the outset. The Report highlights recurring issues in the management of health records, patient identification procedures, the disclosure of health data and the prevention of unauthorised access to information systems. Digital healthcare therefore remains one of the main testing grounds for compliance: the more useful data is for patient care, the more it must be protected through genuinely effective technical, organisational and procedural measures.

The use of biometrics likewise confirms the central importance of the principle of proportionality. The FaceBoarding case at Milan Linate Airport, concerning the centralised storage of passengers’ biometric data, illustrates that the efficiency of the service cannot override the legal assessment of risk, the necessity of the processing and less intrusive alternatives. In a context of increasing automation of identification processes, biometric data remains a high-risk category and requires heightened caution.

On the public sector front, the Report also confirms the Garante’s advisory role in the digitalisation of public administration, including work on the IT-Wallet system. The message is clear: digital identity, interoperability and administrative simplification can only work if the data-processing architecture is designed in a manner consistent with the European framework and with the principle of effective protection of data subjects.

Children and work: where technology meets vulnerability

The protection of children remains a cross-cutting priority. The Garante continued to focus its activities on age verification systems, the phenomenon of sharenting and awareness-raising campaigns, including “Your privacy is worth more than a like”. Children’s personal data should never be regarded as “insignificant”: it is information that may accompany an individual over time, affecting their digital identity, reputation and freedom of self-determination.

In the employment context, instead, the Report confirms the focus on disproportionate processing activities and excessive forms of monitoring. The prohibition imposed on Amazon Italia Logistica in relation to the data of over 1,800 workers is part of a well-established approach: digital tools, monitoring systems, video surveillance and AI solutions applied to the organisation of work must comply with the principles of necessity, proportionality and transparency. Productivity alone does not justify pervasive surveillance.

Telemarketing, news reporting and inspections: traditional challenges become more sophisticated

Alongside the new frontiers of AI, the Report points out that the traditional challenges have by no means disappeared. The fight against aggressive telemarketing, particularly in the energy sector, continues to require significant action, not least because data collection and commercial profiling techniques are becoming increasingly sophisticated. Similarly, in balancing privacy and the right to report news, the Authority reaffirmed the principle of the essential nature of information, criticising excessive sensationalism and the publication of unnecessary details that undermine individual dignity.

Inspection activities confirmed the pervasiveness of data processing and the central importance of controls in high-impact sectors, such as SPID, facial recognition, video surveillance, scientific research, data breaches and public databases. Perhaps the most significant takeaway is that the Garante describes a landscape in which poor practices do not disappear but become layered and amplified by increasingly sophisticated technologies. For this reason, compliance must be continuous, verifiable and underpinned by concrete organisational safeguards.

Key figures for 2025

• 807 decisions adopted by the Board.
• 4,288 complaints and 145,846reports examined.
• 65 opinions on legislative and administrative acts and data protection impact assessments.
• 506 corrective and sanctioning measures.
• More than €37 million in fines collected.
• 2,415 data breach notifications, an increase compared with 2024.
• 854 reports concerning the dissemination or threatened dissemination of intimate material, primarily involving cases of sextortion.
• 130 inspections carried out, including with the support of the Guardia di Finanza.
• More than 13,500 requests for information from members of the public and organisations handled.

From data to trust: the Report’s real message

In 2025, the Garante took part in 260 international meetings and contributed to European and global initiatives on AI, data governance and the protection of fundamental rights. Yet the Report’s central message is directed equally at the national level and at day-to-day implementation: businesses and public administrations are called upon to make data protection a structural pillar of governance, security and trust. Privacy compliance can no longer be confined to the records of processing activities or privacy notices: it must be integrated into decision-making processes, technological development models, supplier management, cybersecurity and corporate culture. In other words, the question is no longer whether to innovate, but how to do so without losing control over data and, consequently, over the relationship of trust with individuals, customers, employees and citizens.

The Content of the New Paragraph 1-bis

The proposal expressly includes data, algorithms and mathematical methods used for training AI systems among the business information and technical-industrial know-how that may qualify as trade secrets, provided that the traditional requirements of secrecy, economic value and reasonable protection measures are met.

Scope of the Provision: Inclusion and Definition

The amendment operates on two complementary levels. First, it expressly clarifies that AI-related assets may fall within the scope of trade secret protection. Secondly, it provides a definition of algorithms and mathematical methods, including model architectures, optimisation functions, training procedures and configurations, as well as any other technical-computational element functional to the development of AI systems.

A Clarification Rather than a New Intellectual Property Right

The amendment does not create a new intellectual property right over AI models, nor does it alter the existing requirements for trade secret protection. Rather, it provides legal certainty by confirming that AI assets may benefit from the existing trade secret regime.

Objective Limits of Protection

Protection remains conditional upon the fulfilment of the requirements set out in Article 98. Consequently, publicly available model weights, openly accessible datasets, and generally known architectures or optimisation functions will not automatically qualify for protection.

Why Trade Secrets Rather than Copyright?

The legislative choice reflects the difficulties of relying on copyright law to protect AI assets. Copyright remains tied to human authorship and individual creative contribution, whereas many AI-related assets derive their value primarily from investment, data collection, engineering effort and technical development rather than creative expression.

From this perspective, trade secret protection appears better suited to preserving the economic value of large-scale AI investments through an objective and technology-neutral legal framework.

Procedural Aspects: The Specialised Business Courts

Disputes concerning training datasets, algorithms and model weights benefiting from trade secret protection would fall within the jurisdiction of the Italian Specialised Business Courts, ensuring continuity with existing case law on trade secrets and confidential business information.

Critical Perspectives: The Transparency Challenge

The proposal is not immune from criticism. Some commentators argue that recognising AI data, architectures and parameters as potential trade secrets may increase opacity at a time when both EU and national legislation are moving towards greater transparency and explainability requirements.

However, a distinction must be drawn between the explanation of a specific automated decision and disclosure of the underlying model. The former concerns the intelligibility of a decision affecting an individual, whereas the latter concerns access to datasets, model weights, architectures and training configurations. These are distinct legal and technical issues.

A more delicate tension may arise where verification of an AI system requires access to training data or the model itself in order to investigate bias, discrimination or malfunction. In such circumstances, trade secret protection may operate not as a barrier to explanation, but as a limitation on full inspection of the system.

Conclusion

By expressly recognising the potential trade secret protection of AI assets, the proposed amendment provides businesses with valuable guidance for structuring research and development investments and designing protection strategies. It confirms a clear policy choice in favour of an objective form of protection based on secrecy rather than a creativity-based model centred on authorship. The effectiveness of this choice will ultimately depend on how courts and regulators balance innovation, legal certainty, transparency and accountability in the AI ecosystem.

For more information, please visit our Intellectual Property and Digital and Data practice areas.

Space is progressively asserting itself as one of the dimensions of State sovereignty, due to its strategic importance in terms of national security, scientific research and economic competitiveness. Space infrastructure and services, as well as data collected through observation, telecommunications and navigation systems, affect a wide range of public functions: from civil protection to environmental monitoring, from territorial protection to critical infrastructure security, and ultimately industrial and scientific development.

For these reasons, it is not surprising that the space sector has recently been subject to regulation under Law No. 89 of 13 June 2025, which has bridged the previous regulatory gap, providing Italy with a stable legal framework. This legislative measure recognises the structural transformation of the space sector, which is increasingly characterised by the presence of private operators alongside traditional government agencies, and aims to regulate access to outer space and the performance of space activities through a licensing regime. The law therefore responds to the need to ensure adequate public oversight of operators’ activities, also in order to prevent potential international liability on the part of the State and to avoid a competitive disadvantage compared to other European legal systems already equipped with national regulations governing this sector.

Law No. 89 of 13 June 2025 represents, however, only one component of the broader process of consolidating Italy’s space governance. Whilst it defines the regulatory framework within which operators are required to carry out space-related activities, the planning and strategic dimension remains central, aimed at identifying the country’s public, industrial, scientific and technological priorities. It is precisely in this context that the National Space Policy Strategic Document (DSPSN) takes on significance. It does not directly regulate access to space, but translates the Government’s guidelines into a medium- to long-term vision for the development of national space policy.

With regard more specifically to the DSPSN, the relevant legal basis is Law No. 7 of 11 January 2018, which vested in the Prime Minister overall leadership, general political responsibility and coordination of policies relating to space and aerospace programmes. The aforementioned law established the Interministerial Committee for Space and Aerospace Research Policies (“COMINT”), tasked with defining the Government’s policy guidelines on space and aerospace matters. On 14 May, COMINT approved the first National Space Policy Strategic Document (“DSPSN”), which is aimed at translating the Government’s policy guidelines on space and aerospace matters into a medium- to long-term planning framework. The Document sets out strategic objectives and priority measures aimed at strengthening national strategic autonomy, supporting the growth of the industrial and scientific sector and consolidating Italy’s international position in the space sector.

Key elements of the DSPSN and the strong interconnection between the Space Economy and the Data Economy

The DSPSN is structured around four key areas of action: i) expanding knowledge and the benefits to society; ii) fostering the growth and competitiveness of the national industrial ecosystem; iii) strengthening the regulatory and governance framework; and iv) identifying priority areas for international cooperation. Across these four areas, “traditional” digital topics play a central role, recognising a close correlation between the development of the Space Economy and the Data Economy.

In fact, for each of the four areas, the Document attributes strategic relevance to the governance of data collected or related to the space domain, to enabling technologies (artificial intelligence, quantum technologies and robotics) and to cybersecurity. National space policy therefore appears to be built around the idea that the value of space – in terms of efficiency in the performance of public functions and new opportunities for economic operators – lies not only in the development of orbital infrastructure, launch systems or missions, but also – and increasingly – in the ability to transform space-related data, technologies and services into tools for public decision-making, industrial development and national security. 

From this perspective, the Space Economy and the Data Economy are closely interlinked: Earth observation, satellite telecommunications, navigation, Space Domain Awareness and government services all depend on the collection, processing, protection and utilisation of large volumes of data.

The central role of data governance for the Space economy

The Document first highlights the importance of space-related analysis and the central role of data in advancing scientific research. With this in mind, Objective 5.1, which is specifically dedicated to supporting scientific and industrial research, provides for the development of open platforms for sharing – both public and private – data relating to scientific and industrial research. The Document also calls for laboratories and centres of advanced expertise specialising in data processing and interpretation, with a view to promoting Open Science and strengthening the national research ecosystem.

A similar approach is evident in Objective 6.4 regarding satellite data, which focuses on supporting the sustainability of the planet and improving public administration services. In this area, the DSPSN envisages the enhancement and development of the “Iride Marketplace” infrastructure platform, including cloud-based solutions, in order to facilitate access to, processing and sharing of satellite data among public administrations and institutional users. This initiative includes the definition of data interoperability standards and the development of software tools for data visualisation and analysis.

Furthermore, Objective 9.2 expressly links the use of satellite data to growth in the industrial sector. In this regard, the Document aims to promote the widespread use of satellite data and information, with a particular focus on SMEs and start-ups, in order to enhance their competitive positioning in the commercial market.

Objective 8.1 is also particularly relevant, as it is dedicated to strengthening Italy’s leadership in Earth Observation. The Document highlights the development of the national Earth Intelligence ecosystem and stipulates that services should be designed to be interoperable and scalable, integrating Earth Observation data with other information sources such as socio-economic data, IoT-derived data, and predictive models. The aim is to provide solutions capable of meeting the needs of public administrations and key sectors, including precision agriculture, natural resource management, environmental monitoring, cultural heritage and security.

Technology as a driving force behind the space economy

A second macro-theme emerging from the DSPSN is the central role of technology in national space policy. The Document does not view technology merely as an area of research and development, but as a cross-cutting lever to enhance competitiveness, strategic autonomy and the capacity to transform space into public and industrial value. 

Already in the “Reference Scenario” section, the DSPSN highlights how the Space Economy is driven by satellite services and data, but also by innovation in launch systems, satellite constellations and artificial intelligence.

This approach is reflected in the objectives relating to research and skills. Objective 5.1 identifies artificial intelligence for space applications, quantum technologies, new materials, robotics, MEMS sensors and applications for environmental, climate and agricultural monitoring as priority technologies. Objective 5.2 links these areas to the development of advanced STEM skills, providing for specialised training pathways and centres of excellence dedicated, among other things, to AI, cybersecurity and quantum technologies applied to space.

Technology is also of key importance in relation to national technological sovereignty. Objective 7.3 provides for a plan to develop critical space technologies and calls for proposals relating to emerging and enabling technologies, including AI, advanced propulsion, cybersecurity and quantum technologies, also for complex and dual-use space applications. In this regard, safeguarding critical technologies is intended to reduce dependencies and strengthen the country’s industrial capacity.

Finally, the DSPSN emphasises technology in the management of space data and in the modernisation of the production and administrative system. Objective 8.1 links the development of the Iride Marketplace to data storage, analysis and distribution, including through the use of AI and machine learning. Objectives 9.1 and 11.1 refer, respectively, to digitalisation, robotics, digital twins and AI for production infrastructure, as well as advanced digital skills in public administration. This gives rise to an integrated vision, in which technology cuts across research, industry, data, training and administration, emerging as an essential prerequisite for an innovative and independent space policy.

Space and cybersecurity

The third macro-theme is that of cybersecurity. In the DSPSN, cybersecurity is closely linked to the recognition of space as a strategic domain, characterised by critical infrastructure, dual-use applications and geopolitical risks. The protection of space systems is, therefore, not regarded merely as a technical requirement, but as a component of national security.

The Document, again in the “Reference Scenario” section, highlights that the protection of satellite infrastructure has become indispensable for safeguarding national activities and capabilities on Earth. This is particularly relevant for dual-use systems, where security requirements must be taken into account from the earliest stages of development.

Objective 5.2 explicitly includes cybersecurity skills among those necessary for the development of the Space Economy. The Document provides for dedicated training programmes and the creation of laboratories and centres of excellence for research and training in cybersecurity applied to space.

The key point on this issue, however, is Objective 7.2, which provides for the development of a cybersecurity plan or roadmap, in accordance with Law No. 89 of 13 June 2025. This plan is intended to implement end-to-end cybersecurity, monitoring systems for critical infrastructure and natural hazards, rapid response, data protection and standard protocols. The Document also emphasises the maintenance, upgrading and resilience of space, satellite, ground and IT infrastructure, as well as the establishment of advanced cyber defence capabilities, including a Space Security Awareness Centre.

Finally, Objective 7.3 places cybersecurity within the broader framework of the National Space Security Strategy. The Document links the protection of critical assets, know-how and classified and sensitive information to the need to strengthen national technological sovereignty. Objective 8.2 also has significant implications, insofar as it refers to the development of satellite infrastructure for secure and resilient connectivity, high-speed optical communications, quantum encryption, RF systems, onboard processing, protocols, ground segments and user terminals.

Preliminary reflections on the DSPSN: new opportunities for Italian businesses?

The analysis of the DSPSN reveals that digital technology constitutes an essential component of national space policy. The Space Economy outlined in the Document is no longer limited to the infrastructural dimension of space, but increasingly relies on the ability to collect, process, protect and leverage digital data and services. 

From this perspective, the Space Economy and the Data Economy are closely interconnected: the strategic value of space depends on the ability to transform satellite data, enabling technologies and space capabilities into useful tools for public administration, businesses and society.

The central role attributed by the DSPSN to data governance, artificial intelligence, quantum technologies, robotics, machine learning, digital twins and cybersecurity confirms that digital technology is the key enabler of the new space economy. Through these technologies, space infrastructure and data can be converted into advanced services for environmental and climate monitoring, precision farming, civil protection, the security of critical infrastructure, secure communications and the modernisation of production and administrative processes.

Within this framework, significant opportunities arise for Italian companies, including SMEs and start-ups, which are called upon to develop solutions based on satellite data, Earth Intelligence, artificial intelligence, cybersecurity, resilient communications and downstream services. Data access and sharing platforms, the further development of the Iride Marketplace, support for emerging technologies and targeted calls for proposals relating to critical space technologies may contribute to strengthening Italy’s industrial supply chain.

From a personal data protection perspective, a medium-to-large football club is no longer just about “sport and ticketing”; it is a physical and digital ecosystem that generates value through data and proprietary content.

Here, privacy is not a “side issue” to be ticked off a list: it is part of the business model, as it builds trust, enables monetisation, enhances brand value and ensures operational continuity. The GDPR requires the club to know precisely what data is collected, where it is stored, who has access to it, on what legal basis it is processed and for how long, while clearly distinguishing among the various categories of data subjects (supporters, minors, players, technical and medical staff, employees, suppliers).

At the same time, many clubs now operate as fully-fledged media companies: they produce and distribute proprietary content, manage official thematic channels and, in some cases, “club-branded” digital or streaming platforms with a D2C (Direct-To-Consumer) approach.

Types of data and “high-impact” risks

The data that is most valuable from a business perspective is often also the most risky in terms of its potential impact on the fundamental rights of data subjects:

• Personal and contact data (memberships, ID badges, accreditation data, CRM data);
• Financial data (payments, refunds, invoicing);
• Audio-visual recording data (matches, training sessions, events, editorial content);
• Access and physical/digital security data (turnstiles, access control, logs);
• Data relating to users’ digital behaviour (apps/websites, interactions, marketing campaigns);
• Health and performance data (fitness, injuries, wearables/GPS, performance analysis).

An often underestimated “strategic” aspect is that many top-tier clubs now have entire teams of data analysts (or analytics departments) working on performance, injury prevention, match analysis and, above all, player scouting and recruitment.

When inferences about health or physical condition are drawn from performance data, or when health or biometric data are processed, the processing tends to become “high risk”. This requires stronger legal bases and conditions of lawfulness, compliance with the principles of data minimisation and proportionality, segregation of access rights and, often, a DPIA (and, if legitimate interest is used, a well-reasoned LIA).

Privacy by design and by default (separation by domain, not by “function”) 

In a well-structured club, the golden rule is to design separate data domains and controls that are consistent with the relevant purposes and legal bases, whilst avoiding informal archives and “catch-all repositories”.

From a best-practice perspective, one might envisage at least:

• A medical/sports performance area: health and performance data;
• A sporting operations area: contracts, team selection records, non-health-related technical statistics;
• A media/marketing area: images and videos for communication, contact details and preferences, digital interaction data.

Privacy roles and the supplier chain (including broadcasters and media partners)

As a rule, the club is the data controller for the processing of personal data relating to its sporting and commercial activities. However, the actual governance depends on the supply chain of the relevant service providers, such as, for example, ticketing, CRM, cloud services, contact centres, digital agencies, wearable tech, media content production and distribution.

Here, compliance hinges on contracts and responsibilities:

• Data processor, where the supplier processes data on behalf of the club;
• Joint controllers, where the purposes and means are determined jointly (e.g. initiatives with sponsors or co-marketing);
• Independent controller, where the partner uses the data for its own purposes (a scenario that is not uncommon in the media, streaming and advertising sectors).

From the “media company” perspective, it is also useful to consider the scope and distribution rights between the club’s own channels and third-party digital services (concepts such as “official club platform” versus “third-party digital service” help to avoid confusion between content governance and personal data governance).

Legal bases and transparency: why consent is not a “wild card”

A club should avoid the temptation of “universal consent”:

• for many core processing activities (performance of a contract, legal obligations, security, sports management), consent is not the most appropriate basis;
• consent becomes crucial for direct marketing, commercial profiling, and non-essential cookies and tracking technologies.

In practical terms, two things make all the difference:

1. Omnichannel privacy notices (stadium, ticketing, app, e-commerce, academy), which are consistent but not “one-size-fits-all”;
2. Preference and consent management in CRM systems: granular consents, simple withdrawal mechanisms, cross-channel alignment.

The digital dimension of data processing activities

This is where the most typical risks are concentrated: lack of transparency in profiling, excessive sharing with third parties, “indefinite” retention, and unregulated transfers outside the EU.

Italian Data Protection Authority’s Guidelines on cookies and tracking tools (10 June 2021) reiterate that, where required, consent must be freely given, specific, informed and documented, and discourage misleading practices.

For a club that offers users a seamless experience within an interconnected ecosystem – across apps, e-commerce, OTT services (streaming platforms and on-demand content) and other

digital initiatives – it is essential to avoid automated cross-device and cross-platform tracking across the various touchpoints. A data value-creation strategy is truly effective only when supported by robust data governance and when its logic remains transparent and explainable to users at all times.

Minors and the youth sector

The youth sector significantly increases the level of risk exposure, both because of the age of those involved and the nature of the data processed, which often relates to sport, education and, in some cases, health.

In Italy, the age at which a person may validly provide digital consent in relation to information society services is set at 14; below this age, parental authorisation is required.

This does not mean, however, that content and images may be used freely or indiscriminately. The correct approach remains to minimise the amount of data and clearly distinguish between what is necessary for sporting activities and what serves promotional purposes, by establishing specific policies on the use of images, official channels, retention periods and procedures for revocation.

The stadium as a “data system”

Video surveillance systems, access control, stewarding and crowd management also generate continuous streams of personal data.

Compliance is achieved through: visible privacy notices (including simplified versions), clearly defined purposes (security/public order), non-excessive data retention, restricted access to recordings, rules governing cooperation with the authorities, and clarity regarding the data protection responsibilities assumed by the company on a case-by-case basis.

Cybersecurity and data breach management

For clubs, the security of personal data is not merely an IT issue: a data breach affecting CRM, ticketing, payment or sports medicine systems can have legal, financial, reputational and sporting consequences.

A clearly defined process is required: detection, containment, risk assessment, recording, post-incident procedures and – where required – notification to the supervisory authority within 72 hours, and communication to data subjects.

Privacy function, DPO and internal governance

As complexity increases, a mature privacy function is required, integrated with other corporate functions:

• DPO where applicable (regular and systematic monitoring on a large scale, special categories of data on a large scale, etc.);
• A constantly updated record of processing activities;
• Data ownership by domain (Fans/Ticketing, Media/Content, Academy, Player Medical/Performance, Stadium Security): clarity on who decides, who authorises and who is accountable;
• Vendor governance: due diligence and audits on critical processing operations (e.g. ticketing, CRM, OTT, wearables, security).

Conclusion: trust as an asset, data as a strategic lever

In modern football, the trust among fans, families, players, sponsors and investors also depends on how the club manages its data. A club that treats personal data as an asset (rather than a risk to be addressed) achieves greater operational continuity, better fan engagement and more sustainable partnerships – precisely because it effectively operates as both a sports organisation and a media company.

By Order No. 284 of 17 April 2026, published in the Official Gazette on 29 April 2026, the Data Protection Authority (“Authority”) adopted the first Guidelines specifically dedicated to the use of tracking pixels in electronic mail communications (“Guidelines”).

This measure comes at a time of growing attention to tools for monitoring users’ online behaviour and aims to provide a uniform interpretative framework regarding the application of Article 122 of Legislative Decree No. 196/2003 (“Privacy Code”) and the provisions of Regulation (EU) 2016/679 (“GDPR”) to tracking systems embedded in emails.

According to the Authority, tracking pixels are particularly intrusive tools as they operate without the data subject’s knowledge. The Guidelines are based on the observation that such technologies enable the sender to determine whether a message has been opened, the number of views, the device used and, in some cases, further technical data relating to the recipient.

2. Key points of the measure

2.1 The classification of tracking pixels as tools subject to Article 122 of the Privacy Code

One of the main clarifications provided by the Authority concerns the legal nature of tracking pixels.

The Authority states that the insertion of the pixel and the subsequent collection of information generated by its activation constitute operations falling within the scope of Article 122 of the Privacy Code, as they involve both a form of “storage of information on the terminal equipment of a data subject or user” and subsequent “access to information already stored”.

Of particular significance is the passage in which the Authority states that tracking pixels must be regarded as covert tracking tools, as their presence is not normally detectable by the user and they operate automatically and invisibly.

The Guidelines also identify a number of parties that may be involved in the use of tracking pixels, including the sender of the message, the email service provider, the provider of mailing list rental services, the provider of tracking technology and the content creator. The Authority specifies that each of these parties is required, on a case-by-case basis and in accordance with the principle of accountability, to define their respective roles for the purposes of the legislation on the protection of personal data.

The measure also distinguishes between different types of email messages relevant for the purposes of

the application of the regulations: (i) newsletters, i.e. periodic communications of an informative nature; (ii) DEM (Direct Email Marketing), communications of a predominantly promotional or commercial nature; (iii) transactional emails and automated messages, sent in connection with specific user actions or ongoing transactions; and (iv) service emails, characterised by content designed to meet the specific needs of individuals or the community. This classification is relevant for the purposes of identifying the legal basis applicable to the processing associated with the use of tracking pixels.

2.2 The obligation to provide prior information

The Guidelines attach particular importance to transparency.

Indeed, according to the Authority, the use of tracking pixels in emails must be disclosed in advance to the email recipient, regardless of the purpose of the communication or the type of sender.

The Authority also emphasises that the use of tracking pixels requires all data controllers who already use them or intend to use them to adequately inform the data subjects, in accordance with the principles of fairness and transparency set out in the GDPR.

At an operational level, the measure allows for simplified, layered information procedures, allowing, for example, the use of summary notices accompanied by links to detailed documentation, as well as the use of digital tools such as chatbots, pop-ups, virtual assistants or other communication channels.

2.3 When consent is required

A central aspect of the Guidelines concerns identifying the cases in which the use of tracking pixels requires the user’s consent.

The Data Protection Authority reiterates that Article 122, paragraph 2-bis, of the Privacy Code introduces a general prohibition on accessing information stored on a user’s terminal equipment, storing information, or monitoring user activity through electronic communications networks; such prohibition may only be subject to derogation where the conditions set out in paragraph 1 of the same Article are met.

The main scenarios in which consent may not be required include:

• processing carried out solely for the purpose of aggregated statistical analysis of email opens, provided that appropriate anonymisation techniques are used;
• activities necessary to ensure the security of authentication or account management processes;
• service or institutional communications where the sender has a legal obligation to send them or where there are specific requirements to protect users. By way of example, the Data Protection Authority refers to messages containing useful guidance on how to prevent phishing or fraud, communications regarding contractual or logistical/organisational changes, notifications relating to security incidents, official information campaigns, as well as reminders regarding deadlines and contractual or social security obligations.

Conversely, consent is required when tracking is used for marketing purposes, profiling, or the individual optimisation of promotional campaigns.

The provision expressly refers to cases where individual measurement and analysis of email open rates are used to assess and improve the performance of promotional campaigns on the basis of observed behaviour, or when the open rate data is used to derive inferred information about the user’s potential tastes, interests and preferences for the purpose of creating commercial profiles.

2.4 Single consent and the right to granular withdrawal

One of the most innovative aspects of the Guidelines is the attempt to reconcile the need for protection with that for simplification.

The Data Protection Authority indeed recognises that consent to receive promotional communications and consent to the use of tracking pixels can be obtained through a single expression of consent.

This simplification is, however, accompanied by an important safeguard for the data subject: the possibility of subsequently withdrawing consent, even on a selective basis.

The Guidelines stipulate that the user may revoke consent only partially, specifically with regard to tracking associated with the receipt of tracking pixels, while continuing to receive email communications that do not contain tracking tools, if they so wish.

The Data Protection Authority also draws attention to the data controller’s obligation to duly record all choices made by the data subject, including any partial withdrawals, not least for the purposes of demonstrating consent, which the data controller may be required to do pursuant to Article 7(1) of the GDPR.

2.5 Privacy by design and data minimisation

The measure also focuses on the technical measures that data controllers should adopt to reduce the risks arising from tracking.

Among the suggested solutions is the use of pseudonymised and non-sequential identifiers, while keeping the correspondence between these identifiers and the recipients’ email addresses separate.

According to the Data Protection Authority, these measures help to reduce the exposure of email addresses by minimising the risk of data passing through the network being traceable.

3. Practical implications

The new Guidelines will have a significant impact on all operators using email campaigns, marketing automation platforms, newsletters and direct email marketing systems.

In particular, organisations will need to:

• check whether the tracking pixels used fall within the exemptions identified by the Data Protection Authority or whether they require consent to be obtained;
• update their personal data processing notices/privacy policies, cookie policies and consent collection procedures;
• implement mechanisms that allow users to withdraw their consent to tracking in a simple and granular manner;
• review their contractual relationships with email service providers, marketing automation platforms and tracking technology providers;
• assess the adoption of technical measures in line with the principles of “privacy by design” and “privacy by default”.

The transitional arrangements set out in the measure are also particularly significant. The Data Protection Authority has recognised the complexity of the required adjustments, granting operators a period of six months from the date of publication in the Official Gazette. The Guidelines distinguish, in this regard, between new processing operations, for which consent must be obtained in advance at the time the email address is collected, and processing operations already underway, for which the data controller must promptly fulfil their information obligations with the first available communication and implement a mechanism allowing for the withdrawal of consent, even on a granular basis, identifying solutions characterised by maximum recognisability, visibility and ease of use for the benefit of the data subject. The Data Protection Authority specifies that this transitional regime is intended to be gradually phased out as new processing operations are undertaken and become subject to the rule requiring prior consent.

4. Conclusions

The new Guidelines mark an important step in the evolution of Italian legislation on tracking technologies.

The Authority confirms a broadly rigorous approach, classifying tracking pixels as tools subject to the special rules set out in Article 122 of the Privacy Code and reaffirming the central importance of the principles of transparency and control by the data subject.

At the same time, the Authority introduces certain operational simplifications – such as a single consent for promotional communications and tracking – and identifies specific cases of exemption that allow the efficiency of certain services to be maintained.

For businesses, public bodies, technology providers and digital marketing practitioners, the six-month compliance period provided for by the regulation therefore represents an opportunity to review the processes, tools and legal bases for data processing relating to the sending of electronic communications, in light of a regulatory framework that increasingly prioritises transparency and user awareness.

Regulation (EU) 2024/1689 (“AI Act”) imposes significant obligations regarding governance, documentation, transparency, human oversight and monitoring on AI systems classified as “high-risk” under Article 6. In this context, the European Commission has recently published and launched a public consultation on draftGuidelines, adopted pursuant to Article 6(5) of the AI Act, with the aim of supporting providers, deployers and competent authorities in classifying the level of risk associated with AI systems.

Although not legally binding, the Guidelines represent the main interpretative reference currently available for carrying out this classification and provide numerous practical examples intended to guide the application of the provisions of the AI Act.

Article 6 distinguishes between two categories of high-risk systems. The first comprises AI systems intended for use as safety components of a product, or which themselves constitute a product covered by the EU harmonisation legislation listed in Annex I to the AI Act, provided that they are subject to third-party conformity assessment. The second, on the other hand, concerns systems that fall within one of the use cases listed in Annex III, which includes, amongst others, the areas of biometrics, employment, access to essential services (including credit scoring and insurance risk assessment), critical infrastructure, migration and the administration of justice.

Annex I: the concept of “safety component”

With regard to the systems covered by Annex I, one of the most significant clarifications provided by the Guidelines concerns the concept of “safety component” referred to in Article 3(14) of the AI Act,

which applies in two alternative scenarios.

The first scenario is fairly intuitive and concerns AI systems intended by the provider to perform a safety function, namely to prevent or mitigate risks to health, the safety of persons or property.

The second scenario is less obvious: an AI system may qualify as a safety component, irrespective of the provider’s intended purpose, if its failure or malfunction – including incorrect outputs, false negatives or misclassification – may endanger the health and safety of persons or property in the product context.

The Commission cites, by way of example, systems used in the operation of lift doors, lane assistance functions, or the optimisation of the functioning of household appliances, where a malfunction could result in physical harm to persons.

By contrast, functionalities aimed solely at operational efficiency, performance optimisation or service-quality improvement remain excluded where any error would not give rise to safety risks.

The “intended purpose” and liability along the AI supply chain

A key issue addressed by the Guidelines concerns the concept of “intended purpose”, defined in Article 3(12) of the AI Act as the use for which an AI system is intended by the provider, including the specific context and conditions of use, as specified in the relevant technical documentation, instructions for use and promotional or sales materials.

According to the Commission, the classification of a system does not depend solely on its technical characteristics, but also on the way in which the provider presents it on the market.

The Guidelines clarify that, where contractual documentation, instructions for use, promotional materials or technical documentation present the system as applicable across a generality of contexts, without clearly defining the permitted uses or specifically excluding high-risk uses, the intended purpose may also encompass such uses.

Of particular significance is the statement that a generic contractual clause asserting that high-risk uses of the system are excluded is in itself insufficient to prevent the system from being classified as “high-risk”, if the product positioning or the provider’s examples of use effectively provide for or promote such uses.

Annex III: use cases of greatest interest to businesses

Systems used in the employment sector

Among the cases covered by Annex III, those relating to the employment sector are of particular practical importance to businesses.

The Guidelines clarify that all systems which significantly influence the selection process are classified as high-risk, even if they do not directly determine the outcome.

Therefore, the high-risk category includes, for example, job-matching and candidate-ranking systems, tools that assign scores or classifications during the selection process, automated systems for searching for candidates on social networks or public databases, as well as targeted job advertising solutions that determine which users will see specific job vacancies.

A similar approach is adopted with regard to the management of work-related relationships. The Guidelines confirm that systems used to assign tasks, determine operational priorities, monitor performance, influence professional assessments or decisions relating to promotions, remuneration or termination of employment, particularly where such activities are based on the processing of behavioural indicators.

Furthermore, the Commission specifies that the scope of application of the cases in question is not limited to employees, but may also extend to self-employed individuals, professionals, contractors and platform workers.

Credit assessment systems

The Guidelines confirm an equally broad interpretation with regard to systems used for credit assessment.

According to the Commission, any AI system intended to be used to evaluate the creditworthiness of natural persons or to establish their credit score must be considered high-risk, even where the system serves only one of these purposes.

This category includes systems that process financial, asset-related or behavioural data to generate scores or assessments used in the decision-making process relating to the granting of credit. Excluded, however, are systems used exclusively for marketing, customer service or the monitoring of exposures following the granting of credit, as well as those intended solely for the purpose of detecting financial fraud, for which the AI Act provides a specific exemption.

The “filter” mechanism provided for in Article 6(3) of the AI Act

The Guidelines also devote considerable attention to the exclusion mechanism provided for in Article 6(3) of the AI Act, which allows excluding, subject to certain conditions, from the category of high-risk systems certain AI systems which, despite formally falling within one of the use cases listed in Annex III, do not materially influence the outcome of the decision-making process.

The Commission cites, by way of example, systems that perform purely preparatory, organisational or support tasks, such as document classification, the reorganisation of information or the provision of regulatory references, without making assessments of the specific case or affecting the content of the final decision.

The Guidelines specify, however, that the filter does not apply when the system carries out

profiling activities within the meaning of the GDPR, or when it operates within more complex architectures whose outputs contribute substantially to a significant decision. Furthermore, it is reiterated that the mere presence of human oversight (an essential requirement laid down by the AI Act itself) is not sufficient to preclude classification as a high-risk system.

Timeline and next steps

The Guidelines are currently open for public consultation, but already provide guidance of

considerable interest to organisations undertaking AI Act compliance programs. With regard to deadlines, the Guidelines note that the deadlines originally set out in Article 113 of the AI Act have been postponed by the proposed Digital Omnibus Regulation, on which the European institutions have reached a political agreement. In particular, the obligations for high-risk systems classified under Article 6(2) (Annex III) will apply from 2 December 2027, whilst those for systems classified under Article 6(1) (Annex I) will apply from2 August 2028. For systems already placed on the market or put into service before 2 August 2026, the AI Act will apply only in the event of significant design changes made after that date.

In this context, organisations should carefully review their inventory of AI systems in use, verify the intended purpose identified by providers – including through technical and commercial documentation – and adequately document the assessments carried out in cases of more complex classification.

Indeed, for many organisations, the main challenge will not be to identify systems that are clearly high-risk, but rather to demonstrate, through a structured and documented analysis, the reasons why a particular system should not be classified as such.

On 18 March 2026, the Court of Rome annulled in its entirety order No. 755 issued by the Italian Data Protection Authority on 2 November 2024. However, the Court did not examine the substance of the alleged infringements, resolving the matter entirely on a preliminary and overriding issue: jurisdiction. A procedural defeat, one might say; yet, in terms of practical consequences, it amounts to a defeat on the merits.

The contested order: what the Data Protection Authority objected to

The Data Protection Authority alleged that OpenAI had breached Article 33 of the GDPR for failing to notify the data breach of 20 March 2023: of Articles 5(2) and 6 of the GDPR for the lack of a legal basis for the training of its models; of Articles 5(1)(a), 12 and 13 of the GDPR for shortcomings in the privacy policy; of Articles 24 and 25(1) of the GDPR for failing to put in place age verification systems; and of Article 83(5)(e) of the GDPR for failing to launch the communication campaign that had previously been ordered. The fine amounted to EUR 15 million, accompanied by a six-month institutional communication campaign across all the main Italian media outlets (radio, television, newspapers and the internet).

OpenAI challenged the order, setting out ten grounds of appeal. The Court considered only the first of these, ruling that it was well-founded and that it encompassed all the others.

The crux of the matter: who was authorised to impose the penalty?

OpenAI complained that the Data Protection Authority lacked the competence to investigate cross-border infringements and impose the resulting sanctions, as Articles 55 and 56 of the GDPR provide for the so-called “one-stop-shop” mechanism, under which the only supervisory authority “competent to act” in relation to “cross-border processing” is that “of the main establishment or of the single establishment of the controller”, in its capacity as “lead supervisory authority”.

The change in circumstances had occurred in the course of the proceedings: OpenAI set up its Irish subsidiary on 24 March 2023 and received, on 15 February 2024, formal notification from the Irish Data Protection Commission recognising OpenAI Ireland as an EU establishment for GDPR purposes. However, the penalty decision was not issued until November 2024, nine months later.

The Data Protection Authority’s argument — and its legal limitations

It must be acknowledged that the Data Protection Authority’s position was not without its own internal logic. The defendant administration replied that the penalty decision concerned infringements committed prior to 15 February 2024, taking the view that the applicable legislation ratione temporis was that in force at the time the infringement was committed, with the consequence that the one-stop-shop mechanism did not apply to infringements committed and finalised before that date. In line with such approach, the Data Protection Authority in fact partially complied with the cooperative mechanism: it forwarded to the lead authority in Ireland the documents relating to ongoing and continuing infringements, in accordance — according to its interpretation — with the principle of “tempus regit actum” referred to in Article 11 of the Preliminary Provisions.

However, the Court did not agree with this interpretation, considering that the argument was based on an erroneous reading of Opinion No. 8 of 9 July 2019 of the EDPB — a soft-law instrument adopted pursuant to Article 64 of the GDPR at the request of the French and Swedish authorities, which does not constitute a primary source of EU law but contributes to defining the rules applicable to the allocation of competences among national supervisory authorities, serving as an authoritative interpretative guide for courts and administrative authorities to ensure the uniform application of the Regulation throughout the Union.

How the Court interpreted the EDPB Opinion

The crux of the decision lies in the interpretation of Article 4.3.2 of the EDPB Opinion, which specifically governs the creation of a main establishment whilst proceedings are ongoing.

The EDPB has clarified that “the creation of a main or single establishment or its relocation from a third country to the EEA” whilst proceedings are ongoing ”will allow the controller to benefit from the one-stop-shop, with the consequence that every pending proceeding will be transferred to the supervisory authority of the State in which the main establishment is located” and that “such supervisory authority will become the lead supervisory authority”.

The Data Protection Authority’s defence regarding the continued applicability of the one-stop-shop mechanism solely in relation to ongoing or continued infringements was found to lack a legal basis, stemming from an erroneous interpretation of paragraph 16 of the Opinion, which refers the issues addressed “mainly” to infringements of an ongoing or continued nature. The Court observed that the very use of the adverb “mainly” serves to rule out the possibility that the EDPB intended to limit the issues covered by the Opinion solely to ongoing infringements; rather, it sought to indicate the types of infringements in which such issues arise most frequently.

The underlying principle is even more significant: making the determination of the competent authority dependent on the nature of the alleged infringement would not only cause the uncertainty that the EU legislation aims to avoid, but also a reversal of the logical legal order in which issues are examined, making the resolution of a preliminary question such as jurisdiction dependent on the outcome of the examination of a question of substance.

The “tempus regit actum” argument — rejected

The Data Protection Authority also invoked the legal principle of “tempus regit actum” to argue that the applicable legislation was that in force at the time the infringements were committed. The Court considered this argument to be irrelevant: in the present case, what is at issue is not a change in the applicable legislation during the course of the proceedings, but rather the change in certain factual circumstances — the creation of a single establishment by the data controller within the territory of the Union — the consequences of which are taken into account and governed by the EDPB Opinion. It is not, therefore, a matter of the retroactive application of the law, but of adapting jurisdiction to supervening facts, as already provided for and regulated by European law.

The exceptions that did not apply

The Court also examined whether any of the exceptional circumstances applied in which jurisdiction reverts to the national authority concerned. In this regard, Article 56(2) of the GDPR — according to which each supervisory authority is competent to handle complaints that relate solely to an establishment in its Member State or that have a substantial impact on data subjects solely within its Member State — and Article 66, which, by way of derogation from Article 60, grants each supervisory authority the power to adopt provisional measures where it considers that urgent action is required to protect the rights and freedoms of data subjects. In addition to these cases, there is the case where the lead supervisory authority, although seised of the matter, decides not to handle the case (see, to that effect, CJEU, C-645/19, Facebook Ireland and Others). However, none of these exceptional circumstances was found to exist in the present case.

The case law of the Court of Cassation

The Supreme Court had already clarified that “the national data protection authority is entitled to impose sanctions where it appears that the processing was carried out by an Italian company with full and direct decision-making autonomy with regard to personal data” (order, First Division, No. 27189 of 22 September 2023) and that “the Italian Data Protection Authority has the power to issue the measures falling within its remit against a foreign entity, even if it is established outside the Union, which operates outside the national territory, provided that it carries out, through a permanent establishment on Italian territory, an actual and genuine activity in the context of which the processing takes place” (judgement of First Division, No. 3952 of 2022). In both rulings, the prerequisite for recognising the Italian Data Protection Authority’s power to impose sanctions is identified as the presence on Italian territory of a company or a permanent establishment: circumstances which do not exist in the present case.

The Court’s decision therefore forms part of a consistent line of case law.

The data point worth more than a thousand arguments

Other supervisory authorities, although “concerned” at the time proceedings were initiated in relation to the same infringements committed by the applicant company, subsequently declined to exercise their jurisdiction in favour of the Irish supervisory authority, which was deemed to be the lead authority from 15 February 2024, and forwarded all the investigative files to it. The Italian Data Protection Authority was left on its own. The Court held that it was in the wrong — whilst acknowledging, in the allocation of legal costs, the genuine novelty and complexity of the issues addressed.

The operative part

The creation of the data controller’s single establishment pending the administrative proceedings — even though these had been lawfully initiated in January 2024 — should have

immediately resulted in its transfer to the supervisory authority of the State in which the main establishment is located — in this case, the Irish authority — and the initiation of the cooperation mechanism set out in Articles 60 and 61 of the Regulation. In upholding the appeal, the Court annulled order No. 755 of the Data Protection Authority dated 2 November 2024. The costs of the proceedings have been shared between the parties, given the novelty of the issues involved.

The merits of the case remain open — and this is what matters

The judgement does not amount to a ruling on the merits. The infringements originally alleged by the Italian Data Protection Authority — legal basis for training the models, transparency, age verification, data breach and failure to implement previously-imposed corrective measures — remain intact and will presumably be addressed by the Irish DPC under the cooperative mechanism set out in Articles 60 and 61 of the GDPR. The case file is not extinguished; it merely changes hands.

Implications: a lesson that extends far beyond OpenAI

The ruling by the Court of Rome has implications that extend far beyond the parties to the case. The legal issues identified — legal basis for training AI models, transparency obligations towards users, age verification, and the handling of data breaches — are structural issues affecting any provider of artificial intelligence systems offering their services to European users, regardless of what emerges from the new Digital Omnibus legislative and regulatory framework.

For non-EU AI providers currently operating on the European market without a formally recognised establishment, the picture that emerges from the judgement is clear:

• Until there is a recognised EU establishment, any national supervisory authority is potentially competent, and there is a real risk of parallel and fragmented proceedings.
• Once the establishment has been formally recognised, the one-stop-shop mechanism is triggered — even if proceedings are already underway — and the case file must be transferred to the lead authority, unless a final decision has already been taken.
• The objective criterion is temporal, not substantive: what matters is not the nature of the infringement (whether a one-off or ongoing breach), but whether or not a final decision had already been issued at the time the establishment was recognised. EDPB Opinion No 8/2019 identifies this moment as the point at which jurisdiction is “crystallised”.
• Exceptions do exist, but they are exceptional: local jurisdiction remains only for infringements affecting data subjects in that Member State exclusively, or for urgent measures under Article 66 of the GDPR. It is not a standard recourse.

For AI system providers with an established presence in Europe, however, the ruling serves as a reminder that the choice of country of establishment — and the speed with which formal recognition is obtained from the local regulatory authority — is a decision with regulatory implications of the utmost importance: not a corporate detail, but a strategic lever for risk management.

In conclusion: whilst the Court of Rome has (for now) brought the Italian chapter of the OpenAI case to a close, the issues that fuelled the preliminary investigation remain unresolved and highly topical. Anyone who develops or distributes artificial intelligence systems aimed at the European market — from any country in the world — will sooner or later have to grapple with them.

Software, hardware, connected devices and, more generally, products containing digital elements must be designed, developed and maintained with cybersecurity in mind throughout their entire lifecycle.

The Cyber Resilience Act came into force on 10 December 2024, but its effects will begin to be felt in the coming months.

Indeed, the CRA will be implemented gradually, with some provisions coming into force as early as 2026, while the regulatory framework will be fully applicable from 11 December 2027.

The first deadlines have already been set: from 11 June 2026, the rules relating to conformity assessment bodies will apply; from 11 September 2026, manufacturers will be required to report any actively exploited vulnerabilities or serious incidents affecting product security.

Who is affected and which products containing digital components are covered?

The provisions of the Cyber Resilience Act are primarily addressed to manufacturers of products containing digital components, but they also apply to other economic operators in the supply chain, including importers, distributors, authorised representatives and, where applicable, open-source software maintainers. In some cases, the manufacturer’s obligations may also fall on importers or distributors, for example when they market a product under their own name or brand or substantially modify the product.

With regard to its material scope, the Cyber Resilience Act applies to products with digital elements made available on the European Union market. Broadly speaking, these are software or hardware products, including related remote data processing solutions, where their intended purpose or reasonably foreseeable use involves a direct or indirect, logical or physical data connection to a device or network.

The Cyber Resilience Act therefore covers, by way of example, IoT devices, routers, operating systems, applications, management software, hardware and software components, smart home products, wearable devices and, more generally, digital or connected products intended for distribution or use in the European market.

However, certain exclusions apply, for example, to products already regulated by specific sectoral legislation, to products developed exclusively for national security or defence purposes, and to certain cases relating to free and open-source software not supplied as part of a commercial activity.

The practical application of the Cyber Resilience Act therefore requires a case-by-case assessment, taking into account both the product and its distribution model, as well as the role played by the economic operator.

Key obligations

The Cyber Resilience Act requires manufacturers to integrate cybersecurity throughout the entire lifecycle of products containing digital elements. Such products must therefore be designed, developed, manufactured and maintained in such a way as to ensure a level of security appropriate to the risks.

Before placing the product on the market, the manufacturer must carry out an assessment of the cybersecurity risks of the product and take them into account at all relevant stages, from design to development, from production to delivery, right through to maintenance. The product must also comply with specific security requirements, including the reduction of exploitable vulnerabilities, secure-by-default configuration, protection against unauthorised access, safeguarding the confidentiality, integrity and availability of data, as well as the ability to receive security updates.

The manufacturer will also be required to prepare the technical documentation, carry out the applicable conformity assessment procedure, draw up the EU declaration of conformity and affix the CE marking. For many products, self-assessment may be sufficient, while for those considered important or critical from a cybersecurity perspective, more rigorous procedures may be required, including the involvement of notified bodies.

The manufacturer’s obligations do not end with the placing of the product on the market. The CRA requires the adoption of appropriate processes to identify, correct and document vulnerabilities even in the post-market phase.

From 11 September 2026, manufacturers will also be required to notify actively exploited vulnerabilities affecting the product and serious incidents affecting its security. For actively exploited vulnerabilities, an initial report must be made within 24 hours of the manufacturer becoming aware of them, followed by a formal notification within 72 hours and a final report. Similar obligations apply to serious incidents, in accordance with specific timeframes for reporting and the final report.

Importers and distributors are also subject to specific obligations. Before placing a product on the market or making it available, they must verify that the manufacturer has complied with the required obligations and that the product is accompanied by the required documentation and bears the CE marking. If they have reason to believe that a product does not comply or poses a cybersecurity risk, they must not place it, or make it available, on the market.

What to do now

In light of the deadlines set out in the Cyber Resilience Act, it is essential to begin an assessment of products, internal processes and relationships with suppliers and business partners in good time.

Preparing in advance will therefore be essential to identify any compliance gaps and approach the upcoming deadlines with greater awareness.

On 10 June 2026, exercising the powers delegated under Law No. 132/2025 (the Italian Law on Artificial Intelligence), the Council of Ministers granted preliminary approval to two draft legislative decrees concerning artificial intelligence, which are still subject to amendment. The first decree addresses the powers of national authorities, market surveillance, sanctions, regulatory sandboxes, training and employment-related provisions (the “Decree”). The second decree regulates the use of AI systems in policing activities and introduces provisions on civil and criminal liability. This briefing focuses on the first draft decree.

Governance takes shape: authorities, coordination and regulatory sandbox

The Agency for Digital Italy (AgID) is the national notifying authority, with responsibility for notification procedures and conformity assessment bodies. The National Cybersecurity Agency (ACN) is responsible for market surveillance and acts as the single point of contact. ACN is also responsible for the national registration of high-risk AI systems listed in Annex III, point 2, of the AI Act.

The role of sectoral authorities remains unchanged: the Decree identifies the Bank of Italy, CONSOB and IVASS as the competent authorities within their respective fields, in addition to the Italian Data Protection Authority insofar as matters fall within its remit.

The Decree also establishes a Coordination Committee within the Presidency of the Council of Ministers, to ensure coordination and cooperation among national authorities, other public administrations and independent authorities. The Committee may issue common guidelines for the conclusion of agreements and memoranda of understanding, as well as for the adoption of policy documents.

The Decree also establishes the Italian AI Regulatory Sandbox — the regulatory sandbox provided for in Article 57 of the AI Act — which will be jointly managed by AgID and ACN.

Sanctions: a graduated enforcement framework

In accordance with the AI Act, the most serious infringements, relating to the prohibited practices set out in Article 5 of the AI Act, may result in fines of up to 35 million euros or, if higher, up to 7% of the undertaking’s total annual global turnover for the previous financial year. Lower maximum fines apply for other categories of infringements, including those imposed on providers and deployers in relation to high-risk AI systems, those applicable to notified bodies, and those concerning transparency and reporting to the authorities.

The Decree also provides for non-monetary penalties for less serious infringements. As an alternative to financial penalties, the authorities may order that the infringement be remedied or require the publication of a statement setting out the infringement and identifying the responsible party. Sanctioning proceedings in the financial sector remain subject to the sector-specific procedures applied by the Bank of Italy, CONSOB and IVASS under the Italian Banking Act (TUB), the Consolidated Financial Act (TUF) and the Insurance Code, in accordance with the special regime applicable to financial institutions. 

Employment: the final decision must remain human

The Decree stipulates that, in employment-related decision-making processes, employers using AI systems must ensure that decisions concerning the establishment, modification or termination of the employment relationship, including disciplinary measures, are not taken solely on the basis of automated processing. The final decision must remain with a natural person exercising genuine and independent judgment.

Upon request, the worker is entitled to receive, through human intervention, a clear and understandable explanation of the decision, including how the AI system influenced the decision-making process and the main parameters taken into account. Any dismissal carried out in breach of these provisions is null and void. This provides stronger protection than that currently available under Italian employment law: it will not be sufficient to state that “the final decision is made by a human” if, in practice, the AI system’s output substantially determines it.

The Decree also establishes an explicit link between AI and occupational health and safety: the use of AI systems affecting work organisation, production rates, the way in which work is carried out, or safety-related decision-making processes must be taken into account in the workplace risk assessment (Documento di Valutazione dei Rischi – DVR) pursuant to Legislative Decree No. 81/2008.

Training: a cross-cutting obligation

The Decree devotes a substantial section to training, introducing measures for schools, teachers, adults, the public administration, universities, research institutions, regulated professions, the judiciary and the health sector. A total of €100 million has been allocated for teacher training under the national programme “PN Scuola e Competenze 2021–202”.

For regulated professions, the Decree introduces obligations to ensure technical, legal and ethical competence in AI: professional bodies will have six months to update their regulations and twelve months to revise their fair remuneration criteria to reflect the risk classification of the AI system used. In the healthcare sector, AI will become part of the Continuing Medical Education (Educazione Continua in Medicina - ECM) programme, with the involvement of healthcare managers and the national “MIA” platform.

What to do now

The texts are not yet final, but there are two operational priorities.

First, an initial review of the AI systems currently in use — distinguishing between prohibited practices, high-risk systems, systems subject to transparency obligations and low-risk systems — to prioritise compliance activities and to prepare of the required technical documentation: logs, risk assessments, human supervision, change logs and governance decisions.

The second priority concerns HR processes that make use of AI systems. The Decree prohibits decisions relating to the establishment, modification or termination of an employment relationship (including disciplinary measures) from being taken solely on the basis of automated processing, and provides that any dismissal carried out in breach of these requirements is null and void. In practice, this requires a review of decision-making processes relating to staff selection, performance management, job assignments and disciplinary measures, ensuring that meaningful human oversight is in place and properly documented, rather than merely formal. Particular attention should be paid to candidate ranking and scoring systems, productivity monitoring tools, and software used for automated shift scheduling or workload allocation, where their outputs have a decisive influence on management decisions. From a contractual perspective, it will also be advisable to review the clauses in contracts with the AI system providers, in terms of algorithm transparency, access to logs and the allocation of liability in the event of a dispute.

But it is not always a safe place. It amplifies hate speech and disinformation, facilitates practices such as cyberbullying and the non-consensual sharing of sexual or explicit content, and can foster patterns of isolation or addiction. Artificial intelligence further exacerbates these risks: it enables the creation of deepfakes and AI-generated images without the consent of the person depicted; it allows the deployment of chatbots capable of influencing minors’ choices and behaviour; and it makes it possible to tailor content to the specific cognitive vulnerabilities of individual users.

There is now widespread consensus on the need to protect minors online. How effective protection can be achieved, however, is far less clear.

In Italy, as in the rest of Europe, the regulatory framework is fragmented and rapidly evolving, and many of the key issues remain unresolved.

The regulatory framework

Italy has no comprehensive regulatory framework specifically addressing minors in the digital environment.

The legal framework is made up of various legislative instruments operating at different but complementary levels and often requiring a holistic interpretation.

The main legislative instruments currently relevant are:

• Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree No. 196/2003 (“Italian Privacy Code”), applicable to data controllers processing the personal data of minors;
• Regulation (EU) 2022/2065 (“Digital Services Act” or “DSA”), the European Commission’s Guidelines adopted pursuant to Article 28(4) of the DSA, and Commission Recommendation (EU) 2026/1035 on establishing a common framework for EU-wide age verification technologies, applicable to providers of intermediary services;
• Directive 2010/13/EU, as amended by Directive (EU) 2018/1808 (“Audiovisual Media Services Directive” or “AVMS Directive”), transposed in Italy by Legislative Decree No. 208/2021 (“Consolidated Act on Audiovisual Media Services” or “TUSMA”), applicable to video-sharing platform providers;

• Decree-Law No. 123/2023, converted into Law No. 159/2023 (“Caivano Decree”) and AGCOM (Italian Communications Authority) Resolution No. 96/25/CONS, applicable to providers distributing pornographic content but increasingly serving as a technical benchmark for age verification; and

• Law No. 132/2025 (“Italian Artificial Intelligence Act”), which includes a provision specifically addressing minors’ use of artificial intelligence systems.

In addition to the legislative instruments outlined above, two further initiatives deserve mention: the G7 Common Principles for a Safer and More Secure Digital Space for Minors, adopted by the G7 Digital and Technology Ministers in 2026, which establish a shared framework covering age verification, safety by design, protection from illegal content, parental control tools, digital literacy and risk management, and Bill No. 1136 (“Bill 1136”), currently under consideration by the Italian Parliament, which introduces specific provisions governing minors’ access to social media and video-sharing platforms, as well as age verification and digital consent.

Three key issues

Beyond the existing legal framework, three issues currently lie at the heart of the political and regulatory debate at both national and European level.

The ban on access to social media

One of the issues currently dominating the debate on the protection of minors online concerns the introduction of a minimum age for accessing social media.

In 2024, Australia introduced a ban on under-16s; France, Denmark and Spain are considering similar measures; in Italy, Bill 1136 proposes to prohibit minors under the age of 15 from opening accounts on social media (as well as on video-sharing platforms).

These measures address genuine concerns. The risk, however, is that attention is focused exclusively on the age threshold for access, while neglecting the characteristics of the services once minors are granted access. A comparison with more mature regulatory models is instructive. The UK’s Age-Appropriate Design Code and the California Age-Appropriate Design Code Act do not merely set age limits, but impose requirements relating to responsible design, risk assessment and provider accountability. From this perspective, the protection of minors depends not only on who can access the service, but also on how the service is designed.

The digital age of consent 

Closely linked to the issue of minors’ access to social media is that of minors’ consent to the processing of their personal data.

Article 8 of the GDPR sets the age at which a minor may validly consent at 16, while allowing Member States the option to set lower thresholds, which in any case must not be below 13. Italy has exercised this option, setting the age for a minor’s consent at 14.

If approved in its current form, however, Bill 1136 would raise the age of consent for minors to 16.

The issue is further complicated by the fact that age thresholds are not uniform even within the same legal system. The Italian Artificial Intelligence Act, for example, allows minors to access and use AI systems independently from the age of 14 onwards. Accordingly, an operator managing a service with social components and AI-based features may find itself applying different rules to the same user base.

Service design and the functioning of algorithms

The third aspect of the debate — and probably the most sensitive — concerns the design of digital services and the functioning of algorithmic systems.

From this perspective, the regulatory debate is gradually shifting from content control to accountability for design choices that encourage compulsive use of services. These include infinite scroll, notifications deliberately designed to capture users’ attention, recommender systems optimised to maximise time spent on the platform, autoplay features, and intermittent reward mechanisms. The European Commission’s Guidelines adopted pursuant to Article 28(4) of the DSA expressly classify these techniques as incompatible with a high level of protection for minors. This is the principle of “safety by design”, which requires minors’ protection to be integrated from the service development stage, rather than addressed ex post on individual pieces of content.

The scope of these obligations varies, however, depending on the type of service provided. Transparency obligations relating to recommender systems and the ban on profiling-based advertising apply to all online platform providers. The obligations to assess and mitigate systemic risks, on the other hand, are more stringent for very large online platforms (“VLOPs”) and very large online search engines (“VLOSEs”), which are required to carry out periodic risk assessments and adopt mitigation measures that are reasonable, proportionate and effective.

Age verification

Setting a minimum age for access to social media and for digital consent risks remaining a dead letter unless supported by truly reliable age verification mechanisms.

From this perspective, Commission Recommendation (EU) 2026/1035 establishes a common framework for age verification technologies, based on an interoperable, privacy-respecting model utilising digital identities and advanced cryptographic protocols. The system — developed by the European Commission as an open-source solution and already being trialled in some Member States, including Italy — is based on zero-knowledge proofs: the user downloads an app, verifies their age using an electronic ID or a pre-installed banking app, and receives a digital credential that can be submitted to online platforms. The aim is to enable verification that a specific age threshold has been met without disclosing additional information about the user’s identity: the platform receives only a true/false response (e.g., “over 18: yes”), without access to the user’s name, date of birth or other personal data. Once certification is complete, the link between the user and the certificate provider is severed, preventing any tracking of online activities. In Italy, Bill 1136 provides for a verification system based on a national digital mini-wallet, which constitutes a national implementation of the European solution: not an alternative or parallel system, but a tailored application of the same technical blueprint made available by the Commission as open source, consistent with the requirements of the Recommendation and the implementation timetable set out therein.

Obligations for businesses

Against this background, while these issues remain unresolved and the regulatory framework continues to evolve, what should businesses providing information society services intended for, or otherwise accessible to, minors do?

The answer depends on the nature of the service provided, as well as on the size of the business.

Providers of online platforms (including social media providers and video-sharing platform providers) must not only comply with the ban on advertising based on the online profiling of minors, but also design their platforms so as to ensure an effective level of protection for minors. This entails, among other things, the adoption of protective default settings, configuring recommender systems that do not maximise user attention and engagement, eliminating features that encourage compulsive behaviour, and providing parental control tools. Furthermore, VLOPs and VLOSEs must identify, analyse and assess the systemic risks their services may pose to minors and adopt reasonable, proportionate and effective mitigation measures, which may include adjusting algorithmic systems, the introduction of age verification tools and specific content moderation measures.

It is important to note that merely stating in the terms and conditions that a platform is intended for adults does not exempt providers from these obligations. Where effective measures are not implemented to prevent access by minors, the service is deemed to be accessible to minors.

In addition to the obligations applicable to all online platform providers, providers of video-sharing platforms subject to Italian jurisdiction are also required, under TUSMA, to implement age verification systems for content that may impair the physical, mental or moral development of minors, as well as parental control tools. Providers of video-sharing platforms (and website operators) distributing pornographic content in Italy are also subject to a ban on access by under-18s to the pornographic content distributed, and are required to verify users’ age, in accordance with the procedures laid down by AGCOM.

Furthermore, should Bill 1136 be enacted, social media providers and video-sharing platform providers would be subject to two additional obligations.

The first concerns the prohibition on the creation of accounts for minors under the age of 15, rendering void any contracts already concluded with minors who have not yet reached that age at the time 

the law enters into force. The second is the obligation to verify users’ ages via a national digital mini-wallet implementing the European age verification solution, again in accordance with procedures laid down by AGCOM.

And what about those providers of information society services other than online platforms (such as e-commerce services) or entities that process personal data of minors? For these entities, there is currently no explicit obligation to verify age. Data protection law requires appropriate measures to ensure that a minor’s consent is valid, but it does not prescribe a specific age verification system nor define the technical means by which such verification must be carried out. In the absence of an express statutory obligation, however, it is advisable to carry out a risk assessment — similar in principle to that required under the Commission’s Guidelines for online platform providers — to determine whether, having regard to the nature of the service, the categories of personal data processed and the reasonably foreseeable presence of minors among users, age verification mechanisms compliant with the European technical solution or equivalent standards should be implemented.

Yesterday, the European Commission published the final version of the Code of Conduct on the marking and labelling of AI-generated content, a strategic tool within the European regulatory framework for AI. The Code represents the operational response to the transparency obligations set out in Article 50 of the AI Act, which will come into force on 2 August 2026.

The AI Act, moreover, has identified transparency as one of the most urgent systemic risks to be addressed. When machine-generated content is indistinguishable from human-generated content — journalistic texts, deepfake videos, synthetic voices — it creates fertile ground for disinformation, the manipulation of public opinion and a loss of trust in the information ecosystem. Consider, for example, an apparently authentic video of a political leader circulated during an election campaign, a voice recording used to impersonate a company executive and authorise a bank transfer, or images of events that never took place circulating on social media during crisis situations. In all these cases, the ability to identify the artificial origin of the content plays an essential role in preserving user trust.

The Code of Conduct is the practical tool through which the Commission seeks to translate these regulatory principles into concrete actions.

What the Code provides for: obligations and target audience

The Code is voluntary in nature, but carries significant legal weight: companies that sign up to it will be able to rely on shared standards to more easily demonstrate compliance with the obligations set out in the AI Act in the areas covered by the Code itself. This mechanism makes it particularly attractive to industry.

There are two target groups.

Providers, i.e. those who develop (generative) AI systems. They are under an obligation to ensure that the content produced (audio, images, video, text) is marked in a machine-readable format and detectable as artificially generated or manipulated. The technical solutions adopted must be effective, interoperable, robust and reliable, in line with the state of the art and implementation costs.

Deployers, i.e. those who make generative AI systems available to end users. They are subject to disclosure obligations in two specific cases:

• Deepfakes: audio, image or video content depicting real people, objects, places or events in such a way as to appear authentic, but which is not. In practical terms, this category would include a video showing a person making statements they have never actually made.
• Texts of public interest: articles, press releases or publications generated by AI on matters of public relevance, unless they have undergone a process of human review with editorial responsibility. The most obvious example is an article generated by an AI system commenting on election results, health measures or government decisions. Conversely, a text that has undergone substantial human review and been published under the editorial responsibility of a journalist or editorial team could benefit from the exception provided for in the AI Act.

There is also a requirement to inform users when they interact with an interactive AI system, such as a chatbot or a virtual assistant.

The process: how the Code was developed

The Code is the result of a participatory process launched in September 2025 by the AI Office, involving a public consultation and a call for expressions of interest. The process involved two thematic working groups (one for providers and one for deployers), led by independent chairs and vice-chairs, and included a wide range of stakeholders: developers of detection technologies, trade associations, civil society organisations, academics and major online platforms.

Over seven months — from November 2025 to June 2026 — three interim drafts were produced and put out for consultation before the final version was finalised. In parallel, the Commission published interpretative guidelines to clarify the scope of regulatory obligations and cover aspects not addressed by the Code.

Practical implications: what changes for businesses and users

For technology companies, signing up to the Code means adopting technical standards for content labelling and traceability, such as digital watermarking, signed metadata and provenance standards such as C2PA, as well as implementing appropriate disclosure systems for end users.

For example, an image generated by an AI model could contain metadata that allows platforms and verification tools to automatically identify its artificial origin, even if the label visible to the user has been removed.

Companies that do not sign up will still have to comply with the obligations of the AI Act from 2 August 2026, but without the benefit of being able to refer to the shared standards identified by the Code.

For the public, the expected impact is significant: deepfakes and AI-generated texts on matters of public interest will have to be clearly identified, making it easier to recognise when one is dealing with synthetic content.

The question of technical feasibility remains open. Watermarks and metadata can be removed or altered, and the detection of synthetic content in distributed environments still poses a significant technological challenge. The Code itself acknowledges this limitation, requiring the adoption of ‘technically feasible’ solutions in light of the state of the art.

Outlook: a model for the rest of the world?

The European initiative comes at a time of intense global regulatory competition over artificial intelligence. Whilst the United States is proceeding with a more fragmented approach and China has adopted specific rules on synthetic content, the European Union aims to build a model based on transparency and the accountability of operators.

A scenario that is far from unlikely is one in which a global platform chooses to apply European labelling standards to all users, rather than developing different systems for each national market. This is a phenomenon already observed in the past with European data protection legislation.

The challenge will be to maintain a balance between transparency and innovation, ensuring that excessive compliance burdens do not put European businesses at a disadvantage compared to their global competitors. The Code of Conduct on represents a significant attempt to strike this balance, with August 2026 serving as the first real-world test.

The Digital Omnibus — the legislative package through which Brussels is streamlining the EU’s digital rules — has been moving in the same direction for years: more sharing, more portability, fewer silos. A legitimate objective, but one with a side effect that many companies have not yet fully grasped: every data-sharing obligation creates an additional window through which know-how that has not been — or cannot be — patented may escape.

The package includes two main texts: one amending existing rules on data, cybersecurity, and privacy (the “digital acquis”), still under negotiation; and another concerning artificial intelligence, for which a provisional political agreement was reached on 7 May 2026. The dates of official publication remain subject to completion of the formal process.

What changes in practice

The most relevant amendments to the digital acquis for those handling sensitive information include:

– Public data and large operators. Public administrations may impose special conditions on Very Large Enterprises and DMA gatekeepers reusing public-sector data, in order to prevent privileged access to data from reinforcing already dominant positions.

– Data intermediaries. The mandatory regime under the Data Governance Act would become voluntary, with lighter separation requirements. More actors in the chain means more points of contact.

– Cloud switching. Simplified regimes for certain categories, but with explicit safeguards regarding trade secrets and risks of exposure to third-country jurisdictions.

– Smart contracts for data sharing. The essential requirements under Article 36 of the Data Act would be removed: fewer technical constraints, greater reliance on contractual governance.

The starting point: the Data Act

Already applicable since 12 September 2025, the Data Act grants users of connected devices the right to have their data shared with third parties. For manufacturers, this exposes a delicate perimeter: the data may contain operational logic, configuration parameters, performance information — everything that makes up know-how without ever having been labelled as such. Moreover, the Data Act disapplies the sui generis protection of databases in this context, shifting the burden of protection onto trade secrets.

Consider a practical example. A manufacturer of connected industrial equipment receives a request from a customer to share 18 months of operational logs with an independent maintenance provider that directly competes with its after-sales service. Those logs contain calibration parameters and control sequences developed over years of R&D and never patented. The Data Act does not allow for a blanket refusal, but it does permit the manufacturer to require proportionate technical measures before sharing the data (Article 4(6)): NDAs with anti-reverse-engineering clauses, sensitive data disclosed only in aggregated form, and contractual prohibitions on using the data to develop competing services (Article 6(2)(e)). If the third party refuses those measures, the manufacturer may block the sharing, but must provide written reasons and notify the competent authority. These two steps are not optional: they are the formal conditions for a lawful refusal.

The Regulation also provides for the possibility of refusing disclosure where sharing would make serious economic harm highly likely. The threshold is high, and the practical problem is that the harm must be demonstrated before the disclosure occurs, based on data that has not yet left the company. Those who have not documented the value of their trade secrets will find themselves without arguments when they are most needed.

The Digital Omnibus novelty: the jurisdictional factor

If approved in its proposed form, the amendment to the Data Act would introduce a new basis for refusing disclosure: the risk of unlawful acquisition by entities operating in third countries with insufficient safeguards — or with formally equivalent safeguards lacking effective enforcement.

This represents a concrete shift in perspective. Today, many leaks do not originate from cyberattacks or disloyal employees: they arise because data lawfully shared reaches a legitimate recipient operating in a jurisdiction where a local authority may require disclosure — and where obtaining an injunction is slow or impossible. The secret is lost because of a structural systemic issue, not because of malicious intent. The proposal seeks to turn this asymmetry into a legal lever: refusal is legitimate, but it must be justified in writing and notified to the competent authority.

Five things to do now

– Map data from a competitive standpoint. Not for GDPR purposes: which datasets, if analysed, reveal proprietary processes or logic? Which fall within the scope of the Data Act?

– Build a trade secret registry. A trade secret exists if it is not generally known, has economic value because it is secret, and is protected through reasonable measures. NDAs, access controls, audit logs, internal policies: everything documented and updated.

– Structure responses to data-sharing requests. What is needed is a process, not a case-by-case assessment. Clear criteria are required regarding when to refuse disclosure, how to justify the refusal, and how to notify it.

– Conduct a jurisdictional assessment of data flows. Who receives the data? Where do they operate? Where are their subcontractors located? What is the actual level of enforcement in those jurisdictions?

– Monitor the legislative process. The Digital Omnibus for the digital acquis will evolve. Those working with sensitive data need to know how, and when.

The direction of the Digital Omnibus will not change: more circulation, more portability. But companies that have built their competitive advantage on data and unpatented processes cannot wait for the legislation to stabilise. The trade secret that survives is the one already structured as such before someone asks for it to be shared.

Italy’s National Cybersecurity Agency (“ACN”) has today published Determination No. 155238/2026 (“the Determination”), which sets out the relevance categories, as well as the process, procedures and criteria for the listing, characterisation and categorisation of activities and services. 

The Determination introduces two categorisation models, set out in its Annexes 1 and 2 respectively. Both are structured around ten macro-areas, each with a name, description and pre-assigned relevance category. The four relevance categories established by the Determination are: high impact, medium impact, low impact and minimal impact. 

Essentially, the two annexes identify the same macro-areas, which differ only in the relevance category assigned to them.

As regards the scope of application, Annex 1 applies to (i) NIS entities operating in the following sectors: energy; transport; healthcare; drinking water; wastewater; space; postal and courier services; waste management; manufacturing, production and distribution of chemicals; production, processing and distribution of food; manufacturing; and (ii) entities providing local public transport services. Annex 2 applies to all other NIS entities not falling within those sectors.

In practice, the Determination requires NIS entities, through the ACN Portal, to list and categorise all internal and external activities and services and assign them to the relevant macro-areas of the model set out in the applicable annex. For each activity or service, entities must specify three elements: the corresponding macro-area, the name and description, and the relevance category.

The Determination also allows entities a degree of discretion. NIS entities may assign a specific activity or service to a different category from that pre-assigned to the macro-area, based on their assessment of the impact that a potential compromise could have on their ability to properly carry out NIS-related activities and services. In such case, the entity must retain the documentation supporting that assessment. By contrast, where the entity does not carry out activities or provide services attributable to one or more macro-areas, it is not required to report them.

The Determination also lays down two coordination provisions. The first concerns entities that have already classified data and services for the Public Administration in accordance with ACN Directorial Decree No. 21007/24: for such entities, that model continues to apply, rather than the model introduced by the Determination. The second concerns activities and services subject to the national cyber security framework, for which the relevance category is predetermined as “high impact”, without applying the standard procedure.

For matters not expressly governed by the Determination, the provisions of the NIS Decree shall apply. The Determination shall apply from 1 May 2026.

As you know, a number of business models are based on Consent or Pay mechanisms – indeed, they depend on such mechanisms. This is particularly true of the online publishing sector: newspapers fund their journalism through advertising revenues.

You will also be familiar with the legal issue these models have raised for years: the requirement that consent be freely given.

According to supervisory authorities, consent is not freely given – and is therefore invalid – if the alternative offered to users, namely paying, effectively pushes them to consent. This approach is consistent with Article 7 of the GDPR and with how it is strictly interpreted by the European Data Protection Board.

I have to admit that, after years of debate, I am still not sure what this so-called “equivalent alternative” – which would ensure free consent – is supposed to look like. But I don’t think I’m the only one. After all, it is easy to argue that charging €1.99 a month may influence a user’s choice. It is far harder to identify a genuinely viable alternative that would not.

And while we were debating this – that is to say, the price of consent – the European Commission reframed the debate.

With the Digital Omnibus, the legislator acknowledges something we all know: users do not read cookie banners, do not fully understand what they are agreeing to, and tend to give consent simply in order to fully access content that would otherwise be blocked by the presence of such banners.

In other words, consent is not the result of a genuinely free and informed choice.

To address this problem, the proposal introduces automated signals: technical tools that allow users to express their preferences once and for all without having to interact with cookie banners every time. Data controllers are required to implement tools capable of reading and complying with these signals.

In a sense, this represents an attempt to move beyond consent as we have known it until now.

But – and this is where the debate becomes particularly interesting – the legislator introduces an exception: media service providers, when offering media services, are not required to comply with those signals.

And there is no technical justification for such an exemption. The reason is economic: the aim is to preserve publishers’ ability to interact directly with users to obtain their consent and, in doing so, to safeguard the revenue streams that support independent journalism, which is considered a pillar of democratic society.

Now, on the one hand, the European legislator tells us that the cookie banner system is ineffective, creates fatigue - the fatigue associated with consent - and does not lead to genuinely informed decisions.

On the other hand, it has decided to maintain – and indeed to protect – it precisely in the media sector.

This raises an obvious question: how can we, at the same time, acknowledge that the mechanism is structurally inadequate for obtaining free consent, yet continue to base the validity of such consent on that very mechanism?

Perhaps the answer is simpler – and more uncomfortable – than we have been willing to admit so far.

Perhaps it is time to openly acknowledge that Consent or Pay, in its current form, has limitations. That the user’s choice is inevitably influenced. That consent, in these contexts, can never be entirely free from influence.

But that does not automatically make it unlawful.

Because another consideration comes into play: the need to strike a fair balance.

The right to the protection of personal data, after all, does not exist in a vacuum. It coexists with other rights and freedoms: freedom of expression, freedom of information, and freedom of enterprise.

The point is not to question the fundamental nature of the right to personal data protection. Rather, it is to recognise that, in a constitutional system, even fundamental rights can come into conflict and must be balanced.

And here, in my view, the Digital Omnibus marks a significant shift.

It does not say that personal data is a commodity.

It does not say that the right to data protection can be waived.

But it goes a step further by recognising that when sufficiently significant interests are at stake, which are structural and democratically justified, balancing is not only possible, but legitimate.

And it does so through an express legislative provision, not through a doctrinal construct.

This, inevitably, has significant implications.

Because it makes it harder to sustain an absolutist approach, such as that expressed by the European Data Protection Board itself, according to which personal data can never become the object of commercial exchange or be made subject to conditionality.

The emerging regulatory landscape is more nuanced.

So perhaps the real question is no longer: “Can data have a price?”. But rather: “What interests justify it having a price under certain conditions?”.

And above all: who decides where to strike this balance?

The European legislator, certainly.

The supervisory authorities, through their interpretation.

The courts, in concrete cases.

And, to some extent, the market itself – although market forces alone cannot determine the outcome.

Otherwise, there is a clear risk that the balance will gradually slip into commodification.

So, in my opinion, this is the real issue on which the debate must now focus: the framework of values that the European system is building.

If the exemption for the media is justified by the democratic importance of journalism, what other economic interests can lay claim to the same status?

I am thinking of the sustainability of digital platforms, technological innovation, access to digital services, and scientific research.

The open question remains where to draw the line between a legitimate balance and a gradual erosion of a fundamental right.

Much, in my view, depends on the interplay between the Digital Omnibus and Consent or Pay.

And perhaps that is why Consent or Pay is no longer simply about consent.

It has become the place where a much broader question is being decided: what kind of relationship European law should establish between fundamental rights and the data economy.

• ACN Determination No. 127437 of 13 April 2026, which updates and replaces the previous ACN Determination No. 379887 of 19 December 2025 and introduces the obligation to carry out the new process for listing and categorizing activities and services, as well as listing relevant NIS suppliers during the annual information update;
• ACN Determination No. 127434 of 13 April 2026, which sets the deadlines by which entities newly included in the NIS list during 2026 must comply with obligations concerning the notification of significant incidents and the adoption of security measures.

List of relevant NIS suppliers

ACN Determination No. 127437/2026 introduces the obligation to indicate relevant NIS suppliers as part of the broader annual information update process.

A relevant NIS supplier is an entity that provides services or products to a NIS entity and meets at least one of the following criteria:

1. the supply relates to the activities or services referred to in Annex I, points 8 and 9, of the NIS Decree, including DNS service providers, top-level domain name registry operators, cloud service providers, data center service providers, content delivery network (CDN) providers, as well as managed service providers and managed security service providers;
2. disruption or compromise of the supply would have a significant impact on the NIS entity’s ability to deliver the activities or services falling within the scope of NIS, also because adequate alternative suppliers are not available (non-substitutable suppliers).

To comply with this obligation, NIS entities must use the “NIS Service / Annual Information Update” on the ACN Portal and indicate, for each relevant supplier:

• company name;
• tax identification number;
• country of registered office;
• CPV (Common Procurement Vocabulary) codes relating to the supplies received by the NIS entity;
• the relevance criterion applied.

Listing and categorization of activities and services

One of the main operational innovations concerns the obligation for NIS entities to communicate the list of their activities and services, assigning each of them a corresponding relevance category. Legislative Decree No. 138/2024 (“NIS Decree”) provides that this requirement must be fulfilled from 1 May to 30 June each year, via the ACN digital platform, starting from the receipt of the first notification of inclusion in the list of NIS entities.

ACN Determination No. 127437/2026 specifies that this activity must be carried out through the “NIS Service / Categorization” on the ACN Portal. In practice, the Point of Contact must complete the list of the organization’s activities and services and assign to each a relevance category according to the model that will be established by ACN in the coming days, with the publication of a determination containing the categorization model, together with supporting materials to assist in carrying out a simplified Business Impact Analysis (BIA).

It is important to note that, after the 30 June deadline, the categorized list of activities and services will be considered final and no longer amendable, except in cases of delay due to documented technical-operational issues not attributable to the entity.

Furthermore, financial entities subject to the DORA Regulation and also falling within the scope of NIS are exempt from this specific requirement, without prejudice to the possibility of voluntary compliance.

The categorized list of activities and services submitted by NIS entities may be subject to compliance checks by ACN, carried out on a sample basis and also by comparison with data submitted by comparable entities. ACN must provide feedback within 90 days of submission, a deadline that may be extended once by up to an additional 60 days in case of further review. Where additional information, clarifications, or amendments are requested, the NIS entity must respond within 30 days; in case of failure to respond or late response, the list may be rejected. In the absence of a negative outcome communicated within the prescribed timeframe, the list shall be deemed validated.

Deadlines for entities included in the NIS list for the first time in 2026

ACN Determination No. 127434/2026 concerns entities that were included for the first time in the list of NIS entities during 2026. For these entities, ACN has set the deadlines for compliance with obligations relating to security measures and incident notification. In particular:

• the deadline for the adoption of the security measures set out in Annexes 1 and 2 of ACN Determination No. 379907/2025 is 31 July 2027;
• the obligation to notify significant incidents described in Annexes 3 and 4 of ACN Determination No. 379907/2025 applies from 1 January 2027.

An additional provision concerns top-level domain name registry operators and domain name registration service providers included in the NIS list during 2026. For these entities, ACN Determination No. 127434/2026 provides that the obligations referred to in Article 4(1) of ACN Determination No. 379907/2025 must be fulfilled by 31 July 2027.

If you need assistance and support in complying with the obligations under the NIS framework, please contact your trusted advisors.

The law includes 28 articles that define how AI can be used in different sectors. It also introduces rules for protecting minors under 14, requiring parental consent before any data linked to them can be processed. Italian lawmakers say the goal is to make AI systems fair and safe for citizens while allowing companies to keep innovating responsibly.

According to Giulio Uras:

“The Italian government’s effort has been both remarkable and, for once, genuinely timely. It sets a clear benchmark for EU countries aiming to complement the AI Act at the national level. Its approach is founded on three key pillars: innovation, transparency, and criminal protection. 

On innovation, the Italian law conveys a clear and forward-looking policy direction. By authorising the secondary use of pseudonymised personal data for research purposes, it adopts a functional and proportionate regulatory model designed to foster scientific and technological development. This approach implicitly acknowledges that Europe’s ability to compete in the global AI landscape depends on avoiding an overly dogmatic interpretation of fundamental rights (particularly in the field of data protection) that could unduly restrict legitimate research and innovation. 

As for transparency, the Italian law is more debatable. The law extends disclosure obligations across several sectors (including employment and intellectual professions) without following the AI Act’s risk-based approach. Such a broad rule may overburden low-risk systems and, paradoxically, stifle innovation.

The criminal protection provisions yield mixed results. The new offense addressing deepfakes(Art. 612-quater of the Italian Criminal Code) effectively targets a growing threat. More broadly, introducing criminal law safeguards was undoubtedly necessary, as it reinforces protection against the unlawful use of AI to obtain unfair profits or inflict harm. However, criminal provisions are effective only when they can be concretely enforced. In this regard, the drafting technique adopted for the new aggravating circumstance (Art. 61, no. 11-decies of the Italian Criminal Code) raises issues of legal clarity and operational effectiveness, which may ultimately limit its enforceability in practice.

The real challenge for EU Member States that wish to follow Italy’s example will be to do so without adding unnecessary layers of bureaucracy or new burdens on businesses. Otherwise, the drive for innovation risks being lost in translation.” 

Full article published in TechRound. 
 

The most significant change is the introduction of the CSIRT Contact Person.

Who is the CSIRT Contact Person?

The CSIRT Contact Person is the individual responsible for managing communications with CSIRT Italia (the national Computer Security Incident Response Team) and for transmitting notifications of significant incidents (as defined in Determination ACN No. 164179) as well as voluntary reports of relevant cybersecurity information.

To ensure prompt and continuous communication with the CSIRT, the regulation allows the appointment of one or more deputies to the CSIRT Contact Person. These deputies support the Contact Person in their duties and can act on their behalf in cases of absence or impediment.

Unlike the Point of Contact and the Deputy Point of Contact, the CSIRT Contact Person (and their deputy) may also be an external individual (for example, a consultant).

In any case, designated persons must possess basic skills in cybersecurity and incident management, along with an in-depth knowledge of the information systems and networks of the NIS entity for which they operate.

The designation must be carried out by the Point of Contact through a dedicated procedure. This procedure will be active from 20 November 2025 and must be completed by 31 December 2025 via the service portal accessible through the ACN website.

At first glance, the introduction of the CSIRT Contact Person represents an important support tool for NIS entities, as it allows them to delegate the management of incident notifications to external individuals. This relieves NIS entities from particularly burdensome and time-consuming activities for which it may be preferable to rely on external consultants with specific expertise.

This is particularly useful for:

• NIS entities that lack adequate internal structures or resources to manage the requirements related to incident notification;
• foreign organizations under national jurisdiction (for example, providers of public electronic communications networks and publicly available electronic communications services) that may face challenges due to language barriers or time zone differences.

If you need assistance and support in fulfilling the obligations under the NIS framework, click here

The final approval
On September 17, 2025, the Senate, with 77 votes in favor, 55 against and 2 abstentions, definitively approved the law on artificial intelligence (hereinafter, the “Law”).
Italy thus becomes the first EU country to integrate the rules set out in the AI Act with national legislation on artificial intelligence. The aim of the national legislator is to further strengthen the level of protection from risks connected with the use of artificial intelligence in certain areas and sectors.

The structure of the Law
The Law is composed of 28 articles divided into six titles.
Title I, programmatic in nature, establishes the principles to be respected and the purposes that artificial intelligence should pursue.
Title II lays down specific provisions regarding the use of artificial intelligence systems in certain sectors such as the healthcare sector, scientific research, the world of employment, intellectual professions, public administration and the administration of justice.
Title III sets out the procedures for drafting and updating the national strategy for artificial intelligence, which must foster public-private collaborations and promote research and training.
Title IV is dedicated to copyright protection and Title V to criminal protection.
Finally, Title VI contains the financial and final provisions.

The competent authorities
With the approval of the Law, the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN) have been officially designated as the national competent authorities in the field of artificial intelligence.
AgID, as the notifying authority, will define the procedures and exercise the functions and tasks relating to notification, assessment, accreditation and monitoring of the entities appointed to verify the compliance of high-risk artificial intelligence systems.
Meanwhile, ACN, as the supervisory authority, will be responsible for monitoring artificial intelligence systems, with inspection and sanctioning powers.
Both authorities will also contribute to the definition and updating of the national strategy for artificial intelligence in agreement with the Department for Digital Transformation.
In addition, within the Presidency of the Council, the following are established:

• the Steering Coordination Committee, with functions of coordinating steering action and promoting research, experimentation, development, adoption and application activities of artificial intelligence systems and models;
• the Coordination Committee among the authorities, with the task of ensuring coordination and cooperation between national competent authorities, other public administrations and independent authorities.

The main innovations sector by sector
Healthcare and research. Art. 8 of the Law authorizes the secondary use of personal data (including special categories) for research purposes, provided they are free of identifying elements and without prejudice to the obligation to inform the data subject. The use of artificial intelligence in healthcare will be allowed as support for prevention, diagnosis, care and treatment processes, on condition that the final decision remains with the doctor.

Employment. A ministerial observatory on artificial intelligence is established to monitor risks and opportunities of artificial intelligence in the employment context. Any automated assessment of workers’ performance without the possibility of contestation is prohibited, while employers are required to inform and train staff on the use of technological tools.

Intellectual professions. Art. 13 of the Law limits the use of artificial intelligence systems in intellectual professions to instrumental and support activities for professional work, with prevalence of the intellectual work being performed. In addition, professionals are required to inform the client about the artificial intelligence systems used, with clear, simple and exhaustive language.

Justice. Art. 15 of the Law prohibits the use of artificial intelligence systems for the adoption of judicial decisions in an automated way; however, they may be used for analysis and support in the drafting of documents, without prejudice to the responsibility of magistrates.

How the criminal code changes
Title V introduces certain amendments to the criminal code. In particular, the Law introduces a new type of offence and a new common aggravating circumstance.
The new offence, which is included in Art. 612-quater c.p., punishes the dissemination of falsified content, capable of misleading (so-called deep fakes), through artificial intelligence systems.
On the other hand, the Law establishes an articulated system of aggravating circumstances, the core of which is the introduction of a common aggravating circumstance in Art. 61, no. 11-decies c.p., which provides for an increased penalty where the use of an artificial intelligence system constitutes a treacherous means to facilitate the offence, hinder the defence or aggravate its consequences.

Implementation of the Law
For the entry into force of the Law, it remains only to await promulgation by the President of the Republic and its publication in the Official Gazette, from which the 15 days of vacatio legis will begin.
In any case, once the Law has entered into force, it will be up to the Government to complete the framework through the adoption, within twelve months, of one or more legislative decrees. These will regulate aspects of particular importance, including:

• the definition of an organic framework concerning the use of data, algorithms and mathematical methods for the training of artificial intelligence systems;
• the attribution to the competent authorities of supervisory, inspection, sanctioning and other administrative powers provided for by the AI Act;
• the regulation of measures for updating the existing legislation on banking, financial, insurance and payment services;
• the definition of rules on civil liability for damages resulting from the use of artificial intelligence;
• the definition of criteria for imputing criminal liability of natural persons and administrative liability of entities, taking into account the actual level of control over systems.

The unresolved issues
Some critical issues highlighted during the parliamentary process remain in the text of the Law definitively approved by the Senate.
In particular, in its detailed opinion C(2024)7814, the Commission had “rejected” the first draft of the Law for three main reasons:

1. definitions cannot deviate from those used in the AI Act;
2. the healthcare, intellectual professions and judicial administration sectors risk being subject to excessive obligations;
3. AgID and ACN are government authorities and therefore do not ensure full independence.
   While the first issue had already been resolved by referring to the AI Act definitions, the other two areas of potential incompatibility with EU legislation do not appear to have been addressed.

The challenge is now
The final approval of the Law represents an important milestone for Italy, which takes the lead among other European countries with regard to artificial intelligence. But the real challenge begins now with the implementation of the legislation.
The success of the Law will in fact largely depend on the quality of the legislative decrees that the Government will have to adopt within the next year; a crucial test to translate the programmatic objectives into operational rules that can adequately balance the needs of operators, technological progress and the protection of fundamental rights and freedoms.

Key Figures of 2024: A Year of Challenges and Actions

The report clearly highlights how complex and interconnected the landscape of data protection has become:

• 2,204 data breaches were reported across both public and private sectors—evidence of increasing exposure to risk and the need for a rigorous, proactive approach from all actors, especially in light of the Authority's increasingly strict sanctions in serious cases.
• 130 inspections were carried out, focusing on highly innovative areas: digital identity systems (SPID), facial recognition, video surveillance, and artificial intelligence applications. These audits underscore how the privacy challenge is increasingly intertwined with technological innovation and cybersecurity.
• 835 collegial decisions were adopted, including 468 corrective and punitive measures—a strong signal of the Authority’s growing attention to both repressive and preventive efforts concerning the most relevant violations. Sanction-related payments amounted to €24,430,856.45.
• Over 16,000 inquiries were handled by the Authority, reflecting a growing and tangible interest in data protection and the need for clear and authoritative communication to support citizens and businesses.

Privacy and Artificial Intelligence: Assessments and Perspectives

In 2024, the Authority focused on the profound implications of adopting artificial intelligence in key sectors: from digital healthcare to age verification, digital identity management, and the risks linked to web scraping for algorithm training. The dialogue between technological evolution and legal regulation is becoming increasingly intense, leading the Authority to reaffirm the need for strict, up-to-date governance in response to emerging digital scenarios.

Audit activities and decisions also addressed the sensitive issues of automated decision-making and profiling, as well as the cybersecurity of public and private infrastructures. The report calls on all data controllers to maintain a high level of awareness and responsibility in terms of both technical and organizational security.

Culture of Compliance: Rights and Trust at the Core

The Authority’s assessment is clear: building a culture of compliance and data security is no longer a mere regulatory requirement. It is a safeguard for the fundamental rights of individuals and an essential foundation for digital trust in society and the marketplace.

A renewed call is made to all stakeholders—public and private—to invest in training, continuous process updates, and transparency, in order to strengthen a digital ecosystem that protects the dignity, freedom, and security of every individual.

The 2024 Annual Report of the Italian Data Protection Authority portrays a country where personal data protection is no longer just a technical issue, but a social, legal, and ethical matter. From managing data breaches to AI innovation, the challenge is ongoing and demands that all players rise to the occasion—working together to build a safer, more inclusive, and more transparent digital future.

Comments from Paolo Lazzarino, Partner at ADVANT Nctm (Italy):

“The new Code of Practice released by the European Commission on July 10, 2025, marks a significant step toward transparency in artificial intelligence. One of its core elements is the requirement for developers of generative AI models to disclose what data was used to train them. This isn’t just a formality—it allows users, journalists, and other developers to understand the foundations behind AI-generated content. Think of it as a nutrition label for AI: knowing what a model was ‘fed’ helps to assess the reliability of what it produces.

“This focus on transparency is aimed to build public trust and increase corporate accountability. If we know whether the data comes from a certain media or archives, we can better evaluate the model’s potential biases and limitations. While the Code is voluntary, companies that adopt it show a commitment to responsible AI, anticipating the binding requirements that will come into force under the EU AI Act in the coming years.”

Comments from Paolo Gallarati, Partner at ADVANT Nctm (Italy):

“This will also contribute to raise awareness on the fair processing of personal data in AI training models, with a view to preserving the right balance between the legitimate interest of AI developers and data subjects’ consent: in fact, big data and machine learning can pierce the veil of anonymous data enabling the identification of individuals with technical means whose affordability was unimaginable just a few years ago.”

Comments fromGiulio Uras, Counsel at ADVANT Nctm (Italy):

“From a compliance standpoint, the EU’s newly released code of practice for general-purpose AI systems reveals not only the technical direction of AI Act enforcement, but also the political and economic balancing act the Union is currently engaged in.

“While framed as a voluntary tool, the code is clearly intended to become the de facto compliance path for major AI providers. For legal and compliance professionals working within the AI Act’s risk-based framework, the immediate challenge is operational: how to ensure conformity and due diligence in an environment where upstream transparency — particularly in relation to model documentation and training data — remains discretionary and, in many cases, asymmetrical.

“Beyond the legal mechanics, however, the broader picture is harder to ignore. The EU’s attempt to ‘simplify’ compliance via soft law mechanisms is, in reality, a defensive maneuver. With geopolitical uncertainty increasing — and transatlantic tensions, industrial policy shifts, and global AI races accelerating — Europe’s regulatory approach risks becoming both overly cautious and structurally rigid. The code’s voluntary nature may ease the short-term burden on industry, but it also delays legal certainty and fosters fragmented compliance strategies across jurisdictions and actors.

“Moreover, the EU’s efforts to accommodate industry concerns, while politically expedient, arguably dilute the AI Act’s foundational promise of trustworthy and safe AI. In practice, this risks creating a compliance framework that is neither robustly enforceable nor truly innovation-friendly — particularly for EU-based firms that do not have the scale or leverage of the major GPAI developers.”

In this Decision, the IDPA reiterated that metadata generated by email management systems and Internet browsing logs are personal data and that their generalized collection, as it enables remote monitoring of work activity, requires the employer, under certain circumstances, to follow the procedures set out in Article 4(1) of the Workers’ Statute.

The IDPA’s Position Paper dated June 6, 2024, had already established this position, specifying that metadata generated by employee email systems may be retained only for limited periods, generally not exceeding 21 days. If retention exceeds 21 days, it is necessary—according to the IDPA—to follow the procedures under Article 4(1) of the Workers’ Statute. This is unless the data controller can concretely demonstrate specific technical or organizational reasons (e.g., related to the cybersecurity of the email service) that justify the extension of the retention period beyond 21 days.

Such reasons were not found in this case.

The Region, moreover, through three external providers, was able to combine IP addresses, MAC addresses, and employee identities, thus having full access to information that enabled potential profiling and individual monitoring of employees. The IDPA considered such processing disproportionate and excessive relative to the principles of data minimization and storage limitation. It therefore mandated, among other things, the anonymization of attempts to access blacklisted websites, the reduction of Internet browsing log retention from 365 to 90 days (with retention beyond this limit allowed only after anonymization), restricted access to data to expressly authorized personnel, and encryption of data enabling the association between device and employee.

The IDPA also clarified that, considering the fact that processing metadata from employee email systems potentially involves “high risks” to the rights and freedoms of the individuals concerned (since it entails systematic monitoring of employees—deemed vulnerable due to their subordinate employment status), conducting a DPIA is mandatory, and failure to do so constitutes a violation of Article 35 of the GDPR.

The IDPA’s stance is thus clear: metadata should not be retained for more than 21 days, and doing so without following the procedures under Article 4(1) of the Workers’ Statute is only legitimate in the presence of proven technical reasons related to the functioning and cybersecurity of the service (which cannot be based on generic IT security concerns of the employer’s networks and systems). Where such reasons are lacking, it is necessary, depending on the case, to reach an agreement with union representatives or obtain authorization from the competent Labor Inspectorate. In all cases, a DPIA and a Legitimate Interest Assessment (LIA) must be conducted and documented, relevant information notices on the processing of personal data and internal policies and procedures updated, and appropriate technical and organizational measures adopted to ensure an adequate level of personal data protection.

If you need assistance and support in complying with the obligations related to the collection and retention of metadata generated by corporate email systems, contact your trusted professionals.

Who is obliged to comply with the regulations?

Digital accessibility obligations apply specifically to: 

- Private economic operators providing digital services to the public, including but not limited to:

• banks, insurance companies, transportation companies and telecommunications operators;
• e-commerce platforms, providers of audiovisual content, marketplaces and online services;
• operators of ATMs, self-service terminals, electronic ticketing and postal services.

- Entities involved in the design, production and marketing of digital tools intended for the general public, including but not limited to:

• web sites and mobile applications;
• electronic devices with user interfaces;
• management or application software accessible by end users. 

Who supervises and what do those who fail to comply risk?

The Agency for Digital Italy (AgID) is responsible for supervising the implementation of the regulations: it can carry out audits, inspections and, in case of non-compliance, take sanctioning and inhibitory measures.

Specifically, in case of violation, AgID can:

- issue a warning setting a deadline for compliance; 

- apply fines:

• up to 5% of the average annual turnover for serious violations committed by entities offering services to the public through websites or mobile applications, with an average turnover, in the last three years of activity, exceeding €500 million;
• between €5,000 and €40,000 for the other subjects, taking into account the seriousness of the violation, the number of users involved and the scope of the inaccessible services;
• additional sanctions of €2,500 to €30,000 in case of non-compliance with AgID warnings or obstruction of inspection activities. 

AgID can also take particularly strong administrative inhibitory measures, including: 

- website blackout or removal of applications from digital stores; 

- temporary or permanent ban on access to non-compliant digital services.

Sharing agreements are governed by Article 17 of Legislative Decree No. 138/2024 and concern the (voluntary and optional) sharing between NIS entities or between NIS entities and other entities (e.g. suppliers of NIS entities) of information relating to cybersecurity, such as cyber threats, near misses, vulnerabilities, techniques and procedures, security alerts, etc. Such agreements are functional to the prevention of incidents as well as to the management, containment and mitigation of their consequences, and contribute to raising collective cybersecurity standards.

The participation of a NIS entity in one or more sharing agreements must be notified to the ACN via the service portal, providing the text of the agreement and indicating its name and the list of the entities that are a party to it.

As regards the notification deadlines, for agreements entered into after the entry into force of Legislative Decree 138/2024 (i.e. after 16 October 2024), notification must be made promptly and therefore at the same time or immediately after the conclusion of the agreement. In any event, sharing agreements signed before the entry into force of Legislative Decree 138/2024 (and still in force on 31 May 2026) must be notified by 31 May 2026.

The list of sharing agreements to which the NIS entity is a party notified to the ACN must always be checked and updated over time: in particular, pursuant to Resolution 136118, any changes (e.g., the signing of a new agreement, the termination of an agreement in place, or changes to the text or parties to the agreement) must be notified to the ACN within 14 days of the date of the change.

The list of sharing agreements must be updated at least once a year: between 15 April and 31 May of each year, NIS entities shall update, again via the portal, the list of sharing agreements to which they are a party.

Should you need any assistance and support in complying with the obligations under the NIS regulations, please contact your professional advisors.

Legislative Decree No. 138/2024 generally applies to medium and large enterprises in 17 critical and highly critical sectors (besides public administrations and certain other types of entities identified directly by the National Cybersecurity Agency (ACN)) and imposes on NIS entities obligations that can be grouped into the following categories:   

• obligations to register and update information: every year NIS entities must register or update their registration on the ACN web portal, specifying their point of contact and providing a series of information relating, among other things, to the activities carried out and services provided;

• obligations relating to security measures: NIS entities are required to adopt appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the information and network systems used in their activities or in the provision of their services;

• obligations relating to incident notifications: NIS entities must notify the CSIRT, according to a multiple-stage approach and without delay, of security incidents that have a significant impact on the provision of their services;

• obligations for administrative and management bodies: administrative and management bodies, which are responsible for breaches of NIS regulations, are required to undergo training in IT security and to promote the periodic offer of IT security training for their employees.

If your organisation is an NIS entity or you assume it will become one during the course of this year, here is a calendar with the dates to remember to ensure compliance with Legislative Decree No. 138/2024.

If you need assistance and support to fulfil the obligations of the NIS regulations, please contact your reference professionals. 

Legislative procedure

On the night of Thursday 20 March 2025, the Senate of the Italian Republic approved the bill on artificial intelligence (the “AI Bill”) that will supplement, at domestic level, the rules laid down in Regulation (EU) 2024/1689 (better known as “AI Act”). 

Almost a year after it was submitted to Parliament, the AI Bill has been given the green light by the Senate with minor amendments. The ball is now in the Chamber of Deputies’ court. However, in order for the provisions to be actually implemented, it will be necessary to wait (even after final approval by Parliament) for the Government to adopt legislative decrees on the matters delegated to it. 

The (long) time taken by the Senate to approve the AI Bill can also be explained in light of the opinion issued by the European Commission, which identified a number of inconsistencies with the AI Act. As outlined below, such inconsistencies have been only partially resolved.

The bill

The objective of the AI Bill is to further strengthen the level of protection in relation to the use of artificial intelligence with specific reference to certain areas and sectors.

The structure of the AI Bill is as follows.

The first part establishes the guiding principles and defines the national strategy in relation to the use of artificial intelligence.

The second part instead contains specific-sector provisions, aimed at increasing the level of transparency in the following areas and sectors:

• healthcare  and scientific research;
• world of work and intellectual professions;
• judicial activities;
• public administration;
• national security;
• user protection and copyright.

The third section is dedicated to governance and identifies the competent national authorities in this regard, namely:

• the Italian Agency for Digital Italy (AgID), as notifying authority; and
• the Italian Agency for National Cybersecurity (ACN), as supervisory authority.

Finally, the fourth part is dedicated to criminal protection and establishes a series of aggravating circumstances in relation to the use of artificial intelligence systems in the commission of certain crimes, while introducing a new type of crime that punishes the unlawful dissemination of so-called deep fakes.

Changes to the original text

Compared to the original version of 23 April 2024, the new text of the AI Bill has undergone few changes, all of minor importance, including, in particular, the following:

• the removal of autonomous definitions of the terms “artificial intelligence systems” and “artificial intelligence models”, while referring to the definitions in the AI Act;
• the processing of personal data for research and clinical trial purposes will be specifically regulated by a decree issued by the Ministry of Health;
• the granting of specific powers to the government to set out comprehensive regulations on the use of data, algorithms and mathematical methods in the training of artificial intelligence systems.

The Commission’s remarks

As mentioned above, the EU Commission made a number of remarks to the Government about the original text of the AI Bill, deemed to be excessively restrictive. 

More specifically, in its detailed opinion C(2024)7814, the Commission  voted down the bill for three reasons:

• definitions cannot deviate from those used in the AI Act;
• intellectual professions, judicial activities and healthcare are at risk of being overburdened by excessive obligations;
• the appointed governance authorities, AgID and ACN, are governmental authorities that cannot ensure full independence.

Final considerations

While the first issue has been addressed and resolved, the remaining issues do not appear to have been taken into consideration. Areas of potential incompatibility with European regulations on artificial intelligence therefore persist.

The question at this point is: will the AI Bill be approved as it stands, or will lawmakers take the Commission’s opinion into account and revise its content? All we can do is wait for the decision of the Chamber of Deputies.

Artificial intelligence is beginning to make a relevant contribution within the scope of its operations to players in the financial market. We try to take stock of the consequences with Fabio Coco, Partner at ADVANT Nctm.

Artificial intelligence use cases can bring great benefits to businesses in the financial world. Can we give some examples? In particular, artificial intelligence has been used to detect potential fraud against the payment service provider and customers. The ability to analyze large amounts of data makes it possible to identify anomalies in transactions to detect fraud attempts, but also to profile customer habits and identify transactions that deviate from these so-called patterns even through forms of “adaptive learning” i.e., tools that update their parameters, learning from the data in real time.

Full Article on Plus 24 - Il Sole 24 Ore

Within the scope of Regulation (EU) 2016/679 (“GDPR”), which introduces the concept for the first time, pseudonymisation is considered one of the technical measures that the data controller or processor can use to fulfil their obligations regarding personal data protection. Specifically, the pseudonymisation procedure consists of making personal data relating to a specific individual no longer attributable to that individual, except – and this is the substantial difference with anonymisation – through the use of additional information, including any additional information that is beyond the control of the party carrying out the pseudonymisation. Such additional information (so-called pseudonymisation secrets) must be stored separately and protected by adequate security measures. The aim is to ensure that those who process the pseudonymised data are not able to attribute it to the individual to whom the data belongs. 

As stated in the Guidelines, since pseudonymised data constitutes information relating to an identifiable natural person, it remains personal data to all intents and purposes and, as such, is subject to the provisions of the GDPR. 

In this regard, the EDPB seems to adopt a very broad notion of personal data, in contrast to the recent conclusions of Advocate General Dean Spielmann in case C-413/23 P of 6 February 2025. In fact, adopting a more restrictive approach, the Advocate General emphasises that, in order to determine whether pseudonymised data should be considered personal data and therefore fall within the objective scope of the GDPR, one must take into account the reasonable likelihood that the additional information can be used by the recipient of the data to identify the data subject, as the mere theoretical identifiability of the data subject is not sufficient.

Going back to the Guidelines, a fundamental concept introduced by the EDPB is that of “pseudonymised domain”, which can be defined as the set of authorised individuals and systems that can access the pseudonymised data. Within said domain, which is to be determined by the data controller/processor, the pseudonymised data can be processed minimising the risk of re-identifying the data subjects. This logically implies that pseudonymisation secrets must be kept separate from the pseudonymisation domain. 

Keeping in mind the accountability principle, the controller is required to evaluate, also through periodic risk assessments, the likelihood of re-identification within the pseudonymisation domain, so as to ensure that the risk remains negligible throughout the entire processing period.

On the other hand, the Guidelines also provide useful operational guidance for companies and operators, giving some examples of appropriate technical measures for pseudonymisation, including:

• advanced encryption techniques, such as SHA-3 hash functions, which can be used to create pseudonymised data. To increase the security of the process, it is possible to combine such functions with a salt, i.e. a randomly and securely generated data string;

• security measures relating to the IT infrastructure, such as limiting access to pseudonomysation secrets (in concrete terms, access could be limited to system administrators only, applying also to them the principle of least privilege);

• the use of data protection engineering tools on so-called quasi-identifiers (i.e. information that, if combined, can indirectly identify an individual), including techniques such as generalisation and suppression, which modify the level of detail of the data or eliminate highly risky data to reduce the risk of re-identification.

In conclusion, the analysis of the Guidelines highlights the fundamental role that pseudonymisation can play in the application of the principle of privacy by design, as well as in some areas of business activity that are extremely sensitive from a data protection point of view, such as the management of whistleblowing channels and the transfer of personal data outside the EU. As clarified by the Guidelines, pseudonymisation can also facilitate the use of legal bases such as the legitimate interest referred to in Article 6(1)(f) of the GDPR for the processing of personal data - an approach that is certainly useful when looking for an alternative to consent and balancing the interests of companies and the rights of individuals - and favour the compatibility of the data processed by any recipients with the evaluation of the original purpose of the processing, pursuant to Article 6(4) GDPR. 

Legislative Decree No. 138/2024 (“NIS2 Decree”), transposing Directive (EU) 2022/2555, known as the “NIS2 Directive” was published in the Official Gazette.

The NIS2 Decree, in addition to repealing Legislative Decree No. 65/2018 – which transposed Directive 2016/1148, the so-called NIS Directive –also provided for the repeal of Articles 40 (“Security of networks and services”) and 41 (“Implementation and control”) of Legislative Decree No. 259/2003 (“Electronic Communications Code”), with the consequence that now providers of public electronic communications networks or publicly available electronic communications services are subject only to the provisions set out in the NIS2 Decree.

To whom does it apply?

The NIS2 Decree applies to both public and private entities operating in “critical” sectors (e.g. energy, transport, banking, healthcare, digital infrastructure, space, waste management, manufacturing of medical devices, machinery, motor vehicles, etc.). 

Moreover, the obliged entities are distinguished into “essential” and “important”, according to their importance for the sector or type of services they provide, as well as their size. Belonging to one or the other category is relevant for the application of sanctions in the event of breach of the obligations under the NIS2 Decree, which are higher for essential entities (equal to a maximum of at least EUR 10 million or a maximum of at least 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the essential entity belongs, whichever is higher).

What are the obligations?

The main obligations incumbent on the obliged parties are the adoption of IT security risk management measures and the notification of significant incidents.

With regard to the obligations in the area of IT security risk management, essential and important entities are required to take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the information and network systems used in their activities or in the provision of their services. 

With regard to reporting obligations, the NIS2 Decree requires essential and important entities to notify the CSIRT (Computer Security Incident Response Team) of incidents that have a significant impact on the provision of their services. 

Notification is phased and involves: a pre-notification within 24 hours of the incident, the actual notification within 72 hours of the incident, and a final report within 1 month of the notification.

Both IT security risk management and reporting obligations will be set in detail (also with regard to terms, modalities, specifications and gradual implementation timeframes) by the NCA (National Cybersecurity Authority), through its own decisions based on gradualness and proportionality criteria.

The responsibility for ensuring compliance with the obligations laid down in the NIS2 Decree lies with administrative and management bodies of essential and important entities, which are responsible for breach of the NIS2 Decree.

For more information, see our Guide on Cybersecurity (updated in accordance with NIS2 Decree, CER Decree and the Cybersecurity Law) or contact our dedicated professionals.

The document imposes timely obligations on employers in relation to the collection, use and storage of metadata by e-mail management computer programs and services in use by employees.

But what is metadata and what is the content of the obligations imposed by the Guarantor?

Click here for the full document

1. The “Digital Green Certificate”

Pursuant to Article 21 of the Treaty on the Functioning of the European Union, every EU citizen has the right to move and reside freely within the territory of the Member States, subject to the limitations and conditions laid down in the Treaties and by the measures adopted to give them effect.However, some of the measures adopted by the Member States in order to limit the spread of the ‘COVID‑19’ pandemic often consisted of restrictions on entry or other specific requirements applicable to cross-border travellers, such as to undergo quarantine or self-isolation or to be tested for SARS-CoV-2 infection prior to and/or after arrival.The Proposal is set in such context, which aims to facilitate the exercise of the right to free movement within the EU Member States and establish a common framework for the issuance, verification and acceptance of interoperable certificates on COVID-19 vaccination, testing and recovery, called "digital green certificate". 

2. Vaccination certificate

As mentioned, the digital green certificate allows cross-border issuance, verification and acceptance of any of the following certificates:

(a) a certificate confirming that the holder has received a COVID-19 vaccine in the Member State issuing the certificate ("vaccination certificate");

(b) a certificate indicating the holder’s result and date of a NAAT test or a rapid antigen test listed in the common and updated list of COVID-19 rapid antigen tests established on the basis of Council Recommendation 2021/C 24/01[2]> ("test certificate");

(c) a certificate confirming that the holder has recovered from a SARS-CoV-2 infection following a positive NAAT test or a positive rapid antigen test listed in the common and updated list of COVID-19 rapid antigen tests established on the basis of Recommendation 2021/C 24/01 (“certificate of recovery”).

(a) name: surname(s) and forename(s), in that order;(b) date of birth;(c) disease or agent targeted;(d) vaccine/prophylaxis;(e) vaccine medicinal product;(f) vaccine marketing authorization holder or manufacturer;(g) number in a series of vaccinations/doses;(h) date of vaccination, indicating the date of the latest dose received;(i) Member State of vaccination;(j) certificate issuer;(k) a unique certificate identifier.

3. What are the data protection implications?

It seems appropriate to recall that Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR") applies to the processing of personal data carried out in the context of the Proposal.Well, with reference to the processing of personal data carried out for the purpose of issuing the certificates in question, the Proposal provides for the legal ground to process personal data necessary to issue such certificates and to process  the information necessary to confirm and verify the authenticity and validity of such certificates.In this regard, Whereas Clause 37  of the Proposal identifies the legal basis for the processing of personal data under Article 6(1)( c) of the GDPR (i.e., processing is necessary for compliance with a legal obligation to which the controller is subject) and Article 9(2)(g) of the GDPR (i.e., processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject), as necessary for the issuance and verification of the interoperable certificates provided for by the Proposal. [3]Furthermore, the Commission specifies that, in accordance with the principle of  minimisation of personal data, the certificates should only contain the personal data necessary for the purpose of facilitating the exercise of the right to free movement within the Union during the COVID-19 pandemic, underlining the necessity to set out specific categories of personal data and data fields to be included in the certificates, with a decentralised verification system that does not involve the storage of the  assessment results, and limited to the continuation of the state of emergency as declared by WHO. The Commission indeed clarifies that the Proposal does not create a legal basis allowing  the Member State of destination or the cross-border passenger transport services operators, which are required by national law to implement certain public health measures during the COVID-19 pandemic, to retain personal data obtained from the certificate.More specifically, in order to allow for the secure issuance and  verification of the certificates, the Commission and  the Member States  shall  under Article 4 of the Proposal set up and maintain a trust framework digital infrastructure. Such trust framework shall ensure, where possible, interoperability with technological systems established at international level.Furthermore, personal data  personal data may be transmitted/exchanged across borders with the sole purpose of obtaining the information necessary to confirm and verify the holder’s vaccination, testing or recovery status.Finally, the Proposal provides that the  authorities responsible for issuing the certificates referred to in Article 3 shall be considered as controllers referred to in Article 4(7) of Regulation (EU) 2016/679. 

4. The EDPS-EDPB joint opinion

By a joint opinion (04/2021 of 31 March)[4], the European Data Protection Board (the “EDPB”) and the European Data Protection Supervisor (the “EDPS”) suggested certain significant actions that are illustrated below:

• first, to avoid any discrimination based on the health condition of a person, clarification is requested as to the obligation for Member States to accept all three types of digital green certificates – including the vaccination certificate  – as well as the unlawfulness of any use of the green certificate that may cause, even de facto only, any such that is  discriminatory or in any event disproportionate with respect to the aim pursued;
• the need is underlined for any national rules legitimising further uses of the digital green certificate to precisely set out the scope and purposes of the processing[5];
• it is also requested that the European regulation better defines the purpose of the digital green certificate and provides for a mechanism for monitoring its use by Member States, as well as the introduction of adequate technical and organizational measures safeguarding against falsification of the certificates and any other type of abuse, especially with regard to data belonging to "special" categories[6] and those subject to automated processing;
• it is also requested to further clarify, also through a specific sunset clause, the illegitimacy of access to the data contained in the certificates once the pandemic emergency has ended and to exclude, by means of a delegated act of the Commission, that the digital green certificate system can be reactivated following suspension for ceased needs, in the presence of a further declaration of the existence of a pandemic from Sars-Cov-2, a variant thereof or similar infectious diseases with epidemic potential;
• it is requested to clarify whether the creation of the certificate itself or only its issuance is subject to the request of the party and, in order to exclude discriminatory effects, it is suggested to oblige the States, with a regulatory wording strengthened with respect to the current one, to issue the certificate not only in digital but also in paper form, as well as to limit, where technically possible, the verification techniques to those not implying the transmission of personal data;
• as to the categories of data used, it is stated that the Proposal in its recitals should provide additional substantiation as to the need for data fields such as the vaccine medicinal product, vaccine marketing authorisation holder or manufacturer and number in a series of vaccinations/doses administered, specifying that the amendments that may be made by delegated acts of the Commission should be limited to operating within the subcategories of the catalogue data  set out in the Annex;
• it is also considered preferable to leave to an executive act of the Commission the identification of only the technical details of the measures for the security of the processing, indicating already in the Proposal, thus raising the source, the obligation for controllers and processors to take technical and organizational measures appropriate to the risk of the processing;
• similarly, in view of the possibility given to the Commission to introduce, by means of its own executive act, specifications on the relationship between data controllers and data processors for the purposes of allocating the respective responsibilities, it is hoped that the Member States will make public a list of the subjects involved in the processing, in order to allow the effective exercise of rights by the data subjects, in compliance with the principle of transparency;
• it is also hoped for a more precise definition of the maximum periods of retention of data functional to the issuance of the pass, or alternatively the criteria by which to define them, however, not beyond the end of the pandemic;
• finally, it is suggested to better specify the conditions of legitimacy and the guarantees for the international data transfers, ensuring that data is used exclusively for the purposes set out in the Proposal.

Said remarks are aimed at an overall, further refinement of proposals that, however, already involve an adjustment of the balance between the protection of personal data, public health needs and freedom of movement, demonstrating, once again, how the discipline of data protection represents an increasingly important prerequisite for a sustainable management of innovation as much as of the emergency. 

5. The action of the Italian Data Protection Authority

On the subject of vaccination certificates and the related data protection implications, the Italian Data Protection  Authority expressed its view as well. The Authority highlights how data on vaccination status is particularly sensitive data and its incorrect processing can seriously impact the life and fundamental rights of people. Such impact, in case of solutions – including digital solutions (e.g. apps) – implemented to meet the need to make information on vaccination status a condition for accessing certain premises or using certain services (e.g. airports, hotels, stations, gyms, etc..) can result in discrimination, violation and unlawful restriction of constitutional freedoms.If one intends to resort to the above solutions,  public decision-makers and Italian private operators should, in the Data Protection  Authority’s view, focus on the obligation to comply with the rules on the personal data protection.The Data Protection  Authority therefore believes that the processing of data relating to the vaccination status of citizens for the purpose of accessing certain premises or using certain services should be regulated by a national rule, in accordance with the principles of  personal data protection (particularly, the principles of proportionality, purpose limitation and minimization of data).In the absence of such legal basis, according to the Data Protection  Authority, the use, in whatever form, by public and private providers of services to the public, of apps and passes designed to distinguish between the vaccinated and unvaccinated, should be deemed unlawful.In the above context, Decree Law No. 52 of 22 April 2021  (so-called “Decreto Riaperture” – “Reopening Decree” –) stands out, which provides for the introduction, on the national territory, of the so-called "Covid-19 green certificates", proving the status of vaccination against SARS-CoV-2 or the recovery from the infection or the performance of a rapid molecular or antigenic test with a negative result.In particular, it is expected that vaccination certificates and recovery certificates will be valid for six months, while  a negative Covid-19 test certificate will be valid for 48 hours. The certificates issued in the Member States of the European Union will be recognised as equivalent, as will also those issued in a third country following a vaccination recognized in the European Union.However, as reiterated by the Data Protection  Authority, from the wording of the Reopening Decree it can be inferred that the issue of privacy will be dealt with in a subsequent Prime Minister’s  Decree, since the decree merely establishes the need for the pass and defines the application areas, but not the approach from a privacy perspective.According to the Authority, however, “it is difficult to discuss the proportionality of the data processed, security measures or retention times with respect to a decree-law that to date lacks any implementation concerning such aspects" [7]. In other words, there are a number of crucial nodes from a privacy point of view that should be discussed and evaluated before starting to use the certificate. 

6. Conclusion

In conclusion, it seems clear that data protection is not an obstacle for fighting the Covid-19 pandemic, nor to implement solutions such as the vaccination certificate and, more generally, the Digital Green Certificate.However, it is necessary to provide for solutions that are fully in line with the EU data protection legislation not only for the sake of legal certainty, but also in order to avoid that the Proposal has the effect of directly or indirectly jeopardising the fundamental right to the protection of personal data.In this regard, it would be desirable that EU law may achieve a fair balance between the objectives of general interest pursued by the Digital Green Certificate and the individual interest in self-determination, as well as the respect for the fundamental rights to privacy, data protection and non-discrimination, and other fundamental freedoms such as freedom of movement and residence.At the same time, the need to ensure compliance with the fundamental principles of accuracy, necessity and proportionality in the processing of data, and the need to mitigate risks to the fundamental rights of data subjects, including risks of (unintended) secondary use of the Digital Green Certificate, as well as of direct and/or indirect discrimination, requires that the processing of data contained in vaccination certificates for purposes other than to ensure the free movement of persons to be specifically regulated by national law, in accordance with the principles of personal data protection,  so as to achieve a fair balance between the public interest to be pursued and the individual interest in confidentiality.According to the Authority, “We all want and hope to be able to move again soon, but we also don't want the price to be paid for moving again to be a substantial expropriation of privacy”. [8] This article is for information purposes only and is not, and cannot be intended as, a professional opinion on the topics dealt with. For further information please contact Ilaria Todaro and Claudia Colamonaco.  [1] The proposal for a Regulation of the European Parliament and of the Council is available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52021PC0130[2] Council Recommendation on a common framework for the use and validation of rapid antigen tests and the mutual recognition of COVID-19 test results in the EU (2021/C 24/01) (OJ C 24, 22.1.2021, p. 1).[3] The Proposal indeed does not regulate the processing of personal data related to the documentation of a vaccination, test or recovery event for other purposes, such as for the purposes of pharmacovigilance or for the maintenance of individual personal health records. The legal basis for processing for other purposes is to be provided for in national law, which must comply with Union data protection legislation.[4] The text of the Joint Opinion is available at the following link: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_edps_joint_opinion_dgc_en.pdf[5] According to the two boards, indeed,  the extension of the application of the digital green certificate to other situations to ease the restrictions currently in place has already been suggested and Member States might plan to introduce it as a de facto requirement, e.g. to enter shops, restaurants, clubs, places of worship or gyms or to use it in any other context as in the employment context. Any such further use of the digital green certificate and its associated framework under a national legal basis should not legally or factually lead to discrimination based on having been (or not) vaccinated or recovered from COVID-19. For this reason, the  two boards highlight that any possible further use of the  digital green certificate and the personal data related to it at Member States level must  be in compliance with the GDPR. This implies the need for a proper legal basis in Member State law, complying with the principles of effectiveness, necessity, proportionality and including strong and specific safeguards implemented following a proper impact assessment, in particular to avoid any risk of discrimination and to prohibit any retention of data in the context of the verification process.[6] The data belonging to special categories are those referred to in Article 9(1) of the GDPR, namely, i “personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation”.[7] So said Guido Scorza, a member of the Board of the  Italian Data Protection Authority, a in an Open nnline interview on 22 April 2021.[8] Ibidem.

• 59,838 communications  of DPO contact details,
• 27,192 complaints and reports, and
• 3,873 personal data breach notifications were received.

Three years after its entry into application, the GDPR can be considered to be an overall success, though there is still a long challenge ahead: the focus must continue to be on the improvement of implementation and on actions to strengthen the enforcement of data protection laws, and there is a need for strict and effective enforcement of the GDPR and increased awareness of the management of personal data and its fundamental importance in the information society, as well as for increased "digital maturity" on the part of data subjects and increased accountability on the part of owners of large digital platforms, integrated companies, and other digital services, particularly in the areas of online advertising, micro-targeting, algorithmic profiling, science and genomics, and the ranking,   dissemination and amplification of content.In conclusion, the GDPR has garnered considerable interest and attention in light of the   digital marketplace and big data boom. The EU Institutions have foresightedly overcome the – to say the least – jagged legal system governing data protection among Member States. The GDPR certainly represents a revolution in European data protection law. This article is for information purposes only and neither is nor can be considered as a professional opinion on the topics covered. For further information, please contact Marco Cappa and Claudia Colamonaco.

1. Introduction

As is known, on  16 July 2020, the Court of Justice of the European Union (hereinafter "CJEU ") handed down its judgment in the case referred to as "Schrems II".In its judgment, on the one hand, the CJEU examined the validity of European Commission’s decision 2010/87/EU on standard contractual clauses (hereinafter, "SCCs") and declared its validity, due to the existence of effective mechanisms that make it possible, to ensure compliance  a level of protection substantially equivalent to that ensured by Regulation (EU) 2016/679 (hereinafter, the "GDPR") within the European Union (hereinafter the “EU").On the other hand, with the above judgment, the CJEU examined the validity of the “Privacy Shield” decision[1], as the transfers of personal data in the context of the dispute that led to the request for a preliminary ruling took place between the EU and the United States. In this respect, the CJEU held that    US domestic law  requirements and, in particular, certain programs that allow the US public authorities to access personal data transferred from the EU to the United States for national security purposes, impose limits on the protection of personal data that are not set out in such a way as to satisfy requirements substantially equivalent to those laid down by EU law and that such legislation does not grant data subjects rights enforceable in legal proceedings against US authorities.In light of the above degree of interference with the fundamental rights of persons whose data is transferred to the said third country (i.e. a country that is not part of the EU), the CJEU declared the decision on the adequacy of the Privacy Shield[2] invalid.As readers will recall, the alternatives to the Privacy Shield for transfers of personal data from Italy to the United States were explained in our previous article on this subject, by examining the various possible solutions that could be taken into consideration[3].So, the aim of this paper is to present concrete solutions to companies based in the EU that have hitherto relied on the SCCs[4] to transfer personal data from Italy to the United States, in light of the recent recommendations issued by the European Data Protection Board (hereinafter, the "EDPB"). 

2.Introduction to the recommendations on supplementary measures for personal data transfers

3.The content of Recommendations 01/2020

1. So, in bearing in mind that the Recommendations are addressed both to data controllers and data processors wishing to identify any sub-processors, the first step indicated is to map all transfers of personal data that the controller makes to third countries[7]. Such activity might be particularly complex, especially when several persons are designated as data processors and sub-processors, but it is a first fundamental step to be taken in accordance with the principle of accountability. Precisely because of said complexity, the data processing register required by the data controller pursuant to Article 30 of the GDPR could be of help in this phase. Finally, it should be emphasized that, in this phase, the controller shall necessarily assess compliance with the principle of minimization together with the possible existence of sub-processors in countries outside the EU.
2. Subsequently to the mapping described above, the transfer tool the transfer relies on must be verified, amongst those listed in Chapter V of the GDPR[8]. In this respect, the EDPB clarifies that in the presence of an adequacy decision by the European Commission declaring that the third country ensures an appropriate level of protection of the personal data to be transferred, it will not be necessary to carry on any further in the assessment and the transfer will be deemed legitimate, without prejudice to the need for the controller to monitor said decision in order to verify that the same is not revoked or invalidated.[9]
3. So, in the absence of an adequacy decision, the third step identified by the EDPB requires the controller to assess whether the transfer tool is effective[10] with respect to the transfer to be made. In other words, an assessment must be made as to whether the third country has laws or practices that impinge on the efficiency and effectiveness of the appropriate safeguards referred to in Article 46 of the GDPR that legitimize the transfer. In this regard, the EDPB invites data controllers to consider the case where the legislation of the third country allows access to personal data by the public authorities for surveillance purposes. Well, in the event that such legislation is ambiguous or not available to the public, an analysis of the legislation must take into account objective and relevant factors and, finally, must include the necessary checks and be documented according to the principle of accountability.

At this point, if the data controller (or the data processor) considers that there is no interference and that the transfer tool the transfer relies on is effective, the data controller (or the data processor) will not need to take any supplementary measures and may continue or begin to transfer personal data to the third country. Otherwise, the supplementary measures that must be taken to ensure an appropriate level of protection shall be identified.

4. However, where the assessment referred to in the preceding step identifies obstacles to the effectiveness of the appropriate safeguards, the controller will be obliged to take supplementary (additional) measures for the transfer that guarantee the data subjects a level of protection equivalent to that afforded to them in the EU. For this step, Annex 2 to the Recommendations must be taken into account that provides a non-exhaustive list of such measures. Said supplementary measures may be technical (such as: encryption, separation of data processing, pseudonymization, etc.), contractual (such as: transparency of obligations, people’s rights, etc.) and organizational (such as: internal policies, transparency, etc.). In any case, supplementary measures may concern several factors, such as: format of the data, nature of the data, complexity of data processing workflow, number of actors involved in the processing, subsequent transfers, etc.

In the event that, despite the adoption of supplementary measures, the data transfer does not provide appropriate safeguards for the data subjects, the controller must refrain from transferring the data or, if already in progress, suspend the transfer.

5. If, on the other hand, the adoption of supplementary measures proves sufficient to ensure the data subjects a level of protection equivalent to that afforded to them in the EU, depending on the transfer tool the transfer relies on, it will be necessary to implement any formal procedures required by the supplementary measures to be adopted.[11]
6. Lastly, it will be appropriate to monitor, update and periodically verify that the measures taken remain effective over time[12].

Finally, the EDPB clarifies that data exporters must document the assessment process described above, as they are "responsible" for the decisions they make, in line with the principle of accountability. 

4. The content of Recommendations 02/2020

On the other hand, "Recommendations 02/2020 on the European Essential Guarantees for surveillance measures” are complementary to those described so far.The recommendations on the European essential guarantees[13] provide data exporters with useful elements to determine whether the legal framework governing public authorities’ access to personal data in third countries for surveillance purposes can be regarded as a justifiable interference with rights to privacy and the protection of personal data, and therefore is not in breach of the commitments made by the exporter and importer through the transfer tool relied on among those referred to in Article 46 of the GDPR. 

5. Practical solutions for the transfer of personal data into the United States

In light of the above and to sum up the matter, what should we do if we use the SCCs with a data importer in the United States?Well, the CJEU has established that the laws of the United States do not ensure a substantially equivalent level of protection.Therefore, as also clarified by the EDPB[14], the possibility or not of transferring personal data on the basis of the SCCs depends on the outcome of the assessment that the data exporter must carry out, taking into account the circumstances surrounding the transfer and any supplementary measures possibly put in place. The supplementary measures together with the SCCs, in light of a case-by-case analysis of the circumstances surrounding the transfer, should ensure that US law does not interfere with the appropriate level of protection guaranteed by the SCCs and the supplementary measures themselves.If the conclusion is reached that, taking into account the circumstances surrounding the transfer and any supplementary measures, appropriate safeguards cannot be provided, then it is necessary to suspend or terminate the transfer of personal data. However, if the intention is nevertheless to continue to transfer data, the competent supervisory authority must be informed.It is also necessary to understand and consequently assess on a case by case basis, what happens if the condition of legitimacy for the transfer is based on the other transfer tools provided for by Article 46 GDPR or is based on one of the derogations referred to in Article 49 GDPR.In any case, it should be considered that, if the transfer is based on the SCCs, Article 6 of the draft decision by the European Commission, submitted for public consultation, with the draft SCCs integrated on the basis of the decision of the CJEU[15] stipulates that, for a period of one year from the entry into force of the decision and the new SCCs, the exporter and importer of the data may continue to rely on the previous clauses, laid down with Decision 2001/497/EC and updated with Decision 2010/87/EU, to perform any contract concluded before the entry into force of the decision.In this period of time, the contract between the parties may however be integrated with the supplementary measures required to ensure that the transfer takes place with the appropriate safeguards and security.In conclusion, it is evident that the EDPB leaves it up to the data exporter and data importer, to assess whether the level of protection required by EU law is complied with in the third country in order to determine whether the safeguards provided by the chosen transfer tools can be complied with in practice, with the result that only in the event that said level cannot be complied with, will it be necessary to assess whether it is possible to provide supplementary measures to ensure a substantially equivalent level of protection to that envisaged in the EEA.In other words, the supplementary measures will be able to fill the gap, where the transfer tool identified among those of Article 46 of the GDPR alone fails to ensure a level of protection of personal data substantially equivalent to that envisaged in the EEA, provided that the legislation of the third country does not permit interference with the said supplementary measures such as to effectively compromise their effectiveness[16]. This article is for information purposes only and is not, and cannot be intended as, a professional opinion on the topics dealt with. For further information please contact your counsel.  [1]Decision 2016/1250 on the adequacy of the protection provided by the EU-US Privacy Shield.[2] The full text of the judgment can be found at the following link: http://curia.europa.eu/juris/documents.jsf?num=C-311/18.[3] All data controllers or data processors could in the short term:

• reassess the need to transfer personal data overseas and consider the possibility of replacing suppliers based in the United States with suppliers established in the EU or the need to store data at an establishment within the EU;
• base transfers of personal data on the SCCs, after having established a procedure for assessing the level of data protection in the country or territory to which such data is transferred and impose appropriate technical and organizational measures for such level of protection;
• rely on the express consent from data subjects, based on the indications of the Data Protection Board;

whilst, in the medium-long term:

• for multinational groups, define binding corporate rules and submit them for approval to competent authorities pursuant to and for the purposes of Article 47 of the GDPR; or
• wait for the issue of codes of conduct or certification mechanisms and then endorse them.

[4] In most cases, companies with headquarters in the United States that do not comply with the Privacy Shield have based the flows of personal data from the EU on the SCCs. The SCCs consist of a set of “standard” clauses that exporters and importers of personal data sign, in order to guarantee, through contractual obligations that comply with the provisions of the GDPR, an appropriate level of protection for personal data that leaves the European Economic Area. So far, the European Commission has approved up to three sets of standard contractual clauses: two for data transfers from data controllers based in the EU to data controllers based outside the EU or the EEA and one for data transfers from data controllers based in the EU to data processors based outside the EU or the EEA. SCCs have not yet been issued that relate to transfers from a data processor based in the EU to a data controller based outside the EU nor that relate to transfers from data processors (or sub-processors) based in the European Union to data processors (or sub-processors) based outside the EU. In this respect, on 12 November 2020, the European Commission published a draft decision, submitted for public consultation until midnight on 10 December 2020 (Brussels time), with the draft SCCs integrated on the basis of the decision of the CJEU, which repeals Decision 2001/497/EC and Decision 2010/87/EU. In particular, the annexes to the draft currently under discussion govern four types of transfers: (i) transfer from controller to controller; (ii) transfer from controller to processor; (iii) transfer from processor to processor; (iv) transfer from processor to controller.[5] Recommendations 01/2020 are subject to public consultation until 21 December 2020 and will be applicable immediately after their publication.[6] Indeed, according to the principle of accountability, envisaged in the GDPR, it is the data controller’s responsibility to be able at all times to demonstrate compliance with the regulations on the processing of personal data.[7] On this subject, the EDPB specifies that remote access from a third country (in support situations) and/or storage in a cloud located outside the EEA is also considered to be a transfer outside the EU.[8] Pursuant to the GDPR, in the absence of an adequacy decision, transfers of personal data to third countries can be carried out only if the data controller or processor transferring the personal data to a third country has provided appropriate safeguards and data subjects have enforceable rights and effective legal remedies. Appropriate safeguards referred to in Article 46 of the GDPR may be provided by: (i) SCCs; (ii) binding corporate rules ("BCR"s); (iii) codes of conduct; (iv) certification processes; (v) ad hoc contractual clauses. In addition to the cases described above, the transfer can also be based on the derogations referred to in Article 49 (including, among others, the explicit consent of the data subject).[9] However, at the same time, it should be pointed out that adequacy decisions do not prevent data subjects from submitting a complaint, nor do they prevent supervisory authorities from bringing a case before a national court in case of doubt about the validity of a decision, so that the national court can then submit a request for a preliminary ruling to the CJEU with a view to examining its validity.[10] The term "effective", means that personal data must be guaranteed a level of protection equivalent to that guaranteed in the EU.[11] In particular, if the transfer is based on the SCCs, as long as the identified supplementary measures do not infringe the rights of the data subjects or contradict the provisions of the SCCs, it will not be necessary to request the supervisory authority’s authorization to be able to take such measures. Otherwise, if the controller wishes to amend the SCCs or if the additional measures identified contrast with the SCCs, the competent supervisory authority’s authorization must be requested, pursuant to Article 43, section 3, letter a) of the GDPR.[12] In particular, the controller must adopt mechanisms to immediately suspend the transfer when the importer is no longer able to comply with the transfer tool relied on and/or the additional measures are no longer sufficient to guarantee an appropriate level of protection for the data subjects.[13] In particular, Recommendations 02/2020 identify the following "essential guarantees": (i) clear, precise and accessible rules for the processing of personal data, (ii) need to demonstrate the necessity and proportionality with regard to the legitimate objectives pursued; (iii) existence of an independent oversight mechanism, (iv) existence of effective remedies for individuals.[14] See the "Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18 - Data Protection Commissioner/Facebook Ireland Ltd and Maximillian Schrems".[15] See Note 4.[16] On this subject, the fact should be considered that clause 3 of the draft decision by the European Commission, submitted for public consultation, with the draft SCCs integrated on the basis of the decision of the CJEU, includes a series of obligations incumbent on the importer in case of requests for access to personal data by the government. Among these is the obligation to notify the exporter of the Authority’s request, and to communicate to the latter as much information as possible on the requests received (number of requests, type of data requested, authority or requesting authority, if the requests have been disputed and the outcome of such disputes, etc.).

1. Foreword and applicable regulatory framework

2. Issues of concern to businesses in the field of personal data protection

• measurement of body temperature before accessing company premises (if higher than 37.5°, access is not allowed), with the legal grounds for that being identified in the obligation to implement the security protocols against the spread of COVID-19 pursuant to Article 1, No. 7, d) of the Decree of the President of the Council of Ministers of 11 March 2020 and the end of the state of emergency being referred to as the conservation period. Temperature data should not, as a rule, be recorded, but it is permitted to identify the person and record such data if the temperature exceeds the threshold set out in order to document the reasons for preventing access to the company's premises. In any case, the relevant information must be provided to the person concerned. The relevant data shall not be disclosed or communicated to third parties, unless expressly provided for by law (for example, if so requested by the health authority for the reconstruction of the chain of close contacts of any person tested positive for COVID-19);
• request for a statement whereby one confirms that he/she is not coming from at-risk areas and that in the last 14 days has not been in contact with individuals tested positive for COVID-19. Such processing is likewise based on the obligation to implement the security protocols against the spread of COVID-19 pursuant to Article 1, No. 7, d) of the Decree of the President of the Council of Ministers of 11 March 2020. It is also clarified that only the data that is necessary, adequate and relevant for the purpose of preventing the spread of the virus shall be collected and processed (for example, if information is requested on contacts with people tested positive for the virus, it is necessary to refrain from requesting additional information regarding the person tested positive);
• request for a self-declaration by a person who has developed COVID-19 symptoms while at the company premises by reporting to the personnel department. Following such reporting, the person must be temporarily isolated and the company must notify the competent authority thereof, cooperating with the latter to identify any person who may have had “close contact” with the isolated person. For the duration of the investigation period, the company may ask possible close contacts to leave the premises, as a precautionary measure.

It should be noted that the above provisions are supposed to apply to external visitors too.Following the adoption of the Protocol, Confindustria prepared an explanatory note aimed at assisting companies with the application of the same; in such context, further indications are specified regarding the role of the competent doctor, who is inter alia required to notify the employer of any situations of particular “fragility” and current or past underlying pathologies of employees and, accordingly, the employer shall procure their protection in accordance with privacy requirements.Finally, for the sake of completeness, it is also worth mentioning the “Statement on the processing of personal data in the context of the COVID-19 outbreak”, adopted by the European Data Protection Board (“EDPB”) on 19 March 2020.First, the EDPB confirms the principle that data protection rules do not hinder the measures taken in the fight against the coronavirus pandemic. Nevertheless, data controllers and processors must ensure the protection of the personal data of the data subjects, the general principles of law must in any event be respected and, finally, any measure taken in such context must not be irreversible. In other terms, emergency may legitimise restrictions of freedoms provided that such restrictions are proportionate and limited to the emergency period.That being said, concerning data processing in the employment context, the EDPB confirms that the employer may process specific health information concerning employees and visitors, in the COVID-19 context, only to the extent allowed by national law.Concerning, in general, the processing of location data, compliance is required with the provisions of Directive 2002/58/EC (known as the “e-Privacy Directive”), which in principle allows the use of location data by the operator when made anonymous or with the consent of individuals. However, Article 15 of said Directive enables Member States to introduce legislative measures to safeguard public security insofar as they are necessary, appropriate and proportionate measures within a democratic society.More specifically, the Authority seems to allow the use by Member State governments of mobile location data as a possible way to monitor, contain or mitigate the spread of COVID-19, which may imply, for instance, the possibility to geolocate individuals or to send public health messages to individuals in a specific area. Nevertheless, public authorities should first try to process location data in an anonymous way, processing data aggregated in a way that individuals cannot be re-identified. When data anonymisation measures are not adopted, the Member State concerned will be required to put in place adequate safeguards such as providing individuals of electronic communication services the right to a judicial remedy. In any event, the Member State should always prefer the least intrusive solutions that are sufficient for prevention purposes.This paper is for information purposes only and is not, and cannot be intended as, a professional opinion on the topics dealt with. For further information please contact your reference lawyer or send an email to the following address: corporate.commercial@advant-nctm.com or to the following lawyers: Paolo Gallarati or Francesca Bonino.The following associates contributed to the drafting of this memorandum: Virginia Paparozzi, Giulio Uras and Lucrezia Lorenzini.