All posts by gaiazunino

Criminal corporate liability arising from AI

Legal news, , , ,

As artificial intelligence becomes increasingly embedded in business operations, companies face a growing challenge: ensuring that AI systems are properly supervised and that the effectiveness of their controls can be demonstrated. Against this backdrop, Italy has taken a further step in aligning its national legislation with Regulation (EU) 2024/1689 (the AI Act), introducing new AI-related offences into the corporate liability framework under Legislative Decree No. 231/2001.

New Offences: From AI Safety to Deepfakes

Legislative Decree No. 160 of 9 September 2026, which entered into force on 30 September 2026, introduced Article 25-vicies, entitled “Offences Committed Using Artificial Intelligence Systems”, extending corporate liability to two offences concerning AI safety and the unlawful dissemination of AI-generated or AI-altered content:

  • Article 437-bis of the Italian Criminal Code criminalises certain failures to implement technical safety measures or human oversight mechanisms in connection with high-risk AI systems, as well as unlawful interference with their operation, where such conduct creates a concrete risk to life, individual or public safety, or national security. The provision also covers certain omissions resulting from gross negligence and establishes specific rules for professional users who intentionally fail to implement the required human oversight measures.
  • Article 612-quater of the Italian Criminal Code addresses the phenomenon of deepfakes by criminalising the non-consensual dissemination of AI-generated or AI-altered images, videos or voice recordings that are capable of misleading others as to their authenticity and cause unjust harm to the person concerned. Unlike the first offence, which specifically concerns high-risk AI systems, the deepfake offence is not subject to the same limitation and may therefore also be relevant to ordinary business activities, including corporate communications, marketing and digital content creation.

What Is at Stake for Companies?

The new Article 25-vicies introduces significant monetary penalties for companies: from 600 to 1,000 quota units for offences under Article 437-bis and from 200 to 700 quota units for offences under Article 612-quater, calculated under the penalty system established by Legislative Decree No. 231/2001. Both offences may also result in disqualification measures, including restrictions on contracting with public authorities, exclusion from public grants and financing, and prohibitions on advertising goods or services. As with other offences under Legislative Decree No. 231/2001, corporate liability arises only where the relevant statutory requirements are met, including that the offence is committed in the interest or to the advantage of the company.

Turning AI Risks into Effective Compliance

The introduction of these offences brings AI-related risks into sharper focus for corporate compliance programmes. While updating the 231 Model is not required, companies should assess their exposure to the new risks and the adequacy of existing controls, starting with a mapping of the AI systems developed or used across business processes and their potential classification as high-risk under the AI Act. Depending on the AI systems involved, companies should focus on different areas of risk:

  • Companies developing, producing or professionally using high-risk AI systems should focus on technical safety measures, human oversight, incident management and the allocation of responsibilities within the organisation.
  • Companies using generative AI should also consider the risks associated with the creation and dissemination of AI-generated or AI-altered images, videos and audio content, ensuring adequate authorisation procedures, content approval mechanisms and oversight of external service providers.

Depending on the outcome of the risk assessment, companies may need to revise their internal procedures, strengthen existing controls and provide targeted training to the personnel involved.

From Oversight to Evidence: The Supervisory Body’s Role

The Supervisory Body (Organismo di Vigilanza) also plays a key role in monitoring compliance with the 231 Model. This may require structured information flows on AI-related risks, incidents and monitoring activities, supported by the relevant technical functions. Ultimately, effective AI compliance is not just about having controls in place, but about being able to demonstrate that they work. Clear responsibilities, documented oversight and traceable decisions are therefore essential to demonstrating that the safeguards established under the 231 Model are effectively implemented.

Updated texts of the reform of the EU Regulatory Framework for Medicinal Products published: the most significant overhaul of the regulatory framework in over two decades

Legal news, , , ,

The institutions of the European Union have published the updated texts of the new Directive and Regulation which together constitute the reform of the EU pharmaceutical regulatory framework.

The reform represents the most significant overhaul of the European Union’s pharmaceutical regulatory framework in over two decades and introduces substantial changes across a broad range of areas governing medicinal products, from development and marketing authorisation through to market access and security of supply.

The reform addresses, inter alia, the following areas:

  • Regulatory data and market protection — the reform reshapes the rules governing the protection of data submitted in support of a marketing authorisation and the subsequent period of regulatory market protection. These forms of regulatory protection are distinct from patent protection and play a key role in product protection and lifecycle management strategies, including by affecting the timing of market entry of generic and biosimilar medicinal products.
  • Marketing authorisation procedures and the role of the EMA — the new framework seeks to streamline and increase the efficiency of assessment and authorisation procedures, including by shortening the applicable scientific assessment timelines, while strengthening patient representation within the Committee for Medicinal Products for Human Use (CHMP).
  • Orphan medicinal products — the incentive framework applicable to medicinal products for rare conditions is revised, including the criteria for orphan designation, the applicable incentives, the regime governing breakthrough orphan medicinal products and the rules concerning the duration and extension of market exclusivity.
  • Paediatric medicinal products — the provisions governing the development and authorisation of medicinal products for the paediatric population are incorporated into the new legislative framework.
  • Generic and biosimilar medicinal products — the scope of the so-called Bolar exemption is clarified and further harmonised at EU level, specifying the activities preparatory to market entry that may be carried out without infringing applicable patent rights or supplementary protection certificates.
  • Antimicrobials — new incentive mechanisms are introduced to support the research and development of antimicrobials, including specific incentives for priority antimicrobials, as part of the broader EU response to antimicrobial resistance.
  • Availability of medicinal products and management of shortages — the new framework strengthens obligations relating to the monitoring, prevention and management of shortages and provides for EU-level mechanisms concerning medicinal products identified as critical.
  • Environmental considerations — greater emphasis is placed on the environmental risk assessment of medicinal products and on the adoption of appropriate measures to prevent or mitigate the identified environmental risks.

The Directive and the Regulation must now be formally adopted and subsequently published in the Official Journal of the European Union.

Both acts will enter into force on the twentieth day following their publication. As a general rule, the Regulation will apply 24 months after its entry into force, while Member States will be required to transpose and apply the Directive within the same 24-month period, subject in each case to the specific transitional arrangements and application dates laid down in the respective acts.

M&A AND “231” LIABILITY

Legal news, , ,

Legislative Decree No. 231/2001 (“Decree”) introduced into the Italian legal system a regime of administrative liability for entities in connection with certain offences committed, in their interest or for their benefit, by persons holding representative, administrative or management positions, or by persons under their direction or supervision. This liability exists alongside – rather than in place of – the criminal liability of the natural person who committed the offence. Alongside pecuniary sanctions, the Decree provides for disqualification measures capable of jeopardising business continuity and, consequently, the value of the investment.

IS YOUR TARGET AT RISK? When structuring an M&A transaction, the due diligence process conducted on the target company – which is essential to identify all risk factors likely to affect the value of the transaction and to define appropriate contractual safeguards – must also include a specific focus on administrative liability arising from the Decree.

BEYOND COSMETIC COMPLIANCE: WHAT TO LOOK FOR.  Due diligence investigations should not be limited to verifying the formal adoption of an organisation, management and control model pursuant to the Decree (the “Model“). Although the adoption of such a Model is certainly an essential factor, it is not in itself sufficient to ensure that the company is not subject to “231” liability. Instead, the Model’s effective implementation and regular updating must be assessed. Equal attention should also be paid to the functioning of the Supervisory Body, its composition, independence and practical operation, as well as to the adequacy of organisational safeguards in the areas most exposed to the risk of offences. Furthermore, it is particularly important to verify the existence of any criminal proceedings or significant allegations under the Decree, because such issues will not disappear as a result of the extraordinary transaction.

“231” LIABILITY AND EXTRAORDINARY TRANSACTIONS. Articles 28 et seq. of the Decree govern transformations, mergers and demergers. The legislator pursues a specific objective: to prevent extraordinary transactions from becoming a means of circumventing the liability regime established by the Decree. Therefore, any “231” liability under the Decree survives in the event of a transformation, merger or demerger. Is there anything that can be done to mitigate the risks of liability arising under the Decree? An entirely new risk assessment, Model and compliance structure may be a good solution.

WHAT ABOUT BUSINESS TRANSFERS?  A milder regime applies in the event of the transfer or contribution of a business in connection with which an offence giving rise to liability under the Decree has been committed. The transferee is jointly liable with the transferor, but only for pecuniary sanctions recorded in the accounting books or relating to an offence of which the transferee was aware.

KEY TAKEAWAYS.  Compliance issues arising under the Decree should not be regarded as a secondary aspect of legal due diligence, but as an essential component of the overall transaction assessment, capable of influencing the structure of the deal, the agreed financial terms and the rights and obligations of the parties post-closing.