Tag Archives: business

AI Act Transparency Obligations Are Now in Force

Legal news, , , , , , , ,

Dear Readers,

I hope you had a great summer! While you were travelling, hiking, swimming or simply resting, article 50 of the AI Act has entered into force, which means that a number of transparency obligations are applicable.

1. YOUR ROLE. First things first: are you an AI provider or an AI deployer?

  • A provider of AI systems is a natural or legal person that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark; while
  • A deployer is a natural or legal person using an AI system under its authority, except where the AI system is used in the course of a personal non-professional activity.

Providers and deployers have different obligations, which are summarized below.

2. PROVIDER’S OBLIGATIONS.

  • Providers must ensure that AI systems intended to interact directly with natural persons are designed so that those persons are informed they are interacting with an AI system, unless this is obvious from the point of view of a reasonably well-informed, observant and circumspect person.
  • Providers of AI systems that generate synthetic audio, image, video or text content must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Technical solutions must be effective, interoperable, robust and reliable, as far as technically feasible.

Providers have started to comply and use different technical solutions. Anthropic, for example, is using a watermarking technique, while Open AI and Google are using different strategies. No single marking technique meets Article 50(2) requirements of effectiveness, interoperability, robustness and reliability, and only an appropriate combination of techniques and detection mechanisms can satisfy them. Some point to a clear “Brussels effect” where the AI Act ends up applying beyond its scope.

3. DEPLOYER’S OBLIGATIONS.

  • Deployers of emotion recognition or biometric categorization systems must inform the natural persons exposed to the system of its operation and must process personal data in accordance with the GDPR and any other applicable data protection laws.
  • Deployers of AI systems that generate or manipulate image, audio or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated. For evidently artistic, creative, satirical, fictional or analogous works, the obligation is limited to appropriate disclosure that does not hamper the display or enjoyment of the work.
  • Deployers of AI systems that generate or manipulate text published to inform the public on matters of public interest must disclose the artificial nature of the content, unless the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility.

All information must be provided in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure.

The AI Office is tasked with encouraging codes of practice at Union level to facilitate the effective implementation of obligations regarding the detection and labelling of artificially generated or manipulated content. In fact, the voluntary Code of Practice on Transparency of AI-generated Content has already been signed by 190+ organizations and has been found by the EU Commission and the AI Office as an effective tool to aid compliance with article 50 of the AI Act.

In a world where AI systems have started to go rogue, perhaps the AI Act – with all its constraints to AI technology – can offer reassurance that the EU continues to pursue a human-centric, trustworthy AI.

The future of GDPR? Focus on Automated Decisions

Legal news, , , , , , ,

The Digital Omnibus Proposal.  The so called “Digital Omnibus” regulation proposal promises to lighten the burden of compliance with data protection legislation. Its aim is “to ensure that the rules continue to be fit for supporting innovation and growth”. Europe is not giving up on privacy, but it is willing to simplify it.

EDPB and EDPS Chime In.  The proposal, published in November 2025, has recently been the subject matter of a joint opinion by the European Data Protection Board and the European Data Protection Supervisor. While these two bodies are apparently in favor of facilitating GDPR compliance and strengthening consistency in its application, they express significant concerns regarding the impact of the changes on the fundamental rights and freedoms of individuals. They also fear that the proposal will create additional legal uncertainties.

The GDPR of the Future.  Gitti and Partners is embarking in a series of blog posts to explain what the GDPR may look like if the Digital Omnibus proposal becomes law. Today we focus on changes to the provision on automated decisions.

Automated Decisions: from Right to Prohibition.  Article 22 of the current GDPR regulates automated individual decision-making. The current language of the provision frames the rule as a “right”: a data subject is entitled not to be subject to a decision based solely on automated processing, unless certain conditions apply. The new proposal, instead, shapes a similar rule as a prohibition.

Conditions for Automated Decisions.  The new proposal reads (new language highlighted in yellow): “1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means. […]”

While – as before – the automated decision is legitimate if necessary to enter into or perform a contract with the data subject, the novelty is that the necessity of the automated decision can be assessed “regardless of whether the decision could be taken otherwise than by solely automated means”. Therefore:

  • An automated decision that does not produce any legal effects is fine.
  • An automated decision producing legal effects may be based on automated processing only if the decision is necessary to enter into or perform a contract with the data subject.
  • No automated decision is allowed unless it is necessary to enter or perform a contract with the data subject.
  • In order to add certainty to the interpretation of the requirement of “necessity”, the proposal clarifies that the decision may be regarded as necessary also if the decision could be made by a human. In the words of the EDPB/EDPS opinion, “the requirement of necessity does not mean that the mere fact that a decision could theoretically also be taken by a human should prevent the controller from taking the decision by solely automated means”.
  • In short, “The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing” (recital (38) of the Digital Omnibus proposal).

Bottom line: the data controller may choose a human decision process or an automated decision process so long as they are necessary to enter into or perform a contract with the data subject.

In conclusion, as shown in the “AI First” policy, the EU is now worried that AI may not be fully exploited. The above changes are supposed to encourage automated decisions even if such decisions could be taken by a human being.

Stay tuned for more angles of the Digital Omnibus.

Therapeutic cannabis in Italy: business opportunities

Legal news, , , , , ,

Italy’s only authorized medical cannabis facility is currently controlled by the military. However, the production site, located in the Florence area, cannot keep up with the increasing demand, creating shortages for patients and barriers to its prescription by physicians (whose patients are unlikely to be able to obtain the quantities needed).

As Colonel Modica of the Italian Military recognized “The health ministry and the defense ministry are trying to fix the shortfall because there’s been a huge increase in cannabis prescriptions and the number of patients who need them”.

Meanwhile, pressed by the patients’ associations, the Italian Health Care Ministry Giulia Grillo announced not only the increase of import of therapeutic cannabis products from the Netherlands (to cover the short-term shortages), but also the start of a longer-term project, eventually leading to the creation of a public-private partnership for the production of cannabis. “An invitation to present expressions of interest will be published in order to increase the production of therapeutic cannabis“, Ministry said. Although underlining that an appropriate time frame will be needed in order to implement the project, the Ministry confirmed that the cannabis production activity is “of great interest for both the Defense and the Public Health Care” and crucial in order to satisfy the increasing needs of both domestic and foreign markets.

The increase in the domestic production of therapeutic cannabis, along with the overall demand for it, appears to be inevitable.

On the other hand, the boom of “light cannabis” products in Italy (i.e., containing THC in a percentage lower than 0.2 and, therefore, expressly declared legal in Italy starting from January 2017) seems to have encountered some obstacles lately.

The Advisory Board of the Italian Health Care Ministry (Consiglio Superiore di Sanità) issued a report last spring, recommending the adoption of measures aimed at prohibiting the sale of light cannabis products.

In addition to that, an internal note of the Ministry of Home Affairs, recently made public, promoted a zero-tolerance approach and a strict application of the relevant laws and regulations. Such steps have caused great uncertainty and concerns amongst those who have invested in what came to the media’s attention in 2017 as a State-backed business.

Hence, the latest developments relating to therapeutic cannabis in Italy indicate that new business opportunities for both exporters and producers of cannabis-based prescriptions are likely to be offered in the Italian market. Conversely, serious questions can be raised in connection to the light-cannabis boom, in view of the inconsistent approach recently taken by Italian authorities.