‘HIGH RISK AI OFFENSE APPLIES TO COMPANIES

Imprisonment ranging from one to five years shall apply to anyone who fails to adopt the technical safety measures required for the design, training, production, or placing on the market of high-risk AI systems, which are suitable to prevent malfunctions or operational alterations, or who fails to implement human oversight measures, when this results in a danger to public or individual life or safety. The penalty is increased to between two and eight years if the danger concerns State security.

“Naturally, the enthusiasm surrounding the arrival of new and, in the case of AI, I would say disruptive technologies and innovations,” explains Nadia Martini, a lawyer at the international legal consulting group Rödl and one of the leading experts in the field, “is not accompanied by a well-reasoned adoption of them. The numerous and, in some cases, sensational instances of misconduct or uncontrolled events, such as hacks and data leaks reported by media worldwide—and Italy is not immune to this,” the Rödl expert emphasizes, “are just a small part of a broader and more concerning scenario.”

According to recent research by the Artificial Intelligence Observatory of the Politecnico di Milano (*2025 data), 71% of large Italian enterprises have launched at least one AI project which, for six out of ten companies, has had a significant impact on their business model. ISTAT (the Italian National Institute of Statistics) found that in just one year, the actual adoption (meaning a step beyond generic usage) of AI at the corporate level more than doubled, and now concerns half (53.1%) of large enterprises.

“And this phenomenon is heading toward an acceleration,” the expert continues, “which the European legislator has now duly regulated, reflected in Italy by the high-risk AI offense. This primarily calls into question companies—whether large or small—which must now hastily comply with the regulations, especially given the criminal implications they entail.” This creates a context that potentially leaves small and medium-sized enterprises (SMEs)—which represent 90% of our production system and have fewer resources and budgets than the large corporations quickly ‘equipping’ themselves—”outlaws” through no fault of their own.

The lawyer: “Eight interventions to adapt governance and avoid civil penalties and criminal implications”

Here are the eight urgent interventions suggested by the sector expert Nadia Martini (Rödl) that companies should immediately adopt within their organizations, if they have not already done so:

Map and classify AI systems: Audit all systems developed internally or acquired from third parties, identifying high-risk systems and their corporate uses.
Verify safety and human oversight: Ascertain the effective implementation of applicable measures, assign responsibilities, and document checks.
Update the “231 Model” (Corporate Liability Framework): Review risks and, where necessary, the compliance model, preventive protocols, and information flows to the Supervisory Body (Organismo di Vigilanza).
Organize evidence: Ensure that operational logs, technical documentation, risk assessments, and evidence of human oversight remain accessible and intact.
Preserve relevant documents: Define retention periods and procedures to halt the deletion of relevant evidence in the event of incidents, complaints, or litigation.
Review supplier contracts: Verify timely access to logs and documentation, the preservation of evidence, and cooperation in legal disputes.
Manage incidents: Establish who intervenes and when, documenting malfunctions, impacts, human interventions, and corrective measures.
Review insurance coverage: Verify covered risks, liability limits, exclusions, and deductibles, while also organizing the response process for information requests mandated by the recent legislation.

“Priorities must be defined starting from the actual uses of AI,” concludes Nadia Martini of Rödl, “and its integration into corporate processes and methodologies. This requires establishing a governance framework and a chain of accountability, as well as measures and tools that enable management or entrepreneurs to identify and neutralize ‘loopholes,’ thereby avoiding exposing both the company and its executives to the civil and criminal penalties provided by the new high-risk AI offense.”

Press Office:

Purple & Noise PR
ufficiostampa@purpleandnoise.com