Italy introduces criminal penalties for high-risk AI security failures

Italy has introduced a new criminal offense regarding the training and management of high-risk artificial intelligence systems through Legislative Decree 160/2026. This measure, which entered into force on September 30, aligns national law with the European Union’s AI Act (Regulation EU 2024/1689).

Under the new Article 437-bis of the penal code, individuals who fail to implement necessary technical security measures during the design, training, production, or market placement of high-risk AI systems can face imprisonment ranging from one to five years. This penalty applies when such omissions result in danger to life or public and individual safety.

This legislative update moves AI oversight beyond administrative compliance and data protection into the realm of criminal law. It works alongside existing regulations regarding the illicit dissemination of deepfakes to create a dual-layered legal framework: one focusing on the security of system design and management, and the other on the repression of abuses in content dissemination.