Italy

For judges, the Scuola Superiore della Magistratura (the judiciary school) participates in European initiatives including the JuLIA (Justice, Fundamental Rights and Artificial Intelligence) project, co-funded by the European Commission and led by Pompeu Fabra University. The project focuses on how algorithmic decision-making affects fundamental rights—the right to a fair trial, non-discrimination, data protection—and aims to equip judges and legal practitioners with analytical tools to evaluate the legal implications of AI systems and preserve judicial independence and impartiality.

For lawyers, training initiatives are also being offered by the Cassa Nazionale Forense, the social security institution for Italian lawyers, and the Associazione Regolazione Intelligenza Artificiale (AIRIA), the Italian association for AI research.

At the European level, Italy is also linked to the TRUST-AI project (commenced December 2025), coordinated by the Siracusa International Institute for Criminal Justice and Human Rights, in partnership with the Asser Institute and the Vrije Universiteit Brussels. TRUST-AI focuses on training criminal justice professionals in both adjudicating AI-enabled crimes and evaluating the risks of AI tools used within criminal proceedings, with particular attention to bias in algorithmic risk-assessment tools and compliance with EU legal standards.

There is also evidence of training activities addressing deepfake-related risks, although these are typically embedded within broader AI and cybersecurity education. In particular, the National Bar Council (Consiglio Nazionale Forense), together with the Scuola Superiore dell’Avvocatura, has organised a training cycle on ‘Cybercrime, Cybersecurity and Digital Forensics’, which included a dedicated session on the use of AI in cybercrime and cybersecurity, explicitly addressing deepfake scenarios.

REGULATION

Italy has adopted a comprehensive legal framework on AI (Law 132/2025). However, the legislation does not directly govern the use of AI in criminal proceedings or in judicial proceedings more broadly. Instead, it establishes general principles and safeguards that must guide its development and application. Nevertheless, the use of AI in the administration of justice is expressly addressed in several legal instruments, most notably the EU AI Act. Professional bodies, such as the Bar Associations of Rome and Milan, have also issued specific guidelines to help legal practitioners use AI tools responsibly and ethically.

AI regulations

Law 132/2025 of 23 September 2025 (Disposizioni e deleghe al Governo in materia di intelligenza artificiale)

Law No. 132/2025 represents the first comprehensive Italian legislation on AI and lays down general principles governing the research, testing, development and use of AIsystems and models in fields such as healthcare and scientific research, employment, liberal professions, public administration, copyright and justice. It also includes specific provisions concerning their possible application within the judicial system, including criminal justice.

EU AI Act (Regulation (EU) 2024/1689)

The EU AI Act is a key part of the legal framework regulating the use of AI across the EU. It entered into force on 1 August 2024, and sets out a comprehensive legal framework aiming to ‘guarantee safety, fundamental rights and human-centric AI’. The EU AI Act is being phased between 2025 and 2030. Italy is obliged to implement and comply with the provisions of the Act, which set out a harmonised legal framework for ‘the development, the placing on the market, the putting into service, and the use’ of AI systems across the EU.

The EU AI Act introduces a risk-based approach, categorising AI systems into four levels of risk, banning ‘unacceptable-risk’ systems, and imposing strict obligations on high-risk systems. The rules on prohibited uses have applied since 2 February 2025, the rules on general-purpose AI models and the designation of competent national authorities have applied since 2 August 2025 while obligations related to the use of high-risk AI systems, are being introduced later.

The EU AI Act includes explicit references to AI systems related to the administration of justice, and to criminal proceedings. These are mainly classified as high-risk given ‘their potentially significant impact on . . . the rule of law, individual freedoms . . . the right to an effective remedy and to a fair trial’ as well as the right to defence and the presumption of innocence, particularly if ‘such AI systems are not sufficiently transparent, explainable [or] documented’. The Act highlights the potential ‘difficulty in obtaining meaningful information on the functioning of those systems and the resulting difficulty in challenging their results in court, in particular by natural persons under investigation’.

Articles 51-56 of the EU AI Act establish a specific regime for ‘general-purpose AI models’, defined in article 3(63) as models trained on large datasets capable of performing a wide range of tasks. They typically include large language models (LLMs) that can be integrated into legal research platforms, drafting tools or judicial support systems. Providers of such models must:

• maintain technical documentation;
• provide information to downstream integrators;
• comply with EU copyright law; and
• publish a summary of training data.

Under articles 55-56, additional obligations apply to general-purpose AI models presenting systemic risk, including risk assessment, mitigation measures and incident reporting. The framework is particularly relevant to the judicial sector given that courts and prosecutors may rely on external LLM-based tools rather than developing their own systems.

In terms of governance and enforcement of the EU AI Act, the Act adopts a two-pronged approach. At the EU-level, according to Articles 64-69 of the AI Act, the AI Office of the European Commission and an AI Board (Article 65) are the main actors. The AI Office enjoys enforcement powers with respect to obligations of general-purpose AI models (Article 88 et seqq.). The AI Board assists the European Commission and the member States in facilitating coherent applications of the AI Act, and therefore contributes to the coordination among national authorities (Article 66(a)).

Several non-binding guidelines have already been published by the European Commission to provide further directions when implementing the AI Act:

• Guidelines on prohibited artificial intelligence (AI) practices (published on 04 February 2025) provide legal explanations and practical examples of AI practices that are deemed unacceptable and hence prohibited by Article 5 of the AI Act, due to their potential risks to European values and fundamental rights. The guidelines specifically address practices such as harmful manipulation, social scoring, and real-time remote biometric identification, among others.
• Guidelines on AI system definition (published on 06 February 2025) explain the practical application of the legal concept of AI to assist providers and other relevant persons in determining whether a software system constitutes an AI system. The guidelines elaborate on each of the seven elements of the definition of an AI system provided by Article 3(1) AI Act : (1) machine-based system, (2) autonomy, (3) adaptiveness, (4) AI system objectives, (5) inferencing how to generate outputs using AI techniques, (6) outputs that can influence physical or virtual environments, (7) interaction with the environment.
• Other guidelines are currently being developed by the European Commission. For instance, the Commission has issued Draft guidelines on the classification of high-risk AI systems, setting out the Commission’s interpretation of certain concepts that are relevant for classification purposes, and contain practical examples of AI systems that should or should not be classified as high-risk. High-risk uses of AI systems may include, for example, tools for the assessment of an individual’s risk of offending or reoffending, generating risk scores, profiling identified persons, or otherwise supporting operational law-enforcement decision-making. The Guidelines emphasise that classification depends on the system’s intended purpose and practical use, rather than solely on how it is labelled by the provider.

Other European Regulations and Guidelines

At the European level, the AI Act coexists with additional regulations and guidelines:

Guidelines for practitioners

As at June 2026, guidelines have been issued both by the National Bar Council and local Bar Associations. Italy has not formally adopted or engaged in binding implementation of the UNESCO Guidelines on the Use of AI in Courts and Tribunals.

Council of Bars and Law Societies of Europe, Guide on the Use of generative AI by Lawyers (2025)

The Council of Bars and Law Societies of Europe (‘CCBE’) is an international non-profit association whose primary purpose is to represent the bars and law societies of its member states on all matters of common interest relating to the practice of law, the rule of law, the proper administration of justice, and relevant legal developments at both European and international level. The CCBE also acts as the official representative body of bar associations and law societies.

With regard to Italy, the country actively participates in the CCBE through its dedicated Delegation, which operates under the direction of the Presidency of Italy’s National Bar Council (Consiglio Nazionale Forense). The Delegation appoints specialist experts who actively engage in the work of the various thematic committees and contribute to decisions adopted during Permanent Committee sessions and Plenary Meetings. Italy’s presence within the CCBE is further strengthened by the National Bar Council’s permanent representative in Brussels, who serves both as the Delegation’s Information Delegate to the CCBE and as the National Bar Council’s representative before the institutions of the European Union.

The CCBE issued a Guide on the Use of Generative AI by Lawyers in October 2025, and provides an overview of generative AI, its application in legal practice, and the related opportunities and risks.

The Guide identifies the following risks:

The Guide on the use of generative AI by lawyers also focuses on lawyers’ professional and ethical obligations and is intended to support lawyers, bar associations, and law firms in ensuring the responsible use of such technologies. It includes the following guidance:

The Guide also highlights that misuse of generative AI can lead to professional misconduct, malpractice, reputational harm, or conflicts of interest, thereby affecting the lawyer’s integrity, client loyalty, and the proper administration of justice.

The Council of Bars and Law Societies of Europe’s Guide has been translated and adopted by Italy’s National Bar Council (Consiglio Nazionale Forense), following an administrative decision on 24 October 2025. According to the Council’s interpretation, the Guide serves as a framework for the self-regulation of AI systems, with the stated aim of ‘raising awareness of what GenAI specifically entails, illustrating its current practical applications, and highlighting the opportunities and risks potentially associated with its use in the legal profession’. Italy’s National Bar Council is the highest institution in the Italian bar system. It is the sole representative of the legal profession at a national level and works closely with the Ministry of Justice and the judiciary. The Council also exercises disciplinary jurisdiction over lawyers, hearing appeals against local Bar Councils’ disciplinary decisions and adopting the Code of Conduct that governs the profession. As mentioned above, it also represents Italian lawyers within bodies such as the CCBE.

Bar Association Guidelines

Guidelines have been developed by local Bar Associations, such as those of Milan and Rome, aimed at regulating and framing the responsible use of AI systems within the legal profession.

Regional guidelines on judiciary’s use of AI

Moreover, there are several European-level guidelines that address the judiciary’s use of AI, most notably the European Ethical Charter on the use of AI in judicial systems and their environment adopted by the European Commission for the Efficiency of Justice (CEPEJ) of the Council of Europe (discussed above). These guidelines are not binding, and instead serve as useful standards for Italy.

Other non-binding initiatives have given rise to guidelines for justice system professionals and for lawyers, or may serve as useful benchmarks and standards to be upheld in professional practice:

Criminal procedure rules

Italian Code of Criminal Procedure (1988)

Article 189 of the Italian Code of Criminal Procedure governs so-called ‘atypical evidence’ providing that ‘[w]hen evidence that is not governed by law is requested, the judge may admit it if it is suitable for establishing the facts and does not infringe upon the individual's moral freedom. After hearing the parties on the manner in which it is to be taken, the judge shall admit the evidence’. Even though AI is not specifically targeted or mentioned, evidence generated through AI systems may still be admitted under Article 189, provided it is necessary and suitable to establish the alleged offence. In addition, digital material may be treated as documentary evidence under Article 234 of the Italian Code of Criminal Procedure.

Italian law does not yet contain AI-specific rules for authenticating deepfake evidence in criminal proceedings. In practice, authenticity, reliability and integrity may need to be assessed through ordinary evidential mechanisms, including expert technical examinations, forensic copies and chain-of-custody safeguards where appropriate.

General criminal law and procedural safeguards may also apply to manipulated or fabricated evidence. Article 374 of the Italian Criminal Code (frode processuale) punishes artificial alteration of places, things or persons in order to mislead a judge or expert, while Article 375 of the Criminal Code (depistaggio) addresses certain forms of misleading conduct by public officials or persons charged with a public service. Under Article 358 of the Code of Criminal Procedure, prosecutors must also investigate facts and circumstances favourable to the person under investigation, and Article 415-bis gives the suspect access to the investigation file before closure and the opportunity to request further investigative acts.

Law 132/2025 of 23 September 2025 (Disposizioni e deleghe al Governo in materia di intelligenza artificiale) (2025)

Law No. 132/2025 introduces new criminal offences involving the use of AI. In particular, it introduces the offence of the unlawful dissemination of AI-generated or AI- manipulated content (Article 612-quater of the Italian Criminal Code), which punishes the distribution of falsified images, videos, or audio that are capable of causing unjust harm and misleading people as to their authenticity (‘deepfakes’).

Law No. 132/2025 also introduces a new aggravating circumstance (Article 611-decies of the Italian Criminal Code), which provides for increased penalties where an AI system is used to facilitate the commission of a crime, hinder the defence of a crime or exacerbate its consequences. Notably, the provision acknowledges the increased danger posed by AI when used to multiply offences. Sentence enhancement depends on a case-by-case assessment of whether the AI system significantly facilitated the offence, obstructed the victim’s defence or exacerbated its effects.

Data protection legislation

The use of AI in criminal proceedings may further be constrained by existing data protection frameworks, in particular EU Regulations In addition to the EU AI Act, EU data protection regulations must be observed with regard to the use of AI in criminal proceedings. The EU AI Act does not seek to affect existing EU law governing the processing of personal data (according to Article 2 No. 7 AI Act and Recital 10). Data protection law governing the use of personal data may be relevant with regard to various stages of the AI lifecycle. Personal data can be relevant during AI development (e.g., collection and use of data for training) and AI use (e.g., personal data as input data).

On 25 January 2012, the European Commission presented the Data Protection Reform package, proposing a directive (LED) and a regulation (GDPR). On 27 April 2016, the European Parliament and the Council adopted:

• The Law Enforcement Directive (Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data) (‘LED’)
• The General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the European Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (‘GDPR’).

The GDPR remains the primary regulation for ‘general’ processing of data, but the LED is the lex specialis for criminal matters, since it governs processing ‘for the purposes of the prevention, investigation, detection, or prosecution of criminal offences or the execution of criminal penalties’. These regulations have distinct scopes of application that are intended to be complementary.

In both regulations, ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Article 3 (1) LED and Article 4 (1) GDPR). As at June 2026, this term also includes pseudonymised data as indicated by Article 4 (5) GDPR. Recital 26 sentence 2 GDPR points out that identifiability should (still) be recognised in view of pseudonymised personal data that could be assigned to a natural person based on additional information.

In Italy, the Italian Data Protection Code (Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018), which implements the General Data Protection Regulation at national level, and the Legislative Decree No. 51/2018 implements the Law Enforcement Directive.

EU Directive 2016/680, Law Enforcement Directive (LED) (2016)

The directive governs the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection, and prosecution of criminal offences or the execution of criminal penalties.

The rights of data subjects are recognised but may be limited in order to ensure the proper conduct of investigations, prevention, and the prosecution of offenses. These rights include the right to information, the right of access (often exercised indirectly through the supervisory authority), and the right to rectification or erasure. As such, the directive imposes obligations on data controllers that are comparable to those of the GDPR, but creates additional obligations that are specific to the criminal context:

1. There must be a clear distinction among categories of data subjects: those suspected of committing or planning a criminal offense, those who have been convicted, victims of crimes, and individuals who may be at risk of becoming victims. It also includes third parties connected to a crime, such as potential witnesses, people who can provide information, and contacts or associates of the individuals mentioned above, as set out in Article 6.
2. The processing of special categories of personal data is strictly regulated under Article 9(2) of the GDPR and requires the data subject's consent, which shall be freely given and well-informed, or for a legitimate purpose. But the LED establishes a specific exception for criminal matters: Article 10 permits the processing of sensitive data without consent when it is strictly necessary, provided that appropriate safeguards are implemented.
3. The LED also addresses automated individual decision-making. A decision ‘based solely on automated processing, including profiling, which produces an adverse legal effect concerning the data subject or significantly affects him or her’, is prohibited unless authorised by Union or Member State law to which the controller is subject and which provides appropriate safeguards for the data subject´s rights and freedoms of, at least the right to obtain human intervention on the part of the controller (Article 11 (1)). The EU legislator specifies that this right to intervention comprises the right to express his or her point of view, to obtain an explanation of the decision reached after such assessment or to challenge the decision (Recital 38). Furthermore, such decisions shall not be based on special category data, such as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union memberships, as well as genetic data, biometric data, data concerning health or a natural person’s sex life or sexual orientation, unless suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place (Article 11 (2)). The LED further prohibits profiling resulting in discrimination against natural persons on the basis of special category data (Article 11 (3)).
4. In order to protect individuals’ rights during criminal investigations, Articles 13 and 14 provide for information and access rights, while allowing limitations where their exercise could undermine ongoing investigations or prosecutions.
5. Article 16 complements these safeguards by providing the right to request the rectification of inaccurate data and the erasure of data, and in case of refusal, the possibility of lodging a complaint with a supervisory authority or seeking judicial remedy.
6. Finally, Articles 27 and 29 impose obligations relating to risk assessment and data security, requiring competent authorities to assess the impact of high-risk processing operations and to implement appropriate technical and organisational measures throughout the criminal procedure.

Regulation (EU) 2016/679, General Data Protection Regulation (GDPR)

The GDPR protects fundamental rights in the digital landscape by imposing obligations on data controllers and processors in relation to all processing of personal data. Hence, in the area of criminal justice, the GDPR is relevant for (i) the processing of personal data collected by competent authorities for the purposes set out above but intended to be further processed for other purposes, (ii) processing by public bodies for other purposes from the outset (this includes, e.g., archiving conducted by criminal justice authorities), and (iii) any processing by natural persons or private entities (Article 9 (1) and (2) LED, Article 2 (1) GDPR, Recital 19 to GDPR).

Obligations placed on data controllers include: lawful, fair and transparent processing; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability; transparency and information duties; security obligations; data protection impact assessments. The GDPR also grants basic rights to data subjects such as access, rectification and erasure of personal data.

Compared to the LED, the GDPR establishes a higher level of protection regarding the lawfulness of processing. Several aspects of criminal proceedings are subject to the following provisions of the GDPR:

1. Article 10 requires the processing of personal data relating to criminal convictions and offences to be carried out ‘only under the control of official authority’, and to provide for ‘appropriate safeguards for the rights and freedoms of data subjects.
2. Paragraph 1 of Article 22 prohibits any decision that produces legal or similar effects if it is based exclusively on automated data processing. This serves as a key safeguard against ‘algorithmic judges’ or fully automated sanctions.
3. Paragraph 1 of Article 35 provides that the controller must carry out a data protection impact assessment prior to any processing likely to pose a high risk to the rights and freedoms of individuals, particularly when new technologies are involved. A single assessment may cover multiple similar processing operations presenting comparable risks.

On 6 and 25 May 2018 respectively, the GDPR and the LED were implemented across all EU Member States.

EU AI Act (Regulation (EU) 2024/1689)

Acknowledging both existing data privacy regulations and the relevance of personal data in the AI context, the EU AI Act contains several provisions addressing the use of such data in the course of complying with broader obligations under the AI Act:

1. The EU AI Act provides a (narrow) legal basis for the processing of special category personal data in the context of training or testing a high-risk AI system. Where such processing is strictly necessary for the purpose of ensuring bias detection and correction in relation to a high-risk system, the providers of such systems may exceptionally process special category data, subject to appropriate safeguards for the fundamental rights and freedoms of natural persons. Exceptional circumstances exist where (in addition to the requirements for such processing set out in the LED or the GDPR) certain cumulative conditions are met, including where there are technical limitations and state-of-the-art security measures, including pseudonymisation, as well as strict security safeguards (cf. Article 10 No. 5 sentence 2 AI Act, (6)).
2. The data sets for training, validation, and testing of AI systems shall be subject to appropriate data governance and management practices that, in the case of personal data, shall also concern the original purpose of the data collection (Article 10 No. 2 (b) AI Act).
3. Where applicable, deployers of high-risk AI systems shall use the information provided for such systems under their transparency obligation (cf. Article 13 AI Act) for conducting a data protection impact assessment under the LED or the GDPR (Article 26 No. 9 AI Act).

Cybersecurity laws

EU AI Act (Regulation (EU) 2024/1689)

For high-risk AI systems, the EU AI Act requires resilience against attempts by unauthorised third parties to alter their use, outputs, or performance by exploiting system vulnerabilities (Article 15 (5)), which is confirmed by the underlying Recital 76, emphasising the crucial role of cybersecurity.

EU Cybersecurity Act (2019) and EU Cyber Resilience Act (2024)

As regards the demonstration of compliance with the AI Act’s cybersecurity requirements for high-risk AI systems, two other European regulations may be relevant:

EU NIS2 Directive (2016) and Implementing Legislation

At the domestic level, Italian cybersecurity law is primarily based on the implementation of the EU NIS2 Directive (Directive (EU) 2022/2555) (implemented via Legislative Decree No. 138/2024), which imposes strict risk management, incident notification, and security obligations on critical entities and public bodies, under the supervision of the National Cybersecurity Agency.

In particular, EU NIS2 Directive establishes a high common level of cybersecurity across the EU, requiring entities subject to the framework to implement comprehensive cybersecurity risk management measures, covering access control, supply chain security, physical security of network systems, and human resources security, while management bodies are personally accountable for approving and overseeing such measures. On incident reporting, the Directive introduces a tiered architecture requiring an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and further reports as the situation develops. At governance level, Member States must establish national cybersecurity strategies, designate competent authorities, and set up Computer Security Incident Response Teams.

Law No. 132/2025 (2025)

Law No. 132/2025 further strengthens this framework with specific regard to AI systems. Article 3(6) establishes cybersecurity as an essential precondition throughout the entire AI lifecycle, requiring a risk-based and proportionate approach, including technical safeguards to ensure resilience against manipulation. Moreover, Article 18 also expands the National Cybersecurity Agency’s role, empowering it to promote initiatives (also through public-private partnerships) to enhance national cybersecurity through AI.

Human rights

In Italy, the use of AI in criminal proceedings is constrained by a broad framework of constitutional and international human rights guarantees.

Moreover, the Council of Europe Framework Convention on AI and Human Rights, Democracy, and the Rule of Law deserves special mention as a multilateral initiative, being the first legally binding international treaty specifically designed to regulate AI. Opened for signature in September 2024, its primary objective is to ensure that as AI technologies evolve, they do not erode the fundamental pillars of modern society: human rights, democratic integrity, and the rule of law. As at June 2026, the Convention has not yet entered into force, as the minimum number of five ratifications has not been reached yet. Thus, the Convention currently has no binding effect in Italy. The Convention focuses on the lifecycle of AI systems, from design to decommissioning, and mandates adherence to seven fundamental principles: human dignity, transparency, accountability, equality, privacy, reliability, and safe innovation. It requires signatories to establish independent oversight bodies and provide clear legal remedies for individuals who suffer harm due to AI systems.

Outlook

A large number of projects have recently been initiated in the domain of AI, the most significant being Law No. 132/2025. As at June 2026, implementation has begun but remained incomplete: on 10 June 2026 the Council of Ministers approved two drafts implementing decrees in preliminary form, including provisions on national authorities, training, police use of AI, biometric identification and liability. These drafts are expected to undergo further review before final adoption.

Numerous criticisms have been levelled at the approach adopted in Law No. 132/2025, prompting calls for reforms. The ‘Science, Trials and Artificial Intelligence’ Observatory of the Union of Italian Criminal Chambers, for example, has issued a position paper highlighting the risks that AI may introduce into the criminal justice system, namely algorithmic opacity, unverifiable outcomes, and merely formal safeguards. Such dynamics, it warns, could undermine the role of judges and hinder effective defence oversight. The paper therefore advocates for much stricter and more precautionary regulations, particularly during preliminary investigations.

Further legislative developments are expected in the medium term as Italy continues to refine its AI governance framework in line with the 2024-2026 Artificial Intelligence Strategy. The strategy seeks to foster both the development and responsible use of AI across all sectors, with a focus on promoting country-specific AI solutions to safeguard national competitiveness, strengthening research and international cooperation, supporting AI-driven economic and social innovation, and investing in skills, education and digital transformation of public administration. Regarding the legal sector, the 2024-2026 Artificial Intelligence Strategy envisages supporting administrative processes with AI technologies to increase efficiency and optimise the management of public resources, financing selected national-scale pilot projects, and promoting initiatives developed by individual administrations.

European Commission’s Proposed Digital Omnibus Regulation (2025)

In November 2025, the European Commission published its Digital Omnibus Regulation Proposal, a reform package to simplify and streamline existing EU regulations concerning the digital space, including the GDPR and EU AI Act. Respective amendments to the LED are to follow.

Notably, the European Commission intends to amend the definition of the term ‘personal data’ in Article 4 (1) GDPR by stating that information is ‘not to be considered personal data for a given entity when it does not have means reasonably likely to be used to identify the natural person to whom the information relates.’ Accordingly, such an entity would not fall within the scope of the GDPR regarding the processing of such data. This approach is generally in line with recent CJEU case law establishing that existing additional information enabling an entity to identify the data subject does not as such mean that pseudonymised data are to be considered personal data in all cases and for every person. In other words, personal data can be pseudonymised for one entity and anonymised (and thus not identifiable) for another (CJEU, 4 September 2025, EDPS v SRB, C‑413/23 P). Such an amendment wording would, if implemented, significantly reshape the legal test to be conducted to assess applicability of the GDPR (i.e., the assessment of the existence of personal data) towards an entity-focussed approach and largely exclude pseudonymised data from the scope of the GDPR.

The European Commission, through its Digital Omnibus Regulation, also intends to clarify that the processing of personal data in the context of AI development may be carried out for purposes of a legitimate interest where appropriate (Article 6 (1) (f) GDPR). Such an amendment would address an issue that has been widely adopted since the emergence of LLMs, and which has also been subject to a dedicated Opinion of the European Data Protection Board (Opinion 28/2024).

CASES

Italian courts have also begun to address the use of AI in judicial proceedings, predominantly in civil matters.

Misuse of AI 

In a decision issued on March 2025 concerning the seizure of allegedly counterfeit goods, the Tribunal of Florence, Specialised Section on Business Matters, considered whether liability under Article 96 of the Code of Civil Procedure (which regulates lawyers’ aggravated liability) should arise after a defence brief cited non-existent Supreme Court precedents generated through ChatGPT. The court acknowledged the phenomenon of AI hallucinations whereby artificial intelligence systems may fabricate plausible but unfounded legal references, expressly stating that: ‘[. . .] The AI had therefore generated incorrect results that can be described as the phenomenon of so-called artificial intelligence hallucinations, which occurs when AI invents non-existent results but which, even after a second query, are confirmed as true’. It nevertheless excluded the application of Article 96, finding no evidence of bad faith or abusive intent, as the incorrect citations supported a defence strategy already advanced from the outset and were not aimed at misleading the court.

However, in ruling No. 1034/2025, issued on 23 September 2025, the Tribunal of Latina dismissed a claim seeking a negative declaration of a social security debt and addressed the manner in which the proceedings had been conducted. The court noted the duplication of actions concerning the same claim and the filing of defensive briefs that were largely composed of abstract and irrelevant legal citations. It expressly observed that the pleadings appeared to have been drafted using AI tools and described them as standardised and lacking logical coherence.

In particular, the Tribunal of Latina stated that:

‘[. . .] The judicial appeal – like all the other hundreds of cases defended by the same lawyer, all drafted using a template – was clearly drafted using artificial intelligence tools; this is evident not only from the management of the proceedings (filing of notes pursuant to Article 127 ter of the Italian Code of Civil Procedure the day after the filing of the decree setting the hearing date) but above all from the poor quality of the defence briefs and the total lack of relevance or significance of the arguments used; the document is in fact composed of a jumble of abstract regulatory and jurisprudential citations, lacking in logical order and largely irrelevant to the thema decidendum and, in any case, all manifestly unfounded’.

The Tribunal therefore held that the action had been introduced with bad faith or gross negligence and applied Article 96 of the Code of Civil Procedure, emphasising that the use of AI does not relieve counsel of the professional duty to verify the relevance and accuracy of legal arguments submitted to the court.