Italy approves the implementation of new liability rules for defective software and AI

On 28 October 2026, the Italian Council of Ministers approved the draft legislative decree implementing Directive (EU) 2024/2853 on liability for defective products (the “Product Liability Directive”). The Product Liability Directive introduces new liability rules for defective software and AI, related digital services and updates, and applies to products placed on the market or put into service after 9 December 2026. Its central change is that software is expressly treated as a product, including AI systems and software supplied through cloud infrastructure or a software-as-a-service model. Digital services integrated into or interconnected with a product qualify as related services where their absence would prevent the product from performing one or more functions; not every digital service is therefore covered. Free and open-source software developed or supplied outside a commercial activity is excluded, but an open-source license does not exempt a business that commercially integrates it into a product. Defectiveness depends on the safety a person is entitled to expect or that applicable rules require, taking account of foreseeable use, relevant cybersecurity requirements and a product’s ability to continue learning or acquire new features. Manufacturers may remain liable for defects arising after release: they cannot necessarily avoid liability by arguing that the product was safe when first marketed if the defect later results from software or related services under their control, or from their failure to provide safety updates within that control. However, this does not mean that the directive itself creates a general obligation to supply updates. Liability may involve both the manufacturer of the defective product and the manufacturer of a component that made it defective under the prescribed conditions. Where the manufacturer is established outside the EU, importers and authorized representatives may also be liable. If none of them is established in the Union, liability may instead extend to fulfilment service providers, which handle the logistics of fulfilling product orders. Distributors and qualifying online platforms may be liable under further conditions, including failure to identify the relevant operator or their own supplier within one month of a request. Anyone who makes substantial changes to a product beyond the control of the original manufacturer and subsequently makes it available on the market or puts it into service may also be considered its manufacturer. No proof of fault is required, but claimants must generally establish defectiveness, recoverable damage and causation. Courts may order necessary, proportionate disclosure of relevant evidence, subject to confidentiality safeguards. Rebuttable presumptions address specified situations, including failure to disclose evidence, breach of relevant mandatory safety requirements and obvious malfunction. Technical or scientific complexity may make it excessively difficult for a claimant to prove defectiveness or causation, even after relevant evidence has been disclosed. In those circumstances, the court may presume defectiveness or causation, or both, provided the claimant also shows that they are likely: complexity alone is not enough to trigger these presumptions. Recoverable damage includes death or personal injury, including medically recognized psychological harm, qualifying property damage, and destruction or corruption of data not used for professional purposes. The defective product itself is excluded, as damage to the product into which a defective component was integrated or interconnected by its manufacturer or under its control. This regime does not cover damage to property used exclusively for professional purposes, or the destruction or corruption of data used for professional purposes. Such losses may nevertheless be recoverable under other applicable rules. Compensation may also include non-material losses resulting from damage covered by the Product Liability Directive, but only to the extent that national law allows compensation for those losses. Pure economic loss or disclosure of information alone does not independently trigger this regime, although other contractual, civil or data-protection remedies may apply.

Platform work reform puts algorithmic management under human scrutiny

At its meeting on 28 October 2026, the Italian Council of Ministers approved the draft legislative decree implementing Directive (EU) 2024/2831 on improving working conditions in platform work (the “Platform Work Directive”). The European transposition deadline is 2 December 2026. The EU framework addresses both employment classification and algorithmic management, including systems allocating tasks, influencing remuneration, ranking performance or determining access to work. Working through an app does not automatically make a person an employee: where facts indicate that the platform directs and controls the work under the applicable national framework, an employment relationship must be presumed. Where the platform seeks to rebut the legal presumption, it shall be for the platform to prove that the contractual relationship in question is not an employment relationship as defined by the law. Separately, the safeguards concerning automated management and personal data also protect people performing platform work without an employment relationship. A human, not an automated system, must decide whether to restrict, suspend or terminate a person’s platform work account – through which the person accesses work on the platform – or contractual relationship, or take an equivalent detrimental decision. Automated systems may support the assessment, but the decision must be taken by a human; applicable national disciplinary and dismissal procedures remain relevant.

The directive requires transparency of information about automated monitoring and decision-making, including relevant data categories, main parameters and their relative importance. It also restricts specified data practices, including automated processing of emotional or psychological data and private conversations, and collection while a person is neither offering nor performing platform work. Human oversight must be effective: those responsible need sufficient competence, training and authority, including the ability to override automated decisions. People performing platform work are entitled to explanations of relevant decisions and to a reasoned response within two weeks when they request a review. These rights do not apply to people performing platform work who qualify as business users under the Article 2(1) of the Platform-to-Business Regulation (Regulation (EU) 2019/1150) – meaning any private individual acting in a commercial or professional capacity who, or any legal person which, through online intermediation services offers goods or services to consumers for purposes relating to its trade, business, craft or profession. Article 9(6) specifically grants people performing platform work, including the self-employed, the right to portability of their personal data generated through that work in automated monitoring or decision-making systems, expressly including ratings and reviews. This worker-specific right supplements the general portability right under Article 20 of Regulation (EU) 2016/679 (the “GDPR”); it does not create a separate portability right for customers receiving the service. Platforms must provide free tools facilitating both rights and, on the person’s request, transmit the data directly to a third party. Ratings and reviews may contain personal data relating to customers as well as to the person performing platform work. The worker’s portability right does not override those customers’ GDPR rights, which must also be respected when the data is transferred. These are not merely changes to contract wording: they require coherent data flows, accessible review processes and staff who can understand and correct outcomes. The scope nevertheless remains specific to digital labour platforms organizing paid work and using automated monitoring or decision-making, not every internal HR application. Businesses purchasing deliveries, logistics or professional services through platforms should review the data they exchange and the responsibilities allocated to providers, without assuming that they automatically bear all platform obligations. In practice, legal, HR, privacy and technology teams should map the systems involved, review data collection and retention, and ensure that contractual arrangements support meaningful explanations, human intervention and reliable records.