Diritto intelligente – Issue N. 20

If one message runs through this issue of Diritto Intelligente, it is that AI regulation is no longer primarily about understanding what the rules will eventually say. It is about being able to demonstrate, today, who made the decision, on what basis, with what safeguards, and what evidence exists to prove it.

The shift is visible across the entire AI lifecycle. The EDPB’s new web scraping guidelines reach back to the data used to train and fine-tune models, requiring organisations to confront questions of legal basis, transparency, minimisation, source selection and even the technical measures used to prevent problematic data from entering the dataset. At the other end of the lifecycle, the AI Act transparency rules now require businesses to explain when users are interacting with AI and to label certain AI-generated content. The common denominator is not the technology. It is accountability.

The enforcement picture makes this even more concrete. The first AI Act information requests are no longer hypothetical regulatory exercises. A company’s response can itself become part of the case, which means that the first letter from an authority is not simply a request for information but the beginning of a defence. The Italian framework then takes the issue further, with the introduction of criminal liability for failures concerning the safety and human oversight of high-risk AI systems, together with corporate exposure under Legislative Decree 231/2001. The question for management is therefore changing from “What happens if we are fined?” to “Can we demonstrate why we approved this system in the first place?”

The same principle appears in the Garante’s action concerning Character.AI and in the warning on workplace emotion inference. In both cases, compliance cannot be retrofitted after the technology has been deployed. Age safeguards, DPIAs, transparency, intended purpose and technical limitations have to be considered when the system is designed and before it reaches users. Good intentions do not replace governance, and a compliance policy that cannot be demonstrated in practice is unlikely to provide much protection when the regulator arrives.

There is, however, another dimension to this issue. Europe is not only regulating how AI is developed and used. It is increasingly trying to shape the market in which that AI develops. The Commission’s intervention on Google’s Android ecosystem and the proposed Cloud and AI Development Act show a European strategy that combines competition, interoperability, industrial policy, cloud sovereignty and public procurement. The difficult question is whether Europe can build an AI ecosystem that is both trusted and competitive, without regulation itself becoming an obstacle to scale.

This is why the AI compliance file is becoming much more than a legal document. It is becoming part of corporate governance, procurement, product development and, increasingly, the defence strategy of the company.

AI regulation is becoming operational. Accountability is becoming personal. And the organisations that will navigate this transition best will be those that can prove what they did before anyone asked them to.