Innovation Law Insights

Legal Break

Italy’s new private copy copyright levy explained: What it means for businesses and users

Is Italy applying an outdated copyright mechanism to modern cloud services? In this episode, Roberto Valenti (DLA Piper partner) explains the Italian Ministry of Culture’s decision to extend the private copy copyright levy to cloud storage. Watch the video here.

 

Artificial Intelligence 

Draft Code of Practice on Marking and Labelling of AI generated content

On 3 March 2026, the second draft of the Code of Practice on Marking and Labelling of AI-generated content was published. It was developed under the coordination of the European AI Office through two working groups dedicated, respectively, to the obligations for providers and deployers set forth in Article 50 of the AI Act.

Article 50 of the AI Act introduces targeted transparency obligations for systems that generate or manipulate audio, visual, audiovisual, or textual content. These obligations span the entire value chain: on the one hand, providers have to ensure that content is technically marked and detectable as artificial; on the other hand, deployers are responsible for disclosure to the public in cases of deepfakes and text generated to inform on matters of public interest.

Codes of Practice play an essential role here: they don't replace the primary regulation but facilitate its application by offering a shared framework for demonstrating compliance with the Regulation’s obligations. Adherence to these codes, while not constituting an absolute presumption of compliance, is a significant factor in dialogue with supervisory authorities and in establishing credible accountability measures.

Purpose and structure of the Code of Practice

The Code of Practice clearly distinguishes between the responsibilities of providers and deployers.

Forproviders of generative AI systems, the focus is on:

• machine-readable marking of content, using imperceptible watermarks, metadata, and, where necessary, fingerprinting or logging mechanisms;
• detection, through interfaces or detectors accessible to third parties, capable of verifying the artificial origin of the content;
• traceability of the provenance chain, ie the sequence of human and artificial interventions on the content.

Fordeployers, the main focus is on labelling content to ensure transparency for the public, through:

• application of an icon or disclaimer to flag deepfakes and AI-generated texts of public interest; and
• specific attention to particular contexts, such as artistic, satirical, or fictional works, where transparency must be guaranteed without compromising the enjoyment of the work.

Compared to the first draft, the structured taxonomy distinguishing fully AI-generated content from AI-assisted content has been removed, in favour of a more flexible approach.

If content generated or manipulated using AI undergoes editorial review before publication, the requirement to explicitly disclose its artificial origin may not apply. To qualify for this exception, the organisation publishing the content must demonstrate that it has editorial review procedures in place and clearly identify the party assuming editorial responsibility for the publication, ensuring accountability and traceability.

Deadlines and operational implications

The Code of Practice isn't binding, but adhering to its provisions can serve as an important tool for demonstrating compliance, facilitating relations with supervisory authorities, and reducing interpretive uncertainty.

The public consultation on the second draft closed on 30 March 2026, leaving the relevant committees and the AI Office the coming weeks to work on the final version of the Code of Practice. The final version is expected to be published in early June, just in time to prepare for the effective date of Article 50, which – unless postponed with the approval of the Digital Omnibus on AI – is currently set for 2 August 2026.

While waiting for clearer guidance with the publication of the final version of the Code of Practice, companies must prioritise a comprehensive mapping of the use of generative AI systems in their workflows, identifying which content is intended for the public and which is subject to editorial control. At the same time, it’s essential to draft or update internal AI policies, establishing clear protocols for preventive labelling and the documentation of human review processes, so as to ensure a smooth transition toward full compliance with European transparency standards.

Author: Marianna Riedo

 

DMA and AI: European Parliament pushes the Commission for stricter enforcement

On 19 March 2026, the European Parliament’s Committee on the Internal Market and Consumer Protection (IMCO) approved a draft resolution on the implementation of the Digital Markets Act (DMA). The document, which is expected to be put to a vote in plenary at the end of April, aims to urge the European Commission to ensure a rigorous enforcement of the obligations set out in the DMA, to promptly conclude the ongoing non-compliance proceedings, and to guarantee a consistent and forward-looking application of the regulation, also in light of rapid technological developments, particularly in AI-based services and cloud infrastructures.

This initiative comes in a context where the European Commission is already examining, from an antitrust perspective, certain practices in the AI sector carried out by Big Tech companies. The IMCO Committee intends to call on the European Commission to make full use of all the tools at its disposal, starting with the DMA. Although the regulation is still in an early phase of application, with the related challenges of ensuring timely and effective enforcement, it was specifically designed to guarantee contestability and fairness in digital markets. These objectives are now particularly critical in the AI sector, which is increasingly characterised by the dominant presence of established large technology platforms.

A lack of timely and decisive intervention, IMCO warns, could facilitate the emergence of new forms of lock-in, foreclosure practices, or gatekeeping dynamics, especially where gatekeepers leverage their control over data, computational resources, or integrated services to the detriment of emerging AI developers and new innovative entrants.

The IMCO is devoting particular attention, and concern, to the now well-established practice of integrating AI-based search tools and assistants into core platform services operated by large technology companies, such as Apple’s Siri or Microsoft’s Copilot. These tools are progressively becoming key gateways to information, commerce, and digital services, with the risk of undermining contestability and fairness in these market segments, also in light of the advantage these operators enjoy in developing, training and deploying AI systems.

Pending the possible adoption of the resolution by the Parliament, we can already observe that the positions outlined above reflect a rather widespread perception regarding the limited effectiveness of DMA enforcement, as well as the implications arising from the positioning of large technology companies at the forefront of the AI sector.

However, the other side of the coin should not be overlooked. In applying a relatively recent instrument such as the DMA, in a rapidly expanding and evolving sector like AI, the European Commission risks negatively affecting market development by intervening prematurely in competitive dynamics. The balancing of interests that the institution is called upon to perform is particularly complex, also in light of pressures coming from overseas, aimed at promoting a less stringent approach towards US companies, especially in the current sensitive geopolitical context.

While it’s true that contestability and fairness in digital markets can contribute to a healthier development of these markets, primarily for the benefit of consumers, it’s equally true that public intervention should be carefully calibrated and limited to what’s strictly necessary so as not to unduly interfere with innovation processes.

Author: Josaphat Manzoni

 

Data Protection and Cybersecurity

Legitimate interest under GDPR: Why it still fails in practice (and what the Garante is telling us)

Legitimate interest under the GDPR continues to be one of the most used, and most misunderstood, legal bases. But what are the most relevant issues to be addressed, and how can it be used properly?

The recent digest published by the European Data Protection Board offers a very clear message: the issue isn’t whether legitimate interest can be used, but how it’s applied in practice. And if you look at recent enforcement trends, including decisions of the Italian data protection authority, Garante per la protezione dei dati personali, the direction is consistent.

What legitimate interest under the GDPR really requires

Under Article 6(1)(f) GDPR, legitimate interest relies on a three-step test:

• a legitimate interest must exist
• the processing must be necessary
• the interest must not be overridden by the rights of individuals

This looks simple in theory. In practice, it’s one of the most complex legal bases to operationalise.

The EDPB digest, which analyses more than 60 One-Stop-Shop decisions, confirms that legitimate interest can cover a wide range of scenarios, from fraud prevention to marketing and even AI development. But that flexibility comes at a cost: a much higher burden of justification.

Why legitimate interest under the GDPR keeps failing

No real Legitimate Interest Assessment (LIA)

The first recurring issue is procedural. Many companies simply don’t carry out a proper LIA before starting the processing. And this is where things break. Supervisory data protection authorities are very clear: the assessment must be done ex ante, not reconstructed after the fact.

Interests described in generic terms

Another pattern I see very often in practice, and that the digest confirms, is the use of vague purposes, for example; “improving services,” “measuring performance” or “enhancing user experience.”

These formulations don’t work. Regulators expect the legitimate interest to be clearly and precisely articulated, otherwise the entire test collapses.

The necessity test is underestimated

Even when the interest is accepted, controllers often fail to show that the processing is necessary. Authorities are increasingly asking a very simple question: could you achieve the same result in a less intrusive way? In some cases, the answer is yes – and that’s enough to invalidate the legal basis.

The balancing test is where most cases are lost

This is the real battleground. The analysis isn’t theoretical. It’s based on how the processing is perceived by the individual.

Key factors include reasonable expectations, level of transparency and actual impact on the data subject. If the processing is unexpected, opaque or too intrusive, legitimate interest won’t hold.

The Garante’s position on legitimate interest

What’s particularly interesting is how closely recent decisions of the Italian data protection authority align with this approach. In several cases, the Garante has challenged the insufficient level of detail of LIAs, the use of boilerplate or generic assessments and the lack of a real, documented balancing test.

The key message is quite pragmatic: a formal LIA isn’t enough. It must be specific, reasoned and evidence-based.

In other words, simply stating that a legitimate interest exists isn’t sufficient. You need to demonstrate what the interest actually is, why the processing is necessary, how the impact on individuals has been assessed and which safeguards have been implemented.

This is where many organisations are still exposed.

Can you switch to legitimate interest later?

Another point clarified by the EDPB digest is particularly relevant in practice. Trying to rely on legitimate interest after another legal basis has failed is, in most cases, not acceptable. Why? Because it undermines transparency obligations and the right of individuals to object.

There are limited exceptions, but they are just exceptions. Besides, the Garante’s position is that it’s not possible to list multiple legal bases for the same data processing without specifying in detail when each legal basis applies.

Legitimate interest and AI: A growing risk area

This topic becomes even more relevant when we look at AI systems. Legitimate interest is often used in AI-related processing because of its flexibility. But that flexibility can be misleading. AI projects typically involve evolving purposes, large-scale data reuse and difficulty in assessing impact upfront. These are elements that make the necessity and balancing tests more complex. From what I see, this is exactly where the gap between legal theory and operational reality is still too wide.

Legitimate interest is a governance issue

The takeaway is quite clear. Legitimate interest under the GDPR isn’t the easy option. It’s one of the most demanding legal bases from a governance perspective. The shift we’re seeing, both at EDPB level and in Garante decisions, is towards a much more substantive assessment. This means moving beyond templates, integrating LIA into internal processes and aligning legal analysis with technical design.

Because today, the real risk isn’t choosing the wrong legal basis. It’s assuming that legitimate interest requires less work than the others.

Author: Giulio Coraggio

 

Blockchain and Cryptocurrency

Sanctions and (digital) payment services: Closing the backdoors to Russia

With Regulation (EU) 2025/2033, adopted as part of the nineteenth sanctions package, the EU has broadened the restrictive framework under Article 5b(2) of Regulation (EU) No 833/2014 by extending it beyond crypto-asset services to a defined set of payment and electronic money services.

As the European Commission clarified in its Frequently Asked Questions (FAQ) updated on 13 March 2026, the amended provision prohibits the provision of those services to three specific categories of recipients: Russian nationals, natural persons residing in Russia and legal persons, entities or bodies established in Russia.

The significance of the new framework lies precisely in its architecture. It doesn’t impose a general ban on payment activity involving Russian-related persons, but constructs a targeted prohibition built around specific regulated services identified by reference to existing EU financial legislation, in particular Directive (EU) 2015/2366 (PSD2) and Directive 2009/110/EC (EMD2).

The interpretative exercise is highly operational: for providers, compliance no longer turns on a generic assessment of exposure to sanctions risk, but on the precise legal classification of the service offered, the status of the client, and the functional role played by the provider in the relevant transaction chain.

Objective scope of the prohibited services

Article 5b(2) establishes a closed and exhaustively defined list of prohibited services, structured around three distinct categories.

• First, point (a) covers crypto-asset services, without further internal differentiation within this provision, but clearly intended to capture the range of activities already addressed under the EU crypto regulatory framework.
• Second, point (b) targets specific payment services, which must be interpreted strictly in accordance with Article 4 PSD2. In particular, the prohibition applies to:

• the issuing of payment instruments within the meaning of Article 4(45), namely the provision of instruments enabling a payer to initiate and process payment transactions;
• the acquiring of payment transactions under Article 4(44), consisting in the acceptance and processing of payment transactions on behalf of a payee resulting in the transfer of funds;
• and the provision of payment initiation services under Article 4(15), defined as services initiating a payment order at the request of the user with respect to an account held with another provider.

• Third, point (c) extends the prohibition to the issuing of electronic money, as defined in Article 2 EMD2, including electronically stored monetary value issued against funds and accepted by third parties for payment purposes.

The Commission further clarifies (FAQ 10) that the prohibition under point (b) doesn’t extend to all payment services listed in Annex I to PSD2, but only to those corresponding to points 5 and 7 of that Annex. As a result, other payment services, such as the execution of credit transfers or cash withdrawals, remain outside the scope of Article 5b(2).

This clarification is critical in practice, as it confirms that the measure isn’t designed to restrict the movement of funds as such, but rather to prevent access to specific payment infrastructures and intermediation services that enable the broader functioning of payment systems.

Subjective scope and exemptions

The personal scope of Article 5b(2) is defined through a set of objective and formally identifiable criteria. As clarified in FAQ 1, the prohibition applies exclusively to three categories of subjects:

• Russian nationals
• natural persons residing in Russia
• and legal persons, entities or bodies established in Russia

This delimitation is particularly relevant, as it excludes any automatic extension of the prohibition based on ownership or control structures. In fact, the Commission expressly states in FAQ 3 that entities incorporated in the EU or in third countries are outside the scope of the restriction even where they’re owned or controlled by Russian persons, unless the structures are used to circumvent the sanctions regime. This qualification must be read in conjunction with Article 12 of Regulation (EU) No 833/2014, which prohibits the knowing and intentional participation in arrangements aimed at bypassing the restrictive measures. As a result, while corporate ownership is not in itself determinative, it becomes relevant where it’s instrumental to indirect access to prohibited services.

Alongside this targeted scope, Article 5b(3) introduces explicit exemptions based on nationality and residence. In particular, the prohibition does not apply to:

• nationals of EU member states
• EEA countries or Switzerland
• nor to natural persons holding a temporary or permanent residence permit in those jurisdictions

Moreover, the Commission further clarifies in FAQ 2 that, depending on national law, this exemption may extend to holders of long-stay visas (such as Type D visas) who have completed the relevant registration formalities and are therefore considered legally resident.

This latter element introduces a dynamic dimension to compliance, as the applicability of the prohibition may change over time in light of the evolution of the individual’s residence status. Providers therefore have to monitor not only the initial qualification of the client, but also any subsequent change, such as the loss of EU residence, that may bring the client within the scope of Article 5b(2).

Operational implications and compliance model

From an operational perspective, in FAQ 5 the Commission adopts a strictly functional and service-based compliance model.

Article 5b(2) doesn’t require payment service providers (PSPs) to terminate existing contractual relationships or to close accounts held by in-scope clients. PSPs can continue to maintain these relationships and provide non-prohibited services. However, the prohibition applies equally to new and existing customers, with the consequence that providers must immediately cease providing any service falling within the prohibited categories as soon as a client is, or becomes, in scope. This includes situations in which a client enters the scope at a later stage, for example where a Russian national ceases to be legally resident in the EU. In such cases, the obligation to discontinue the prohibited services arises as soon as the provider becomes aware of the change in status.

The allocation of compliance responsibilities in the payment chain is clarified by reference to the functional role of each actor.

• According to recital 19 of Regulation (EU) 2025/2033 and as confirmed in FAQ 6, primary responsibility for sanctions compliance in relation to payment transactions lies with the account-servicing payment service provider (ASPSP).
• By contrast, payment initiation service providers (PISPs) and acquirers aren’t required to perform full screening of individual transactions at the moment of execution; their obligation is limited to ensuring that they don’t provide prohibited services within the meaning of Article 5b(2). This distinction is particularly relevant in open banking environments, where multiple actors intervene in the same transaction chain.

The Commission also introduces a clear distinction between the issuing of payment instruments and their subsequent use.

While Article 5b(2)(b) prohibits the issuing, renewal or replacement of payment instruments in favour of in-scope persons, it doesn’t prohibit the continued use of instruments already in circulation; as recalled in FAQ 7. However, this distinction doesn’t neutralize the effect of the prohibition at the level of the underlying services. Where the execution of a transaction through an existing instrument requires a service that is itself prohibited – such as acquiring payment transactions – the transaction must be blocked. In this context, the regulatory focus shifts from the instrument to the service enabling the transaction. This is particularly evident in digital environments, including e-wallets and tokenized payment solutions, where transactions typically rely on acquiring services.

This logic extends to specific use cases involving card issuance. The prohibition applies to any payment instrument issued in the name of a natural person falling within scope, irrespective of the structure of the underlying contractual relationship. As clarified in FAQ 11, this includes additional cards issued to family members or employees: even where the primary account holder is an EU-based individual or company, the issuance (including renewal or replacement) of a card in the name of a Russian national or a person residing in Russia is prohibited.

The same principle applies to commercial cards (FAQ 12), defined as card-based instruments issued to undertakings or public sector entities for business expenses. Even in these cases, the relevant criterion is the personalization of the instrument: if the card is issued to, or personalized for, a natural person within scope, its issuance is prohibited, regardless of the identity or location of the contracting entity. By contrast, the continued use of already issued instruments for non-prohibited services remains permitted, subject to the same limitations regarding the underlying services.

Finally, the Commission provides important clarification on the qualification of payment initiation services in digital environments. In particular, the “bank-link” model – where the user is redirected to their own bank’s interface to initiate a payment – isn’t considered a payment initiation service within the meaning of Article 4(15) PSD2, provided that no third-party provider intervenes and the user initiates the payment directly with their bank (FAQ 13). Conversely, where a third-party PSP initiates the payment on behalf of the user, for example through open banking APIs, the service qualifies as a payment initiation service and is prohibited when provided to in-scope persons. This distinction is critical in practice, as it determines whether a given technological solution falls within or outside the scope of Article 5b(2).

Crypto-assets and circumvention risks

Within the architecture of Article 5b(2), crypto-asset services, formally captured under point (a), must be interpreted in light of the broader anti-circumvention framework established by Regulation (EU) No 833/2014.

In particular, FAQ 4 clarifies that the notion of prohibited provision cannot be limited to direct relationships, but extends to cases of indirect provision, which must be assessed in conjunction with Article 12 of the Regulation. Under that provision, any knowing and intentional participation in arrangements aimed at circumventing the prohibitions is itself prohibited. This interpretative lens is especially significant in the crypto-asset context, where transaction structures are frequently mediated through intermediaries, third-country entities or decentralized infrastructures that may obscure both the identity of the counterparties and the functional nature of the service provided.

In practical terms, this means that crypto-asset services may fall within the scope of Article 5b(2) not only where they’re directly provided to in-scope persons, but also where they’re used as part of a broader arrangement enabling access to restricted payment functionalities. This is particularly relevant in hybrid or tokenized environments, where crypto infrastructures intersect with regulated payment services.

For example, where a transaction involving crypto-assets relies, at any stage, on a prohibited payment service – such as acquiring within the meaning of Article 4(44) PSD2 – the prohibition attaches to the service enabling the transaction rather than to the technological form of the asset. The same logic applies where crypto-asset services are channelled through intermediaries established outside the EU to provide de facto access to restricted services.

The Commission’s approach reflects a clear regulatory choice. Crypto-assets aren’t treated as an autonomous category requiring separate sanctions logic, but as functionally equivalent channels of value transfer subject to the same constraints applicable to traditional payment infrastructures. The decisive element isn’t the qualification of the asset but, once again, the role played by the service in the transaction chain.

In this sense, Article 5b(2), read together with Article 12, shifts the focus from formal classification to economic substance. This raises a broader question for the future of sanctions enforcement: whether a framework built on identifiable service providers and clearly delineated payment functions can remain effective in increasingly decentralized environments, where both intermediation and control may be structurally fragmented.

Author: Andrea Pantaleo and Giulio Napolitano

 

Technology Media and Telecommunications

Infratel publishes report on the progress of the National Ultra-Broadband Plan as of 28 February 2026

In a press release dated 17 March 2026, Infratel announced the publication of its report on the progress of the National Ultra-Broadband Plan, updated to 28 February 2026.

The National Strategy for Ultra-Broadband – “Towards the Gigabit Society,” included in the National Recovery and Resilience Plan (Piano Nazionale di Ripresa e Resilienza – PNRR) and approved on 25 May 2021, by the Interministerial Committee for Digital Transition (Comitato interministeriale per la Transizione Digitale – CiTD), aims to bring 1 Gbp/s connectivity across Italy by 2026 and foster the development of fixed and mobile telecommunications infrastructure.

The strategy encompasses several public intervention plans to promote and incentivize the coverage of geographical areas where the provision of infrastructure and ultra-high-speed digital services by the operators is either absent or insufficient.

The operational activities of the National Ultra-Broadband Plan were initiated in 2016 by Infratel Italia S.p.A. Infratel’s aim is to intervene in market failure areas by building and integrating broadband and ultra-broadband infrastructure to extend access opportunities to high-speed internet for citizens, businesses and public administrations.

Through Infratel, the Ministry of Enterprises and Made In Italy implements measures defined in the National Ultra-Broadband Strategy to reduce infrastructure and market disparities across Italy, creating favourable conditions for the integrated development of electronic communications infrastructure.

The report describes the plan’s progress, focusing on the five main operational phases: final design (progettazione definitiva), executive design (progettazione esecutiva), works' execution, testing, and start of service.

During the final design phase, the layouts of the networks to be built are identified, along with the infrastructure to be reused, the authorities responsible for granting authorisations for FTTH (Fiber To The Home) technology deployment, and the necessary sites for FWA (Fixed Wireless Access) technology deployment. After Infratel approves the final designs, the executive design phase begins, aimed at obtaining the necessary authorisations. Subsequently, works can commence on the sites. Upon completion of the work, Infratel conducts final verifications, which, if successful, result in the issuance of a positive testing certificate (collaudo).

The report indicates that as of 28 February 2026, the final design for the FTTH network has been approved in 6,068 municipalities, one less than in September 2025. As highlighted in the report, the number of planned projects may vary over time due to redesigns prompted by various obstacles. Specifically, during the progress of the executive design phase, some municipalities were found to lack any “white” housing units to connect, leading to the issuance of new regional technical plans that incorporated the cancellation of interventions in certain municipalities. As a result, the number of municipalities with approved final designs for the FTTH network is slightly lower than the figure recorded in September 2025.

As for the number of municipalities in which the final design for the FWA network has been approved, there has been an increase of 100 municipalities. In fact, as of 28 February 2026, the number of municipalities with approved final designs for the FWA network was 7,062.

As stated in the report, the municipalities for which the executive design of FTTH (Fiber to the Home) network infrastructure has been approved total 6,043, while a total of 3,232 executive projects have been approved for the implementation of FWA (Fixed Wireless Access) technology networks. This reflects an increase of one municipality with approved executive designs for FTTH networks. For FWA technology, the number of approved executive projects has decreased by 269 compared to September 2025. As noted above, the number of projects may vary due to the cancellation of interventions in certain areas.

Furthermore, as of 28 February 2026, infrastructure work has been completed in 10,451 out of 11,885 total active sites for fibre construction and in 3,153 out of the 3,230 sites for the FWA network construction.

Infrastructure work for FTTH technology was completed with positive testing in 5,327 municipalities, covering a total of 10,027 projects; compared to September 2025, projects related to the FTTH network have been positively tested in an additional 263 municipalities and the number of positively tested projects increased by 618 units.

Infrastructure work for FWA technology was completed with positive testing in 2,877 sites, an increase of 118 units compared to last September.

Authors: Massimo D'Andrea, Arianna Porretti, Matilde Losa

 

---

Innovation Law Insights is compiled by DLA Piper lawyers, coordinated by Edoardo Bardelli, Carolina Battistella, Noemi Canova, Gabriele Cattaneo, Maria Rita Cormaci, Camila Crisci, Cristina Criscuoli, Tamara D’Angeli, Chiara D’Onofrio, Federico Maria Di Vizio, Enila Elezi, Laura Gastaldi, Vincenzo Giuffré, Nicola Landolfi, Giacomo Lusardi, Josaphat Manzoni, Valentina Mazza, Lara Mastrangelo, Maria Chiara Meneghetti, Giulio Napolitano, Andrea Pantaleo, Deborah Paracchini, Maria Vittoria Pessina, Marianna Riedo, Rebecca Rossi, Roxana Smeria, Massimiliano Tiberio, Federico Toscani, Giulia Zappaterra.

Articles concerning Telecommunications are curated by Massimo D’Andrea, Flaminia Perna, Matilde Losa and Arianna Porretti.

For further information on the topics covered, please contact the partners Giulio Coraggio, Marco de Morpurgo, Gualtiero Dragotti, Alessandro Ferrari, Roberto Valenti, Elena Varese, Alessandro Boso Caretta, Ginevra Righini.

Learn about Prisca AI Compliance, the legal tech tool developed by DLA Piper to assess the maturity of AI systems against key regulations and technical standards here.

You can learn more about “Transfer”, the legal tech tool developed by DLA Piper to support companies in evaluating data transfers out of the EEA (TIA) here, and check out a DLA Piper publication outlining Gambling regulation here, as well as Diritto Intelligente, a monthly magazine dedicated to AI, here.

If you no longer wish to receive Innovation Law Insights or would like to subscribe, please email Silvia Molignani.