Notes
What the rule says, and what it means on Monday morning.
I write for the people who have to decide: what already applies, who answers for what, which documents are needed and in what order. No alarm about fines, no restatement of the statute.
Notes are written first in Italian, the language of the companies I work with day to day, and published here in English. The subject matter — EU regulation — is the same on either side of the border; where a rule is Italian rather than European, it is set out in full.
-
AI Act
Who checks AI-written texts
Watermarks, human review and editorial responsibility: how businesses and professionals can organise their use of AI in published texts.
2 min read -
Cyber Resilience Act
You blocked a cyberattack on your connected product. Now decide whether to report it
A blocked cyberattack may be a near miss, an incident below the reporting threshold or a severe incident. How to distinguish the three before the 24-hour clock becomes the main problem.
6 min read -
Legislative Decree 231/2001
AI documentation as evidence
From 30 September 2026, AI risk assessments, logs and oversight records may enter Italian civil proceedings. How to document decisions without weakening the company’s defence.
6 min read -
Medical devices
The file that protects you is the one you would already have thrown away
From 9 December 2026, product liability changes the rules of evidence. For manufacturers of devices with software, everything turns on four things: documentation, updates, retention and contracts.
9 min read -
Cyber Resilience Act
The same incident, three reports and three different clocks
From 11 September 2026, manufacturers of products with digital elements must report exploited vulnerabilities and severe incidents within 24 hours, including for products already sold.
5 min read -
AI Act
The six documents your clients will start asking you for
Technical documentation, logs, incident notification, data use, liability and instructions: which of the six documents clients request are already legal duties, and which remain matters for negotiation.
8 min read -
Legislative Decree 231/2001
Your 231 compliance model does not know about artificial intelligence yet
Legislative Decree 160/2026, in force since 30 September 2026, creates a specific offence for a professional user who intentionally omits human oversight where the specified danger results. What the supervisory body should verify now.
6 min read -
AI Act
Your AI vendor has already pushed its obligations onto you
The AI Act places duties on the company that deploys an AI system, but the means to discharge them — logs, technical documentation, incident alerts — sit inside the vendor’s system. Six clauses that standard contracts almost always omit, and six questions to ask before signing.
6 min read -
AI Act
The AI Act deferral also affects companies that use AI
The deferral of high-risk AI duties also affects some companies that use rather than build AI. Prohibitions and transparency duties follow different dates: distinguish what applies now from what comes later.
7 min read
Published for general information. Each note states the date on which the legal framework was verified. Rules change: before acting on a text published months earlier, check that it still holds.