AI documentation as evidence

The answer is neither to accumulate documents nor to leave as little trace as possible. Decisions must be verifiable: the record should show what was decided, why, and by whom.

What changes on 30 September

Italy’s Legislative Decree no. 160 of 9 September 2026, published in the Gazzetta Ufficiale no. 214 of 15 September 2026, takes effect on 30 September and changes the position on three fronts.

• A new Article 437-bis enters the Italian Criminal Code. Its first paragraph applies where, in producing or placing a high-risk AI system on the market, a person omits technical safety or human oversight measures and creates a danger to life or public or individual safety. The sentence is one to five years’ imprisonment, rising to two to eight years where State security is endangered. The fourth paragraph separately addresses a professional user who omits human oversight and creates one of the dangers identified by the provision.
• The new Article 25-vicies of Legislative Decree 231/2001, Italy’s corporate liability regime, makes that offence capable of triggering liability for the entity. The financial penalty for the Article 437-bis offence ranges from 600 to 1,000 quotas.
• Articles 17, 18 and 19 of Legislative Decree 160/2026 introduce specific civil evidence rules. A court may order disclosure of records and technical information. A breach of an AI Act duty gives rise to a rebuttable presumption of causation. Formal or certified compliance with the AI Act does not by itself exclude liability.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, postponed the high-risk duties until 2 December 2027 for stand-alone systems and 2 August 2028 for systems embedded in products. This is the problem identified by Michele Iaselli in La sanzione prima della regola: the sanction arrives before the rule.

Those EU dates do not postpone the Italian provisions. From 30 September, Article 17 governs disclosure in civil proceedings. In criminal proceedings the same documents may become relevant evidence of the measures adopted and the oversight actually exercised.

When the same file can protect or damage the company

Risk assessments, records, logs, human oversight minutes and operating instructions can be read by people whose interests point in opposite directions.

Under Legislative Decree 231/2001, these documents help show that the entity had organised itself and effectively implemented its compliance model. Without concrete evidence, the model remains a statement of intent and the defence under Article 6 loses its force.

In civil proceedings, the same documents may be disclosed by court order. An unjustified failure to comply produces the consequences set out in Article 17 of Legislative Decree 160/2026. The presumption of causation under Article 18 is different: it operates only where the damage results from breach of an AI Act duty.

At the request of a person alleging damage, the court orders the other party or a third party holding the material to disclose evidence specifically relevant to the system’s operation, provided the applicant puts forward facts and evidence making the claim plausible. Article 17(2) expressly identifies four categories of documents required by the AI Act for high-risk systems:

• the logs required by Article 12 of Regulation (EU) 2024/1689;
• the risk-management documentation required by Article 9;
• the relevant information in the technical documentation required by Article 11;
• the information on the parameters and arrangements for human oversight under Article 14.

The disclosure order may concern any AI system. For systems that are not high-risk, however, those four categories cannot be assumed to be mandatory under the AI Act provisions just cited.

The order must remain necessary and proportionate to the claim. The court must also adopt measures to protect trade secrets and confidential information.

The consequences depend on who fails to comply. If a party does not comply without justified reason, the court may draw adverse inferences under Article 116 of the Italian Code of Civil Procedure. If the failure concerns the four categories just listed, the court, after assessing all the other evidence, deems the applicant’s allegations admitted. A third party that fails to comply is instead subject to a financial penalty of EUR 1,500 to EUR 10,000.

A party that fails to comply without justified reason therefore risks more than being left without evidence. Where the failure concerns those documents, the other side’s allegations may be deemed admitted. A third party’s failure attracts only the penalty in Article 17(6).

Leaving fewer traces makes it harder to prove that the entity was properly organised. Accumulating documents without governing them exposes the company to contradictions and to recorded decisions that were never followed through.

Why documenting too little or everything both fail

The absence of documents and their indiscriminate accumulation weaken the company’s position for different reasons.

Documenting the minimum. This reduces the material available, but not the exposure. Article 17 of Legislative Decree 160/2026 governs unjustified non-compliance with a disclosure order; Article 18 concerns breach of the duty, not the number of documents produced. Under Legislative Decree 231/2001, inadequate records also make effective implementation of the compliance model harder to prove.

Documenting everything. This creates files no one can control and increases the risk of inconsistency. Minutes that identify a known risk but do not record the treatment selected or the person responsible may become evidence against the company.

The right test is the evidential usefulness of each document. It should show what decision was taken, the information on which it was based, and who took it.

The risk of compliance that exists only on paper

Declaring compliance with technical standards that are not yet available exposes a company on both fronts. Michele Iaselli raises the issue in relation to the certainty required of a criminal offence. On the civil side, Article 19 of Legislative Decree 160/2026 states that compliance, even when certified, does not exclude liability. If the standard invoked does not yet exist, the declaration provides no protection.

The same problem arises where a compliance model under Legislative Decree 231/2001 is updated by copying generic language that refers to standards and procedures with no application inside the company. The gap between what is written and what is done may show that the model was not effectively implemented.

What to check now

1. Identify who produces AI documentation and who is expected to read it. Technical documents must remain intelligible to a person reviewing the company’s decisions from outside.
2. Include these documents in the reporting flows to the Supervisory Body. Set a reporting interval and retain evidence of receipt. The new predicate offence brings AI use within the oversight performed under Legislative Decree 231/2001.
3. Read the existing documents again. Ask what decision each one would prove, who would appear responsible and whether it also records the action taken after the risk was identified.

There is no need to wait until 2027. Produce the documents that are needed and write them so that the entity’s decisions will remain intelligible in later proceedings.