Your 231 compliance model does not know about artificial intelligence yet

A word first on what this note is about, for a reader outside Italy. Italian Legislative Decree no. 231 of 8 June 2001 makes a company itself liable — with fines, disqualification measures and confiscation — for a closed list of offences committed in its interest by its directors or its staff. The company's defence is an organisational and compliance model that is adequate, effectively implemented and monitored by an internal supervisory body, the Organismo di Vigilanza. That list expanded on 30 September 2026.

Your 231 model lists the offences the company can commit. If it has been updated recently it reaches as far as cybercrime and tax offences, and for each one it identifies the exposed process, the protocol covering it and who answers for it. Almost certainly it contains not a line about the system that has been assigning warehouse shifts for the past eight months, or the one rejecting defective parts on the line. From 30 September that risk map should be reviewed against the new Article 25-vicies; not every use of AI constitutes a new offence.

What was decided on 4 August.

On 4 August 2026 the Italian Council of Ministers gave final approval to two legislative decrees adapting Italian law to Regulation (EU) 2024/1689, the AI Act, under the delegated powers contained in Italian Law no. 132 of 23 September 2025. The first of the two concerns the use of artificial intelligence in policing and contains the criminal provisions; the second sets out the national supervisory architecture, entrusted to AgID, the Agency for Digital Italy, and to the National Cybersecurity Agency.

The decree that matters here is the first, because it inserts into the Italian Criminal Code a new Article 437-bis, punishing the failure to adopt security measures in high-risk artificial intelligence systems and their unlawful alteration, with penalties graded according to the interest placed at risk. The same decree strengthens the position of anyone harmed by an AI system: access to the technical documentation, a presumption of causation, a court close to the claimant's residence and a direct action against the defendant's insurer.

The final text was issued on 9 September 2026 and published in the Italian Official Journal no. 214 of 15 September: it is Legislative Decree no. 160, in force from 30 September 2026, with no special commencement clause. From that date Article 437-bis of the Criminal Code is law in force, and so is Article 25-vicies of Legislative Decree 231/2001. The draft approved on 10 June 2026 remains useful for one purpose only: reading the differences, because on three points the published text does not match what was known in August.

The two offences entering the list.

Under the published decree, the new family of predicate offences enters Legislative Decree no. 231 of 8 June 2001 through an Article 25-vicies, headed "Offences committed through the use of artificial intelligence systems", which refers to two offences: the new one in the Criminal Code and one that has already been in force for almost a year.

The second row of that table is the easier one to underestimate. The offence has existed for months and nobody had to wait for an implementing decree: its connection to corporate liability has applied since 30 September 2026. A promotional video in which an executive's voice has been reconstructed, a spokesperson's face generated from a real person, an internal announcement produced with a voice clone: these are uses that inside a company go through marketing, not through compliance, and that nobody today classifies as a 231 risk.

To the fines in that table the decree adds, for both offences, the disqualification measures of Article 9(2), points b), c), d) and e) of Legislative Decree 231/2001: suspension or withdrawal of the authorisations used to commit the offence, a ban on contracting with public authorities, exclusion from grants and public funding, and a ban on advertising goods or services. Disqualification from carrying on the business — point a), the one that stops the company — is left out as disproportionate. For a supplier to the public sector the item that bites is not the fine: it is the contracting ban.

Why it concerns companies that merely use AI.

There is a widespread, and convenient, belief that the rules on artificial intelligence concern those who build it. The decree says otherwise, though not in the way the draft suggested. In the published text "professional use" no longer appears among the forms of conduct in the first paragraph: the professional user has a paragraph of its own, the fourth, punishing whoever intentionally fails to adopt human oversight measures, with the penalties of the first paragraph. The legislator was indeed looking at the company that buys the system and puts it into production, but gave it a narrower offence.

It is worth knowing where the provision stops before drafting protocols. The danger that triggers the offence is not danger of any kind: if it concerns life or public or individual safety, the penalty is imprisonment for one to five years; if it concerns the security of the State, the penalty is imprisonment for two to eight years. Two conditions must both be met: the system must be high-risk within the meaning of Article 6 of Regulation (EU) 2024/1689, and the failure to oversee it must have created a danger to someone’s safety.

Which systems, then. The natural candidates are those acting as safety components of products already subject to European harmonisation — machinery, medical devices, lifts — and those running critical infrastructure: there the danger to safety is inherent in what the system commands. Annex III to the Regulation also classifies as high-risk the systems used for recruitment, for the allocation of tasks, for evaluating the performance of workers, for creditworthiness assessment and for access to essential services: they remain high-risk in full, with the obligations that follow, but for the offence the second requirement has to be shown. That gap changes the order of the inventory: you start on the production line, not in the HR department.

There is, however, a point that changes the arithmetic for companies that merely use AI, and it runs the other way compared with what was known in August. The third paragraph of Article 437-bis of the Italian Criminal Code reduces the penalty by between a third and a sixth where the conduct under the first paragraph is committed through gross negligence; the explanatory report to the draft pointed to Article 590-sexies of the Criminal Code, the medical liability provision. In the published text, however, the first paragraph no longer covers professional use: for the professional user the relevant provision is the fourth paragraph, which requires an intentional omission. For that user the difference is substantial: disorganisation alone does not establish this offence, which also requires the danger specified by the law. Article 25-vicies of Legislative Decree 231/2001, in referring to the offence, does not distinguish between its forms. Corporate liability may therefore also extend to the grossly negligent form in the third paragraph; that paragraph refers to the conduct in the first, not to the professional user’s separate offence in the fourth.

This is the point that concerns the supervisory body. Corporate liability under Legislative Decree 231/2001 presupposes that the offence was committed in the company's interest or to its advantage by someone in a senior position or by someone under another's direction, and the company's defence is an organisational model that is adequate, effectively implemented and monitored. If nobody has been assigned to check the system’s output, or no record of that check exists, the organisational gap calls for investigation. It does not by itself establish the offence: the fourth paragraph also requires an intentional omission and the specified danger.

The gap between the offence and the European deadlines.

The reasonable objection is that the European obligations on high-risk systems have been postponed. That is true: Regulation (EU) 2026/1744, in force since 27 July 2026, moved to 2 December 2027 the obligations for the Annex III systems and to 2 August 2028 those for systems that are safety components of regulated products.

The postponement, however, moved the obligations, not the classification: Annex III already sets out today which systems are high-risk, and no company will be able to argue in 2028 that it did not know beforehand which category its software fell into.

On how the offence fits with those deadlines, the published decree, not the parliamentary draft, is the relevant text. Its only transitional provision, Article 21, concerns AI systems already in use for policing. For the Title containing the offence and corporate liability there is nothing comparable: no provision ties Article 437-bis of the Criminal Code or Article 25-vicies of Legislative Decree 231/2001 to 2 December 2027. The administrative penalty regime is governed separately by Articles 19–25 of Legislative Decree no. 179 of 7 October 2026, which enters into force on 23 October. Legislative Decree 160/2026 contains no clause tying the offence to the later EU deadlines: Article 437-bis of the Italian Criminal Code has been in force since 30 September 2026.

One question no text settles, and it should be stated as such: the technical security measures "provided for" high-risk systems are largely those of a regulation that will not apply to such systems until 2027. The objection is a serious one, but it bears on the technical measures, not on human oversight, which is the other half of the conduct punished.

There is also a more mundane reason not to wait. Updating a 231 model is not a two-week exercise: it requires mapping the exposed processes, drafting the protocols, a resolution of the board, information flows to the supervisory body and training for the people who will have to apply those protocols. A company that starts when the rule is in force starts a year late.

What the supervisory body can do now.

The final text is in force. The following steps should therefore be calibrated to Article 437-bis of the Italian Criminal Code and Article 25-vicies of Legislative Decree no. 231 of 8 June 2001, introduced respectively by Articles 12 and 15 of Legislative Decree no. 160 of 9 September 2026.

1. Ask for the inventory, not for reassurance. Not "do we use artificial intelligence?", but the list of systems in production with the process they affect, the date they were introduced and the function that bought them. In a good many companies half of those systems never went through the IT department.
2. Separate out the high-risk ones. An entry-by-entry comparison with Annex III to Regulation (EU) 2024/1689 and with the products subject to harmonisation. It is the only step that calls for a legal reading, and it is the one that decides the size of everything else.
3. Put a name to the human oversight. For each high-risk system: who checks it, what they must be able to stop, how often, and where a record of the check remains. Oversight that leaves no record is, in proceedings, the same as oversight that never happened.
4. Bring the protocols into the model. A dedicated special section, information flows to the supervisory body, and a duty to report when a new system goes into production — which is the moment when, today, nobody tells anybody.
5. Reread the supplier contracts. The technical documentation, the operating logs and the instructions for use, without which oversight cannot be demonstrated, are held by the vendor: if they are not written into the contract, you will not have them when you need them. That is the subject of an earlier note.
6. Schedule and document the review. Legislative Decree 160/2026 has been in force since 30 September: check that the risk map and protocols have been updated against the enacted text. Legislative Decree no. 179 of 7 October 2026, published and due to enter into force on 23 October, also calls for reviewing, where relevant to the processes concerned, the interaction with its provisions on AI-assisted employment decisions and occupational health and safety risk assessments (Articles 41 and 42 of that decree).

A closing remark on the order of priorities. Faced with a new criminal provision, the temptation is to update the document first: add the special section, attach the list of offences, file the board resolution. But a model that lists Article 437-bis of the Italian Criminal Code without knowing which systems the company actually uses is not a defence: it is written proof that the risk had been recognised and left uncovered.