With Legislative Decree No. 160 of 9 September 2026, published in Official Gazette No. 214 of 15 September 2026 and entering into force on 30 September 2026, the Italian legislature has taken steps to align the national legal framework with Regulation (EU) 2024/1689 (the “AI Act“), introducing, among other measures, specific provisions on civil and criminal liability arising from the use of artificial intelligence systems.
Of particular relevance to businesses and the insurance market are the provisions governing compensation for damage caused in connection with the use of AI systems.
Within this framework, Article 18 provides that, where one or more obligations under the AI Act have been breached, a rebuttable presumption of a causal link between the infringement and the damage applies. Article 19 further clarifies that compliance by an AI system with the requirements laid down by the European Regulation, even where such compliance has been certified, does not in itself exclude the defendant’s liability.
Direct action against the insurer
Of particular interest to the insurance sector is Article 20, entitled “Direct action against the insurance undertaking“, which is expected to affect both claims handling and, prospectively, the structuring and management of liability insurance policies covering risks associated with the use of artificial intelligence.
The key development does not consist in the introduction of a general obligation to take out insurance covering liability arising from the use of AI systems. Rather, the Decree strengthens the position of the injured party where liability insurance coverage is already in place.
Before bringing a claim for damages, a person who considers that they have suffered damage caused in connection with the use of an artificial intelligence system may ask the party they consider responsible whether that party is covered by a liability insurance policy in respect of the relevant damage.
The recipient of the request must provide the following information within thirty days of receipt:
- confirmation of the existence of insurance coverage;
- details of the insurance contract;
- the name of the insurance undertaking.
The prior request does not constitute a procedural prerequisite for subsequently bringing legal proceedings. However, the provision places specific emphasis on transparency: where the information is not provided, or is provided only incompletely, the court may draw evidential inferences pursuant to Article 116 of the Italian Code of Civil Procedure.
The injured party may bring a direct action against the insurer
The aspect with the greatest potential impact on the insurance market is the ability of the injured party to bring a direct action against the insurance undertaking providing liability coverage to the defendant.
Such action may be brought within the limits of the sums for which the insurance contract was entered into. The insurer may therefore be directly involved in litigation concerning damage arising from the use of AI, without the injured party having to wait for the insured to seek the insurer’s involvement in the proceedings.
This does not, however, mean that the insurer becomes an unconditional guarantor of compensation.
Article 20 provides that the insurer may raise against the injured party defences arising from the insurance contract, provided that they pre-date the loss. Policy terms and conditions, as well as the proper definition and scope of the insured risk, therefore assume a central role even in the direct relationship between the injured party and the insurer.
The insurer’s right of recourse
The legislation also protects the position of the insurance undertaking.
Where the insurer makes a payment, it has a right of recourse against the insured to the extent that, under the terms of the insurance contract, it would have been entitled to refuse or reduce the insurance payment.
The provision therefore distinguishes between the external relationship between the insurer and the injured party and the internal contractual relationship between the insurer and the insured.
This mechanism may be particularly significant where the damage is connected, for example, with a failure to comply with technical, organisational or security requirements that may affect the operation of the insurance coverage.
For businesses that develop or use AI systems, this means that technology risk management should be regarded not only as a matter of regulatory compliance, but also as a factor that may be relevant to the effective operation of liability insurance coverage.
Necessary joinder and limitation periods
Where the injured party brings a direct action against the insurance undertaking, the party identified as being responsible for the damage is a necessary party to the proceedings and must therefore be joined in the action.
The limitation period applicable to the direct action against the insurer is also the same as that applicable to the action brought against the party identified as responsible for the damage.
What are the implications for insurers, intermediaries and insured businesses?
Legislative Decree No. 160/2026 does not introduce a specific form of compulsory insurance for risks arising from artificial intelligence. It does, however, introduce a significant change in the handling of claims relating to the use of AI: where liability insurance coverage is in place, the injured party may obtain the identity of the insurer and bring a direct action against it.
For insurers and insurance intermediaries, the new framework makes it increasingly important to assess how existing insurance policies respond to risks arising from the use of AI systems, with particular attention to the scope of coverage, exclusions, the insured’s obligations and any terms or conditions that may affect the insurer’s obligation to indemnify.
For insured businesses, it is becoming increasingly important to ensure consistency between the AI systems actually used, the business processes in which those systems are deployed, the governance and control measures adopted, and the representations and obligations set out in the relevant insurance policies.
The evolving regulatory framework therefore appears likely to strengthen the connection between AI governance, civil liability and insurance risk management.
Artificial intelligence is no longer merely a new risk to be insured. Its use also affects the rules governing the establishment of liability, the management of litigation and the relationship between injured parties, insureds and insurers, making coordination between legal, compliance and risk management functions and the insurance market increasingly important.