Italy’s New AI Liability Rules: Consumer Forum Actoris and Other Challenges

As already noted on this blog, in October 2025 the European Commission withdrew its Proposal for a Directive on adapting non-contractual civil liability rules to artificial intelligence (AI Liability Directive). The proposal, presented in 2022, was intended to adapt national civil liability rules to the specific challenges posed by AI, notably by facilitating access to evidence and introducing rebuttable presumptions concerning causation. This leaves the development of AI liability largely to the existing framework of EU and national law.

Against this background, Italy has now adopted a comprehensive national framework on AI. Legislative Decree No 160 of 9 September 2026 adapts Italian law to Regulation (EU) 2024/1689 (the AI Act) and contains provisions concerning the use of AI in policing, criminal liability and, notably, civil liability for damage caused by the use of AI systems. Published in the Gazzetta Ufficiale della Repubblica Italiana on 15 September 2026, the Decree entered into force on 30 September 2026.

The provisions on civil liability are particularly interesting from a private international law perspective.

The decree’s Title II, Chapter II, entitled “Civil procedural instruments for compensation for damage caused by the use of artificial intelligence systems”, comprises Articles 16-20. It applies not only to non-contractual liability but, in certain respects, also to contractual claims.

Article 16: Scope of Application and Consumer Jurisdiction

Article 16 establishes the scope of the new procedural framework.

It provides that Article 17 applies to actions for compensation for both contractual and non-contractual damage caused in the use of an AI system. Then, it provides that Articles 18 and 19 apply where the damage results from a breach of one or more obligations under the AI Act. The provision expressly preserves Article 82 of Regulation (EU) 2016/679 (General Data Protection Regulation) and the national legislation implementing the Directive (EU) 2024/2853 (Product Liability Directive).

Of particular interest from a private international law perspective is Article 16(4), which establishes an additional forum for natural persons acting for purposes outside their business or professional activity: such actions may also be brought before the courts of the place where the injured person has their residence or domicile.

This provision potentially gives consumers a particularly favourable forum for AI-related damage claims. Its interaction with Brussels I bis, however, will require careful consideration.

For contractual claims falling within the Brussels I bis consumer regime, Article 18 of that Regulation already permits a consumer to sue the other party either in the courts of the defendant’s domicile or in the courts of the consumer’s domicile. Article 16 of the Italian decree is potentially broader because it is expressly framed around actions for compensation for damage, rather than simply disputes concerning a consumer contract.

This raises an important question: to what extent can the Italian rule operate autonomously where Brussels I bis applies? The answer will depend, among other things, on the qualification of the claim and on whether the defendant is domiciled in a Member State. The Regulation’s rules on consumer jurisdiction are autonomous and, in relevant cases, prevail over conflicting national jurisdictional rules.

The provision may therefore become particularly significant in cross-border AI disputes involving consumers, where the place of damage, the consumer’s domicile and the establishment of the AI provider or deployer may all be situated in different countries.

Article 17: Access to Evidence

Article 17 introduces a detailed mechanism for disclosure of evidence.

At the claimant’s request, the court may order the defendant or a third party holding the relevant material to disclose evidence specifically concerning the functioning of the AI system, provided that the claimant presents facts and elements making the claim sufficiently plausible, including the connection between the system’s output and the alleged damage. The provision expressly mentions AI Act records, risk-management documentation, technical documentation and information concerning human oversight.

The provision is clearly reminiscent of the evidentiary architecture of the withdrawn AI Liability Directive. The difference is that Italy has now introduced such a mechanism through national legislation.

From a private international law perspective, however, access to evidence immediately raises a lex fori/lex causae question.

Rome II expressly excludes evidence and procedure from its scope, while Article 22 provides that the law governing a non-contractual obligation determines matters concerning legal presumptions and the burden of proof.

Article 17 is drafted as a procedural mechanism: it regulates an order by the court, its proportionality, the protection of trade secrets and the procedural consequences of non-compliance. This would strongly support its characterisation as a matter of procedure governed by the law of the forum.

Yet the distinction is not entirely straightforward. The disclosure of AI documentation may directly affect the claimant’s ability to establish elements of liability which are governed by the applicable substantive law. The Italian court may therefore have to distinguish between the procedural mechanism for obtaining evidence, on the one hand, and substantive questions concerning the burden of proof or presumptions under the applicable law, on the other.

This distinction becomes particularly important where an Italian court applies a foreign law under Rome II.

Article 18: Presumption of Causation

Article 18 provides that, where damage results from the violation of one or more obligations under the AI Act, the causal link between the violation and the damage is presumed, unless proved otherwise.

This is arguably a significant provision under the Chapter. It responds directly to one of the central difficulties identified in the debate on AI liability: the opacity and complexity of AI systems may make it particularly difficult for an injured person to establish the causal relationship between a regulatory violation, an AI output and the resulting damage.

But Article 18 also presents a classic conflict-of-laws problem.

Under Article 4 of the Rome II, the law applicable to a non-contractual obligation is, as a general rule, the law of the country in which the damage occurs. Rome II applies universally, meaning that the law designated by its rules may be the law of a non-EU State.

Moreover, Article 22 of Rome II provides that the law governing the non-contractual obligation applies insofar as it contains rules which raise presumptions of law or determine the burden of proof.

Article 18 therefore cannot simply be assumed to apply whenever an Italian court has to rule on an AI-related claim. Where Rome II designates another law as applicable to the non-contractual obligation, the crucial question will be whether the Italian presumption forms part of the applicable substantive regime or can instead be characterised as a procedural rule of the forum.

The wording and systematic position of Article 18 strongly suggest that it concerns the substantive allocation of the risk of uncertainty concerning causation. If so, Article 22 of the Rome II becomes particularly relevant, potentially preventing the Italian presumption from being applied merely because proceedings are brought before an Italian court.

This could produce an interesting divergence between jurisdiction and applicable law: an injured person may be able to sue in Italy under Article 16, while the causal presumption in Article 18 may nevertheless not apply if the applicable law under Rome II is that of another State.

Article 19: Compliance with the AI Act

Article 19 provides that compliance with the obligations imposed by the AI Act, including compliance certified under the AI Act, does not in itself exclude the defendant’s liability.

The provision is significant because it prevents regulatory compliance from becoming an automatic civil-liability safe harbour.

From a conflict-of-laws perspective, however, its operation again depends on the applicable law. Article 19 appears to formulate a substantive rule concerning the legal consequences of compliance with the AI Act. In a cross-border non-contractual dispute, its application should therefore be assessed in light of the law designated by Rome II.

This is particularly relevant because the AI Act itself is an EU instrument with a highly extensive (extra)territorial reach, while the applicable law governing civil liability may be that of a Member State or, potentially, a third State.

The result is a potentially complex interaction between uniform EU regulatory obligations and nationally determined civil liability.

Article 20: Direct Action Against Liability Insurers

Finally, Article 20 introduces a direct action against the liability insurer.

Before bringing proceedings, the injured person may ask the person allegedly responsible whether they are covered by liability insurance. The insured party must communicate the existence and details of the relevant insurance contract within 30 days. The injured person may then bring a direct action against the insurer, within the limits of the insurance coverage. The provision also regulates the insurer’s recourse against the insured, the necessary joinder of the person allegedly responsible and limitation.

This provision is particularly rich from a private international law perspective.

First, Article 18 of the Rome II already contains a specific conflicts rule for direct actions against insurers: the injured person may sue the insurer directly where either the law applicable to the non-contractual obligation or the law applicable to the insurance contract permits such an action. The existence of the direct action is therefore already subject, in cross-border cases, to a specific connecting mechanism under EU private international law.

Secondly, jurisdiction in matters relating to insurance is addressed by Articles 10-16 of the Brussels I bis. In liability insurance, Article 12 allows the insurer to be sued, in addition, in the courts of the place where the harmful event occurred. Article 13 expressly addresses direct actions by injured persons against insurers and makes the jurisdictional rules applicable where such direct actions are permitted. Consequently, the fact that Article 20 of the Italian decree confers a direct right of action under Italian law does not, by itself, determine which court has jurisdiction in a cross-border dispute where Brussels I bis applies.

This gives rise to at least three distinct questions in transnational litigation. First, which court has jurisdiction? This is primarily a question governed by Brussels I bis where the Regulation applies. Secondly, does a direct action against the insurer exist? This may depend on the conflict-of-laws rule in Article 18 of the Rome II, including the law applicable to the non-contractual obligation and the law applicable to the insurance contract. Thirdly, what are the consequences and limits of the direct action? Issues such as the scope of the insurer’s liability, the availability of contractual defences and the insurer’s right of recourse may require consideration of the applicable insurance and liability laws.

Article 20 therefore illustrates a particularly interesting interface between a national rule establishing a direct action in AI-related liability cases and the pre-existing EU private international law framework.

A First Private International Law Assessment

The significance of Legislative Decree No 160/2026 therefore extends well beyond Italian domestic civil (procedure) law. Chapter II represents a national attempt to address some of the structural difficulties inherent in AI-related litigation – above all, the claimant’s limited access to evidence and the difficulty of establishing causation – at a time when the EU-level project for a harmonised civil liability regime for AI has been withdrawn.

What makes the Italian approach particularly interesting from a private international law perspective is not merely that these rules may apply to cross-border disputes. It is that several of them occupy an uncertain position at the boundary between procedure and substantive liability. The qualification of a rule as procedural or substantive is not merely conceptual: in a cross-border dispute, it may determine whether the rule is applied as part of the lex fori or travels with the law governing the underlying obligation. The Italian reform therefore raises a broader question as to how nationally enacted procedural mechanisms designed to facilitate AI-liability claims fit within an EU conflicts system that was largely conceived without AI-specific litigation in mind.

These questions point to a more fundamental feature of AI-related private international law. The technological architecture of AI does not map neatly onto territorial legal categories. The claimant may be domiciled in one State; the provider or deployer may be established in another; the system may have been developed, trained or operated across several countries; the relevant output may have been generated elsewhere; the damage may materialise in a further State; and the provider’s liability may be covered by an insurance contract governed by yet another law. A single AI-related event can therefore activate several connecting factors without any one country corresponding neatly to the technological or economic centre of the activity.

In this context, national procedural rules may have effects that are anything but purely domestic. A disclosure order can determine whether a claimant is practically able to prove a claim governed by foreign law; a national presumption can alter the evidentiary balance in litigation concerning a non-contractual obligation governed by another legal system; and a national direct-action rule can intersect with an insurance contract subject to a different law. The distinction between lex fori and lex causae, traditionally used to allocate procedural and substantive matters, may consequently become increasingly difficult to apply to rules specifically designed to overcome the informational asymmetries characteristic of AI litigation.

The Italian reform thus offers a useful laboratory for examining a broader question: what happens when the procedural infrastructure necessary to enforce AI liability develops nationally, while the substantive liability framework and the conflict-of-laws rules remain European and, in many respects, technology-neutral? The answer is unlikely to be uniform across Member States. Different national solutions to evidence, presumptions, consumer jurisdiction and direct actions may produce materially different litigation environments even where the underlying AI-related conduct is subject to the same EU regulatory standards.

This does not necessarily mean that the absence of further EU harmonisation makes national initiatives undesirable. On the contrary, Article 16 and Articles 17-20 demonstrate how national procedural innovation can make existing EU substantive regulation more effective in practice. But it also means that procedural divergence may itself become a source of private international law complexity. The more national procedural mechanisms influence the practical ability to establish liability, the greater the importance of determining which of them can be applied by a court seised in one Member State when the underlying obligation is governed by the law of another.

The most interesting issue may therefore not be whether Italian law has succeeded in filling the gap left by the withdrawal of the proposed AI Liability Directive. It is whether, in doing so, it has revealed a gap of a different kind: the absence of a sufficiently articulated private international law framework for nationally differentiated mechanisms of AI-liability enforcement.

The Italian experience accordingly suggests that the next phase of AI liability may not be defined only by the substantive question of who should be liable for AI-related harm. It may increasingly be defined by a prior, and more distinctly private international law, question: which country’s procedural and evidentiary machinery should determine whether that liability can effectively be established at all?