Companies fined for deepfakes and failure to monitor AI

Artificial intelligence also makes its debut in the Decree 231. In the draft legislative decree approved by the Council of Ministers, under the auspices of the Ministries of the Interior and Justice, a new offence is introduced to penalise the failure to adopt security measures in artificial intelligence systems. The offence is punishable by imprisonment for two to eight years and is linked to actual danger, intent and gross negligence: the aim was to avoid penalising operational errors or technical deviations.

However, businesses are also being held accountable, as the same conduct is also punishable under organisational liability, with a fine of between 600 and 1,000 units; Furthermore, Decree 231 also includes the offence introduced last year by the Artificial Intelligence Act, Law 132 of 2025: thus triggering a penalty of between 200 and 700 units for cases of deep fakes, the unlawful dissemination of content generated or altered using artificial intelligence systems.

This was then implemented through a series of amendments to the Code of Criminal Procedure, allowing the use of artificial intelligence systems for the identification of suspects and fugitives. Where proceedings are brought for a wide range of offences, as identified by the European Regulation (IA Act), including those falling within the remit of the European Public Prosecutor’s Office as well as others such as drug trafficking, murder, kidnapping and child pornography, the use of artificial intelligence systems may be authorised for the remote biometric identification of the suspect in real time.

In the hunt for fugitives, the location of the person sought may also be authorised through biometric identification using artificial intelligence systems, by comparing their biometric data with that of individuals stored in a reference database. In the same manner, targeted searches may be carried out, within the context of criminal proceedings, for specific victims of abduction, human trafficking or sexual exploitation of human beings.

In ordinary proceedings, it is the public prosecutor who requests authorisation from the investigating judge, who, in the reasoned order granting approval, must define the geographical area of application, specify the persons specifically sought and determine the strictly necessary duration, which may in no case exceed fifteen days, extendable by the judge, at the request of the public prosecutor, for further periods of fifteen days, provided the conditions remain in force.