Skip to content
KisunoAI
Self-host for free Get started
Pricing Docs Blog Get started Self-host for free

Law and operations

When human oversight becomes a criminal offence: three workflows, and what did not yet apply at the time of writing

The Italian Council of Ministers has given final approval to two implementing decrees under the country’s AI law. They provide for making the failure to supervise high-risk systems a criminal offence, for adding AI offences to the liability of the company itself, and for rendering void a dismissal based solely on automated processing. This article works through three workflows to show what can be prepared today, and it says first what was not yet in force.

Law and operations Reading time: 12 minutes

In brief

  • On 4 August 2026 the Italian Council of Ministers gave final approval to two implementing decrees under its AI law. One of them adds Article 437-bis to the codice penale, Italy’s criminal code: one to five years in prison where the prescribed technical safety measures or the human oversight of a high-risk system are omitted and a concrete danger to life or physical integrity follows from that.1
  • When this text went to press on 2 September 2026, the two decrees had not been published in the Gazzetta Ufficiale, Italy’s official journal.2 Numbering and wording become binding only with publication, and until then Italy had no AI criminal offence.
  • A second new article, 25-vicies, adds AI offences to the liability of the company under decree 231, the Italian law that makes the organisation itself answer for offences committed in its interest, with 600 to 1,000 quotas and disqualification sanctions on the draft wording.1 At a quota value of 258 to 1,549 euros that works out at 154,800 to 1,549,000 euros.3 A provision of the same package renders void a dismissal based solely on automated processing.1
  • What a platform can contribute to this is narrowly bounded: logs, permissions and a record of who intervened and when. The risk analysis, the procedures and the oversight itself remain the job of your company, and for the strategic data of a public administration our Swiss operation is not enough on the wording of the ACN rulebook. This article is no substitute for legal advice.

Where things stand: a criminal offence that is not yet in the official journal

Italy passed its AI law almost a year ago. Legge 132/2025 entered into force on 10 October 2025 and instructed the government to align national law with the EU AI Act within twelve months and to regulate the cases of unlawful production and use of AI systems.4 On 10 June 2026 the Council of Ministers approved two drafts on a preliminary reading, and on 4 August 2026 it adopted them on the final reading.1

At the core of it sits a new Article 437-bis of the criminal code. It punishes anyone who omits the prescribed technical safety measures or the human oversight of a high-risk AI system and thereby triggers a concrete danger: one to five years in prison where the life or physical integrity of individuals is at stake, two to eight years where the danger is directed at public safety or the security of the state. Alongside it come the new Article 25-vicies, which adds AI offences to the list of predicate offences for the liability of the company under decree 231 of 2001, and a provision of the second decree, which renders void a dismissal based solely on automated processing.1 Liability under decree 231 falls not on the person who acted but on the organisation, and besides the fine it also carries a ban on entering into contracts with the public administration.3

And now the part that an article about new criminal law has to say first. When this text went to press on 2 September 2026, the two decrees had not been published in the Gazzetta Ufficiale.2 What the Council of Ministers adopts is a text on its way to the official journal: the order of the articles, their numbering and their wording become binding only with publication, and until then no AI criminal offence applies in Italy. Anyone selling you a finished checklist on Article 437-bis today is selling you the reading of a text whose final version they do not know. Check the published wording before you build anything on it. This article is no substitute for legal advice.

Against that background it is worth looking at where the country stands. According to the survey by the Italian statistics office Istat, which rests on a sample of 26,246 companies and is representative of 218,446 companies with ten or more employees, 16.4% of companies used at least one AI technology in 2025; among large companies the figure is 53.1%, among small and medium-sized ones 15.7%, and the gap between the two has widened from around 20 percentage points in 2023 to 37 percentage points.5 More telling for our subject is another figure from the same survey: 33.4% of the companies that use AI name none of the proposed fields of application, and 83.3% of those are businesses with 10 to 49 employees.6 Anyone who cannot say what they use AI for cannot say either whether one of those systems falls into the high-risk category.

  1. Legge 132/2025, in force since 10 October 2025, with a mandate to the government
  2. Council of Ministers of 10 June 2026, two drafts on a preliminary reading
  3. Council of Ministers of 4 August 2026, adopted on the final reading
  4. Publication in the Gazzetta Ufficiale, still open at the time of writing
The path of the two decrees. The wording becomes binding only with the last step.

Who this affects, and who it does not

The criminal offence hangs on a single word, and that word is high-risk. The EU AI Act, Regulation 2024/1689, lists in Annex I the systems built into a product as a safety component, and in Annex III the fields of use that count as high-risk in their own right, among them employment and recruitment, creditworthiness assessment, critical infrastructure, education and parts of law enforcement. Article 14 requires such systems to be built so that people can effectively oversee them, and Article 26 requires the deployer to assign that oversight to natural persons who are trained for it and hold the authority to carry it out.7

These obligations do not apply yet, however. The Digital Omnibus, adopted as Regulation 2026/1744 and published in the Official Journal of the Union on 24 July 2026, has narrowed the high-risk article further and postponed its application: to 2 December 2027 for standalone high-risk systems and to 2 August 2028 for systems built into a product.8 How a national criminal offence relates to that postponed calendar is one of the questions only the published wording will answer. We put that on record here rather than making the urgency look greater than it is.

The second question is how many companies would even know whether they are affected. Sound figures on this are scarce: the best known survey of AI governance in large Italian companies, the Osservatorio Artificial Intelligence of the Politecnico di Milano, is sponsor-funded and does not disclose its sample, which is why we do not repeat its shares here.9 From the same direction comes a figure from the statistics office that Italian reporting regularly gets wrong: of the companies that do not use AI, 11.5% have considered using it at all, and the obstacles reported refer to that subgroup alone, namely a lack of skills at 58.6% and a lack of legal clarity at 47.3%.10 That is not a statement about the Italian economy as a whole, and anyone using it that way is talking a problem up.

Who What triggers the assessment What Kisuno contributes there
Industry, mechanical and plant engineering AI as a safety component of a product falls into the high-risk category under Annex I of the AI Act, and that is exactly what the planned criminal offence attaches to A log of who started which analysis and who approved it, exportable as a file
HR departments and recruitment agencies Selection, assignment and termination of employment appear in Annex III; the nullity provided for hits the dismissal decided solely by automated means Drafts with the source reference in the documents, without a decision, plus a note naming the person who decided
Banks, insurers and credit brokers Creditworthiness assessment of natural persons, together with risk classification and pricing in life and health insurance, is named in Annex III Permissions per tool, so that a model reaches only the records belonging to the task
Public administration and its suppliers The cloud rulebook of the ACN requires that, for strategic data, all types of metadata be processed on infrastructure within the territory of the Union11 Self-hosting under the MIT licence on your own infrastructure, with no operation by us in between, provided you also keep the model path within the Union
Essential and important entities ACN Determinazione 379907/2025, applicable since 15 January 2026, sets a deadline of 18 months from notification for the baseline measures12 A register of what actually runs through the platform, with accounts, connectors and permissions

The overview below sorts by who has to carry out the assessment, not by who is doing something wrong. The right-hand column contains only what a platform can contribute, which is evidence. The assessment itself belongs in your company, and in regulated fields with your legal counsel as well.

Use case 1: setting up human oversight so that it can be demonstrated

In most companies the oversight has long been happening. A specialist looks at what a system proposes and decides. It is just that nothing is left of it afterwards: no timestamp, no source reference, no note, nothing that could be shown to an authority two years later. In the AI workspace this step runs inside one case file. The proposal from the specialist system is opened together with the documents it rests on, the responsible person records the review and the decision in the same case file, and the call appears with timestamp, account and tool in the audit log, the running record of every access, which you can export as a file.

Two settings decide whether this becomes usable evidence. First the permissions: they apply in the order user, role, group, server default, and write access to connected systems has to be approved separately. Second the source references: answers from a knowledge base, that is from your company’s own documents, are shown with the place where they appear. That way you can later show not only that someone reviewed the case but what they reviewed it against. Which settings your administration sets for this is described under Governance.

  1. Proposal from the specialist system, opened with the documents it rests on
  2. Review, note and decision by the responsible person in the same case file
  3. Entry in the audit log with timestamp, account, tool and outcome
The oversight happens anyway. What is new is that it leaves a trace.

The limit to this, and it is the most important one in this article: the product does not create human oversight, it makes it demonstrable. Anyone who confirms a proposal without reading it produces a log entry and not oversight. Whether oversight is sufficient in substance is judged in the end by a supervisory authority and a court, not by a log.

Use case 2: a register of what actually runs

The first question in an audit is never whether your company uses AI, but which AI. It can only be answered if the points of access come together in one place. Through Kisuno your staff reach the models through a single access: the current models from OpenAI (ChatGPT) and Anthropic (Claude), which run in the AWS data centre in Frankfurt. AWS is a US company, so the US CLOUD Act applies even with servers in Frankfurt, and we say so openly. For customers with higher data-protection requirements, open frontier models such as GLM, Kimi and DeepSeek are available, operated by European companies on servers in Europe; the CLOUD Act does not apply there. Third-party systems are connected via MCP, the Model Context Protocol, an open standard for connecting to external programs; a single connection of that kind is called a connector, and permissions apply per tool.

What comes out of this is not a piece of paper but an analysis: which models are available at all in your instance, that is in your own installation of the software, which model is the server default, which knowledge bases exist and who may read them, which connectors are set up, which tools those release and who actually makes use of them. Consumption is broken down per model. Which software can be connected today is listed on the Integrations page.

  1. All model access runs through one point of access instead of scattered accounts
  2. Connectors to third-party systems via MCP, with permissions per tool
  3. Analysis: model, knowledge base, tool, account and consumption
What runs through the platform becomes visible. Everything else stays invisible, and that is part of the statement.

The limit: no automatic AI inventory comes out of it. The platform sees what runs through it, and nothing else. A browser extension, a private account on a phone, a model inside a specialist application, all of that stays invisible. That is exactly why the 33.4% of users who name no field of application are an indication of how much runs alongside the official routes.6 A register that holds up in an audit under decree 231 or under the AI Act is broader, and it is kept by people.

Use case 3: preparing personnel decisions without taking them by automated means

A job advertisement brings in more applications than can be read in an afternoon. The usual route is automatic ranking. That is expressly not what the new Italian provision targets: according to the official statement, searching and shortlisting applications does not count among the final decisions on whether an employment relationship comes about, not even where it means that someone does not reach the next stage.1 What does remain is Article 22 of the General Data Protection Regulation, which asks not what a step is called but what effect it has.13 The workflow that holds up on both counts looks like this: the specialist unit sets the criteria from the advertisement and approves them. The AI colleague then compiles, for each application, what the documents say on those criteria, each time with the place where it appears, and what is missing. Nothing is ranked, nothing is weighted, nothing is discarded.

The decision stays with a person and is recorded as that person’s decision, with reasons, date and name. What the General Data Protection Regulation prohibits is the decision based solely on automated processing with a significant effect, not support in reaching it.13 The adopted provision of the second decree draws that line more sharply for dismissal by placing the legal consequence not in a fine but in nullity.1 On top of this comes an obligation that already applies in Italy: Legge 132/2025 requires employees to be informed in writing about the use of AI systems in the employment relationship.4

  1. Criteria from the advertisement, set and approved by the specialist unit
  2. A compilation per application, with the source reference in the documents
  3. Decision, reasons and the name of the deciding person in the case file
The draft comes from the system. The decision comes from a person and is recorded as such.

The limit, and an Italian case helps here. On 14 May 2026 the Garante, Italy’s data protection authority, issued a formal warning to the provider of a browser add-on that was meant to infer employee stress from messages in chat programs; what mattered was not the intention but that the aggregated analyses could put the employer in a position to learn something about the emotional state of individuals, even indirectly. The warning also relies expressly on Article 5(1)(f) of the AI Act, which prohibits systems that infer emotions in the workplace.14 Carried over, that means: a signature under a ranking that has effectively already decided is not a human decision. Anyone who draws the shortlist so tightly that only one person is left has decided by automated means and had a human sign it.

Limits: what is not being claimed here

First the restriction that takes the scale out of the whole article. The criminal offence applies to high-risk systems. An ordinary chat assistant that someone uses to draft a text, produce a summary or put a question to their own documents is normally not one. Anyone suggesting that every company is affected from now on is not being serious, and the Digital Omnibus has narrowed the high-risk article further and pushed back its application.8 Checking whether one of your systems falls into that category still makes sense, and it is a legal check and not a technical one.

Second: no product makes a Modello 231 compliant, that is the organisational and control model decree 231 requires. What a platform delivers is logging and permission control, in other words evidence. The organisational model itself consists of a risk analysis for your company, of procedures, of a supervisory body and of a system of sanctions, and if it comes to it a court decides whether it was adequate. Compliance is not met by introducing a piece of software, and a provider who hints otherwise is selling you a problem for later.

  1. No high-risk system, no strategic data: managed operation in Lupfig
  2. A high-risk system in use: oversight, procedures and assessment with you
  3. Strategic data of an administration: all metadata within the territory of the Union
  4. This case: self-hosting on your infrastructure, with no us in between
Four rows. At the third one our operation in Lupfig does not fit on the wording, and the fourth is the answer to that.

Third: what is prohibited is the solely automated personnel decision, not the assistance. Anyone concluding from this that AI has become unusable in HR is reading the rule too broadly; anyone concluding that a signature is enough is reading it too narrowly. What counts is whether a person actually assessed the case and was in a position to assess it, and for that they need time, access to the documents and the authority to decide differently from the proposal.

Fourth, the point where our own offering does not fit. The ACN cloud rulebook for the public administration classifies data and services as ordinary, critical or strategic, where strategic means that an impairment can touch national security. For strategic data and services it requires all types of metadata to be processed on infrastructure located within the territory of the European Union; the requirement carries the number 8_S in Annex 2 and the number 17_S in Annex 3, and the only exception is the metadata needed to provide the services expressly named there.11 Switzerland is not part of the territory of the Union. On the wording, our managed operation in the ISO 27001 certified data centres of Green in Lupfig is precisely not enough for this case, and the certification of those data centres changes nothing about that, because it concerns the security of the operation and not the location. The honest answer here is self-hosting: you run the software on your own infrastructure within the territory of the Union, the model path stays within the Union as well, and we have no part in it. The LibreChat base is MIT licensed, the repository with our own extensions follows shortly.

Fifth, the other direction, so that no false fear grows out of this. That cloud rulebook applies to the public administration and to those who supply it, not to private companies. For a private company it is a benchmark and not an obligation. And where a tender calls for a data centre in Italy, that is as a rule a criterion set by the contracting authority and not a statutory requirement. What applies to you depends on your classification, your sector and your contracts. This article is no substitute for legal advice.

Frequently asked questions on Article 437-bis, the Modello 231 and human oversight

Does a prison sentence for missing AI oversight apply in Italy from now on?

No, at least not as at the editorial deadline of this article. The Council of Ministers adopted the two decrees on the final reading on 4 August 2026; on 2 September 2026 they had not been published. Article numbering and wording become binding only with publication in the Gazzetta Ufficiale. Check the published text before you base measures on it. This section is no substitute for legal advice.

Is our chat assistant a high-risk system?

As a rule, no. Under the AI Act, high-risk covers systems built into a product as a safety component and systems in the fields of use in Annex III, such as recruitment, creditworthiness assessment, critical infrastructure or education. An assistant that drafts texts and answers questions put to your own documents normally does not fall under it. What is decisive is not the tool but the purpose you use it for, and that classification is made by your company.

Does a platform make our Modello 231 compliant?

No, and no product can. An organisational model under decree 231 consists of a risk analysis, of procedures, of a supervisory body and of a system of sanctions. A platform supplies evidence for it: logs of who called which tool and when, and permissions showing who was allowed to reach what. Whether the model is effective is decided if it comes to it by a court, not by a provider.

Are we still allowed to use AI in recruitment?

Under the adopted text, what is prohibited is the solely automated decision on the establishment, modification or termination of the employment relationship, not the support. The official statement expressly leaves the search and shortlisting of applications outside that, even where it means that someone does not reach the next stage; Article 22 of the General Data Protection Regulation still applies there. You can open up documents, set criteria against each other and have drafts produced. The decision has to be taken by a person who actually assessed the case and could have decided otherwise. In Italy there is the additional duty to inform employees in writing about the use of such systems in the employment relationship.

What does the Digital Omnibus change about the deadlines?

Regulation 2026/1744 was published in the Official Journal of the Union on 24 July 2026. It postpones the application of the obligations for high-risk systems to 2 December 2027 for standalone systems and to 2 August 2028 for systems built into a product. It changes little about the obligations themselves and a great deal about when they start. How a national criminal offence relates to this can only be judged from the published wording.

Is a server location in Switzerland enough for Italian administrations?

For strategic data and services it is not, on the wording of the cloud rulebook. There, all types of metadata have to be processed on infrastructure within the territory of the European Union, and Switzerland is not part of it. For that case, self-hosting on your own infrastructure is the form that fits, not our managed operation in Lupfig. For private companies this rulebook does not apply; there it is a benchmark and not an obligation.

What is in the audit log, and what is not?

The log holds the calls that run through the platform: timestamp, account, model used, tool called and outcome, exportable as a file. What it does not hold is what happens outside it, so a browser extension, a private account or a model inside a specialist application. An AI inventory does not come out of it on its own. Telemetry is switched off by default with us and customer data does not train any models; both are set out in the data processing agreement.

What does it cost, and what is free?

The LibreChat base is MIT licensed, the repository with our own extensions follows shortly, and self-hosting is free of charge. The managed instance costs CHF 7 (EUR 7.50) per person per month, through the end of the current month with 50 percent off on a twelve-month term, that is CHF 3.50 (EUR 3.75). Testing is free and not limited in time: every new account starts with a starting credit of CHF 50 (EUR 55) for model usage, with no payment details. If your case calls for all metadata to be processed within the territory of the Union, self-hosting is not the cheaper of the two forms but the only one that fits. All the figures are on the Pricing page.

Walk through it on a case of your own

Bring an anonymised workflow in which a person reviews and decides today, and we will go through together what of it would be demonstrable and what would not. Or sign up and try it out yourself.

Book a live demo Get started

Sources

All figures, deadlines and wordings in this article come from the sources below, last checked on 2 September 2026. At that point the two implementing decrees had been adopted but not published; the details on them rest on the official communiqué of the Council of Ministers and on a law firm commentary on the draft. The final numbering and wording follow only from publication in the Gazzetta Ufficiale.

  1. Presidenza del Consiglio dei ministri, Comunicato stampa del Consiglio dei ministri n. 185 of 4 August 2026, final reading of the two decrees aligning national law with Regulation (EU) 2024/1689, with the new Article 437-bis of the criminal code, which punishes the failure to take safety measures with a penalty graded by the legal interest at risk, and with the nullity of a decision on the establishment, modification or termination of the employment relationship based solely on automated processing, the statement expressly recording that the search and shortlisting of applications does not count among those decisions even where it leads to non-admission to the later selection stages: governo.it; law firm commentary by Gianni & Origoni on the draft criminal decree, with the element of omitted human oversight, the penalty ranges of one to five and of two to eight years and the new Article 25-vicies of decree 231/2001: gop.it. The figure of 600 to 1,000 quotas and the disqualification sanctions are set out in Article 17 of the draft transmitted to Parliament, Atto del Governo no. 418 of the 19th legislature; the wording may still change before official publication: sistemapenale.it
  2. Gazzetta Ufficiale della Repubblica Italiana, Serie Generale: review of the sommari of the Serie Generale nos. 177 to 203, 1 August to 2 September 2026; the most recently published decreto legislativo carries the number 151 of 30 July 2026, and the two decrees adopted on 4 August 2026 are not among them: gazzettaufficiale.it
  3. Decreto legislativo 8 giugno 2001, n. 231, Article 9 on the disqualification sanctions including the ban on entering into contracts with the public administration, and Article 10 on the fine with a quota value of 258 to 1,549 euros: normattiva.it
  4. Legge 23 settembre 2025, n. 132, Disposizioni e deleghe al Governo in materia di intelligenza artificiale, published in Gazzetta Ufficiale no. 223 of 25 September 2025, in force since 10 October 2025, Article 11 on informing employees in writing and the delegating provisions addressed to the government: normattiva.it
  5. Istat, Statreport Imprese e ICT, Anno 2025, published on 15 December 2025, sample of 26,246 companies, representative of 218,446 companies with ten or more employees: 16.4% using at least one AI technology, 53.1% among large companies, 15.7% among small and medium-sized ones, gap widening from around 20 percentage points in 2023 to 37 percentage points in 2025: istat.it
  6. Istat, Statreport Imprese e ICT, Anno 2025, the same survey: 33.4% of the companies using AI name none of the proposed fields of application, 83.3% of them businesses with 10 to 49 employees: istat.it
  7. Regulation (EU) 2024/1689 on artificial intelligence, Article 6 with Annex I and Annex III on classification as high-risk, Article 14 on human oversight and Article 26 on the obligations of deployers: eur-lex.europa.eu
  8. Regulation (EU) 2026/1744 simplifying the rules on artificial intelligence, published in the Official Journal of the European Union on 24 July 2026, with the new application dates of 2 December 2027 for standalone high-risk systems and 2 August 2028 for those built into a product: eur-lex.europa.eu
  9. Osservatorio Artificial Intelligence of the Politecnico di Milano, survey on AI governance in large Italian companies, sponsor-funded and without a disclosed sample; we do not repeat the shares reported there, because they cannot be checked against the publication that is accessible: osservatori.net
  10. Istat, Statreport Imprese e ICT, Anno 2025, the same survey: of the companies that do not use AI, 11.5% have considered using it; the obstacles of a lack of skills at 58.6% and a lack of legal clarity at 47.3% refer exclusively to that subgroup and not to all non-users: istat.it
  11. Agenzia per la cybersicurezza nazionale, Regolamento per le infrastrutture digitali e per i servizi cloud per la pubblica amministrazione, in force since 1 August 2024, category PR.DS-01, requirement 8_S in Annex 2 and requirement 17_S in Annex 3: for strategic data and services, all types of metadata are to be processed on infrastructure within the territory of the European Union, except for those needed for the services named there: acn.gov.it
  12. Agenzia per la cybersicurezza nazionale, Determinazione n. 379907/2025 of 19 December 2025, applicable from 15 January 2026, with a deadline of 18 months from notification for the baseline measures; it replaces the earlier Determinazione 164179/2025: acn.gov.it
  13. Regulation (EU) 2016/679, General Data Protection Regulation, Article 22 on decisions based solely on automated processing with legal or similarly significant effect: eur-lex.europa.eu
  14. Garante per la protezione dei dati personali, Provvedimento n. 342 of 14 May 2026, a warning under Article 58(2)(a) of the General Data Protection Regulation addressed to the provider of a browser add-on that was meant to infer the strain on employees from messages in chat programs; the warning also relies expressly on Article 5(1)(f) of Regulation (EU) 2024/1689, which prohibits systems that infer emotions in the workplace: garanteprivacy.it