CLARYEL · Law, AI and data
Fines of up to €35 million or 7% of turnover, and in some cases prison. What a company really risks, with the official sources.
Local AI or cloud AI? How the two fit together, with the legal caveats.
Using AI, the cloud and data is normal. Breaking the law without noticing, unfortunately, is too. These are rules an Italian company can break every day, with the maximum penalties and links to the official texts.
General information, not legal advice.
up to €20M or 4%maximum penalty
What is easy to break
Uploading customers’ or employees’ personal data to an AI service without a legal basis, a processor contract or transfer safeguards.
Example
An employee pastes a client list or a candidate’s CV into a cloud chatbot (illustrative example). Lower tier: up to €10M or 2% of worldwide turnover.
Text of the law Regolamento (UE) 2016/679 — EUR-Lex
up to €35M or 7%maximum penalty
What is easy to break
Prohibited practices such as emotion recognition at work (banned since 2 February 2025); AI-generated content without labelling (Art. 50, from 2 August 2026).
Example
An HR tool that “reads” employees’ emotions. High-risk obligations: 2 December 2027 and 2 August 2028 (Digital Omnibus). For SMEs the lower amount applies. In Italy, D.Lgs. 179/2026 is due to enter into force on 23 October 2026 and names the supervisory authorities.
Text of the law Regolamento (UE) 2024/1689 — EUR-Lex
1–5 yearsmaximum penalty
What is easy to break
Spreading AI-generated or altered content (deepfakes) that causes unjust harm (Art. 612-quater of the Criminal Code); using AI in a crime is an aggravating circumstance.
Example
A “joke” video with a real person’s AI voice, published without consent. Employers must also inform workers about the use of AI.
Text of the law Legge 23 settembre 2025, n. 132 — Normattiva
up to €10M or 2%maximum penalty
What is easy to break
Not adopting security measures or not notifying incidents to CSIRT Italia (early warning within 24 hours, notification within 72 hours).
Example
Connecting cloud AI agents to the infrastructure without assessing supply-chain risks. Important entities: up to €7M or 1.4%.
Text of the law D.Lgs. 138/2024, art. 38 — Gazzetta Ufficiale
up to 2 yearsmaximum penalty
What is easy to break
Revealing or using someone else’s trade secrets, including through AI services; the penalty increases if IT means are used.
Example
Uploading a former employer’s technical documentation to an AI service. And without “reasonably adequate measures”, your own know-how may lose protection (Art. 98 Industrial Property Code).
Text of the law Codice penale, art. 623 — Normattiva
6 months – 6 yearsmaximum penalty
What is easy to break
Unlawful processing or transfer of personal data for profit and causing harm, including transfers outside the EU without GDPR safeguards (1–3 years).
Example
Exporting the customer database to an external service; disseminating a large-scale archive of personal data: 1–6 years.
Text of the law D.Lgs. 196/2003, art. 167 — Gazzetta Ufficiale
up to 1 year of arrestmaximum penalty
What is easy to break
AI tools that allow remote monitoring of employees without a union agreement or authorisation from the National Labour Inspectorate; individual consent does not replace it.
Example
Systematic backups of employees’ email: €460,000 fine to Piaggio (July 2026). An AI plug-in that measured stress in chats: warning to a start-up (May 2026). Penalty: fine of €154–1,549 or arrest from 15 days to 1 year.
Text of the law Legge 20 maggio 1970, n. 300 — Normattiva
6 months – 3 yearsmaximum penalty
What is easy to break
Text and data mining for AI against the rightsholder’s opt-out (Art. 70-quater): now a specific offence (Art. 171, letter a-ter).
Example
Mass-downloading other people’s texts and images to feed an AI. Art. 171: fine of €51–2,065; Art. 171-ter: 6 months – 3 years.
Text of the law Legge 22 aprile 1941, n. 633 — Normattiva
The CLARYEL system will run continuous compliance audits and build a shared knowledge base that CLARYEL will make available. It helps reduce risks; it does not replace a DPO or a lawyer.
The filter helps reduce risks; it does not promise 100% anonymisation.
News items are shown in the language of the source. Hover or tap for a short summary; the link opens the source in a new tab.
General information, not legal advice.
