Art. 25-vicies is the proposed new article introduced by draft decree no. 418 into Italy’s D.Lgs. 231/2001. Based on available information, it would bring AI governance, system security, human oversight, deepfake risk, and documentary proof into the corporate liability framework. In practice, that means an organization may need to show not only that its AI worked, but that it was controlled, approved, and monitored.
For cybersecurity teams, the term matters because security controls become legal evidence. Access logs, approval workflows, model-change records, and review notes can help prove who authorized an action and whether a human checked it. This is especially relevant when attackers use synthetic audio, video, or text to impersonate staff, trigger fraud, or push unauthorized AI actions. A strong defense under a rule like Art. 25-vicies is traceability: clear records, human oversight, and auditable controls.