How does Italy’s new Artificial Intelligence Law change the liability risks for businesses, and what should companies do to protect themselves?

In this episode of The Legal Break Podcast, Giulio Coraggio, technology and data lawyer, and Antonio Ravenna, journalist, discuss the impact of Italy’s new AI legislation on corporate liability. They explore how the new framework affects companies developing, deploying or using AI systems, the potential exposure of businesses and their management, and the practical steps organisations should consider to mitigate legal risks.

From AI governance and accountability to risk management and compliance, this conversation examines what the new law means for businesses and how companies can prepare for the evolving legal landscape surrounding artificial intelligence.

Listen to the episode to understand the implications of Italy’s new AI law for corporate liability and the key issues businesses should address when adopting AI.

Send us Fan Mail

What should a company do when it discovers a vulnerability in a product covered by the EU Cyber Resilience Act? And what happens when that vulnerability becomes a cybersecurity incident?

In this episode, Giulio Coraggio, a technology and data lawyer, discusses with the journalist Antonio Ravenna how companies should deal with vulnerabilities and cybersecurity incidents under the Cyber Resilience Act (CRA), including the new reporting obligations, the role of ENISA and the CRA Single Reporting Platform, and the importance of having the right internal processes in place before an incident occurs.

We look at the key practical questions companies need to address: when does a vulnerability have to be reported, when does an incident trigger a notification, what are the applicable deadlines, and who needs to be involved?

The CRA is changing the way manufacturers need to approach cybersecurity, moving from reactive incident response towards continuous vulnerability management and security throughout the product lifecycle.

If you manufacture, distribute or work with products with digital elements, understanding these obligations is becoming increasingly important.

Send us Fan Mail

What incidents and vulnerabilities must be reported under the Cyber Resilience Act (CRA)?

Since 11 September 2026, the CRA reporting obligations are in force, with companies required to assess and report certain cybersecurity incidents and actively exploited vulnerabilities through the ENISA reporting platform.

In this video, I explain:

* What events and vulnerabilities need to be reported
* How companies should assess whether a report is required
* What internal processes should be put in place
* What companies need to do to comply with the CRA

And yes, there is also a brief appearance by my Neapolitan horn socks. 😉

Send us Fan Mail