How does Italy’s new Artificial Intelligence Law change the liability risks for businesses, and what should companies do to protect themselves?

In this episode of The Legal Break Podcast, Giulio Coraggio, technology and data lawyer, and Antonio Ravenna, journalist, discuss the impact of Italy’s new AI legislation on corporate liability. They explore how the new framework affects companies developing, deploying or using AI systems, the potential exposure of businesses and their management, and the practical steps organisations should consider to mitigate legal risks.

From AI governance and accountability to risk management and compliance, this conversation examines what the new law means for businesses and how companies can prepare for the evolving legal landscape surrounding artificial intelligence.

Listen to the episode to understand the implications of Italy’s new AI law for corporate liability and the key issues businesses should address when adopting AI.

Send us Fan Mail

What should a company do when it discovers a vulnerability in a product covered by the EU Cyber Resilience Act? And what happens when that vulnerability becomes a cybersecurity incident?

In this episode, Giulio Coraggio, a technology and data lawyer, discusses with the journalist Antonio Ravenna how companies should deal with vulnerabilities and cybersecurity incidents under the Cyber Resilience Act (CRA), including the new reporting obligations, the role of ENISA and the CRA Single Reporting Platform, and the importance of having the right internal processes in place before an incident occurs.

We look at the key practical questions companies need to address: when does a vulnerability have to be reported, when does an incident trigger a notification, what are the applicable deadlines, and who needs to be involved?

The CRA is changing the way manufacturers need to approach cybersecurity, moving from reactive incident response towards continuous vulnerability management and security throughout the product lifecycle.

If you manufacture, distribute or work with products with digital elements, understanding these obligations is becoming increasingly important.

Send us Fan Mail

What incidents and vulnerabilities must be reported under the Cyber Resilience Act (CRA)?

Since 11 September 2026, the CRA reporting obligations are in force, with companies required to assess and report certain cybersecurity incidents and actively exploited vulnerabilities through the ENISA reporting platform.

In this video, I explain:

* What events and vulnerabilities need to be reported
* How companies should assess whether a report is required
* What internal processes should be put in place
* What companies need to do to comply with the CRA

And yes, there is also a brief appearance by my Neapolitan horn socks. 😉

Send us Fan Mail

The September 11 deadline under the Cyber Resilience Act has passed, and the reporting platform is already operational. Companies within the CRA’s scope need to understand what the new reporting obligations mean and what action is required.

Watch my latest video for a practical overview of the CRA reporting requirements and the key implications for companies.

Send us Fan Mail

Prediction markets are expanding rapidly, allowing users to trade contracts linked to the outcome of future events, from elections and sports competitions to economic and other real-world events.

But how should these platforms be qualified under European gambling laws?

In this episode of Diritto al Digitale, Giulio Coraggio, a technology, data and gambling lawyer, looks together with the journalist Antonio Ravenna at the regulatory question that is becoming increasingly relevant for prediction market operators: when does a prediction market become gambling in Europe?

The qualification is far from being merely theoretical. Whether a platform falls within the scope of gambling regulation can affect licensing requirements, consumer protection obligations, advertising restrictions, AML requirements and the regulatory exposure of both operators and other businesses involved in the ecosystem.

I discuss the key elements that European regulators and courts may consider when assessing these platforms, including the role of chance, the user's stake, the nature of the underlying event and the way the platform is structured.

For operators entering the European market, the legal classification of the product can therefore become one of the first regulatory questions to address.

Are prediction markets the next frontier of gambling regulation in Europe?

Watch the episode to find out.

Send us Fan Mail

The EDPB has issued its new Guidelines on Anonymisation, and they could have major implications for AI systems, AI training data and GDPR compliance.

In this episode of the Legal Break, Giulio Coraggio discusses the new EDPB Guidelines with journalist Antonio Ravenna and explains what they mean in practice for organisations developing or deploying AI.

Among the key issues discussed:

• When can data really be considered anonymous under the GDPR?
• Why anonymisation is relative and context-dependent
• The EDPB's three criteria: No Record Isolation, No Linkage and No Inference
• Why AI models and synthetic data create new re-identification risks
• How AI can make inference and re-identification easier
• Why simply removing names and identifiers may not be enough
• What the Guidelines mean for AI developers and businesses using personal data
• Why organisations should periodically reassess whether data remains anonymous
• The relationship between the EDPB's anonymisation guidance and its approach to AI and web scraping

The EDPB Guidelines 02/2026 were adopted in July 2026 and are currently open for public consultation until 30 October 2026.

The key message: anonymisation is no longer something organisations can assume; it needs to be demonstrated, tested and reassessed.

📌 Read the full analysis:
https://www.gamingtechlaw.com/2026/07/edpb-anonymisation-guidelines-ai/

Send us Fan Mail

The Digital Omnibus has postponed the obligations on high-risk AI systems, but it has not modified the general date of application of the AI Act. As a consequence, as of the 2nd of August 2026, the enforcement powers on general purpose AI models, the transparency obligations under Article 50 and the entire sanctioning framework become fully enforceable.

In this episode of Diritto al Digitale, Giulio Coraggio, technology and data lawyer, reviews what is actually applicable as of today, the operational implications of the requalification from deployer into provider, what Regulation (EU) 2026/1744 has postponed to December 2027 and August 2028, and why the actual obstacle to compliance is not the legal text, but the absence of an allocated accountability. With a concrete five-point board paper for in-house legal functions.

Send us Fan Mail

As of 19 June 2026, withdrawing from a contract concluded online should become as simple as signing up for it. In this episode, journalist Antonio Ravenna interviews Federico Toscani of DLA Piper to unpack the new Article 54-bis of the Italian Consumer Code (Legislative Decree 206/2005), introduced by Legislative Decree 209/2025.

At the heart of the conversation is a new obligation for businesses selling at a distance: they must provide a clear, visible, and easily accessible digital withdrawal function — effectively a "withdrawal button" placed on the same online interface used to enter into the contract.

Over the course of the interview, Federico Toscani and Antonio Ravenna discuss:

1. the rationale behind the rule, and why it exists to rebalance the ease of purchase against the difficulty of cancelling;
2. what the withdrawal function must actually include (button wording, the withdrawal declaration, and the details identifying the consumer and the contract);
3. the confirmation step and the acknowledgment of receipt sent on a durable medium;
4. the moment at which withdrawal is deemed validly exercised in relation to the statutory deadline (paragraph 7);
5. what companies should do right now to bring their websites, apps, and customer journeys into compliance and avoid disputes.

A valuable episode for e-commerce operators, legal departments, compliance teams, and anyone working in the digital market who wants to align their withdrawal process with the transparency and accessibility standards required under the new regime.

Send us Fan Mail