A crime for failing to oversee. And for those who cannot?

Since 30 September 2026, Article 437-bis of the Italian criminal code exists. It was introduced by Legislative Decree 160/2026, the first implementing decree of Law 132/2025. According to Domani, it punishes with one to five years anyone who fails to adopt safety or human-oversight measures for a high-risk system, where this endangers life or physical safety; two to eight if state security is at risk. Only gross negligence counts. The offence is also a predicate for corporate liability under Legislative Decree 231/2001.

The model is clear: Article 437, wilful removal or omission of workplace safety precautions. A protection born in the factory is carried into software. I find it coherent. And I find it dangerous, for a reason that has nothing to do with the penalty.

The chain of signatures

In workplace safety we have known for decades who must do what: employer, manager, supervisor, safety officer. Each has a perimeter, training, spending power. In high-risk systems the chain is much shorter and much less clear. Often it shrinks to one person assigned the role of “human overseer” under Article 14 of the AI Act.

Who is that, usually? A department head, a doctor, a credit officer. They did not build the system. They cannot see its training data: the new Italian decree, moreover, extends trade-secret protection precisely to training data and architectures. They receive instructions for use written by others, in others’ language.

When I measure documents with the LX Complexity Score I almost always find the same thing: texts built to protect their authors, not to inform their readers. If the instructions for a high-risk system resemble the brain-computer interface consent documents I analysed (syntactic density 72 out of 100, experimental threshold 45), the overseer is not in a position to oversee. They are in a position to sign.

The scapegoat risk

Criminal law has a known reflex: find the natural person closest to the event. In an incident caused by a system, the closest person is the overseer. Gross negligence should protect them. But gross negligence is assessed against what a person could understand and do. And that is exactly what nobody documents today.

That is why Article 7 of the Habeas Mentem Charter says: “Whoever must oversee a machine has the right to the conditions to judge it, not merely to sign for it.” With Article 437-bis, that sentence stops being a principle and becomes a line of defence.

What changes in compliance programmes

Anyone updating a compliance programme today should treat human oversight as a real safeguard, not a name on an org chart:

1. written appointment with real powers, including stopping the system;
2. instructions for use tested for comprehensibility by those who must use them;
3. training tied to the failure modes of the specific system, not to “AI” in general;
4. supplier contract guaranteeing the information needed to oversee, trade secrets notwithstanding.

The last point is where I see the most negotiating room. Suppliers, especially non-EU ones, offer standard documentation. A deployer facing criminal exposure has a strong argument to ask for more. Use it now, before renewals.