High-risk AI systems: the first harmonised standard supporting the AI Act for quality management systems
Artificial Intelligence
On 14 October 2026, the European Commission, by means of Implementing Decision (EU) 2026/2274, published a reference to standard EN 18286:2026 in the Official Journal of the European Union (“OJEU”) “Artificial intelligence – Quality management system for the purposes of the regulatory requirements of the EU AI Regulation”, transposed in Italy as UNI CEI EN 18286:2026. It is the first harmonised standard supporting Regulation (EU) 2024/1689 (“AI Act”).
Under Article 40 of the AI Act, compliance with harmonised standards published in the OJEU gives rise to a presumption of conformity with the requirements covered by those standards. EN 18286:2026 relates specifically to Article 17(1), translating the obligation to establish a documented quality management system into an organisational model that governs compliance strategy, design and development, data and risk management, post-market monitoring, incidents and non-conformities.
Article 43 links this quality management system (‘QMS’) to the conformity assessment procedures for high-risk systems (internal control in accordance with Annex VI or a procedure involving a notified body in accordance with Annex VII). A QMS compliant with EN 18286:2026 therefore allows for the presumption of conformity with the requirements of Article 17(1) covered by the standard and provides a reference both in dialogue with the notified body, where applicable, and in maintaining the ongoing conformity of high-risk AI systems.
Xandr, €8.6 million fine: advertising intermediaries must verify the validity of consent
Data Protection
The Norwegian Data Protection Authority (Datatilsynet) has imposed a fine of 92 million Norwegian kroner (approximately 8.6 million euros) on Xandr, an AdTech company within the Microsoft group, for the unlawful processing of personal data belonging to users of a dating app.
The decision, adopted on 2 October 2026 and becoming final on 3 November 2026, concerns the real-time bidding system, which shared personal data with advertisers for the automated allocation of adverts.
The data processed included IP addresses, advertising identifiers and app usage information, which were capable of revealing sexual orientation and therefore fell within the special categories referred to in Article 9 of the GDPR; in this context, the data subject’s explicit consent was required.
The most significant aspect of the decision concerns the liability of advertising intermediaries. Xandr, designated as a joint controller alongside the dating app, had relied on the consents collected by the app without independently verifying their validity or suitability to cover its own activities.
Accountability obligations cannot be transferred by contract: each joint controller must be able to demonstrate the lawfulness of the processing. Duplicate consents are not required; rather, the validity of the consent, its scope and its traceability must be verified.
The implications extend to the AdTech and MarTech ecosystems: contractual guarantees and technical indicators of consent are not sufficient. Companies must map data flows, define privacy roles, verify information provided to users and implement documentable controls over technologies and partners, with particular attention to the verification of advertising partners.
Generative AI: the AGCM is investigating Suno’s contractual clauses and content licences
Artificial intelligence and copyright
In a press release dated 6 October 2026, the Italian Competition and Market Authority (AGCM) announced the launch of proceedings CV278 against Suno Inc., a US company offering a generative AI service for music creation, concerning clauses in its Terms of Service that are potentially unfair under Article 33 of the Consumer Code.
The allegations, which are still at a preliminary stage, relate to three areas: (i) unilateral changes and suspension/termination of the service; (ii) limitations on liability and restrictions on consumer protection measures; (iii) content licences.
With regard to copyright, the Terms of Service provide for a very broad licence that extends not only to the generated output but also to works uploaded by users (‘Submissions’), even if created independently prior to using the service; the AGCM challenges the excessively vague scope of this licence.
Reference is also made to the waiver of moral rights, which may be in conflict with Articles 20 et seq. of Law No. 633/1941, which recognise these rights as personal and inalienable.
The proceedings highlight the need for providers of generative AI services to establish transparent and proportionate terms of use, with particular regard to the scope of licences covering content uploaded by users and the protection of copyright.
Gaming and virtual currencies: new European measures to protect consumers
Consumer Protection
The European Consumer Protection Cooperation Network (CPC), coordinated by the European Commission, has launched new actions against nine companies in the video games sector to verify compliance with European legislation regarding the use of virtual currencies. These initiatives complement the proceedings already initiated against Microsoft and Activision Blizzard, in which the Italian AGCM is acting as lead authority alongside the Norwegian and Danish authorities.
The authorities’ focus is on the transparency of prices expressed in virtual currency, the elimination of ‘dark patterns’ (interfaces designed to influence users’ choices) and the protection of minors. The CPC Network’s Key Principles require clear pricing and information, the absence of hidden costs and forced currency purchases, fair terms, respect for the right of withdrawal and enhanced safeguards for vulnerable consumers.
The CPC Network calls on all companies in the sector to review their practices and announces possible further joint actions, prioritising price transparency in virtual currency, the absence of ‘dark patterns’ in purchasing interfaces, and the protection of minors. The launch of these actions does not imply that infringements have been established, but it does make it advisable to review prices and currency packages, interface design and safeguards for minors.
In the accompanying joint statement, the CPC Network calls on all companies in the sector to review their practices and announces further joint action where appropriate, paying particular attention to variable reward systems (so-called ‘loot boxes’), especially where these are aimed at minors, and to deceptive techniques such as misleading countdowns and unfounded claims of scarcity. The launch of these measures precedes any investigation into infringements, but makes it advisable for operators to review the transparency of prices and currency packages, purchase interfaces and safeguards for minors.
EU ‘MYKONOS’ trade mark for perfumes and cosmetics declared invalid: the EUIPO Board of Appeal rules on evocative place names
Intellectual property
By decision of 11 June 2026, the First Board of Appeal of the European Union Intellectual Property Office (‘EUIPO’) declared the European Union word mark ‘MYKONOS’ for perfumery, fragrances and personal care products in Class 3 to be invalid, finding the sign to be descriptive and lacking the distinctive character necessary to indicate the commercial origin of the goods.
The crux of the reasoning lies in the perception of the relevant public: at the date of filing, a significant proportion of consumers in the Union recognised ‘Mykonos’ as the name of a well-known Greek island, associated with tourism, the Mediterranean environment, cultural heritage and natural features. The fact that Mykonos is not a typical place of production for perfumes does not preclude descriptiveness, since in this sector references to places, atmospheres, natural ingredients and regional storytelling constitute a commercial characteristic of the goods.
The Commission refers to Article 7(1)(c) of Regulation (EU) 2017/1001 (‘EUTMR’), which precludes the registration of signs intended to designate, amongst other things, the geographical origin or other characteristics of goods, a defect which may give rise to invalidity under Article 59 of the EUTMR. This approach is consistent with Italian law, where Article 13 of the Industrial Property Code excludes descriptive signs or those lacking distinctive character, and Article 25 provides for their invalidity.
The ruling confirms a rigorous approach to place names: a well-known geographical name is registrable as a trade mark only if, in relation to the goods claimed, it is not perceived as a descriptive indication or has acquired independent distinctive character.
Whistleblowing: ANAC imposes sanctions on report handlers for breach of confidentiality
Compliance
By Resolution No. 344 of 9 September 2026, ANAC clarifies the scope of the confidentiality obligation incumbent on whistleblowing managers and the duties of care laid down in Legislative Decree 24/2023.
ANAC dismisses the allegation of ‘failure to manage’ and fines the members of the management body €15,000 each for breach of confidentiality; pursuant to Article 12 of Legislative Decree 24/2023, a breach may be deemed to have occurred even without proof of actual identification where the information disclosed is such as to enable identification.
Protection does not depend solely on the reporting channel, but also on how the investigation is conducted: procedures are needed that limit the circulation of information, reduce the risk of indirect identification and provide for specific precautions during interviews and checks.
The decision highlights that the protection of confidentiality in whistleblowing does not depend solely on the security of the reporting channel, but also on the practical arrangements for conducting the investigation. Companies must therefore adopt procedures that limit the circulation of information and reduce the risk of indirect identification of the whistleblower, whilst providing for specific precautions during interviews and verification activities.
Focus
Legislative Decree 179/2026: the new Italian rules on artificial intelligence governance
Legislative Decree 179/2026 has been in force since 23 October 2026, introducing further national provisions to align with the AI Act. The decree regulates, amongst other things, the powers of supervisory authorities, testing environments and training in the field of AI, with significant implications for businesses, public administrations and professionals.
Privacy notices in banking relationships: guidance from the Data Protection Authority
Recent decisions by the Data Protection Authority in the Isybank and BBVA cases draw attention to transparency obligations in the banking sector. The decisions highlight how compliance with the GDPR requires not only comprehensive privacy notices, but also communication methods and operational procedures that enable customers to understand data processing activities and effectively exercise their rights.
The voice as a trademark: what safeguards against deepfakes?
The application to register Giorgia Meloni’s voice as a sound trademark reopens the debate on the protection of personal identity in the age of artificial intelligence. Trademark protection can counter certain unauthorised commercial uses, but does not automatically prevent voice cloning. The context, purposes and methods of dissemination of artificially generated content remain key.
Artificial intelligence in law firms: from tool selection to governance
The use of artificial intelligence in law firms poses new organisational and professional challenges, from the selection of tools to the protection of client information. In an article published in ItaliaOggi, Aurora Agostini examines the model adopted by LEXIA, which is based on an internal policy, an AI Committee and procedures for approving tools and use cases, to combine innovation, security and control.
