Artificial Intelligence in Business: Legal Framework, Liability and Corporate Governance

The use of artificial intelligence (AI) by businesses takes place within a complex regulatory framework, in which European legislation governing AI operates alongside rules on personal data protection, confidentiality and liability in dealings with third parties. The legal requirements applicable to these tools must therefore be determined on a case-by-case basis, having regard to the manner in which they are actually used and the activities in which they are deployed.

The growing prevalence of these tools in business practice—often without internal rules governing how they may be used and the limits of such use—makes it particularly important to consider the legal and economic consequences that may arise, especially where the outputs of automated processing are relied upon in corporate decision-making or used to fulfil regulatory obligations.

This gives rise to a matter of considerable practical importance for businesses. Introducing these tools calls for a prior assessment of the conditions governing their use and the responsibilities associated with their deployment. From this perspective, an analysis of the European and national regulatory framework provides the foundation for establishing an internal corporate policy and a dedicated governance system capable of translating applicable legal obligations into operational rules suited to the company’s organisational structure.

The European and Italian regulatory framework and its interaction with personal data protection

The principal piece of European legislation on artificial intelligence is Regulation (EU) 2024/1689, commonly known as the AI Act, through which the EU legislature established a harmonised framework governing the development, placing on the market and use of AI systems.

The Regulation adopts a risk-based approach, imposing different obligations according to the characteristics of the systems concerned, their potential impact on fundamental rights and the roles performed by the parties involved. Indeed, the legislation applies not only to businesses that develop or market AI technologies but also to those that merely use them in the course of their operations, which may accordingly qualify as deployers.

Consequently, even a business using AI tools supplied by third parties - for example, for human resources management, document analysis, customer support or the automation of particular business processes - be subject to specific legal obligations. Whether those obligations apply must be assessed by reference to the system in question and its intended purposes.

The EU regulatory framework does not, however, exhaust the obligations that businesses must consider. The use of artificial intelligence forms part of a broader legal context in which personal data protection rules are particularly significant.
In this respect, the AI Act and Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) establish distinct but complementary legal regimes, both of which apply where the use of AI systems entails the processing of personal data. While the AI Act addresses risks associated with AI systems, irrespective of whether personal data are involved, the GDPR governs the lawfulness and manner of processing such data, requiring compliance with the principles of fairness, transparency, data minimisation, purpose limitation and security.

Accordingly, compliance of an AI tool with the AI Act does not automatically render the processing of personal data carried out through its use lawful. Equally, compliance with data protection legislation does not, in itself, establish that an AI system meets the additional requirements imposed by the EU framework on artificial intelligence.

The interaction between these two regimes is particularly relevant to the practical organisation of business activities, especially where the use of AI systems involves processing personal data relating to customers, employees, contractors or other data subjects.

Businesses must therefore first verify that such processing complies with the principles laid down in the GDPR, particularly those of lawfulness, fairness and transparency, purpose limitation and data minimisation, as well as the requirement that personal data be retained for no longer than is necessary for the purposes for which they are processed.

These checks are especially important in the use of generative AI tools, through which information entered by users may be transmitted to external providers and potentially subjected to further processing operations. Businesses should therefore ascertain how data are collected, processed and stored; whether providers pursue additional purposes, including the possible use of such information to train or improve their models; and whether any personal data are transferred to third countries.

In this context, the proper allocation of roles among the parties involved is also important. Where an AI system provider processes personal data on behalf of a business, that business, acting as data controller, must verify that the safeguards required under Article 28 GDPR are in place and regulate the relationship through an agreement specifying, among other matters, the purposes and means of processing, security measures, the engagement of any sub-processors and the conditions for the return or deletion of data.

These obligations are complemented by those arising from the accountability principle enshrined in Article 5(2) GDPR, under which controllers must be able to demonstrate compliance with the applicable data protection requirements. This entails, in particular, adopting appropriate technical and organisational measures, including access controls, restrictions on the information that may be entered into AI tools, mechanisms for logging and tracing operations, and internal procedures for managing any personal data breaches.

The coordination of the preventive risk assessment mechanisms provided for under the two Regulations is also particularly significant.

Under Article 35 GDPR, where processing, particularly through the use of new technologies, is likely to result in a high risk to the rights and freedoms of natural persons, the controller must carry out a data protection impact assessment (DPIA) before the processing begins. In addition, for the categories of deployers and systems expressly identified in Article 27 of the AI Act, a fundamental rights impact assessment (FRIA) is required to examine the effects that the deployment of certain high-risk AI systems may have on natural persons or potentially affected groups.

A FRIA has a broader scope than a DPIA, since it is not confined to personal data protection but also encompasses other fundamental rights potentially affected by the use of the system. The two assessments are therefore neither automatically interchangeable nor necessarily required in every case. Article 27 of the AI Act nevertheless provides for coordination with the impact assessment required under the GDPR, allowing existing assessments to be supplemented with the additional elements required by the AI legislation.

At national level, the regulatory framework has been further supplemented by Italian Law No. 132 of 23 September 2025, entitled “Provisions and Delegated Powers Concerning Artificial Intelligence”, which introduced specific principles and rules governing the use of AI across various sectors. With particular regard to employment, Article 11 emphasises the need to ensure that AI is used safely, reliably and transparently, with due respect for human dignity, the confidentiality of personal data and workers’ rights, and also establishes specific information obligations towards workers.

The resulting regulatory landscape makes clear that the adoption of AI systems cannot be treated as a purely technological decision. Rather, it requires an advance assessment of the legal implications, the responsibilities of the parties involved and the risks associated with the different contexts in which such systems are used.

From regulatory compliance to corporate governance

Compliance with the regulatory framework outlined above therefore requires businesses to take an informed and structured approach to the use of artificial intelligence, moving beyond the ad hoc management of individual technological tools.
Experience gained in the field of personal data protection offers a useful point of reference. Just as GDPR compliance has gradually prompted businesses to establish internal procedures, allocate responsibilities, implement security measures and introduce monitoring mechanisms, the use of artificial intelligence likewise makes it advisable to put in place an organisational framework governing its deployment.

An internal AI policy may form the first component of that framework, setting out, for example, criteria for selecting and approving tools, rules on the categories of information that may be entered into them, procedures for verifying generated outputs, and processes for handling anomalies or non-compliant use.

This does not mean imposing the same additional compliance requirements on every business. The AI Act does not, as a general rule, require every company to adopt a specific internal policy; rather, it establishes differentiated obligations whose applicability must be assessed in each case. The adoption of internal organisational rules is therefore a means by which businesses can support compliance with the obligations applicable to them, prevent improper use and document the decisions taken in managing AI-related risks.

Fabiola Masotta
de Capoa Law Firm