Innovation Law Insights

Event

DORA: What does the Italian Integration Legislative Decree provide for?

DORA is in place, but the regulatory framework must be completed by the Italian legislative decree that is now available in draft form. In this webinar, DLA Piper professionals will address (in Italian) the main critical issues and provide best practices to address them. You can register here.

 

Publication

Diritto Intelligente – January issue

Last month, we witnessed two pivotal milestones that are set to shape the future of AI compliance. The European Data Protection Board issued its groundbreaking Opinion on AI training. And the Italian Data Protection Authority made a landmark decision against a major LLM.

In this edition of DLA Piper's AI law journal, Diritto Intelligente, we cover these new developments and look into the new EU Product Liability Directive and its implications for AI. We highlight the expanded scope of liability to include software and AI systems and the European Commission’s feedback on Italy’s draft AI law, particularly its stance on copyright and how it aligns with EU regulations. Read the journal here.

 

Podcast

AI Act Data Disclosure Template Unveiled

The European Commission’s AI Office just released a draft template requiring AI providers to disclose detailed data usage – from pre-training to fine-tuning as part of the obligations under the EU AI Act. What are the implications for developers of AI systems? What about companies willing to use them as part of their operations, IP right holders and individuals whose personal data might have been used to train an AI system? Find out in the latest episode of the Diritto al Digitale podcast (in English) available here.

 

Artificial Intelligence

AI Act: Ban on prohibited AI systems comes into force

Sunday, 2 February 2025 will mark a crucial date for AI regulation in the EU. On that date, Article 5 of Regulation (EU) 2024/1689 (AI Act), which identifies prohibited AI systems, becomes fully applicable.

According to Article 5 of the AI Act, the commercialization, use, or deployment of systems deemed incompatible with the fundamental principles of the EU will be subject to sanctions. The most severe violations – including the use of prohibited systems – may result in fines of up to EUR35 million or 7% of global annual turnover, whichever is higher.

AI Systems prohibited under Article 5

Article 5 of the AI Act specifically identifies AI systems that are considered to pose an unacceptable risk due to their nature or intended purpose. Some of the prohibited systems relevant to private enterprises include:

1. Social scoring systems based on behaviour or personal characteristics

AI systems designed to evaluate or classify individuals or groups based on their social behaviour or personal characteristics (whether known, inferred, or predicted) are prohibited when the evaluations result in:

• unfavourable or detrimental treatment in contexts unrelated to those in which the data was originally generated; or
• unjustified or disproportionate treatment relative to the observed social behaviour or its gravity.

A key issue with this prohibition is the lack of specificity in defining “unfavourable or detrimental treatment.” This ambiguity leaves room for varying interpretations. A narrow interpretation might restrict the prohibition to decisions with significant consequences, such as granting loans or mortgages based on algorithmic classifications. A broader interpretation, however, might extend to any decision of relevance derived from algorithmic evaluations, such as personalized commercial offers based on a user’s online behaviour. Considering the potential breadth of this interpretation, enforcement is likely to focus on cases with the most significant impacts. Nevertheless, clarifications from authorities will be critical to fully understand the scope of this prohibition.

2. AI Systems designed to expand databases through indiscriminate facial image scraping

The Regulation prohibits the use of AI systems that indiscriminately scrape facial images from the internet or CCTV footage to create or expand facial recognition databases.

The legality of such scraping depends on its purpose. Scraping conducted for purposes other than building facial recognition databases is not prohibited by the AI Act. However, any such activity must still undergo a thorough analysis under both the AI Act – as the system may still be classified as high-risk – and data protection regulations to ensure compliance.

3. Emotion-inference systems

AI systems designed to infer individuals' emotions are prohibited in workplace and educational settings, except when used for medical or safety purposes.

This prohibition is particularly significant in workplace contexts, reinforcing existing privacy and labour protections. The aim is to prevent the use of technologies capable of monitoring employees’ emotional states, mitigating risks of excessive surveillance or discrimination based on sensitive data unrelated to job performance.

4. Manipulative AI Systems

Another critical prohibition concerns AI systems that:

• employ subliminal, manipulative, or deceptive techniques capable of influencing individuals or groups without their awareness, leading them to take decisions they wouldn't otherwise have made, and which cause or are likely to cause significant harm; or
• exploit vulnerabilities of individuals or groups based on age, disability, or specific social or economic conditions, distorting their behaviour and causing significant harm.

These provisions aim to curb manipulative practices, such as those involving AI-generated content designed to deceive users. However, it's important to note that the prohibition applies only when the induced action causes significant harm to the affected individual. This requirement potentially excludes situations where manipulation occurs, but the resulting harm is negligible. For instance, an AI system persuading a consumer to purchase a product using subliminal techniques might not fall under the prohibition if the financial harm caused is minimal. Further interpretative guidance will be essential to clarify the scope of this provision.

5. Biometric categorization systems

AI systems that categorize individuals based on biometric data to infer sensitive characteristics – such as race, political opinions, religious beliefs, trade union membership, sex life, or sexual orientation – are prohibited.

Exceptions are provided for lawful labelling or filtering of biometric datasets in areas such as law enforcement. However, the use of such systems for broader purposes, including individual profiling, remains strictly forbidden.

Key actions for enterprises

With these provisions entering into force, businesses have to adopt preventive measures to ensure they comply with the AI Act. Priority actions include:

• Mapping AI systems: Identify all AI systems currently in use, whether developed internally or provided by external sources, to ensure accurate documentation and classification.
• In-depth analysis: Perform a thorough evaluation of all AI systems, paying particular attention to those that predict future behaviours, infer sensitive characteristics, influence user behaviour, or are employed in workplace settings. These systems may pose a higher risk of falling within the prohibited categories outlined in Article 5 of the AI Act.
• Exclusion and risk assessment: Evaluate eliminating systems that present an unacceptable risk. For systems classified as high-risk – even if not explicitly prohibited – conduct a Fundamental Rights Impact Assessment (FRIA) and carry out any other legally mandated activities to determine whether and to what extent these systems can be lawfully deployed.

It's also essential to closely monitor regulatory developments and guidance from competent authorities to understand the practical application of the prohibitions.

Conclusions

Applying the prohibitions under Article 5 of the AI Act is the first step toward broader regulation of AI in the EU. While many of the prohibited systems are primarily targeted at public authorities, the implications for private enterprises are significant.

Businesses have to initiate processes to fully comply with the AI Act, initially focusing on prohibited systems, while adopting a long-term perspective to address forthcoming obligations under the AI legislation.

Author: Federico Toscani

 

Intellectual Property

EPO: Board of Appeal rules on post-published data and clinical trials

EPO Board of Appeal recently ruled on clinical trials relating to a patent for a second or further therapeutic indication for a drug for treating antibody-mediated rejection in kidney transplantation. The Board of Appeal was faced with a case where data from the third phase of the clinical trial, published after the filing date of the patent application (post-published data), threatened the validity of the patent by casting doubt on the efficacy of the claimed therapy. 

Art. 83 of the European Patent Convention (EPC) states the invention must be disclosed in the patent application in a manner sufficiently clear and complete for an expert in the field to be able to carry it out. But in the specific case of medical use claims, the patentee only has to make the intended purpose plausible when filing the application. In fact, it's common practice to file an application even before having data to support the claim, especially since the European system is based on the "first to file" principle, according to which the first to file the patent application obtains protection. The patent application itself is sometimes used to raise funds, so the experiments, often costly, to prove what is claimed, can be carried out.

When – like in this case – data published after the filing of the application undermines the claimed effectiveness of the invention and the existence of a sufficient description under Article 83 EPC, the patentee has to dispel the doubts. 

In this case, the patentee tried to argue that the efficacy of the treatment could have been shown by a longer follow-up with patients, in the face of objections raised against the invention. This was not enough, and the technical panel rejected this argument, finding the reference to potential beneficial effects that might occur in the future insufficient and revoking the patent in its entirety.

This decision illustrates the vulnerability of pharmaceutical patents. They can be invalidated even if the clinical studies submitted after the application was filed don't support the claim. 

Author: Noemi Canova

 

The importance of intellectual property rights in the EU economy: EUIPO-EPO study

The EU Intellectual Property Office (EUIPO) and the European Patent Office (EPO) recently published a joint report entitled "Intellectual Property Rights and Firm Performance in the European Union" (2025). The report sheds new light on the strategic importance of intellectual property rights (IPRs) in the growth and competitiveness of European firms. The study, of great relevance to those working in the legal and consulting sectors in the IP field, aims to analyse the link between IPRs ownership – including patents, trademarks, registered designs – and firm performance, with a particular focus on small and medium-sized enterprises (SMEs).

Highlights of the report

1. IPRs and business performance improvement

The study shows that enterprises with IPRs record significantly higher productivity than those without IPRs. Among the main indicators:

• Productivity: companies with IPRs have 23.8% higher revenue per employee (RPE) than companies without IPRs.
• Higher wages: companies with IPRs offer 22.1% higher wages on average.

This data underscores the crucial role of IPRs not only as legal tools, but as key drivers of economic growth and competitive positioning.

2. Benefits for SMEs

The study shows that the effect of IPRs is particularly relevant for SMEs, which are the backbone of the European economy. SMEs holding IPRs register a 44% increase in RPE compared to SMEs that don't hold them.

3. Trademarks and designs as strategic assets

Among the IPRs analysed, trademarks and registered designs prove to be key tools for business success:

• Firms with EU brands see an increase in RPE of 40.9%.
• Firms with registered EU designs show an increase of 29.3%.

This data reflects the importance of protecting the visual and distinctive identity of companies to maintain a competitive advantage in the marketplace.

Legal and strategic considerations

IPRs as a strategic lever for business competitiveness

The EUIPO-EPO report offers significant insights into the development of legal strategies aimed at IPRs valorisation. Registration and ongoing monitoring of rights are key steps in ensuring protection and valorisation of intangible assets.

A proactive approach must include:

• Advice on the selection of IPRs best suited to business models.
• Assistance in registering and maintaining rights.
• The planning of strategies for IPRs monetization.

Facilitated access to IPRs for SMEs

Despite the obvious benefits, many European SMEs remain reluctant to make use of intellectual property protection tools, often due to economic obstacles or lack of awareness. In this context, it's essential to:

• incentivize the protection of intangible assets: through economic incentives, registration fee reductions and dedicated support programs;
• spread awareness: promote information campaigns and training programs specifically for SMEs, with the aim of raising awareness among business owners of the strategic value of intellectual property. This includes training on how to effectively defend their rights and how to deal with possible disputes.

Legal protection and enforcement

Effective IPRs protection requires adequate legal tools to address violations, including:

• enforcement actions to protect patents, trademarks, and designs
• opposition procedures against conflicting applications for registration
• preventive consultations to ensure compliance and prevent litigation

Conclusions and future prospects

The EUIPO-EPO report reiterates that IPRs is a key determinant of business success in the EU. In an increasingly competitive business environment, it's imperative that companies recognise the strategic value of IPRs and take a proactive approach to managing them.

At the same time, it's crucial that European institutions continue to promote policies that support innovation and intellectual property protection, with a particular focus on SMEs. Only through a synergy between businesses, legal professionals and institutions will it be possible to fully exploit the potential of IPRs, fostering economic growth and innovation in the EU.

As a law firm specializing in IP, we believe that focused advice and a strategic vision can make a difference, helping companies grow in an increasingly competitive market.

Author: Maria Rita Cormaci

 

Technology Media and Telecommunication

Infratel launches public consultation on the backhaul network strengthening plan for white areas

On 21 January 2025, Infratel launched a public consultation on the "Backhaul network strengthening in white areas" plan.

The goal of the plan is to develop backhaul infrastructure – that is, the portions of the network that connect the main network to local networks – particularly to address situations where backhaul capacity doesn't support the development of fixed access networks, based on the findings of the mapping.

Last August, the Interministerial Committee for Digital Transition (CiTD) approved financing for the plan, which is part of the National Ultra-Broadband Strategy.

The National Ultra-Broadband Strategy – "Towards the Gigabit Society" – was outlined within the framework of the National Recovery and Resilience Plan (PNRR) and was approved by the CiTD on 25 May 2021. Its objective is to provide 1 Gbp/s connectivity across the entire Italian territory by 2026 and to foster the development of fixed and mobile telecommunications infrastructure.

To implement the plan, Infratel first had to map fixed backhaul networks to identify cases where no backhaul network exists, or where the network (either existing or planned) is not based on fibre optic or other technologies capable of offering the same level of performance and reliability as fibre optics.

Based on this mapping – conducted between December 2023 and January 2024 with the support of telecommunications operators – 578 intervention areas were ultimately identified (these areas are physical locations where backhaul fibre optic connections can be established).

The intervention envisioned by the plan involves constructing passive infrastructure, such as ducts and fibre optic networks, necessary to connect the areas of the national territory that, based on the outcomes of the mapping, are found to lack adequate network infrastructure.

The plan also outlines the design criteria for the infrastructure and the so-called direct intervention model to be followed to implement it. This model involves awarding the related works through public procurement procedures, specifically through construction contracts.

Through the public consultation, Infratel is seeking feedback from interested parties on:

• outcomes of the backhaul network mapping: specifically, participants are asked to verify that the results of the mapping conducted from December 2023 to January 2024 are consistent with the information provided for the purpose of the mapping and to indicate any intentions to modify private plans for backhaul networks in light of the proposed interventions in the plan;
• scope of the intervention: in this regard, Infratel asks participants to express their agreement with the government's orientation to include the fibre optic backhaul connections for the 578 areas identified as lacking adequate network infrastructure according to the results of the mapping in the public intervention plan; and
• the intervention model proposed in the plan: specifically, participants are asked to provide their views on the direct intervention model proposed for awarding the works related to the fibre optic backhaul connections for the identified areas.

Interested parties can submit their contributions by 24 February 2025.

Authors: Massimo D'Andrea, Flaminia Perna, Matilde Losa

---

Innovation Law Insights is compiled by DLA Piper lawyers, coordinated by Edoardo Bardelli, Carolina Battistella, Carlotta Busani, Giorgia Carneri, Noemi Canova, Gabriele Cattaneo, Maria Rita Cormaci, Camila Crisci, Cristina Criscuoli, Tamara D’Angeli, Chiara D’Onofrio, Federico Maria Di Vizio, Nadia Feola, Laura Gastaldi, Vincenzo Giuffré, Nicola Landolfi, Giacomo Lusardi, Valentina Mazza, Lara Mastrangelo, Maria Chiara Meneghetti, Deborah Paracchini, Maria Vittoria Pessina, Marianna Riedo, Tommaso Ricci, Rebecca Rossi, Roxana Smeria, Massimiliano Tiberio, Federico Toscani,  Federico Toscani, Giulia Zappaterra.

Articles concerning Telecommunications are curated by Massimo D’Andrea, Flaminia Perna and Matilde Losa and Arianna Porretti.

For further information on the topics covered, please contact the partners Giulio Coraggio, Marco de Morpurgo, Gualtiero Dragotti, Alessandro Ferrari, Roberto Valenti, Elena Varese, Alessandro Boso Caretta, Ginevra Righini.

Learn about Prisca AI Compliance, the legal tech tool developed by DLA Piper to assess the maturity of AI systems against key regulations and technical standards here.

You can learn more about “Transfer”, the legal tech tool developed by DLA Piper to support companies in evaluating data transfers out of the EEA (TIA) here, and check out a DLA Piper publication outlining Gambling regulation here, as well as a report analyzing key legal issues arising from the metaverse qui, and a comparative guide to regulations on lootboxes here.

If you no longer wish to receive Innovation Law Insights or would like to subscribe, please email Silvia Molignani.