A Comparison of Damage Compensation Models and the Challenges of Professional Liability
Edoardo Almondo
David Sànchez Almagro
Madrid, 22nd oct. 2026
Abstract
This paper analyses civil liability for damage caused by artificial intelligence systems in Italy and Spain in light of Regulation (EU) 2024/1689 (the AI Act). After examining the general regimes of contractual and non-contractual liability, it considers the main evidentiary difficulties arising from the technical complexity of these systems and from the information asymmetry between injured parties and liable parties. The comparative analysis focuses on the differences between the Italian model, characterised by the introduction of specific procedural instruments, and the Spanish model, which relies mainly on the general rules of civil liability and evidence. It also examines the impact of the AI Act on the duties of care and oversight of professionals who use AI tools. The aim is to assess how effective both models are in ensuring effective compensation for damage in a context of rapid technological change.
Contents
The European Regulation on Artificial Intelligence: The AI Act
Proving Damage Caused by Artificial Intelligence
Italy: The New National Regulation on Artificial Intelligence
Spain: Ordinary Law and Regulatory Developments
Italy and Spain Facing AI-Related Damage: A Functional Comparison
Conclusions: The Need to Regulate in the Face of the Speed of Innovation.
Introduction
The rapid development of artificial intelligence (AI) and its gradual incorporation into economic, professional and institutional activities raise a fundamental legal question: who should be liable for damage caused by an artificial intelligence system, and how can the injured party obtain effective compensation?
The question goes beyond technology. The use of AI systems may affect people’s physical and mental integrity, their property, their employment opportunities, their fundamental rights and the quality of the professional services they receive. At the same time, the technical complexity of these systems makes it difficult to identify the conduct that caused the damage, to determine the liable party and, above all, to obtain the evidence needed to support a claim.
The problem is aggravated by the information asymmetry between the person who suffers the damage and the person who develops, markets or uses the system. Technical documentation, operating data, event logs and information on automated decisions are usually under the control of providers or of those who deploy the systems. The injured party may know the harmful outcome without having the elements needed to reconstruct the process that produced it.
In this context, Regulation (EU) 2024/1689, known as the Artificial Intelligence Act (the AI Act), establishes a harmonised framework of obligations for the development, placing on the market and use of artificial intelligence systems in the European Union. However, its main function is preventive and regulatory: it does not establish a general, autonomous civil liability regime, nor does it replace national rules governing compensation for damage.
The comparison between Italy and Spain is particularly significant. Both legal systems start from traditional structures of contractual and non-contractual liability, but they differ in the mechanisms designed to overcome the evidentiary difficulties of AI-related damage. Italy has introduced specific procedural instruments through Legislative Decree No. 160 of 9 September 2026, whereas Spain continues to protect the injured party mainly through ordinary law, the European framework and ongoing legislative developments.
The purpose of this analysis is to examine the general categories of civil liability in both countries, the obligations arising from the AI Act, the new Italian legislation and the Spanish situation, paying particular attention to evidence, causation and the liability of professionals who use artificial intelligence tools.
The European Regulation on Artificial Intelligence: The AI Act
1. Nature and Purpose of the Regulation
Regulation (EU) 2024/1689 lays down harmonised rules for the development, placing on the market and use of artificial intelligence systems. It is directly applicable in the Member States and is intended to ensure a high level of protection of health, safety and fundamental rights, while promoting innovation and the functioning of the internal market.
Its approach is risk-based: the greater a system’s capacity to adversely affect people, the more demanding the obligations on those who develop or use it.
This structure requires a distinction between the provider and the deployer. The provider is, broadly, the person who develops an AI system or has it developed and places it on the market or puts it into service under its own name or trademark. The deployer, or deployer, is the person who uses the system under its own authority, in particular in the course of a professional activity.
The distinction is especially relevant for law firms and other intellectual professions that use third-party tools. Using a system does not automatically make the professional its provider. However, Article 25 provides for cases in which a deployer or another third party may assume the obligations of the provider, for example where it places a high-risk system on the market under its own name or trademark, makes a substantial modification to it, or alters its intended purpose so that it becomes a high-risk system.
For this reason, the customisation of technological tools and their integration into professional processes must be assessed with regard to the actual role played by each party.
2. Risk Levels
The AI Act distinguishes different categories of systems and practices, subject to obligations proportionate to the risks they present.
2.1. Prohibited Practices
Article 5 prohibits certain artificial intelligence practices considered incompatible with the protection of fundamental rights. These include certain subliminal, manipulative or deceptive techniques that distort behaviour and cause, or are likely to cause, significant harm; the exploitation of vulnerabilities linked to age, disability or social or economic situation; and certain forms of social scoring that lead to unjustified detrimental or unfavourable treatment.
Infringements of the prohibitions may give rise to the highest penalties provided for in Article 99, subject to the requirements and limits laid down in the Regulation.
2.2. High-Risk Systems
Article 6 and Annexes I and III identify high-risk systems. These include, on the one hand, certain systems that are safety components of products covered by Union harmonisation legislation and subject to third-party conformity assessment, under Article 6(1).
On the other hand, Article 6(2) and Annex III cover systems used in particularly sensitive areas: biometrics; critical infrastructure; education and vocational training; employment and worker management; access to essential services, including the creditworthiness assessment of natural persons and certain risk assessment and pricing in life and health insurance; law enforcement; migration, asylum and border control; the administration of justice and democratic processes.
However, classification requires regard to the criteria and exceptions laid down by the Regulation itself. In certain cases, a system falling within the areas of Annex III may fall outside the high-risk category if it does not pose a significant risk and performs limited functions, such as carrying out procedural tasks, improving the result of a previously completed human activity, detecting patterns without replacing human assessment, or performing purely preparatory tasks. These exceptions do not apply where the system performs profiling of natural persons, as defined in the Regulation.
Classification therefore does not depend on whether a tool incorporates artificial intelligence in the abstract, but on its purpose, its characteristics and the specific use for which it is intended.
2.3. Transparency Obligations
Article 50 lays down transparency obligations for certain AI systems and AI-generated content. Among other provisions, it requires persons to be informed when they interact directly with an AI system in the cases covered, and requires mechanisms to be put in place so that certain artificially generated content can be identified in a machine-readable format.
Disclosure obligations are also laid down for deepfakes and for certain text generated or manipulated by AI and published in order to inform the public on matters of public interest, subject to the exceptions and conditions set out in the provision itself.
These obligations are relevant not only from the standpoint of transparency, but also for the later reconstruction of the facts in liability proceedings.
2.4. General-Purpose Models and Minimal-Risk Systems
The Regulation lays down specific obligations for providers of general-purpose artificial intelligence models, including those concerning documentation and information for downstream providers, with a particular regime for models that present systemic risks.
By contrast, for systems that do not fall within the higher-risk categories, the Regulation does not necessarily impose the same set of specific obligations. This does not mean that they are free of all legal requirements: the general obligations that apply remain relevant, including AI literacy under Article 4, as worded following the applicable amendments.
3. Obligations of Providers and Deployers
For high-risk systems, Articles 9 to 16 and Annex IV lay down specific obligations for providers. These include establishing a risk management system, under Article 9; the data governance requirements of Article 10; drawing up technical documentation in accordance with Article 11 and Annex IV; the automatic recording of events provided for in Article 12; the transparency obligations and instructions for use in Article 13; the human oversight required by Article 14; and the accuracy, robustness and cybersecurity requirements of Article 15. Article 16 sets out the general obligations of the provider.
The technical documentation must make it possible to understand the essential characteristics of the system, its development, its design choices, the data used for its training, the test results, its performance and its risk management mechanisms. Automatic records, or logs, make it possible to reconstruct certain events and behaviours of the system throughout its life cycle.
For their part, deployers are subject to the obligations of Articles 26 and 27. They must use the system in accordance with the provider’s instructions, assign human oversight to persons with the appropriate competence, training and authority and, where they control the input data, ensure that it is relevant and sufficiently representative for the intended purpose.
They must also monitor the operation of the system, report risks and serious incidents to the provider and to the authorities where appropriate, suspend its use if necessary and keep the logs under their control for the applicable minimum period. They must also inform workers when AI systems are used in the workplace.
Article 27 requires, in certain cases, a fundamental rights impact assessment, especially for public-law bodies, private entities providing public services and certain uses relating to creditworthiness or life and health insurance, in accordance with Annex III.
Failure to comply with these obligations may have regulatory and punitive consequences, but it may also become relevant in civil litigation. Documentation on the design, operation and oversight of a system may be decisive in establishing whether the required standard of care was met.
4. Penalties and Their Relationship with Civil Liability
Article 99 of the AI Act sets out the framework for administrative penalties, the specification of which is left to the Member States within the limits of the Regulation. Penalties must be effective, proportionate and dissuasive.
However, the AI Act does not in itself create a general, autonomous right to compensation for damage. Its function is to lay down obligations of conduct, organisation, transparency, oversight and documentation. Compensation for loss continues to depend on the applicable liability rules, unless another specific provision establishes a different regime.
Accordingly, an infringement of the AI Act may be a relevant factor in determining the required standard of care or the existence of a breach, but it should not be automatically equated with the presence of all the conditions of civil liability. The damage, attribution and causal link must be examined under the relevant legal regime.
Proving Damage Caused by Artificial Intelligence
1. What the AI Act Does Not Regulate
One of the most important, and often least understood, aspects of the European regime is that the AI Act does not establish a general procedural system for allocating the burden of proof in civil claims for AI-related damage.
The Regulation does not, as a general rule, introduce a presumption of fault or causation, nor does it establish a universal mechanism for the disclosure of evidence between private parties. These questions remain governed by the applicable procedural and substantive law.
In Italy, Articles 2043 and 2697 c.c. are relevant, as are Articles 116 and 210 of the Italian Code of Civil Procedure. In Spain, the allocation of the burden of proof is governed in particular by Article 217 of the Civil Procedure Act (Ley de Enjuiciamiento Civil), without prejudice to any special rules that may apply.
The proposed Directive on AI liability, presented by the European Commission in 2022 under reference COM(2022) 496, was intended to facilitate the obtaining of evidence and to establish, under certain conditions, a presumption of causality linked to breach of duties of care. The proposal was withdrawn as part of the Commission’s 2025 work programme, a step confirmed in July of that year.
As a result, the European framework combines two instruments of a different nature: the AI Act, which imposes obligations relating to documentation and the retention of information, and Directive (EU) 2024/2853 on liability for defective products, which establishes a specific product liability regime, including, within its scope of application, software and AI systems.
For damage arising from negligent conduct that is not covered by a special regime, the determination of liability and of the rules of evidence continues to depend largely on national legal systems.
2. Documentation and Logs as Evidence
Although the AI Act does not in itself give the injured party a general right of access to all the system’s documentation, its documentation obligations may become decisively important in civil proceedings.
The technical documentation required by Article 11 and Annex IV, together with the retention obligations of Article 18, makes it possible to learn the architecture of the system, its development, its design choices and its risk management measures.
The automatic logs required by Article 12, linked to the retention obligations of Articles 19 and 26(6), make it possible to document relevant events during the operation of the system. The provider and the deployer must keep the logs under their control for the applicable minimum period.
The instructions for use under Article 13, read with Article 26(1), make it possible to determine the system’s intended purpose, its performance and its limitations, and to assess whether the deployer used it in accordance with the instructions received.
Human oversight, governed by Articles 14 and 26(2), is another relevant element in assessing whether adequate controls existed and whether an automated decision was subject to effective human intervention.
To these are added the risk management and quality management systems of Articles 9 and 17; the post-market monitoring and reporting of serious incidents under Articles 72 and 73 and Article 26(5); and the documentation obligations for general-purpose models under Article 53 and Annexes XI and XII.
Article 86 provides, in certain cases, for the right of affected persons to obtain a clear and meaningful explanation of the role of the AI system in a decision taken by a deployer, where the conditions laid down by the Regulation are met. This possibility concerns certain decisions based on high-risk systems under Annex III, excluding point 2, that produce legal effects or similarly significant effects on persons.
Lastly, the Regulation establishes mechanisms for cooperation with the authorities. Upon a reasoned request, the authorities may require the provider to demonstrate the conformity of the system and to supply the relevant documentation and logs, subject to the safeguards applicable to trade secrets and confidential information. Individuals may also lodge complaints with the competent authorities on the terms laid down in the AI Act.
3. Practical Limits of the European Evidentiary System
The first limit is information asymmetry. Documents and logs generally remain under the control of the provider or the deployer. The AI Act imposes documentation obligations and establishes mechanisms of access for the authorities, but it does not give the injured party a universal, unrestricted right of access to all of these materials.
The second limit is temporal. The obligations relating to the high-risk systems of Annex III and the products of Annex I apply according to the timetable set out in Article 113 of the AI Act, as amended by Regulation (EU) 2026/1744, known as the Digital Omnibus on AI. For systems and events that predate the application of the relevant obligations, it must be analysed which requirements were actually applicable at the relevant time, without presuming the retroactive existence of documentation obligations.
The third limit concerns the length of retention. The minimum period of six months laid down for certain logs will not always be sufficient to deal with a civil dispute, especially if the damage is discovered late or if the claim requires a complex technical investigation. Retaining information for longer periods must in any case be reconciled with the principles of personal data protection, including the data minimisation principle set out in the General Data Protection Regulation.
Consequently, the existence of technical documentation does not, in itself, guarantee that the victim can access it or that the victim will have sufficient material to prove causation. National procedural instruments are decisive in turning regulatory obligations into effective judicial protection.
4. The AI Act Timetable and the Digital Omnibus
Regulation (EU) 2026/1744, on the simplification of the implementation of the harmonised rules on artificial intelligence, entered into force on 27 July 2026 and amended certain aspects of the AI Act timetable, in addition to revising Article 4 on AI literacy.
Under the amended timetable, the prohibitions in Chapter II have applied since 2 February 2025, with the exceptions and additional prohibitions provided for from 2 December 2026. The obligations relating to general-purpose AI models have applied since 2 August 2025, while the transparency obligations of Article 50 have applied since 2 August 2026, with a specific timetable for certain content from systems already on the market.
The application of the obligations for the high-risk systems of Annex III has been postponed to 2 December 2027, while those for the systems of Annex I will apply from 2 August 2028.
As regards Article 4, the AI literacy obligation continues to fall on providers and deployers, but its amended wording is geared towards taking measures to develop that literacy, rather than requiring, on the same terms, a guarantee of a sufficient level.
This timetable highlights an essential tension: the legislator needs time to establish technically feasible obligations and to allow organisations to adapt, while technological systems evolve at a speed that may render certain requirements obsolete even before they fully apply.
Italy: The New National Regulation on Artificial Intelligence
1. Legislative Decree No. 160 of 9 September 2026
Italy has taken a significant step through Legislative Decree No. 160 of 9 September 2026, published in the Gazzetta Ufficiale No. 214 of 15 September 2026, and in force since 30 September 2026. The measure adapts national law to the provisions of the AI Act on the use of artificial intelligence systems for law enforcement activities and on civil and criminal liability.
The decree is divided into several parts. Title I, Articles 1 to 10, regulates the use of AI systems in law enforcement, including aspects relating to biometric identification, facial recognition and staff training. These provisions are of specific interest to public authorities, although they are not the core of the professional liability regime examined here.
Title II, Chapter I, Articles 11 to 15, introduces criminal and procedural provisions. Among other measures, it adds Article 437-bis to the Italian Criminal Code, concerning the failure to put in place safety measures and human oversight in high-risk systems, with imprisonment of one to five years where danger to life or physical integrity results. It also amends the Code of Criminal Procedure and introduces Article 25-vicies into Legislative Decree No. 231/2001, on the liability of legal entities.
However, the most significant innovation for the comparison with Spain is found in Title II, Chapter II, Articles 16 to 20, which establishes specific civil procedural instruments for actions for compensation for damage arising from the use of AI systems.
2. The Procedural Instruments of Articles 16 to 20
Article 16 defines the scope of application of these instruments, which cover actions for compensation for contractual and non-contractual damage arising from the use of AI systems. Article 17 applies to the actions within its scope, while Articles 18 and 19 refer specifically to cases linked to a breach of AI Act obligations. The legislation preserves the application of the liability provided for in Article 82 of the General Data Protection Regulation and that for defective products. In addition, where the injured party is a consumer, the court of the consumer’s place of residence or domicile has jurisdiction on the terms provided by law.
Article 17 directly addresses the main evidentiary obstacle. At the request of a person who alleges having suffered damage, the court may order the other party or a third party to disclose specifically relevant elements concerning the operation of the system, provided that the facts alleged make the claim plausible.
The measure may extend to the logs under Article 12 of the AI Act, the risk management documentation under Article 9, the technical documentation under Article 11 and the information on human oversight under Article 14.
Disclosure must respect the principle of proportionality and the safeguards for trade secrets and confidential information, in particular those provided for in Article 121-ter of the Italian Industrial Property Code. Unjustified refusal may give rise to adverse inferences under Article 116 of the Code of Civil Procedure and, as regards the typical documentation specified by the legislation, to the facts alleged being deemed admitted. A third party that fails to comply with the order may be ordered to pay a pecuniary penalty of between EUR 1,500 and EUR 10,000.
Article 18 introduces a presumption of a causal link between the breach of an AI Act obligation and the damage, unless proven otherwise. The measure does not remove the need to establish the remaining conditions of liability, nor does it turn every regulatory breach into an automatic duty to compensate. Its purpose is to facilitate proof of causation where the legal requirements are met.
Article 19 provides that compliance with the AI Act, even where certified, does not in itself exclude the defendant’s liability, without prejudice to national rules on defective products. Regulatory conformity is thus not equivalent to civil immunity: compliance with technical requirements is a relevant factor, but it does not necessarily resolve all questions concerning the damage and its attribution.
Finally, Article 20 allows the injured party to ask the alleged liable party whether it holds liability insurance. The answer must be given within thirty days, and the enquiry is not a condition for bringing proceedings. The legislation also recognises a direct action against the insurer within the limits of the sum insured, with the necessary participation of the liable party in the proceedings.
3. The Scope of the Italian Reform
The significance of this regulation does not lie solely in adding new substantive obligations. Its main contribution is to connect the AI Act’s documentation obligations with procedural mechanisms capable of facilitating the reconstruction of the facts.
The possibility of obtaining documents and logs under the control of the opposing party or of third parties reduces, at least potentially, the injured party’s informational disadvantage. The presumption of causation in the cases provided for by law also introduces a specific response to the evidentiary difficulties that characterise certain kinds of damage related to complex systems.
The reform does not do away with the need to analyse conduct, damage and attribution. Nor does it turn all AI systems into sources of strict liability. Its aim is to make judicial protection more effective within the framework established by the legal system.
From a comparative perspective, this is the main difference from the Spanish model: Italy has chosen to intervene expressly at the procedural level, whereas Spain continues to depend, to a greater extent, on the general rules of liability and on the applicable European instruments.
Spain: Ordinary Law and Regulatory Developments
1. AI Governance and Administrative Supervision
In Spain, adaptation to the European artificial intelligence framework is being carried out through legislative and regulatory initiatives aimed, among other objectives, at specifying the penalty regime and the role of the Spanish Artificial Intelligence Supervisory Agency (AESIA).
The draft Organic Law on AI Governance, at the parliamentary stage described by the regulatory framework examined here, is aimed at developing aspects of governance, supervision and enforcement of the AI Act. Unlike the Italian reform, it does not, on the terms considered, introduce a specific civil procedural system based on presumptions of causation and disclosure of evidence adapted to AI-related damage.
A distinction must therefore be drawn between the administrative regulation of artificial intelligence and the regime for compensating damage. The existence of supervisory authorities and of penalties for regulatory infringements does not automatically determine how a compensation claim must be proved before the civil courts.
2. The Application of Ordinary Law
In the absence of special rules applicable to the case, claims for damage caused by artificial intelligence are resolved in Spain under the general rules of contractual and non-contractual liability.
Where the damage arises from breach of a contractual obligation, Articles 1101 et seq. of the Civil Code are relevant. Where the loss occurs outside a prior contractual relationship, Article 1902 is the general reference, without prejudice to other special regimes that may apply.
Evidence is governed by the ordinary procedural rules, in particular Article 217 of the Civil Procedure Act. The allocation of the burden of proof must be analysed having regard to the circumstances of the dispute, to each party’s access to, and ease of producing, the evidence, and to any special rules that may apply.
This structure makes it possible to resolve many disputes without creating an autonomous category of AI liability. However, it may prove insufficient where the injured party has no access to the data needed to show how the damage occurred.
The complexity of algorithmic systems does not remove the traditional conditions of liability, but it can make them considerably harder to establish. The victim may have clear indications of the harm without knowing what data was used, what instructions the system received, what human intervention took place or what technical failure produced the outcome.
In such circumstances, mechanisms for the disclosure of documents, evidentiary measures and the proper application of the criteria of availability and ease of proof take on essential importance, even though they are not equivalent to the specific presumptions introduced by Italian legislation.
3. Directive (EU) 2024/2853 on Defective Products
A key element of the European framework is Directive (EU) 2024/2853 on liability for damage caused by defective products. The Directive modernises the European product liability regime to adapt it, among other things, to the digital economy and to the use of software and artificial intelligence systems that fall within its scope.
Its significance lies in the fact that it provides for a regime of liability for defective products that dispenses, on the terms laid down by the legislation, with the need to prove the producer’s fault. It also introduces mechanisms intended to facilitate proof, including the disclosure of evidence and certain presumptions as to the defect, the causal link, or both, where their conditions are met.
It is nevertheless necessary to distinguish the defective products regime from liability for any AI-related damage. Not every incorrect output of a system used in a professional activity is necessarily damage caused by a defective product. It may instead be, for example, a breach of contract, insufficient oversight, use contrary to instructions or a negligent professional decision.
The application of the Directive must be examined according to its material scope, the national transposition measures and the time at which the damage occurred. Its contribution is especially important for cases falling within the product liability regime, but it does not remove the need to maintain a differentiated analysis of the other sources of liability.
The evolution of this European framework will be decisive for Spain’s position. Until a special rule applies that resolves the specific problem, the injured party will have to rely on the general regime and on the evidentiary tools available under national law.
Italy and Spain Facing AI-Related Damage: A Functional Comparison
The comparison between the two legal systems reveals a common foundation and a significant difference in the procedural response.
In both countries, contractual liability presupposes a prior obligation that has been breached, while non-contractual liability is built around legally relevant damage, attributable conduct and the causal link. Both systems also recognise categories of pecuniary and non-pecuniary damage, mechanisms for reducing compensation because of the victim’s contribution, and cases of vicarious liability or liability subject to special rules.
They also share the need to adapt traditional rules to a technological reality in which damage may arise from the interaction between the provider, the professional user, the input data, the design of the system and human oversight. The involvement of several parties does not mean that all of them are necessarily liable, but it requires their respective roles and duties to be reconstructed with precision.
The main difference lies in evidence. In Italy, Articles 16 to 20 of Legislative Decree No. 160/2026 introduce a specific framework for compensation actions relating to AI systems. In particular, judicial disclosure of evidence and the presumption of causation provided for in certain cases linked to breaches of the AI Act may strengthen the injured party’s procedural position.
In Spain, by contrast, the response continues to be built mainly on ordinary law, the rules of the Civil Procedure Act, any special regimes that apply and the European framework on defective products. This does not mean that Spanish law lacks evidentiary tools, but that, within the framework examined here, it does not have an equivalent set of specific rules for AI-related damage.
The difference may have practical consequences. Where the decisive evidence is in the hands of the provider or the deployer, access to the logs and technical documentation may determine whether a claim is viable. Information asymmetry is therefore not merely a technical problem: it directly affects the right to effective judicial protection and the real possibility of obtaining compensation.
From this perspective, the Italian experience offers a model of procedural intervention that deserves consideration in the Spanish and European debate. Its effectiveness will nevertheless depend on judicial interpretation, on the proportionality of disclosure orders, on the protection of trade secrets and on the ability of victims to identify and substantiate the relevant facts at the outset.
Conclusions: The Need to Regulate in the Face of the Speed of Innovation
The comparison between Italy and Spain confirms that the traditional categories of civil liability remain essential for compensating damage caused by artificial intelligence systems. Contractual and non-contractual liability, the criteria of fault-based and strict attribution, causation and the categories of recoverable damage continue to provide the fundamental legal framework.
However, applying these categories to AI reveals a structural difficulty: the injured party may lack access to the information needed to reconstruct how the system operated and to prove the link between the alleged conduct and the damage. Information asymmetry can turn a formal right to compensation into a claim that is extraordinarily difficult to enforce.
The AI Act represents a decisive step forward by establishing obligations of prevention, transparency, documentation, risk management and human oversight. However, it does not create a general civil liability regime, nor does it by itself resolve the problem of the burden of proof. Its effectiveness in securing compensation for damage depends largely on its interaction with national legal systems and with specific European regimes, such as that on liability for defective products.
Italy has chosen to intervene directly at the procedural level through Articles 16 to 20 of Legislative Decree No. 160/2026. The possibility of ordering the disclosure of documents and logs, together with the presumption of causation in the cases provided for by law, is a concrete response to the evidentiary difficulties of AI-related litigation.
Within the framework examined here, Spain maintains an approach more closely tied to ordinary law and to general procedural instruments. This model allows traditional categories to be applied to new situations, but it may present difficulties where the decisive information is exclusively under the control of providers or deployers. The evolution of the European framework on defective products and of national governance initiatives will be decisive in completing the protection of the injured party.
That said, the need to legislate should not lead us to overestimate the capacity of legislation to solve all the problems this technology raises. Regulation is an unavoidable tool: without clear rules, verifiable obligations and effective mechanisms of redress, the risks of AI could be shifted disproportionately onto those who suffer their consequences. The protection of fundamental rights, legal certainty, user trust and effective access to justice require a regulatory framework capable of establishing responsibilities and providing real avenues of redress.
But there is a tension that the legislator cannot ignore. Artificial intelligence evolves at an extraordinary speed, whereas the drafting, adoption, implementation and interpretation of rules take time. A legal system may take years to identify a problem, define the liable parties, design technical obligations and establish mechanisms of proof. During that time, the models, architectures and ways of using the technology may have changed substantially.
The risk is that legislation, although necessary, ends up regulating a technological reality that no longer exists in the same terms. Obligations that are too rigid may become obsolete; those that are too general may be difficult to apply; and long transitional periods may leave those who suffer damage during the adaptation phase without sufficient protection. To this is added the danger that formal compliance with technical requirements becomes an apparent substitute for the effective assessment of risks and for responsibility for the consequences.
The answer is not to give up on regulation, but to design it so that it combines legal certainty with the capacity to adapt. This requires rules that are clear enough to allow citizens, businesses and professionals to know their obligations, but also mechanisms for periodic review, cooperation between authorities, flexible interpretive criteria and evidentiary procedures able to respond to new forms of damage. It is equally essential to prevent technical complexity from becoming a barrier that stops the victim from obtaining effective compensation.
The comparison between Italy and Spain offers, in this respect, a relevant lesson. It is not enough to impose obligations on those who develop and use artificial intelligence systems: it is necessary to ensure that breaches can be proved and that the injured party has adequate procedural tools to enforce their rights. Prevention and compensation must advance together.
In short, legislation is indispensable, but it is not in itself a guarantee of effectiveness. Faced with a technology capable of changing faster than legislative procedures, the real challenge is to build a legal system that does not seek merely to regulate today’s AI, but that can go on protecting people against tomorrow’s AI. The effectiveness of such a system will be measured not by the number of rules adopted, but by its real capacity to prevent harm, to attribute responsibility and to ensure that those who suffer harm can obtain fair and effective compensation.
