AI Liability & Regulation Digest
TL;DR
The compliance calendar fired on three fronts at once: Italy's Decree 160 went live with a claimant-friendly civil chapter, Connecticut's CART Act hit its first effective date, and California's SB 947 "No Robo Bosses Act" was signed — reversing Newsom's own earlier veto. Meanwhile the EU's Product Liability Directive transposition is splintering, with national divergences emerging under a maximum-harmonization regime just four months from its deadline.
California Resolves Its Endgame — and the Answer Is Broader Than Expected
The September 30 signing deadline produced a four-bill workplace AI package, headlined by SB 947. CNBC reports the "No Robo Bosses Act" "prevents businesses around the state from exclusively using 'automated decision-making systems' in matters of employee discipline and termination" — and the enrolled text, per the California Employment Law Report, requires that any employer who "primarily relies" on such a system have a human corroborate the decision, with unusable outputs barred from becoming discipline. Bill author Senator Jerry McNerney put the framing bluntly: "No worker should ever be fired or disciplined by a machine, AI or not" (CNBC).
Two details matter for planning. First, the feared private right of action did not survive negotiations — enforcement sits with the Labor Commissioner and public prosecutors, at $500 per violation, and the operative date is July 1, 2027, not January 1 california-workplace-ai-legislative-blitz-2026. Second, Newsom signed the whole workplace batch (neural-data/emotional-state surveillance ban in AB 1883, bathroom surveillance ban in AB 1331, AI-specific Cal-WARN disclosures in SB 951) while vetoing the sector-specific bills on mental-health and health-care AI. Business opposition zeroed in on the undefined trigger: Chamber of Progress' Robert Singleton wrote that "that critical term is never defined. Employers are given no objective standard for determining when a technology has moved from merely informing a decision to being a primary basis for it" california-workplace-ai-legislative-blitz-2026
.
What to watch: The undefined "primarily relies" standard — expect it to be the battleground in guidance, litigation, and the copycat bills CNBC notes are still pending in New York, Louisiana, and New Jersey.
Italy's Civil Chapter Is Live: Direct Action Against Insurers and Presumed Causation
Italy's Decree 160 entered into force September 30, and the civil mechanics now on the books are unusually claimant-friendly. Under Article 20, "anyone who has suffered damage caused by an AI system may bring a direct action against the insurer providing civil liability coverage to the party responsible for the damage" (CMS). Article 18 adds that "if the damage results from a breach of obligations under the AI Act, the causal link is presumed," and Article 19 forecloses the obvious defense: "Compliance with the AI Act, including through certification, does not in itself exclude liability."
The evidence mechanics have teeth too — courts can order disclosure of logs, technical documentation, and oversight records, with non-compliance punished by deeming "the facts alleged by the injured party... admitted" italy-decree-160-ai-criminal-civil-liability-2026. CMS flags a structural anomaly: the direct action exists without mandatory insurance, compulsory underwriting, or regulated policy content — the three elements that normally anchor such regimes — and even the "liable party" isn't defined. Enterprises deploying high-risk AI in Italy now need third-party liability coverage underwritten around presumed causation italy-decree-160-ai-criminal-civil-liability-2026
.
What to watch: How insurers rebuild underwriting models — and whether other member states copy the direct-action-plus-presumed-causation template as the EU PLD deadline approaches.
Connecticut's Day One Shifts the Burden to Developers
Connecticut's CART Act reached its first milestone October 1, and what's binding now is not what most deployers were bracing for. Per DCI's guidance: "The first deadline is October 1, 2026, when developer information-sharing obligations and the trade-secret carve-out go live" — employer-facing notice duties for newly deployed AEDTs don't arrive until October 1, 2027 connecticut-sb5-ai-employment-law-2026. Developers can even contractually assume the employer's disclosure duties entirely, making vendor-contract negotiation the immediate compliance lever.
The part that applies to deployers now is the discrimination backstop: using an AEDT is no shield to a discrimination claim, and while bias audits aren't mandated, courts may weigh evidence of testing — its "quality, recency, scope, and results" — as a mitigating factor. Enforcement is AG-only, with a 60-day cure notice required for pre-2028 violations connecticut-sb5-ai-employment-law-2026. This extends the prior cycle's finding that the compliance calendar was widely misread — the correct phasing puts this week's burden on developers, not deployers.
What to watch: The UConn layoff study reporting to the General Assembly by January 1, 2027, which is expected to shape the next legislative round.
The EU PLD Transposition Is Splintering Under a Maximum-Harmonization Regime
With the December 9, 2026 transposition deadline under four months away, only three member states have completed transposition — Hungary, Croatia, Lithuania — while twelve have drafts in progress and five (including Spain and Portugal) show no known public movement eu-product-liability-directive-pld-ai-act-strict-liability-2026. This directive is the vehicle that converts EU AI Act obligations into strict product liability in national courts, so the divergences Reed Smith flags are the real story: Finland keeps an outright development-risk defence exclusion while Germany retains it with a genetic-engineering carve-out — "same AI product, three different liability regimes." Finland and Sweden's softer "excessive difficulties" presumption language may "potentially lower[] the threshold for claimants to trigger the presumptions," and whether that survives maximum harmonization "may require judicial resolution."
A corrigendum also matters for product roadmaps: the regime applies to products placed on the market or put into service after December 8, 2026, not December 9 eu-product-liability-directive-pld-ai-act-strict-liability-2026. Reed Smith's bottom line: "The next several months should be used to address those issues so that December 9 is an implementation date, not the beginning of the preparation process."
What to watch: Whether the Commission challenges national overreach — or whether claimants get to forum-shop among divergent national PLD regimes for the same AI product.
What surprised us
- Newsom signed the bill he vetoed. SB 947's enactment reverses his October 2025 veto of the predecessor SB 7 — and the first-in-the-nation ban on sole reliance on automated discipline landed in his final signing window, alongside vetoes of the sector-specific AI bills california-workplace-ai-legislative-blitz-2026
.
- Italy built a direct action against insurers without the insurance framework to support it. No mandatory insurance, no compulsory underwriting, no regulated policy content — and no definition of the "liable party" — yet claimants can sue the insurer directly at policy limits italy-decree-160-ai-criminal-civil-liability-2026
.
- A one-day corrigendum. The PLD's application date moved from December 9 to December 8 — the kind of detail that decides whether a product launch is in or out of scope eu-product-liability-directive-pld-ai-act-strict-liability-2026
.
Open threads worth a vote
- [watch] California SB 947 "No Robo Bosses Act" Operative Date (July 1, 2027) — [/topics/019e4706-c85e-7739-98c5-110149e6ed77#threads]