Probabilistic analysis and Article 158: the GDPR rights that stay limited

Legislative Decree No. 141 of 5 August 2026 — a consolidated text on tax duties and assessment — sits in the Supplemento ordinario n. 28/L to the Gazzetta Ufficiale n. 181 of 6 August 2026. At pages 164-165, Article 158, headed «Razionalizzazione e riordino delle disposizioni normative in materia di attività di analisi del rischio», reproduces almost verbatim Article 2, paragraphs 1 to 4, 7 and 9, of Legislative Decree No. 13 of 12 February 2024. It introduces no new power: it moves an existing one into a consolidated text. But how it is defined measures how much the administration can already do — and how much whoever gets selected can still contest.

Two models, one sentence that tells them apart

Article 158(1) draws a line between two families of tax-risk analysis. The first is what anyone pictures when thinking of a tax check: «analisi deterministica» — deterministic analysis — «insieme dei modelli e delle tecniche di analisi basati sul raffronto e sull’elaborazione di dati […] volti a verificare, tramite criteri selettivi fondati su relazioni non probabilistiche, l’avveramento di un rischio fiscale, in tutto o in parte definibile prima dell’avvio dell’analisi» — models and techniques, based on comparing and processing data, that verify a tax risk through non-probabilistic criteria, one definable before the analysis even starts.

The second family differs in substance, not only in name. It is «analisi probabilistica» — probabilistic analysis — «insieme dei modelli e delle tecniche di analisi che, sfruttando soluzioni di intelligenza artificiale ovvero di statistica inferenziale, consentono di isolare rischi fiscali, anche non noti a priori, che, una volta individuati, possono essere utilizzati per l’elaborazione di autonomi criteri selettivi, ovvero permettono di attribuire una determinata probabilità di accadimento a un rischio fiscale noto» — ours: models that, using artificial intelligence or inferential statistics, isolate tax risks not known beforehand, which once found may feed new criteria of their own, or attach a probability to a risk already known. Its output is named, in the same rule, «indicatore di rischio desunto o derivato»: an inferred risk indicator, the result of a profiling process characterising the taxpayers under analysis — profiling, named as such by the statute.

What the results are for, and on what data

Paragraph 2 closes a doubt: beyond preventing tax evasion, fraud and abuse of tax law and encouraging voluntary compliance, results «possono essere utilizzati anche per lo svolgimento di controlli preventivi» — may also be used for preventive checks. Not only after-the-fact assessment: upstream selection too.

Paragraph 3 covers the data: «tutte le basi dati di cui l’Agenzia delle entrate dispone» — all the databases the Revenue Agency holds, including the Tax Register — «escluse quelle soggette alla disciplina di cui al decreto legislativo 18 maggio 2018, n. 51», excluding those under Legislative Decree No. 51/2018 (police and criminal-justice data, a separate regime) — used «anche tramite interconnessione tra loro e con quelle di archivi e registri pubblici», also through interconnection with public archives and registers. The same logic sits behind the interconnection of European databases.

Paragraph 4: this is where the rule becomes ours

For risk-analysis activities the Revenue Agency conducts with the Department of Finance, under Article 2-undecies(3) of the Italian data-protection code and Article 23(1) of the GDPR, a regulation of the Minister of Economy and Finance — «sentito il Garante per la protezione dei dati personali» — is to define three things: «le specifiche limitazioni e le modalità di esercizio dei diritti di cui agli articoli 15, 17, 18, 21 e 22», ours: the specific limitations and arrangements for exercising those GDPR rights, «in modo da assicurare che tale esercizio non possa arrecare un pregiudizio effettivo e concreto all’obiettivo di interesse pubblico»; the essential minimum content under Article 23(2); and «le misure adeguate a tutela dei diritti e delle libertà degli interessati».

Those five are the rights whoever is singled out by a model would reach for: 15 access, 17 erasure, 18 restriction, 21 objection, and 22 — the most relevant here — the right not to be subject to a decision based solely on automated processing, including profiling. Paragraph 4 does not abolish them: it authorises a regulation to define «specifiche limitazioni» on them.

It is not an unchecked power. Article 23(1) of the GDPR lets states restrict those rights when necessary and proportionate to a public-interest objective, tax among them; the regulation follows consultation with the Garante and must carry adequate safeguards. And the Italian code gets there first: Article 2-undecies(1)(f-bis) already lists «agli interessi tutelati in materia tributaria e allo svolgimento delle attività di prevenzione e contrasto all’evasione fiscale» — ours: interests protected in tax matters and the prevention of tax evasion — among the cases where those rights are not exercised by request to the controller. Paragraph 3 then requires that, where exercise is «ritardato, limitato o escluso», it happen «con comunicazione motivata e resa senza ritardo all’interessato» unless that would defeat the purpose, and adds that the rights «possono essere esercitati anche tramite il Garante con le modalità di cui all’articolo 160». The news is not that these rights disappear: it is that how much survives is deferred to a regulation which, as far as we have verified, has not yet been adopted as of 13 August 2026.

Where we stop

Article 158 reorganises rules that already existed — it reproduces Article 2 of Legislative Decree No. 13/2024, February 2024. Not a new power introduced today: its codification into a consolidated text, the difference between a serious reading and an alarm. We do not know whether or when the regulation will be adopted, nor what it will contain: our search of later Gazzetta issues and Normattiva found no trace of adoption, but it was not exhaustive. We have no news of assessments already grounded in probabilistic analysis under this rule, and we make no such claim. This is a reading of primary sources, not legal advice.

What changes for whoever gets selected

For a business, the consequence is organisational: a check from a model that isolated one of those risks «non noti a priori» — not known beforehand — also means arguing how it was selected, with access and objection rights of a scope still to be defined. Questions worth answering with your own records: which data concerning you sit in interconnected databases and of what quality; whether returns and filings can be reconstructed with a date and version; whether an internal explanation already exists — an extraordinary transaction, a stock movement, an intra-group arrangement — for anomalies an outside model would read as a signal. Not defending against an assessment: answering with a file, not memory — the gap between whoever already holds the data proving implementation and whoever produces only a signed policy, or between whoever knows where every CRM contact came from and whoever finds out only when the request arrives.

See the service · Talk to an engineer

The two axes, applied

Complying. A business’s documentary duties — those Article 158 can now cross-reference against other databases without declaring what it seeks — become, in our system, a control running on the client’s documents and systems: for each duty, which data proves it, where it sits, with what date and evidence. Not a register that lists suppliers without saying what they actually supply, but a file that exports itself, dated, the day a request arrives — instead of being rebuilt from memory.

Deciding. The same system holds management software, archives, documents and systems together in a single operating model on which AI agents execute decisions with a human operator in command, for large enterprises, defence, public administration and healthcare. On the other side of the table, the risk analysis Article 158 describes is already a system of this kind. The asymmetry is not between right and wrong: it is between whoever holds their data in one system and whoever has it scattered. Always in two modes — on-premises, on autonomous machines needing no deep integration into the client’s network, or dedicated cloud with a dedicated VPN and a data centre in Italy — always with shared management.

From the first session, at no cost, comes the dated list of which data prove which of your duties, and where it sits — blank boxes included. It stays yours even if we do not go on together. Talk to one of our engineers.