Legislative Decree 51/2018: what an AI system’s log must say when the police use it

An analytics platform has spent months working through an investigative unit’s case files: cross-referencing a case-management system, an archive of records, the relevance score a model assigns to every name. Then comes the question that matters: who can say who opened that file, when, and why? The case-management system logs a username, the authentication domain a login time. Neither, on its own, logs the reason — and that is exactly what the law requires to be reconstructable.

That law is not the GDPR. It is Legislative Decree No. 51 of 18 May 2018, the regime that applies in place of Regulation (EU) 2016/679 to anyone processing data for policing and criminal-justice purposes — already flagged in passing while writing about tax-risk analysis. Here we read it on the text in force as of 28 August 2026.

The decree implements Directive (EU) 2016/680. Article 1(2) sets its scope: processing carried out by the competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties (our translation from the Italian text). Paragraph 3 excludes national security. This is not an add-on to the GDPR: it is a separate track.

Two definitions in Article 2 count as much as a specification. The data controller is, by law, the competent authority which, alone or jointly with others, determines the purposes and means of the processing of personal data (lett. h): a public role, not the supplier’s. Whoever processes data on its behalf is a data processor (lett. i), never a controller. Point q) says what a log is: a record of accesses and operations.

Article 21: the log, and its written limit

Paragraph 1 lists the operations to be logged: the collection, alteration, consultation, disclosure, transfer, combination and erasure of data, carried out in automated processing systems, shall be logged in dedicated log files. Seven operations: a system tracing access but not combination satisfies only part of the paragraph.

Paragraph 2 says what each entry must contain: The logs of the operations referred to in paragraph 1 must make it possible to establish the reasons, date and time of such operations and, where possible, the identity of the person who carried out the operations and of the recipients. Three elements carry no condition — reasons, date, time. Two are tied to a where possible the law never defines elsewhere: who decides what is possible is whoever designs the system, before anyone queries it. An architecture built to log the operator from the outset never needs that clause.

Paragraph 3 restricts the use of those logs to the sole purposes of verifying the lawfulness of the processing, for internal monitoring purposes, for ensuring the integrity and security of personal data and in the course of criminal proceedings. Paragraph 4 makes them available to the Garante on request.

And there is something Article 21 no longer says. Article 72(2)(c) of Law 182 of 2 December 2025 struck from paragraph 1 the words to be retained for the period set by the decree referred to in Article 5(2), and point (a) repealed the paragraph that reference pointed to. In the text in force from 18 December 2025 the log stays mandatory, but how long it must be kept the decree no longer says — a period whoever writes the specification must now set and justify.

Article 4: a score is an evaluation, not a fact

Article 4 imposes two things before data leaves the system that produced it. The first: the controller distinguishes personal data relating to the different categories of data subjects provided for by law, and data based on facts from data based on personal assessments. The categories, the law lists by name: persons subject to investigation; defendants; persons subject to investigation or charged in a related or connected proceeding; persons convicted by final judgment; persons injured by the offence; civil parties; persons providing information on the facts; witnesses.

This is where artificial intelligence enters the decree without being named in it: a risk score is, by construction, an evaluation, not a fact, and Article 4 requires it to stay labelled as such. The second: verification before transmission. The authority verifies the quality of personal data before they are transmitted or made available, and accompanies their transmission with information enabling the receiving authority to assess their degree of accuracy, completeness, up-to-dateness and reliability (para. 2).

Article 8, briefly

The decree carries its own ban on fully automated decisions: Decisions based solely on automated processing, including profiling, which produce adverse effects on the data subject, are prohibited unless authorised by European Union law or by specific legal provisions (para. 1); in any case, the right to obtain human intervention on the part of the data controller is guaranteed (para. 2). For a system assisting rather than replacing an investigator, Article 8 describes how it should already work.

Where the evidence actually sits today

Article 21’s difficulty is not writing it into a tender specification: the evidence is split across systems that do not talk to each other.

The case-management system knows who opened a file, not necessarily why. The local records system knows the subject’s identity and category, not who else consulted it elsewhere. The authentication domain logs a login with a timestamp, not the purpose. The remote-access gateway knows where and when someone connected, not which file. The analytics tool’s audit trail, where one exists, logs queries and outputs, often with no structured reason field. The paper register of authorisations, where it survives, is sometimes the only place the reason is written in full — and it talks to none of the other five.

None of these, alone, produces what paragraph 2 requires: reason, date, time, person, recipients, for each operation. What is needed is a layer that correlates them, or the reason captured at the moment of the query — not reconstructed afterwards from logs sharing neither a format nor a key.

What to write into the tender, what to test at handover

In the tender specification: a mandatory, non-discretionary reason field for each of Article 21’s seven operations; an explicit evaluation label on every model output, never a fact label, carrying Article 4’s four quality metadata; the correct role for each party: supplier as processor, never controller; and exportable logs on the Garante’s request (Article 21(4)).

At handover: a test consultation, alteration and combination must each produce a distinct log entry; a model output must carry its label and metadata, not just the number; a decision with adverse effects must not close without a logged human intervention; and, for high-risk processing, an Article 23 impact assessment must exist — distinct from the one on fundamental rights under the AI Act, as the Garante has already had to clarify.

What we have not verified

We read, on the text in force as of 28 August 2026 as exported from Normattiva, Articles 1, 2, 4, 8, 20, 21, 23, 24, 25 and 47 of the decree, and Article 72 of Law 182/2025. We did not read the other articles, nor any implementing regulations or Garante decisions interpreting, for an AI system, Article 21’s where possible: if any exist, this research did not find them. We did not verify case law, nor — under the constraint we hold on anything touching public security — look into how any specific Italian police system is built: this piece reads the law, not an archive.

The two axes, applied

Complying. Article 21’s seven operations, Article 4’s fact/evaluation distinction, the four quality metadata: in our system these become fields the platform populates on its own with every query, not a form filled in from memory afterwards. The log exports itself, dated, the day the Garante — or a judge — asks for it.

Deciding. The same data model is what an AI agent works from to help an investigator pull together scattered case files and archives — always with an operator in command, as Article 8 requires. For public-sector and defence clients, always in two modes: on-premise, inside the client’s perimeter, or dedicated cloud, with a dedicated VPN, a data centre in Italy and premises we oversee directly.

Do you need to write a tender specification covering police or criminal-justice data? Half an hour with one of our engineers is enough for a first read of what the decree requires you to prove.

The regime that replaces the GDPR