In recent years, Italy has become one of the jurisdictions most closely scrutinising whether digital infrastructure can give rise to a permanent establishment (PE).

Data centres are increasingly relevant because they provide the physical nexus through which dematerialised economic activity is anchored to a territory (see Power and place: A regulatory guide to data centre developments in Europe).

The Italian tax authority is also increasingly focused on cases in which significant economic activity is carried on through infrastructure located in Italy, even in the absence of local personnel.

For multinational groups investing in cloud infrastructure, AI capacity and digital delivery networks, PE risk can no longer be assessed solely by reference to personnel or traditional business premises. At the same time, treaty protections continue to impose important legal limits on the extent to which domestic concepts of digital presence can be applied.

Against this backdrop, determining where Italy draws the line has become a practical, not merely theoretical, issue.

The Netflix case: a turning point in Italian enforcement

The Netflix case remains the most significant enforcement example and offers an important indication of the direction of Italian enforcement activity.

Investigations by the Italian tax police identified a content delivery network (CDN) comprising more than 350 servers deployed across Italian data centres and telecommunications networks. The Milan Prosecutor’s Office qualified this infrastructure as “essential and significant for the development of business” in Italy because, despite the absence of personnel, the physical proximity of the servers to end users was necessary to ensure service quality.

The case concluded with Netflix paying approximately EUR 55.8 million in taxes, penalties and interest for the 2015–2019 period. It was followed by the establishment of Netflix Services Italy S.r.l. on 1 January 2022 to invoice Italian subscribers directly.

Following the Netflix case, the Italian tax authority broadened its focus beyond digital platforms. It increasingly scrutinises Italian data centre operators that provide services such as co-location, web hosting and cloud solutions to foreign enterprises, to assess whether their non-resident customers might have undeclared digital PEs.

The challenge: applying traditional PE rules to digital businesses

Under both Art. 162(1) of the Italian Consolidated Income Tax Act (TUIR) and Art. 5(1) of the OECD Model Convention, a PE generally requires a fixed place of business through which a non-resident enterprise carries on all or part of its activity.

The increasing dematerialisation of production processes, together with the ability of digital enterprises to operate globally without a significant physical presence, has exposed the limitations of a framework originally designed for traditional business models, in which economic activity was closely linked to physical premises and personnel. Businesses can now generate substantial revenues in a jurisdiction while maintaining only limited physical infrastructure and little or no local workforce.

Data centres – which comprise servers, network equipment, and power and cooling installations used to store, process and transmit digital information – represent the physical nexus through which dematerialised economic activity anchors to a territory and thereby acquires tax relevance.

According to the Politecnico di Milano Data Center Observatory, approximately EUR 25 billion is expected to be invested in Italian data centres between 2026 and 2029, a substantial proportion of it in AI-capable infrastructure.

When can a server give rise to a PE?

International tax doctrine, the OECD Commentary and Italian administrative practice identify servers as the principal connecting factor between the PE concept and e-commerce.

By contrast, a website, which is essentially software and data, is generally not regarded as a fixed place of business.

A server-based PE is most likely to arise where all three of the following conditions are satisfied:

• Fixed location with sufficient permanence: The server is located in Italy on a sufficiently stable basis. The relevant criterion is permanence at a given location, not whether the server can physically be moved.
• Full availability to the foreign enterprise: The enterprise owns, leases or otherwise has the server at its disposal.
• Business activity carried on through the server: The infrastructure performs functions that are more than merely preparatory or auxiliary.

The critical distinction: core versus auxiliary activities

The distinction between core and auxiliary activities is central to the analysis.

PE risk is materially stronger where a server operates as a highly automated operational centre capable of performing a substantial part of the commercial cycle – including customer interaction, service delivery and transaction processing – without significant human intervention. Server-based PE cases are distinctive because PE status may be asserted even without local personnel, provided the applicable treaty requirements are otherwise met. The closer the infrastructure comes to performing functions essential to the enterprise’s business, the stronger the case that the enterprise is carrying on business through a fixed place in Italy.

The position is different when the server performs functions that are merely preparatory or auxiliary, such as:

• temporary data storage,
• caching functions,
• displaying product catalogues, and
• routing internet traffic.

Conversely, where the infrastructure performs only ancillary functions and the decision-making stages of the commercial relationship take place outside Italy, the case for a server-based PE is correspondingly weaker.

Effective availability: a key practical issue

Effective availability is particularly important when assessing whether technological infrastructure can constitute a fixed place of business.

When a non-resident enterprise uses shared-hosting arrangements alongside multiple customers and exercises little or no control over the underlying hardware, a PE determination is generally less likely.

By contrast, exclusive control over the infrastructure – including full authority to manage and configure the hardware – could materially increase PE risk.

Italy’s digital PE rules test treaty limits: the Supreme Court’s position

Italy sought to address the challenges of the digital economy through Art. 162(2)(f-bis) of the TUIR, which introduces the concept of a “significant and continuous economic presence”. However, the practical reach of that provision remains constrained by applicable international tax treaties.

In Decision No. 33390 of 31 July 2023, the Italian Supreme Court examined the relationship between Italy’s domestic digital PE concept and the treaty framework.

The Court recognised that the concept of “significant and continuous economic presence” operates on a plane that is “not consistent with the treaty framework”, thereby acknowledging its potentially limited scope where international obligations apply.

The decision confirms an important principle: when an applicable double tax treaty follows the OECD Model, the existence of a PE remains anchored to the requirements under Art. 5, namely, the presence of a fixed place of business or a dependent agent.

Accordingly, domestic digital PE concepts cannot automatically override treaty protections.

The Court reasoned that Art. 162(2)(f-bis) appears likely to operate only residually where the applicable treaty reflects the OECD Model. PE qualification therefore remains firmly anchored to the traditional requirements of Art. 5 of the OECD Model.

This is one of the most significant legal constraints on Italy’s increasingly expansive enforcement approach.

Legislative developments: the 2026 Data Centre Bill

The same tension is apparent in recent legislative initiatives.

Art. 2 of the Data Centre Bill, approved by the Chamber of Deputies on 24 February 2026, defines a data centre as a complex comprising physical structures and technological infrastructure used to develop, operate and manage IT services and data.

Of particular note, the parliamentary process removed a provision that would have expressly linked the tax treatment of data centres to the OECD principles governing PE qualification.

The legislative debate could be read as reflecting an intention to preserve the ability to assert PE status in relation to economically significant activities associated with data management and digital infrastructure, while avoiding interpretations considered unduly restrictive.

This aspect of the legislative process is notable because it reflects the same tension evident in enforcement practice: the desire to preserve flexibility in addressing digital business models without tying interpretation too closely to existing OECD concepts.

A second challenge: profit attribution

Even when a server-based PE can be established, a second, equally important question arises: how much profit can be attributed to that PE?

The OECD’s Authorised OECD Approach (AOA) places substantial weight on “significant people functions” when attributing profits. This creates obvious difficulties for highly automated business models, in which value creation might depend primarily on technology, data and algorithms rather than on employees located in the relevant jurisdiction. The limitations of the AOA are particularly apparent where a significant digital presence operates through automated infrastructure without locally performed significant people functions.

In these circumstances, the profits attributable to a server-based PE may remain limited, even when the infrastructure itself is considered sufficient to establish a taxable presence. In some cases, the profit attributable to the hardware alone could be negligible compared with the overall value generated by the digital business.

To address this gap, the European Commission proposed COM(2018) 147 final modifying the criteria for determining profit so as to recognise as economically relevant activities carried on through the digital interface in relation to data and users, including the development, enhancement, maintenance, protection and exploitation of intangible assets, even if those activities are not linked to functions performed by personnel in the same Member State. 

By attracting new users to a social network, for example, the set of intangible assets attributable to the underlying enterprise plays a key role in ensuring positive network externalities, that is, enabling users to connect with numerous other users. The network’s expansion through a significant digital presence strengthens that same set of intangible assets. That set can be further enhanced by the processing of user data that enables the social network to sell personalised advertising space at a premium based on user interests. 

Each economically relevant activity uniquely contributes to value creation in digital business models and is an integral part thereof. From this standpoint, the profit-split method is often considered the most appropriate because it uses factors such as R&D, marketing expenses, the number of users, and the data collected per Member State. However, the proposed directive was never adopted.

For the largest and most profitable multinationals, the introduction of the OECD Pillar One rules is expected to bring about a paradigm shift. Those rules expressly recognise the inadequacy of current nexus criteria and envisage a new multilateral mechanism for allocating taxing rights to market jurisdictions, granting them taxing rights on a residual portion of multinational profits regardless of physical presence. Implementation, however, requires a multilateral treaty and widespread international ratification, a process that has been hindered by political deadlock in key countries outside Europe.

Practical implications for multinational groups

The absence of a fully coherent framework governing both PE qualification and profit attribution remains one of the principal challenges for multinational enterprises with digital infrastructure in Italy.

This uncertainty makes tax outcomes more difficult to predict and could increase the risk that multiple jurisdictions will seek to tax the same income, potentially giving rise to juridical or economic double taxation.

In assessing PE risk, particular attention should be paid to three factors: (a) the degree of control exercised over the infrastructure, (b) whether the server is effectively at the disposal of the foreign enterprise, and (c) the nature of the functions performed through that infrastructure. Risk generally increases where dedicated servers in Italy are effectively at the disposal of the foreign enterprise and perform functions that are central to its business activities.

Conclusion

Italy’s approach to data centres and PEs lies at the intersection of two competing trends. On the one hand, tax authorities are increasingly willing to scrutinise digital infrastructure as a potential source of taxable presence. On the other hand, OECD-based treaty rules continue to impose significant limits on how far traditional PE concepts can be extended.

The absence of a fully coherent framework governing both PE qualification and profit attribution remains one of the principal weaknesses of the current international tax system in the digital economy. Italy’s increasingly assertive enforcement activity illustrates the practical consequences of that uncertainty, while the existing treaty framework continues to impose important legal constraints on extending PE concepts beyond their traditional boundaries.

For multinational groups investing in cloud infrastructure, AI capacity and digital delivery networks in Italy, the question is no longer whether these issues matter but how to manage them proactively before they become the subject of an audit.