---
title: "The system administrator of your company’s AI: is the 2008 measure still in force?"
description: "Whoever holds the credentials to the AI server reads the company’s most sensitive files. Verified against the source: what survives, in 2026, of the Garante’s 2008 measure."
url: https://csidia.com/en/notes/amministratore-di-sistema-ai-aziendale/
lang: en
date: 2026-08-01
label: "Regulation"
publisher: CSIDIA S.r.l. (https://csidia.com/)
italiano: https://csidia.com/note-operative/amministratore-di-sistema-ai-aziendale/
---

# The system administrator of your company’s AI: is the 2008 measure still in force?

A typical scenario, not the case of a real company. A company installs a dedicated AI assistant: it reads technical manuals, tender specifications, supply contracts, the payroll of the quality department. The server is administered by whoever set it up — an in-house technician, often an outside supplier — through a single "admin" account that everyone in the IT department knows by heart. It works, nobody complains, until someone asks who opened what, and when. In many companies the answer is that nobody knows for certain, because nobody has ever had to prove it.

## The 2008 measure, with the references

The Italian data protection authority's general measure of **27 November 2008** — "Measures and arrangements required of data controllers processing personal data by electronic means, concerning the assignment of system administrator functions" (doc. web no. 1577499, Official Gazette no. 300 of 24 December 2008), amended on **25 June 2009** (doc. web no. 1626595) — sets out five requirements, all of them operational, not statements of principle:

1. a prior assessment of the "subjective characteristics" of whoever will be designated — experience, capability, reliability;
2. an **individual designation**, never a collective one, with "an analytical list of the areas of operation permitted under the authorisation profile assigned": the administrator gets access to what the job needs, not to everything;
3. an up-to-date list of system administrators, with identifying details and the functions assigned, made known or knowable to workers — through the privacy notice, the technical policy or an internal communication — whenever the processing concerns their data;
4. the **recording of logical access**: complete, unalterable, with verifiable integrity, time references and a description of the event, retained for a "period of not less than six months";
5. a review of the administrator's work **"at least once a year"** by the controller or processor.

The 2009 amendment removed only one paper-based duty — the note in the security policy document, itself later abolished — and allowed retention and review to be delegated to an external processor by contract. The substance of the five requirements has not changed.

## The trap: "the GDPR has superseded it"

It is the most common objection, and it is not baseless: the measure was written under the old Privacy Code, does not mention the GDPR, and has never heard of AI. Checking it at the root means reading a single provision, **article 22(4) of Legislative Decree 101 of 10 August 2018**: "As from 25 May 2018, the measures of the Data Protection Authority continue to apply, **in so far as they are compatible** with the above-mentioned Regulation and with the provisions of this Decree." That is not a blank confirmation: it is a conditional survival, to be checked provision by provision — which is exactly why legal commentators disagree. Some write that incompatibility with the GDPR is "a non-issue"; others argue that still requiring the names of administrators is today "a pointless practice". Neither of them is the Garante.

The answer that counts is not in an FAQ but in an enforcement decision. On **16 January 2025** (register of measures no. 11/2025, doc. web no. 10110241) the Authority fined **Realmaps S.r.l. €100,000**, and among the violations found was precisely the handling of system administrators: "generic accounts used, and usable, by system operators" — the Garante writes — "amount, in fact, to system-level credentials shared among several users", raising difficulties "as to the actual possibility of tracing accesses back to the individual formally authorised to process the data". The processing turned out to have been carried out "in the absence of a formal 'assignment of functions and tasks to designated persons'" under article 2-quaterdecies of the Privacy Code. And to justify this the Authority invokes "the measures set out in the Garante's provision of 27 November 2008 on system administrators, **still to be regarded as valid, with the value of a guideline**".

Here is the outcome, with the precision it deserves: not "in force" as a stand-alone body of rules with its original binding weight — that framework has been absorbed into GDPR accountability — and not "lapsed" either. **Valid, with the value of a guideline**, kept alive by article 22(4) of Legislative Decree 101/2018 and made operational today through article 2-quaterdecies of the Privacy Code and articles 5(2), 24 and 32 of the GDPR, cited together in the same decision. What remains undefined, and we say so because it is more useful than an invented certainty, is which individual requirements of the 2008 measure the Garante would treat as "compatible" in a case unlike Realmaps. The point that is settled — and settled by a recent enforcement decision, not by a rule eighteen years old — is the substance: individual designation, credentials that are not shared, traceable access.

## Who, under the GDPR, is the person administering the system

The system administrator is not a category the GDPR itself uses: the Regulation knows the controller and the **processor** — article 4(8): "a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller" — and anyone who, under either one, has access to the data. **Article 29** puts it in one line: anyone acting under the authority of the controller or the processor who has access to personal data "shall not process those data except on instructions from the controller"; **article 32(4)** places the same duty on both. **Article 2-quaterdecies** of the Privacy Code — introduced by the very same Legislative Decree 101/2018 that also holds the survival clause — is the hinge: it lets the controller assign "specific tasks and functions connected with the processing of personal data" to "natural persons, expressly designated", through "whatever arrangements it considers most appropriate". It is the legal basis on which what was called, in 2008, the designation of the system administrator is written today: the same underlying duty, an updated foundation.

Where the administrator is an outside party — an IT supplier, a service centre, a technology partner — **article 28** of the GDPR also applies: the controller "shall use only processors providing sufficient guarantees", under a contract that sets out the subject-matter, duration, nature and purpose of the processing, the duty to process data "only on documented instructions from the controller", and the security measures of article 32; where that outside processor in turn engages a sub-processor, the same obligations pass on by contract (article 28(4)). It is not a form signed once: it is the document where scope, logs, periodic review and audit rights get written down.

A boundary, for anyone who read this week's piece on AI assistant logs: the administrator's access log is itself one of the "instruments from which the possibility of remote monitoring of workers' activity also follows", under article 4 of the Italian Workers' Statute — [we have already written about that](https://csidia.com/en/notes/log-assistente-ai-segreti-e-controllo-a-distanza) with regard to the prompt register. Here the question comes first, and it is a different one: who has the right to open that log, under what written designation, and who checks that it is opened only for the reasons it was switched on for.

## What to do now

Six things, each verifiable on its own. A written, up-to-date list of who administers the AI system, with the assessment of subjective characteristics and the exact scope of each person — an individual, not a generic role. Individual credentials, never a shared "admin" account: precisely the point that cost Realmaps €100,000. The logical access log, retained for at least six months, complete and with verifiable integrity. A review of the administrator's work at least once a year, minuted — not merely turning logging on. Where the administrator is external, the article 28 contract with the clauses set out above, not a supplier's verbal assurances. Where the processing concerns workers' data, the administrator's identity made known or knowable in the privacy notice: [the same principle that underpins protection of trade secrets](https://csidia.com/en/notes/segreto-industriale-prova-misure-adeguate-ai) — measures count if they can be produced, not merely declared.

## Sources

- [Garante privacy, general measure of 27 November 2008 on system administrators (doc. web 1577499)](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/1577499)
- [Garante privacy, amending measure of 25 June 2009 (doc. web 1626595)](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/1626595)
- [Garante privacy, decision of 16 January 2025 no. 11/2025 — Realmaps S.r.l. (doc. web 10110241)](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10110241)
- [Legislative Decree 101 of 10 August 2018, article 22 — transitional provisions (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2018-08-10;101~art22)
- [Legislative Decree 196 of 30 June 2003, article 2-quaterdecies — assignment of functions and tasks to designated persons (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196~art2quaterdecies)
- [Regulation (EU) 2016/679 (GDPR), articles 4, 28, 29 and 32 (EUR-Lex)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/amministratore-di-sistema-ai-aziendale/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com