Classified contracts: the exemption is from the tender, not from oversight

A typical scenario, not a case of ours. A public authority that has to award a security system contract signs the order that attributes a secrecy classification to it: from that moment the ordinary tender can no longer be run. The procurement office draws up the list of economic operators to invite to the informal procedure that replaces it; the personnel office checks the security clearances of whoever will carry out the contract, but its own system does not say whether, at that classification level, the clearance is actually required. In a third office, the legal one, someone should already know that in the following months the Corte dei conti — Italy’s Court of Auditors — will open a file on that very order, and that by 30 June of the following year the file will feed into a report to Parliament. None of the three offices holds the whole picture. This is not a hypothesis: it is the procedure Italy’s Public Contracts Code sets out, in so many words, for contracts it calls «secretati» — classified.

Two exemptions, not one

The provision is Article 139 of Legislative Decree 31 March 2023, no. 36 — Italy’s Public Contracts Code, in force since 1 April 2023 — placed in Title V, devoted to «difesa e sicurezza» — defence and security — and, precisely, to «contratti secretati» — classified contracts. Paragraph 1 is worth reading in full: the code’s provisions on award procedures may be departed from — in two distinct cases. The first, letter a): for contracts whose subject matter, instruments or method of performance are given a secrecy classification. The second, letter b): for contracts whose performance must be accompanied by special security measures, under legislative, regulatory or administrative provisions. These are two different tracks. The first runs through the secrecy classifications of Law 124/2007; the second does not — a contract can require special security measures without anything in it ever being classified. Whoever opens the file needs to know from day one which of the two letters applies, because everything downstream depends on it.

Two separate reasoned orders

Paragraph 2 leaves no room for automatism. For letter a), the contracting authority attributes the secrecy classification by a reasoned order under Article 42 of Law no. 124 of 3 August 2007 […] setting out the specific grounds that justify entering into a classified contract, with particular regard to the requirements laid down for each classification. For letter b), the contracting authority declares, by a reasoned order, the works, services and supplies that may be carried out under special security measures […] specifying the reasons that require them. It is not the same signature: two separate reasoned orders, resting on different grounds that have to be put in writing — and kept, because it is precisely these acts that the first of the paragraph 5 controls opens on.

The clearance is not automatic

Paragraph 3 provides that the contracts referred to in paragraph 1 are carried out by economic operators holding the requirements set out in the code, as well as the security clearance, under and within the limits of Article 42, paragraph 1-bis, of Law no. 124 of 2007. That «nei limiti» — within the limits — is not decorative: Article 42, paragraph 1-bis of Law 124/2007 says that handling information classified top secret, secret or very confidential also requires holding the security clearance (NOS). The «riservato» — confidential — level is left out. That means the personnel clearance is not a fixed requirement identical for every classified contract: it depends on the classification the paragraph 2 order attributed on that particular day, for that particular contract. Whoever checks the clearances — usually a different office from the one that signed the order — needs to know that classification: it is the same granularity that governs how an AI system may handle classified information. For the company as a whole, not only for the individuals who work in it, the clearance path has requirements of its own — a secure area, beneficial owners, anti-mafia checks — which we have already described here.

The tender without a fixed number

Paragraph 4 replaces the tender with an an informal competitive process to which at least five economic operators are invited, if that many qualified operators exist for the subject matter of the contract, and provided that negotiating with more than one operator is compatible with secrecy and security needs. Here too no fixed number: five is the threshold only if five qualified operators genuinely exist for that subject matter, and only if negotiating with more than one does not compromise secrecy. Deciding that fewer than five exist, or that multi-party negotiation is not compatible with security, is a judgement that — unlike the paragraph 2 orders — the law does not explicitly require to be put in writing. This is the point where the file tends to stay thinnest. It is also the first thing an audit goes looking for.

Three controls, not one

Paragraph 5 hands oversight to the Corte dei conti, but not through a single control: the Court of Auditors, through its Central Section for the control of classified contracts, exercises preventive control over the reasoned orders referred to in paragraph 2, preventive control over the lawfulness and regularity of the contracts under this article, and control over the regularity, correctness and effectiveness of their management. Three controls, on three different objects: the act that justified the classification, the contract itself, and — no longer preventive, but on management over time — its execution. Then the part that closes the circle: this activity is accounted for by 30 June of each year in a report to the Parliamentary Committee for the Security of the Republic — Italy’s COPASIR. An order signed on one specific day, execution that runs for years, a control carried out by a body other than the one that signed it, and an annual parliamentary report that sums it all up: four different clocks, none of which lines up with the moment someone at the authority or the contractor decides to check whether everything is still in order.

What whoever manages a classified contract must be able to show

The reasoned order attributing the classification or declaring the special measures — paragraph 2, with specific grounds, not a boilerplate formula.
The exact classification attributed, because it determines whether the personnel clearance is even required.
The clearances of the economic operator’s personnel, kept current and with expiry dates tracked.
The informal-tender file: who was invited, why that number, under which negotiation method.
The status of the three Corte dei conti controls — on the order, on the contract, on its management — with the date of the last check.
The reference in the annual report to COPASIR, if and when the contract appears in it.

What we have not verified

We do not handle or disclose classified information: we work only from public sources, here the text of Article 139 of the Public Contracts Code and Article 42 of Law 124/2007 as they stand in force on Normattiva as of today. We do not know the concrete procedural practice the Central Section for the control of classified contracts actually follows, nor the average time it takes to complete a preventive control: that is information a public authority or a company checks with its own contacts, not with an article.

The two axes, applied to classified contracts

Compliance, here, is not the summary of a legal opinion: it is a control that runs across the authority’s and the contractor’s documents and lines up, for every classified contract, the order that justifies it, the classification it carries, the clearances that classification requires, the informal-tender file and the status of the three Corte dei conti controls — ready to produce, not rebuilt when the request arrives.

Decisions are the other axis. The same system that holds together orders, clearances, tender files and control reports can also hold together the rest of a defence authority’s or company’s scattered data — archives, management systems, sensors, documents — in a single operating model, on which AI agents execute decisions with a human operator in command. Always in two modes, never only one: on-premise, on autonomous machines that do not require deep integration into the client’s network, or dedicated cloud, with a data centre resident in Italy and premises we directly guard — never a supplier that asks the client to already have, in-house, someone to administer an artificial intelligence system. This is the method behind our platform, applied to a sector — defence — where oversight is not an accessory to security: it is the proof of it.

Do you manage a contract that falls under Article 139, or need to respond to an informal tender that invokes it? Half an hour with one of our experts for a first read of what you will need to be able to show.