---
title: "What does it really take to let an AI system handle classified information?"
description: "Classification attaches to the individual parts, not to the document: what an AI system must be able to prove before it works on classified material."
url: https://csidia.com/en/notes/informazioni-classificate-ai-classifiche-segretezza/
lang: en
date: 2026-07-28
label: "Regulation"
publisher: CSIDIA S.r.l. (https://csidia.com/)
italiano: https://csidia.com/note-operative/informazioni-classificate-ai-classifiche-segretezza/
---

# What does it really take to let an AI system handle classified information?

Before putting an artificial intelligence system on an archive of classified information, it is worth re-reading two articles of Italian law. Not as a formality: the way Italian law builds secrecy makes some architectures that are taken for granted today impossible.

## Classification does not sit on the document, it sits on the parts

The rules are in **law 3 August 2007, no. 124**. **Article 42(1)** states what classification is for: “to restrict knowledge of information, documents, acts, activities or objects to those persons who need to access it by reason of their institutional functions”. **Paragraph 3** lists the four levels — *segretissimo, segreto, riservatissimo, riservato* (top secret, secret, highly confidential, restricted) — attributed “on the basis of the criteria ordinarily followed in international relations”. **Paragraph 2** says who classifies: the authority that draws up the document or is first to acquire the information, which may also **raise** the level.

The paragraph that changes everything is **4**: whoever applies the classification “shall identify, within each act or document, the parts that must be classified and shall specifically fix the classification level corresponding to each individual part”. Secrecy is granular by law. A document is not “secret”: it contains secret parts, confidential parts and unclassified parts, each with its own label.

## First consequence: whoever summarises must be able to classify the output

A system that ingests documents and returns a summary works precisely against that granularity: it fuses parts of different levels into a new text that nobody has ever classified. The operational consequence is blunt: **the output inherits the highest level among the parts it drew on**. To apply the matching classification, as paragraph 4 requires, you must know which parts it drew on. An engine that cannot say so is not prohibited: it is unusable, because it makes compliance impossible. Not a risk to be mitigated: a requirement to be met.

## Second: need-to-know attaches to the person, not to the archive

Paragraph 1 ties knowability to the “need to access it by reason of their institutional functions”: a criterion per person and per function, not per document collection. An index, or a vector store built over an entire corpus, collapses that criterion into a single object that knows everything: whoever queries the object queries the corpus. Control therefore cannot sit upstream, on the archive; it has to sit **at retrieval time**, assessed per user and per clearance level, and be demonstrable afterwards. A filter written into the model’s instructions is not a control: it is a request for cooperation.

## Third: clearance also covers the supplier’s own staff

**Article 42(1-bis)** provides that “for the handling of information classified segretissimo, segreto and riservatissimo, possession of the security clearance (NOS) is also required”. **The lowest level, *riservato*, does not require it**: it is the only one of the four left out. **Article 9** completes the picture. Clearance lasts five years for *segretissimo* and ten for *segreto* and *riservatissimo*, “save for different provisions contained in international treaties ratified by Italy”, and “to each of the three classification levels cited there corresponds a distinct level of NOS” (paragraph 3). Issue is conditional on prior vetting designed to exclude “any person who does not offer sure assurance of scrupulous loyalty to the institutions of the Republic” (paragraph 4).

Hence the consequence almost nobody puts in a specification: whoever runs, updates or supports the system **handles** that information, if in doing so they can see queries, logs, indexes or media. A remote support contract that does not govern the clearance of the supplier’s staff is not an administrative detail: it is security, and it belongs beside [the verifiable limits on data use](https://csidia.com/en/notes/contratti-ai-termini-riservati-limiti-verificabili).

## Fourth: the level changes on its own, derived objects do not

**Paragraph 5**: classification “is automatically downgraded to a lower level once five years have elapsed from the date it was applied; after a further period of five years, every classification constraint ceases in any event”. **Paragraph 6** allows extension by reasoned decision, taken by whoever classified or, beyond fifteen years, by the President of the Council of Ministers. For the *riservato* level, **decree-law 22 June 2023, no. 75** added an authentic interpretation (article 1(4)): once five years have elapsed every constraint ceases, with no intermediate step.

A live archive handles this. An index, a model retrained on that material, a backup copy, does not: they stay at the label of the day they were born. Who relabels the derived objects when the source is downgraded? And, conversely, what happens when a part is **raised** in level under paragraph 2 after it has already gone into an index? The second question is the more uncomfortable one.

## Fifth: this is not a self-certification matter

**Paragraph 7** tasks the President of the Council of Ministers with verifying compliance with the classification rules and refers to a dedicated regulation for the scope of each level, the persons holding classification powers and the connected offices. **Article 9(1)** establishes, within the DIS, the **Central Office for Secrecy (UCSe)**, with directive, coordination, advisory and supervisory functions, expressly extended to “industrial production” (paragraph 2, letter b); letter a) covers the preparatory work for the President of the Council of Ministers’ functions **as National Security Authority**. For EU classified information the regime is instead **Council Decision 2013/488/EU**, in force in the consolidated version applicable from 14 August 2025.

These are tracks distinct from [the assessment of ICT supplies inside the cyber perimeter](https://csidia.com/en/notes/perimetro-cibernetico-cvcn-valutazione-forniture-ict) and [cloud qualification for critical data](https://csidia.com/en/notes/cloud-acn-30-giugno-2026-dati-critici-pa): there, what enters a system and where a dataset sits; here, who may know what.

## What a system must be able to prove

- **Level propagation** from source to output, applying the highest level among the parts drawn on.
- **Filtering at retrieval**, tied to the individual person’s clearance, not to the archive’s configuration.
- **A log** of who asked what, and of what was actually shown.
- **Relabelling of derived objects** — indexes, copies, training artefacts — when the source level falls or rises.
- **A physical and logical boundary** around the environment and the copies: where the machines sit, and who reaches them.
- **A regime for the supplier’s staff**: what clearance is required for operation, updating and support.

## Sources

- [Law 3 August 2007, no. 124, article 42 — classification levels and automatic downgrading (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2007-08-03;124~art42)
- [Law 3 August 2007, no. 124, article 9 — UCSe, National Security Authority and clearance levels (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2007-08-03;124~art9)
- [Council Decision 2013/488/EU — security rules for protecting EU classified information (EUR-Lex, ELI)](https://publications.europa.eu/resource/celex/32013D0488)

Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/informazioni-classificate-ai-classifiche-segretezza/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com