What does it really take to let an AI system handle classified information?

Before putting an artificial intelligence system on an archive of classified information, it is worth re-reading two articles of Italian law. Not as a formality: the way Italian law builds secrecy makes some architectures that are taken for granted today impossible.

Classification does not sit on the document, it sits on the parts

The rules are in law 3 August 2007, no. 124. Article 42(1) states what classification is for: “to restrict knowledge of information, documents, acts, activities or objects to those persons who need to access it by reason of their institutional functions”. Paragraph 3 lists the four levels — segretissimo, segreto, riservatissimo, riservato (top secret, secret, highly confidential, restricted) — attributed “on the basis of the criteria ordinarily followed in international relations”. Paragraph 2 says who classifies: the authority that draws up the document or is first to acquire the information, which may also raise the level.

The paragraph that changes everything is 4: whoever applies the classification “shall identify, within each act or document, the parts that must be classified and shall specifically fix the classification level corresponding to each individual part”. Secrecy is granular by law. A document is not “secret”: it contains secret parts, confidential parts and unclassified parts, each with its own label.

First consequence: whoever summarises must be able to classify the output

A system that ingests documents and returns a summary works precisely against that granularity: it fuses parts of different levels into a new text that nobody has ever classified. The operational consequence is blunt: the output inherits the highest level among the parts it drew on. To apply the matching classification, as paragraph 4 requires, you must know which parts it drew on. An engine that cannot say so is not prohibited: it is unusable, because it makes compliance impossible. Not a risk to be mitigated: a requirement to be met.

Second: need-to-know attaches to the person, not to the archive

Paragraph 1 ties knowability to the “need to access it by reason of their institutional functions”: a criterion per person and per function, not per document collection. An index, or a vector store built over an entire corpus, collapses that criterion into a single object that knows everything: whoever queries the object queries the corpus. Control therefore cannot sit upstream, on the archive; it has to sit at retrieval time, assessed per user and per clearance level, and be demonstrable afterwards. A filter written into the model’s instructions is not a control: it is a request for cooperation.

Third: clearance also covers the supplier’s own staff

Article 42(1-bis) provides that “for the handling of information classified segretissimo, segreto and riservatissimo, possession of the security clearance (NOS) is also required”. The lowest level, riservato, does not require it: it is the only one of the four left out. Article 9 completes the picture. Clearance lasts five years for segretissimo and ten for segreto and riservatissimo, “save for different provisions contained in international treaties ratified by Italy”, and “to each of the three classification levels cited there corresponds a distinct level of NOS” (paragraph 3). Issue is conditional on prior vetting designed to exclude “any person who does not offer sure assurance of scrupulous loyalty to the institutions of the Republic” (paragraph 4).

Hence the consequence almost nobody puts in a specification: whoever runs, updates or supports the system handles that information, if in doing so they can see queries, logs, indexes or media. A remote support contract that does not govern the clearance of the supplier’s staff is not an administrative detail: it is security, and it belongs beside the verifiable limits on data use.

Fourth: the level changes on its own, derived objects do not

Paragraph 5: classification “is automatically downgraded to a lower level once five years have elapsed from the date it was applied; after a further period of five years, every classification constraint ceases in any event”. Paragraph 6 allows extension by reasoned decision, taken by whoever classified or, beyond fifteen years, by the President of the Council of Ministers. For the riservato level, decree-law 22 June 2023, no. 75 added an authentic interpretation (article 1(4)): once five years have elapsed every constraint ceases, with no intermediate step.

A live archive handles this. An index, a model retrained on that material, a backup copy, does not: they stay at the label of the day they were born. Who relabels the derived objects when the source is downgraded? And, conversely, what happens when a part is raised in level under paragraph 2 after it has already gone into an index? The second question is the more uncomfortable one.

Fifth: this is not a self-certification matter

Paragraph 7 tasks the President of the Council of Ministers with verifying compliance with the classification rules and refers to a dedicated regulation for the scope of each level, the persons holding classification powers and the connected offices. Article 9(1) establishes, within the DIS, the Central Office for Secrecy (UCSe), with directive, coordination, advisory and supervisory functions, expressly extended to “industrial production” (paragraph 2, letter b); letter a) covers the preparatory work for the President of the Council of Ministers’ functions as National Security Authority. For EU classified information the regime is instead Council Decision 2013/488/EU, in force in the consolidated version applicable from 14 August 2025.

These are tracks distinct from the assessment of ICT supplies inside the cyber perimeter and cloud qualification for critical data: there, what enters a system and where a dataset sits; here, who may know what.

What a system must be able to prove

Level propagation from source to output, applying the highest level among the parts drawn on.
Filtering at retrieval, tied to the individual person’s clearance, not to the archive’s configuration.
A log of who asked what, and of what was actually shown.
Relabelling of derived objects — indexes, copies, training artefacts — when the source level falls or rises.
A physical and logical boundary around the environment and the copies: where the machines sit, and who reaches them.
A regime for the supplier’s staff: what clearance is required for operation, updating and support.

How we solve it

None of these requirements is met by a service wired to the open web. They need dedicated, closed systems, and we deliver them in two modes, never just one: on-premise, inside the client’s own environment; or a dedicated cloud reserved for the single client, reached over a dedicated VPN, with a data centre resident in Italy and premises we staff ourselves. In both cases the level propagates, retrieval is filtered per person and every query leaves a trace: that is the method behind our platform, not a service tier on a price list.

Do you have to write the requirements for a system destined for classified material? Half an hour with one of our experts for a first reading of what you will need to prove.