Information assets are not protected simply by locking files away
An artificial intelligence system connected to a company’s archives can find contracts, procedures, price lists and technical specifications in seconds. The benefit is obvious. The decisive question is a different one: can it find only what the user has the right to know?
First published: 23 October 2026 · Last updated: 23 October 2026 · EU framework including Regulation (EU) 2026/1744.
AI assistant or AI agent? A note on terminology. In this article, “AI assistant” means a conversational system that queries the company’s archives, usually through RAG, and answers in text. An “AI agent” is a system that, besides answering, can plan and carry out actions through tools: sending emails, creating or modifying files, opening tickets, querying other applications, often in several steps and with some margin of autonomy.
The risks described apply to both, but they increase with an AI agent, because an error or a manipulation produces concrete effects and not merely a wrong answer. Where the difference matters, the text says so; the section on AI agents is further below.
Imagine a sales manager who asks the AI assistant: “What is the maximum discount we can offer this customer?” The system answers by combining a price list, a note from management and a confidential negotiation draft. The answer is useful, but it contains information that the employee was not authorised to consult.
No external attack is needed for an improper disclosure to occur. An effective search over an archive with poorly designed permissions may be enough. This is where AI architecture meets the protection of trade secrets, data protection and technology contracts.
The problem is not simply stopping AI from reading. It is building a system able to read on behalf of the right person, for an authorised purpose, without turning every document into knowledge available to everyone.
LLM, RAG and knowledge base: three concepts, three different functions
LLM: Large Language Model
A large language model is trained on data to learn patterns and to generate sequences of text depending on the context it receives.
It can summarise, compare and draft content. It is not, however, a reliable company archive in itself: it can produce answers that are plausible but inaccurate.
Knowledge base
An organised body of knowledge: documents, procedures, technical data sheets, contracts and information on origin, version, validity and access.
It does not necessarily coincide with a vector database. It may include document repositories, structured data, search engines and knowledge graphs.
RAG: Retrieval-Augmented Generation
An architecture that retrieves relevant content from sources outside the model and places it in the context used to generate the answer.
The model answers also on the basis of the materials retrieved at the time of the question. Retrieval can be lexical, vector-based or hybrid.
For the technical background: RAG documentation and access controls.
Consulting a document does not necessarily mean training the model
In fine-tuning, the model’s parameters are updated through a training process. In an ordinary RAG, by contrast, the system retrieves passages of documents and supplies them to the model while it processes the request: this does not, in itself, update its parameters.
The distinction avoids a misunderstanding: connecting an archive does not automatically embed its content in the model’s weights. But it does not solve confidentiality. Retrieved passages, questions and answers may pass through external services, logs, caches and support systems.
“We do not use your data for training” is therefore a specific guarantee. It does not mean “we retain nothing”, “nobody can access it” or “no data leaves your environment”. The service, its configuration and the conditions purchased must be checked.
Diagram 1 — How documents become searchable
One possible ingestion path. Vector indexing is a common choice, not a requirement of every RAG.
Authorised sources, document categories and content owners.
Text extraction and, where needed, splitting into portions called chunks.
Content, metadata and permissions feed the index. Any embeddings represent the texts numerically.
Updates, revocations and deletions must propagate to the relevant copies and indexes.
An embedding is not automatically anonymous, nor is it, by itself, an encryption measure. The nature of the data and the possibility of linking it to individuals require a concrete assessment. The pause button also applies to the next diagram.
Diagram 2 — Access rights first, then the answer
Unauthorised content must not reach the model. Merely instructing the prompt “not to disclose it” does not replace authorisation controls.
On a smartphone, scroll horizontally. Illustrative diagram, not a security certification.
The least visible risk: bypassing a company’s internal boundaries
An archive can be protected in its original system and become excessively accessible once indexed. This happens if, for example, a connector ingests documents using an administrator account and the search engine does not retain or apply individual users’ permissions.
The AI assistant should not expand the user’s information rights. Permissions need to be checked at document level and, where necessary, at the level of document portions, together with environment separation, revocations and cache management.
Demonstration — Same question, different rights
“What terms can we offer customer Alpha?” Select a role to see an example of an answer. People and data are fictitious.
Editorial demonstration: the buttons do not apply any security controls. In a real system, authorisations must be verified by the application services.
Know-how: confidentiality must be demonstrable
Directive (EU) 2016/943 on trade secrets does not protect just any information labelled “confidential”. Article 2 requires, cumulatively, secrecy, commercial value deriving from that secrecy and reasonable steps to keep it secret. In Italy the reference is Articles 98 and 99 of the Industrial Property Code. [1]
A RAG can unlock the value of know-how without destroying its confidentiality, provided that access, recipients and uses remain governed. Indiscriminate indexing, on the other hand, can increase exposure and make it harder to demonstrate that the measures were adequate.
Not every incident automatically results in the loss of protection: circumstances, extent of disclosure and remaining requirements matter. However, NDAs and generic clauses do not replace classification, selective access, training and verification. The exceptions and lawful disclosures provided for by the legal system remain unaffected.
GDPR: the internal archive is not a free zone
Contracts, emails, minutes and HR documents may contain personal data. Selecting, extracting, indexing and using them to produce an answer constitutes processing when it concerns identified or identifiable individuals. [2]
| Issue | GDPR reference | Practical check |
|---|---|---|
| Purpose and legal basis | Articles 5, 6 and, where relevant, 9 and 10 | Necessity of the data, compatibility of further uses and existence of an appropriate legal basis. |
| Minimisation and design | Articles 5 and 25 | Exclude unnecessary categories and limit the passages sent to the model. |
| Vendors and security | Articles 28 and 32 | Actual roles, instructions, sub-processors and proportionate measures. |
| Information and rights | Articles 12–22, as applicable | Privacy notices, access, rectification, objection and erasure that can actually be handled. |
| Impact assessment | Article 35 | Determine whether the processing may present a high risk to individuals. |
| International transfers | Articles 44–49 | Data flows, third-country access and applicable mechanisms. |
Legitimate interest is not a general shortcut. In its Opinion 28/2024 on AI models, the EDPB points to the need to verify the interest, the necessity and the balancing. The Opinion does not replace the separate assessment of document processing within a RAG. [3]
Erasure also has to be designed: deleting the original file does not show that chunks, copies in the index, caches and logs have been removed. Timing and methods must take into account purposes, retention obligations and the limits applicable to the rights.
Workers and logs: the internal AI assistant is not a neutral tool
A company AI assistant normally records questions, documents consulted and answers. These logs may relate to identifiable workers and make it possible to reconstruct individual activity. Besides the GDPR, it is therefore necessary to consider Article 4 of the Italian Workers’ Statute (Law No. 300/1970), where the tools used also allow remote monitoring, and the information obligations towards workers, including those connected with the use of artificial intelligence in the workplace (Law No. 132/2025 and Article 1-bis of Legislative Decree No. 152/1997), depending on the conditions of each provision. [9]
These are design choices, not details: who can consult the logs, how long they are retained, whether they can be pseudonymised and which usage rules are communicated to staff. A system designed to protect know-how should not become, without a conscious decision, a tool for monitoring people.
AI Act: updated timeline and obligations to tell apart
Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, entered into force on 27 July 2026 and amended Regulation (EU) 2024/1689. A project must therefore be assessed under the amended framework, not under the original text alone. [4]
| Item | Timeline | Practical meaning |
|---|---|---|
| Transparency under Article 50 | From 2 August 2026 | The relevant obligations already apply. Identify role, interaction, content and exceptions. |
| Marking under Article 50(2) | By 2 December 2026 for systems placed on the market before 2 August 2026 (new Article 111(4)) | A specific transitional rule for pre-existing systems: it does not postpone all transparency obligations. For systems developed for internal use, it should be checked whether they fall within the notion of “placing on the market”. |
| Annex III high-risk systems | 2 December 2027 | Deadline postponed by the amending regulation; classification depends on the use case. |
| Annex I high-risk systems (products) | 2 August 2028 | Concerns systems embedded in products covered by harmonisation legislation: rarely relevant to a document AI assistant. |
| GPAI models placed on the market before 2 August 2025 | Compliance by 2 August 2027 | Regime under Article 111(3): not to be confused with the Article 50 transitional rule. |
Transparency is not a universal label
Article 50 distinguishes between the obligations of providers and those of deployers. The machine-readable marking in paragraph 2 does not coincide with the information about interacting with an AI system, nor with the disclosure of the artificial nature of the content covered by paragraph 4.
The latter concerns, among other things, deepfakes and certain texts published to inform the public on matters of public interest. For those texts, the exception relating to human control should not be described incompletely: what matters is the human review or editorial control process and editorial responsibility for the publication, under the conditions set by the law.
An internal document AI assistant is therefore not subject, merely because it uses RAG, to a uniform obligation to visibly label every answer. The position must nevertheless be verified case by case: paragraph 1 concerns systems intended to interact directly with natural persons and does not apply where the interaction is obvious from the context; paragraph 2 falls on providers, with exceptions, among others, for assistive functions for standard editing or that do not substantially alter the input data provided. The concrete scope should also be checked in light of the Commission’s guidelines. The postponements for high-risk systems do not suspend the transparency obligations that already apply.
RAG is not a high-risk category
Qualification depends on the system and its intended purpose. An AI assistant for technical procedures should not automatically be equated with a tool intended to select candidates or evaluate workers. The deployer obligations in Article 26 require the relevant conditions to be ascertained.
Skills and roles: mind the amended text
Article 4 on AI literacy has been reworded by the Omnibus: in the new text, providers and deployers take measures to support the development of the skills of staff and of those acting on their behalf, and are no longer required to “ensure” a sufficient level. The article has applied since 2 February 2025: it is advisable to document the measures adopted, such as instructions and training on confidential documents, the limits of answers, unreliable sources and possible incidents.
Integrating a model does not automatically make a company the provider of that model. But a company that develops a RAG system and puts it into service under its own name, even for internal use, may be qualified as the provider of the system of AI (Article 3, points 3 and 11), with the relevant consequences; in other cases it will typically be a deployer. Where the project includes fine-tuning or other modifications, the role with respect to the model and to the final system must also be re-examined separately. The technical label of the modification does not by itself determine the legal qualification.
Third-party documents: access, extraction and disclosure are not the same
Purchased manuals, reports, databases and customer materials do not become freely reusable because they are held in company systems. A distinction must be drawn between access, reproduction, extraction, indexing and distribution of the content in outputs.
Articles 3 and 4 of Directive (EU) 2019/790 provide for text and data mining exceptions with different conditions. The Italian rules in Articles 70-ter and 70-quater of Law No. 633/1941 (the Italian Copyright Act) derive from the transposition carried out by Legislative Decree No. 177/2021. [5]
Outside scientific research, the general exception applies only if the rightholder has not reserved their rights in an appropriate manner: for content published online, for example, by machine-readable means. It should also be remembered that it is not settled whether the mere retrieval of passages in a RAG falls within text and data mining in the sense of the Directive, and that licences and contractual terms may restrict use regardless of the exceptions.
The Italian reference: Article 70-septies
Article 25 of Law No. 132/2025 introduced Article 70-septies into the Italian Copyright Act. The provision covers reproductions and extractions for text and data mining through AI models and systems, including generative AI, on materials to which there is lawful access and in compliance with Articles 70-ter and 70-quater.
It is not a general authorisation to disclose content in the outputs of an AI assistant. Licences, any reservations, database rights and the operations actually performed must be assessed separately. [6]
The criminal-law profile: Article 171, not Article 171-ter
Article 26(3) of Law No. 132/2025 introduced letter a-ter) into Article 171(1) of Law No. 633/1941. The provision concerns the reproduction or extraction of text or data from works or other materials available online or in databases, in breach of Articles 70-ter and 70-quater, including through AI systems.
The reference is therefore to Article 171(1)(a-ter), not to Article 171-ter. Whether an offence is made out requires its elements to be established: it does not automatically follow from any indexing. [7]
Clauses to negotiate before connecting the archives
| Area | Issue to be regulated |
|---|---|
| Use of content | Separate service delivery, training, evaluation, feedback and product improvement. Define excluded uses. |
| Confidentiality | Cover documents, queries, chunks, indexes, outputs and metadata; regulate human access and support. |
| Service chain | Identify hosting, model, embedding, search, subcontractors, locations and changes. |
| Incidents and evidence | Evidence, proportionate audits, notifications, cooperation and breach management. |
| Continuity and exit | Export, formats, metadata, configurations, deletion and handling of residual copies. Check whether the Data Act rules on switching between data processing service providers apply. [10] |
| Liability | Caps, exclusions and remedies consistent with the economic risk to the information assets. |
European cloud or local model? Geography is not enough
A local infrastructure can reduce some exposure to external services, but it requires management of access, updates, backups, logs and operational security. Hosting in the EU does not, by itself, show the absence of third-country access or of other data flows.
The choice must start from the sensitivity of the documents, the threat model, continuity and administration capacity. Privacy, trade secrecy and reliability are not exhausted by the labels “on-premises” or “EU region”.
Prompt injection: when a document contains an order
A document may contain manipulated instructions that attempt to influence the AI assistant: this is the problem of indirect prompt injection. Material retrieved as a source is treated as a command.
Sources must therefore be treated as untrusted input. Verification of provenance, separation between data and instructions, authorisations and limits on tools must work together. If the system is an AI agent, that is, it can send emails or export files, limits on external actions become particularly important. [8]
When the AI assistant becomes an AI agent: reading is no longer enough
An AI assistant that merely answers can, in the worst case, show information to people who should not see it. An AI agent can also use it: send it outside the company, copy it into another system, modify or delete documents, start processes. The issue is no longer only “what can it read”, but “with which rights does it act, and who is answerable for what it does”.
- Identity and permissions. The AI agent should operate with the rights of the person using it, or with reduced and specific permissions, not with a generic administrative account.
- Limited tools. Every available action (email, exports, writing to archives) widens the risk surface: only the necessary ones should be enabled.
- Human confirmation. For irreversible actions or those with effects outside the company, such as sending, deleting and exporting, explicit approval is prudent.
- Traceability. It must be possible to reconstruct what was asked, which sources were used and which actions were carried out, while respecting the worker and personal-data issues already mentioned.
- Prompt injection with real-world effects. A manipulated document that induces a wrong answer is a problem; one that induces the sending of a confidential file is an incident. Testing must include this scenario.
From a legal standpoint, an AI agent is not a separate category that by itself shifts roles or classifications: what remains decisive are the intended purpose, the company’s role (provider or deployer), the data processed and any decisions affecting individuals. If the AI agent takes or prepares decisions about individuals, Articles 22 and 35 GDPR must also be assessed and, depending on the use case, the possible qualification as a high-risk system.
Before go-live: nine pieces of evidence to ask for
A tool to coordinate management, legal, privacy, HR and IT. It is not a compliance or security certification.
0 of 9 items selected
The script does not save or transmit your selections.
Questions management should ask
If the vendor excludes training, are we protected?
It is a relevant but partial guarantee. Retention, access, logs, subcontractors, security, internal authorisations and actual uses still need to be verified.
Do citations eliminate invented answers?
No. They make the answer easier to check, but it must be verified that the source exists, is up to date and supports the statement. Retrieval may be incomplete and the model may misinterpret the passages.
Can we index everything and restrict access afterwards?
The perimeter must be defined first. Indexing can create copies, involve external services and process personal or confidential data: controls on the final answer alone come too late to govern these steps.
Does the postponement of high-risk rules also suspend transparency?
No. The start dates must be kept distinct. Article 50 has applied since 2 August 2026; the transitional period to 2 December 2026 concerns specifically the marking under paragraph 2 for the pre-existing systems identified by the provision.
Must an internal AI assistant disclose that it is an AI system?
It depends on the case. Article 50(1) does not apply where the interaction with an AI system is obvious from the context, but roles, exceptions and guidelines must be checked. Clear instructions to staff and, where relevant, the notices required in employment and data protection matters remain advisable.
From experiment to knowledge infrastructure
The value does not lie in having a chatbot that “knows everything”. It lies in making information assets searchable without losing control over access, rights, quality and evidence.
A Knowledge Base & AI Governance Review should produce verifiable results: a map of data and flows, a permissions matrix, an analysis of roles, a review of contracts, security requirements, an assessment of employment-law aspects and a release plan with responsibilities and acceptance criteria.
For a company facing international growth, investment or due diligence, this documentation makes it possible to explain not only what AI can do, but why the organisation has the right and the capacity to do it.
Legal, institutional and technical sources
- Directive (EU) 2016/943 , Articles 2–5; Italian Industrial Property Code (Legislative Decree No. 30/2005) (in Italian), Articles 98 and 99.
- Regulation (EU) 2016/679 — GDPR , in particular Articles 5, 6, 9, 10, 12–22, 25, 28, 32, 35 and 44–49.
- EDPB — Opinion 28/2024 on AI models , adopted on 17 December 2024. An interpretative act, distinct from legislative sources.
- Regulation (EU) 2024/1689 — AI Act , to be read with the amendments made by Regulation (EU) 2026/1744 — Digital Omnibus on AI , published in the Official Journal of the European Union on 24 July 2026. Depending on the case, Articles 3, 4, 6, 26, 50, 53, 111 and 113 and Annexes I and III are relevant.
- Directive (EU) 2019/790 , Articles 2, 3 and 4; Legislative Decree No. 177 of 8 November 2021 (in Italian); Directive 96/9/EC on the legal protection of databases .
- Law No. 633 of 22 April 1941 (Italian Copyright Act) (in Italian), Articles 70-ter, 70-quater and 70-septies; Law No. 132 of 23 September 2025 (Italian AI Law) (in Italian), Article 25.
- Law No. 132/2025 , Article 26(3): introduction of letter a-ter) in Article 171(1) of Law No. 633/1941 . The reference is not to Article 171-ter.
- Microsoft Learn — Retrieval-augmented generation and indexes ; Document-level access control ; Input, context and retrieval hygiene ; OWASP — LLM01 Prompt Injection . Technical documentation, not a legal source nor a certification of any project.
- Law No. 300 of 20 May 1970 (Workers’ Statute) (in Italian), Article 4; Legislative Decree No. 152 of 26 February 1997 (in Italian), Article 1-bis; Law No. 132/2025, provisions on employment.
- Regulation (EU) 2023/2854 — Data Act , provisions on switching between data processing services.
Notice to the reader
This article is for general information only and does not constitute legal advice, a compliance certification or a security assessment of any specific system. The safeguards described must be adapted to the documents, data, sector, contracts, architecture and roles actually involved.
Compliance does not depend solely on the use of RAG, on a local model or on the European location of the hosting. Before connecting confidential archives, a coordinated analysis of the legal, organisational and technical aspects is needed, under the framework applicable at the time of the project.
The dates mentioned distinguish between different regimes and do not exhaust all the transitional provisions of the AI Act, which has also introduced, with effect from 2 December 2026, a new prohibited practice relating to certain content generated with AI, as a rule not relevant to a document AI assistant. The qualification of the system and of the parties involved must precede the identification of the relevant deadlines and obligations.
// Commenti