The rapid integration of generative artificial intelligence into the workplace has created a dangerous gap between technological capability and regulatory oversight. In Italy, the city of Treviso is attempting to close this void. On September 1, 2026, the municipal government approved a comprehensive regulation and an accompanying ethical code designed to discipline the use of AI within the city administration, marking one of the first instances of a local Italian government establishing such a rigid framework.

The fight against Shadow AI

At the heart of Treviso's decision is the phenomenon of Shadow AI. This occurs when employees independently utilize free, web-based software to accelerate administrative tasks without official authorization or oversight. While these tools may seem like harmless productivity boosters, they pose a systemic risk to public administration. Free platforms typically store user inputs to train their large language models, meaning any sensitive citizen data or confidential municipal document uploaded to a chatbot effectively leaves the secure perimeter of the city's servers.

Alessandro Manera, the deputy mayor and assessor for digitalization, noted that the primary issue was a lack of a manual for a machine that was already in motion. By banning non-homologated platforms, the administration aims to prevent the uncontrolled dissemination of sensitive information and ensure that the digital transition remains transparent and rigorous.

Preventing administrative hallucinations

Beyond data privacy, the city is concerned with the reliability of AI-generated outputs. The risk of hallucinations—where an AI confidently presents false information as fact—could have severe legal and social consequences if applied to official administrative processes. If a municipal opinion or a legal permit were based on an AI hallucination, the quality and legality of services provided to businesses and citizens would be seriously compromised.

To mitigate this, the regulation stipulates that automatic tools are strictly forbidden from producing legal effects on citizens. Human supervision remains the mandatory final filter for any administrative action, ensuring that the algorithm assists the human worker rather than replacing the decision-making authority.

Balancing restriction with innovation

Despite the strict ban on unauthorized tools, Treviso is not attempting to freeze technological progress. The administration has introduced a sandbox, a controlled and separate environment where AI can be tested using fictitious or anonymized data. This allows the city to experiment with the potential of generative AI without risking the integrity of its actual databases or violating privacy laws.

The city's approach creates a clear distinction between individual, uncontrolled use of online services and institutional experimentation. By providing a safe space for testing, the municipality ensures that it can eventually adopt paid, secure systems that comply with the necessary security standards, rather than relying on open-access tools that trade data for service.

A framework based on European directives

The new rules are not arbitrary but are designed to align with broader European directives on AI management. The regulation integrates four core pillars: transparency, security, human supervision, and data protection. This ethical code applies not only to the most famous chatbots like ChatGPT but extends to all generative tools, virtual assistants, and data analysis platforms that produce reports or texts based on user prompts.

By formalizing these rules, the city of Treviso is positioning itself as a pioneer in the Italian public sector. The move reflects a growing realization that the efficiency gains of AI cannot come at the cost of institutional security or the privacy of the governed.

The goal is to blind the municipal servers against news leaks or privacy violations, ensuring that the digital transition is both transparent and rigorous.

Clarifying the scope of the ban

Initial reports and headlines led to some confusion regarding the target of these restrictions. Some interpretations suggested that Treviso had become the first Italian city to ban ChatGPT in schools. However, a detailed reading of the municipal decree reveals that the measure specifically disciplines municipal personnel and the systems used by the administration. It does not directly regulate the educational environment or student usage in schools.

The focus remains squarely on the administrative machinery. The priority is to protect the relationship between the state and the citizen, ensuring that the data processed by the city of Treviso remains under the city's control.

Global implications for international business

For entrepreneurs and companies operating in the USA, UK, and global markets, the Treviso case serves as a canary in the coal mine for public sector procurement and partnership. As European cities begin to implement rigid ethical codes and technical regulations, the demand for AI solutions will shift away from general-purpose public bots toward enterprise-grade, closed-loop systems that guarantee data residency and privacy.

In the US and UK, where the regulatory approach to AI has historically been more flexible or focused on voluntary commitments, the trend in Europe—driven by the AI Act—is moving toward mandatory compliance and risk categorization. Companies selling AI services to European municipalities must now prepare for a landscape where transparency and the ability to prove that data is not used for model training are not just features, but legal requirements for entry.

The Treviso model suggests that the future of B2G (Business-to-Government) AI will be defined by the sandbox approach: rigorous testing in isolated environments before any wide-scale deployment. For global tech providers, this means that the ability to offer sovereign, localized, and audited AI instances will be the primary competitive advantage in the European market.

FAQ

Sources: Corrieredelveneto, Webmasterpoint, Pressreader ·