CTRL/SHIFT - 15 06 2026 CHAPEL STAGE - ARMANDO DE LUCIA - AGENTIC AI SOVRANA

Armando, a round of applause for Armando. [applause] Armando will talk to us about Agentic AI sovereign SLM first between web 3, privacy and Europe. A thousand thanks. The floor is given to Armando. SC is the same.

Good morning everyone. Thank you, thank you for being here today. As mentioned, I will be speaking about artificial intelligence, and in particular, I will be talking about an increasingly contemporary trend that the European Union is clamoring for: sovereign technology, that is, technology made in the European Union. Let's see how we can apply this concept to small and medium-sized enterprises. Italian, adopting the strategies specific to Web 3, the entire regulatory aspect of data protection and cybersecurity that I have summarized in the word privacy, precisely the European legislation.

Well, I'm a lawyer, um, and I deal with IT, communications, and technology law. Well, the intervention I thought up for you today is divided into three groups of subjects. One part concerns a more ethical and philosophical aspect that I consider essential, a more strictly legal aspect and another much more operational, so we can touch the whole line from the ethical and philosophical aspect to the operational aspect, so as to also leave you with concrete and practical instructions. Perfect. As for the philosophical aspect, what interests us is that for some years now there has been this shift between Web 2 and Web 3, where on a philosophical level Web 2 maintains a strong concentration of data, a strong dependence on a few platforms, almost as if we were in an oligopoly, an economic concentration resulting from this evaluation and, according to some legal scholars, this places us in a sort of modern digital mediacy where the large platform owners remain in control of them and grant us, through license agreements that are veritable concessions, the use of these services within the limits of what we are permitted and, forgive me, sometimes even on the basis of policies that are not always very clear.

This results in the maintenance and increase of power at the expense of many, obviously. Web 3 is trying to change this concept by bringing back and doing a sort of rebalancing of the asset classes, okay? With a decentralization of resources, a reduction in dependence on the big players, on large international vendors, with a distribution of these technologies often even among the affiliates and above all, and this is the important aspect that I am focusing on, with greater control and often also with a concept of sovereignty that we will see later, which is not a bad word, much stronger than the technologies that have occupied the previous years of Web 2 which are still, in short, very widespread, very widespread, as some scholars say, data and access to data is itself an essential component of power. I have brought you an extract from magnifica umanitas by our Pope, where in paragraph 95 you will find this written. In many cases, in the digital context, control of platforms, infrastructure, data, and computing capacity is not the prerogative of states, but of large economic and technological players who effectively set the conditions of access, the rules of visibility, and the very possibilities of participation.

This inevitably generates, or rather, can inevitably generate, I am confident about this, but it can inevitably generate distorted use and this can generate dependencies, exclusions, manipulations or at least violations of the principle of non-discrimination. Well, artificial intelligence is not just a technology today, but it is made of technology plus freedom. The technological revolution was driven by technicians, first with technology, then with telecommunications, then with data. I am of the opinion that today the time has come to include the aspect of human rights and therefore the human component within this great technological revolution that some commentators and some philosophers in doctrine have defined as a new digital humanism. Well, this is the philosophical premise from which I start.

Now let's move on to the more strictly legal aspect and how this philosophical vision applies to the contemporary world and, I hope, to the coming years. We, as the European Union, and as Italy, signed a declaration on European digital sovereignty on November 18, 2025. I'll quickly summarize it for you. It positions us as new pioneers in controlling technologies, data, and infrastructures. It's the technological stack that allows us to have digital sovereignty over these resources, in compliance with European rules and Europe's interests.

This reduces dependence on foreign technologies, with a view to achieving self-sufficiency in European resources for data protection and the protection of individuals. This is the key point, although the European Union remains open to cooperation with international partners. And there is a note that I wanted to share with you or I have I have I have prepared a specific slide because there is a recognition of something that I care a lot about and that is a recognition of open source solutions. There is little talk about open source, all the artificial intelligence solutions that we know today, almost none adopt this open source model, open weight, whatever you want to call it, and I wanted to bring up this little nuance that was present within the declaration precisely because open source is one of those technologies that could allow us and everyone within the European Union to be able to achieve the objectives that we have set ourselves . On June 3rd, just a few days ago, the European Commission came out with a press release that I reported to you here which concerns, let's say, a sovereignty, a package of rules regarding European technological sovereignty in terms of autonomy and resilience of the system.

This package includes a number of other regulations, such as the regulation regarding CIPs, which are the basis of the technological stack of all of everything we are talking about, the cloud and the development of artificial intelligence, as well as again, and I emphasize this, the aspect regarding a European strategy on open source, so the European Union has also understood this added value as well as other things relating to energy. Here too, a particular focus is placed on open source, where, according to the European Union, this must be at the heart of the Union's technological sovereignty and such as to promote open European alternatives compared to other alternatives that are increasingly spreading within the European Union that have no origin or parentage. Within the Union, we as a territory place ourselves at the center of fundamentally, and I'm speaking only about artificial intelligence, two large markets: the US market and the Chinese market, which sees the European Union as a large economy from which to source supplies. We, in law, do not yet have great European competition compared to other technological technologies, but instead place ourselves with a vision that is that of people's rights and freedoms. I am not new to the various problems regarding the rights and freedoms of individuals relating to services that operate within the European Union, even in journalistic and judicial news.

Here I've brought you a special focus for innovators and those working in artificial intelligence. In Europe, we have a regulation, therefore a unitary legislation valid throughout the European Union, which is the ECT. In Italy, we have the first national legislation on artificial intelligence, which anyone developing artificial intelligence systems in Italy must take into account in addition to the European regulation. And then there's the aspect of EU Regulation 69, which is the general regulation on the protection of personal data, which touches on everything related to data processing, how data must be organized, how data must circulate, and how this data must be protected. Well, the approach that the European Union regulation gives us is not a fixed approach, this is what it is and this is what you must apply to me.

It's a pretty variable approach. Depending on what? depending on the concrete risk to the rights and freedoms of the people who are at stake. so based on the danger that there is to rights and therefore you see the centrality of the law and of people's freedom. We as companies—I'm putting it to you from the point of view of companies—must adopt a range of measures and countermeasures that are proportionate to the type of risk, ranging from a risk that the legislator defines as unacceptable.

There are some areas where artificial intelligence absolutely cannot be applied and gradually going from a high risk, a limited risk, to a minimal risk. It is clear that most services fall in that area between limited and minimum, between high and unlimited, except in cases provided for by the regulation where the risk is unacceptable. The other piece of information I wanted to bring to your attention today is the one provided for in Article 4 of the European Union Regulation on Artificial Intelligence, which concerns literacy, that is, the training of all people within the company who have any relationship with artificial intelligence within the company. In fact, Article 4 specifically refers to a sufficient level of artificial intelligence literacy among company staff or any other person involved in the operation and use of these systems, even on behalf of the company. All right?

This therefore introduces a training obligation for companies within their own employee recruitment, but also for top management to the extent that they introduce artificial intelligence solutions, regardless of the assessments of the AI ​​itself, to train their own employees or in any case the people who use that artificial intelligence on behalf of the company. So it's a very very wide range too. Well, let's get to work with these principles and let's put ourselves in the shoes of a legal tech manager working with companies and what are the possible development paths that can be adopted. First, we have a new best practice in AI system development. If until before EACT there was a development that was essentially technology- centric, is that okay?

So, eh client, analysis, design, development, with the audio and distribution. Now we cannot ignore the legal aspect, that is, the effects of what we are planning on people's rights and freedoms . If you see the legal aspect, I put it in the analysis and design stage, is that okay? Because I also realize from experience that this is what happens very often: the legal aspect is postponed until the end of development, almost as if it were something that must be tied to the end of technological development of that product before it is distributed on the market. This leads to this flawed methodology.

Actually I said not best [laughter] practice, okay? Well, it causes problems because, to the extent that that project reaches a lawyer, it happened to me, I raise red flags on some things, that project must return to the design phase with a duty on the part of the companies to redesign perhaps those things that I have highlighted and here I'll leave you to imagine if the redesign is minimal it will have a minimal effect in terms of economics and time delay, but if the redesign is fundamental, it also touches on architectural points of the technology, then it can be much more costly for the company and therefore an additional delivery impact economics because to redesign things the developer, the engineer in any case must be re-hired and therefore must be re-hired not only in terms of product positioning. Here too, if the way in which we have to view the development of a product changes, the team also changes. All right? So, project manager, e-engine engineer, and legal tech manager are the triad, they are the three people who, in short, today should develop such systems.

Here we have some new paradigms that are nothing more than a summary of what has been reported so far and this is a brief summary of the artificial intelligence stack that a small to medium Italian company could use with small or nano local systems, small language models, not large language models which then have compliance problems. different or even nano, the data and for each single step there should be a control to also guarantee that the actions can be verified . Final recap, let's think about artificial intelligence from a local-first paradigm and then eventually move towards cloud-based systems. Even small systems, thanks above all to the research being conducted outside the European Union, can increasingly be hosted locally with ever-decreasing computational power, focusing on sovereignty for those operating in the European Union, training, and the adoption of, er, open source tools and solutions . We start with the small models and then eventually scale up to the large ones.

Pay attention to privacy, traceability and please include the Legal Tech Manager within the process. Thank you. [applause] Many thanks to Armando. Does anyone have any questions or curiosities for Armando? No.

Well, I was good. A thousand thanks. Thank you. Thank you.