How to protect records, access and citizen data in the public sector

Two overlapping frameworks. Law 90/2024, in force since 17 July 2024, requires central government bodies, regions, autonomous provinces, municipalities above 100,000 residents, metropolitan cities, local health authorities and certain public service companies to report an incident within 24 hours and file the full notification within 72, to appoint a cybersecurity officer and to apply the remediation indicated by ACN, the national cybersecurity agency. The taxonomy of notifiable incidents was published in the Italian Official Gazette no. 39 of 17 February 2026. In parallel, Legislative Decree 138/2024 transposes NIS2 and brings most of the public sector in as essential or important entities. The current operational reference is the ACN determination of 13 April 2026.

It does not mandate an algorithm. It asks for measures that fit the risk and can be demonstrated: encryption at rest and in transit, role-based access control, traceability of operations, supplier risk management and the ability to notify an incident within the deadlines. The shift is that an entity now has to prove its measures rather than declare them, and a per-document audit trail with user, timestamp and IP is the simplest evidence to produce during an inspection. Legislative Decree 138/2024 has been in force since 16 October 2024, with operational measures expected by October 2026.

By encrypting the file, not only the channel. An attachment sent by certified or standard email travels protected, but at the other end it becomes readable and copyable without limits. With FileGrant the document is created encrypted inside a vault and shared through a link with RBAC permissions set separately for each agency, department and supplier, with expiry and blocking of downloads, printing and screen capture. Every open lands in an audit trail with user, timestamp and IP. When an assignment ends or a recipient is wrong, access closes in one click and the copy already downloaded stays encrypted and unusable.

Because a public record outlives the encryption that protects it. Case files, civil registry records and documents under long-term retention stay sensitive for decades, well past the horizon where today's public-key algorithms become breakable. That is what "harvest now, decrypt later" means: an attacker stores encrypted data today to read it later. Recommendation (EU) 2024/1101 asks member states to start the post-quantum transition by the end of 2026 and to complete it on critical infrastructure by the end of 2030. FileGrant uses CRYSTALS-Kyber, the NIST FIPS 203 (ML-KEM) standard since August 2024.

Yes, if the AI stays inside. AIGrant is a private on-premise AI that indexes the entity's records and answers in natural language only on the documents the user can already access, segregated by department and logged on every interaction. It is the workable alternative to a ban, which does not hold: IBM found that shadow AI was a factor in 20% of the breaches studied in 2025, adding an average of USD 670,000 to the cost, and that 97% of AI-related breaches involved systems without proper access controls. On the regulatory side, the AI Act and the GDPR ask for governance and traceability, not abstinence.

They sit alongside them rather than replacing them. FileGrant does not replace SharePoint or OneDrive: it adds the protection that disappears once a file leaves, meaning persistent quantum-safe encryption, revocation after sharing, screen capture and public AI scraping blocking, and a per-document audit trail. AIGrant does not replace Copilot: it covers the cases where data cannot leave the entity's network. Deployment is modular, works with legacy systems, and is available in cloud hosted on national territory or on-premise with zero-knowledge keys, with no migration of existing archives.