Governing generative AI in public administration: sovereign, traceable, replicable

Public administrations adopting generative AI face a shared problem: how to capture the productivity gains without losing control over sensitive data, creating vendor dependencies, or operating AI systems that cannot be audited. Regione Emilia-Romagna resolved this by deploying Rational AI’s AI Control Room — a centralized governance layer for all generative AI usage, running entirely on institutional infrastructure.

The Client

Regione Emilia-Romagna is among Italy’s most digitally advanced regional administrations, with active generative AI deployments across internal operations and citizen-facing services. The Region manages sensitive personal and institutional data at scale and operates under strict GDPR and AI Act obligations.

The Problem

Existing AI tools in use at the Region transmitted data to external providers without a governance layer: no real-time visibility into what was being shared, no technical mechanism to honor GDPR deletion requests for previously transmitted data, and no centralized audit trail. Building new AI applications required specialized development resources, limiting innovation to what the technical team could deliver. All existing integrations were point-to-point with specific providers — meaning any infrastructure or regulatory change would require costly re-engineering.

The Solution

Rational AI deployed its AI Control Room — built on Rational Core and Rational Knowledge — self-hosted on the Region’s own HPC infrastructure (MarghERita), in four weeks.

The governance layer acts as a transparent proxy between the Region’s applications and any external or internal AI model. It intercepts all generative AI traffic in real time, retains data within the institution’s own infrastructure, and gives compliance teams — IT, DPO, legal — full visibility and auditability across all AI usage. Existing applications required no code changes: retrocompatibility is built into the architecture.

For document-grounded applications, Rational Knowledge’s Graph RAG architecture provides traceable, source-attributed responses — replacing black-box model outputs with reasoning that can be audited back to its source. A no-code development environment allows non-technical staff to build new governed AI applications internally, reducing dependency on specialized engineering resources.

The platform is model-agnostic and self-hosted, with no lock-in to any provider. Evaluated over a three-year adoption horizon, ROI is projected at year two — making the AI Control Room sustainable as an enabling infrastructure for AI governance at regional scale.

The project was submitted to Forum PA 2026’s “PA e Futuro” prize as a replicable governance framework for generative AI adoption across Italian public administrations.