Data Anonymization and the Italian Solution

Every time a lawyer pastes a contract into ChatGPT to summarize a clause, or an accountant asks Claude to review a financial statement, something happens that neither of them really notices: a tax code, an IBAN, or a client's name crosses a border. Not just a geographic border, but a legal one. They leave the protected perimeter of the company and end up on the servers of a provider that, in most cases, is located elsewhere, sometimes in jurisdictions where guarantees remain to be verified. The topic is data anonymization, and with generative AI, it has shifted from a niche technical matter to an everyday problem for anyone writing a prompt containing real information.

What Anonymization Is (and Why Almost Nobody Really Does It)

The European Data Protection Regulation distinguishes between two concepts that are often confused in everyday language. Anonymization is an irreversible process: once done, data can no longer be linked back to an individual in any way, even by cross-referencing it with other information. If it truly succeeds, that data falls outside the scope of the GDPR and can circulate almost freely. Pseudonymization is something else: it replaces names, codes, and addresses with neutral labels, while keeping the key to reverse the process securely protected elsewhere. The data remains "personal data" in all legal respects, as clearly explained in a technical guide on GDPR and pseudonymization, but in the meantime, it can be processed, moved, and analyzed safely.

The distinction is not legal nitpicking. In business practice, total erasure of traceability is almost never what is needed: what is needed is the ability to say, at the end of the day, who did what, re-link an analysis to the right client, or correct an error. In other words, reversibility is required. And this is where the theoretical boundary between the two definitions becomes the practical choice on which the true utility of a tool hinges.

Why is this topic exploding right now with generative AI? Language models digest enormous amounts of text, often the most sensitive documents in an organization: emails, minutes, medical records, court files. To do so, that text must first transit, almost always, through external cloud infrastructure, with all the risks entailed by an international data transfer—from accidental training on confidential information to fines, all the way to the reputational damage caused by a data breach, as noted in an analysis of PII security best practices for AI. Complicating the picture further, this summer the EDPB (the body coordinating European privacy authorities) published a draft of new guidelines on anonymization (Guidelines 02/2026, in public consultation until October 30) adopting a "relative" approach: the same dataset can be anonymous to the entity holding it and perfectly identifiable to someone with access to other connected information—a principle stemming from the EDPS v. SRB case before the EU Court of Justice. Translated: proving that an anonymization is "true" is becoming harder, not easier.

The Concrete Problem: Italian Documents, Foreign Cloud

A law firm wanting an LLM to summarize a hundred contracts immediately runs into a significant bureaucratic hurdle: those contracts contain tax codes (codici fiscali), VAT numbers (partite IVA), land registry data, IBANs. Sending them to a non-EU provider means activating the whole international data transfer apparatus: processing agreements, adequate safeguards, and the awareness that the text could theoretically fuel the training of a future model. For regulated sectors such as healthcare, finance, or public administration, the risk multiplies, as illustrated in a practical guide to anonymization and pseudonymization in LLM workflows.

Existing generalist tools, such as Presidio or privacy filters integrated into major providers, do work, but they are calibrated for an Anglo-Saxon world: they easily recognize American Social Security numbers, but perform far worse on an Italian tax code or land registry entry—formats that simply aren't present in their training datasets. The same limitation appears in many international guides on PII anonymization techniques for LLMs: very useful, but designed elsewhere. And this is precisely the gap into which a project born in Italy steps.

The Hedgehog on Guard: Rizzo-pii

The name of the project, even before the project itself, tells a story: the mascot is a purple hedgehog guarding a document with a shield, as seen on the repository page. Beneath the pop illustration lies an open-source model of just 0.3 billion parameters, built on a mmBERT/ModernBERT backbone, designed specifically to run on CPUs without needing GPUs or API keys, with a RAM footprint of around half a gigabyte: the technical definition is "token classification"—that is, the model reads the text word by word and flags which fragments are personal data.

Twenty-two categories are recognized: not just classic emails, phone numbers, addresses, and IBANs, but also Italian legal identifiers that no international model covers well—tax codes, VAT numbers, land registry data. The workflow is straightforward and really works like this: the document is analyzed locally, sensitive entities are replaced with placeholders, the "clean" text can safely be sent to a cloud LLM, and when the response arrives, a mapping dictionary kept exclusively on the user's machine restores the original values. The sensitive part never leaves the local perimeter—only the placeholders travel.

In its latest release, version 2.0, the project added a textbook example of responsible design: each data category can be individually toggled off, leaving that specific type of information unmasked. This is useful when you want to compare contract amounts without obscuring them, or keep age and gender readable in a clinical case, as described on the GitHub releases page. The reversible dictionary also has its own toggle: it can be turned off if returning to original values is unnecessary. The code is MIT licensed, the technical report is public, as is the dataset used for training, and ready-to-use desktop apps are available for Windows, macOS, and Linux, alongside an HTTP API for those wishing to integrate it into an existing pipeline.

On a purely technical level, the project does not hide its limitations. A specialized fine-tuning on security documents, published by another community user, shows a real margin of improvement over the base model, with a detailed statistical breakdown of tags where performance varies: a sign that the project is alive, being put to the test, and not all categories function at the same level of precision. Image taken from the official repository

Who Is Behind It: Simone Rizzo, Between Outreach and Code

Behind the purple hedgehog is Simone Rizzo, an AI engineer and communicator whose social presence moves in the orbit of his Rizzo AI Academy—a project promising to teach artificial intelligence "from those who build it every day." In this sense, Rizzo-pii is not just another piece of content to consume: it is proof that this outreach also produces concrete tools, with public code, downloadable datasets, and a verifiable technical report.

The most interesting, and less obvious, connection is with Annota AI, an Italian startup headquartered in Italy that focuses on AI-assisted data annotation to prepare images and documents for model training or fine-tuning. According to the "About Us" page on their official website, Simone Rizzo appears on the team as AI Strategist & Advisor, while the CEO and co-founder role is held by Davide Pascucci, with Massimiliano De Luca as CFO and Alessio Dionisi as CTO. It is therefore not a second project founded by the same person, but a real bridge between two complementary initiatives: Rizzo-pii protects data before it leaves the user's machine; Annota AI builds downstream labeled datasets on which models are trained, using infrastructure that the company itself states is hosted primarily in EU regions, with an explicit promise that client content is never used to train third-party models. Two different pieces of the same supply chain, held together by the same focus on data sovereignty.

From Law Firms to Public Administration: Where It Is Truly Needed

The value of a tool like this is measured in the field, not on a spec sheet. A law firm can anonymize contracts and legal opinions locally before asking an LLM to compare clauses or generate a summary draft. An accountant can analyze balance sheets and company registry reports without clients' tax data ever crossing an external server. In healthcare and public administration, where documents contain particularly protected personal and medical records, local pseudonymization becomes almost a prerequisite before any processing with external models. And companies building products on top of an LLM can insert such a tool as an upstream guardian before calling the model, within a RAG pipeline or an automation script.

The workflow is always the same: incoming document, pass through Rizzo-pii, LLM call with placeholders only, response, restoration of real data. A choreography that in some ways recalls codenames in espionage novels—like those by John le Carré, but with a corporate twist: the real information stays locked in the safe, while only its alias travels the world.

Open vs. Closed: Two Ways to Trust

The choice between an open-source project like Rizzo-pii and a proprietary platform like Annota AI is not a contest with a single winner, but a fork in the road depending on what the user truly needs. Open source offers total transparency: anyone can inspect the code, verify how data categories are classified, or fork it if requirements change. There is no vendor lock-in, and for those facing a GDPR audit or AI Act compliance checks, being able to show the internal workings of the system carries significant weight. The flip side is that internal expertise—or a trusted partner—is needed for installation, updates, and monitoring: it is not a turnkey service.

A platform like Annota AI plays on opposite ground: immediate usability, enterprise support, an end-to-end workflow from annotation to deployment, and clear contractual liability if issues arise. The price to pay is less public technical transparency regarding annotation algorithms and some dependence on the vendor for pricing and roadmaps. The most interesting point, however, is that the two models are not mutually exclusive: a hybrid scenario, increasingly common among Italian companies mindful of the issue, involves pseudonymizing data locally with a tool like Rizzo-pii before uploading it to a European cloud platform for annotation, keeping control over sensitive data without giving up SaaS convenience.

The Italian (and European) Bet

Here the reflection broadens to what is perhaps the most uncomfortable point of the whole discussion. The US and China can count on capital, infrastructure, and years of accumulated advantage in foundational models and dedicated hardware—GPUs and TPUs on a scale that simply does not exist in Europe. Chasing them with yet another general-purpose model with hundreds of billions of parameters would be, for Italy in particular, a lost battle from the start, as clearly argued in an analysis pointing to open source as the only card Europe can play.

However, there is a field where Europe can exert real influence: regulation. The GDPR and the AI Act, often framed solely as bureaucratic dead weight, can instead become an entry barrier and a trust builder for those who genuinely respect them, while remaining an obstacle for those unwilling to adapt. Data sovereignty—the guarantee that information remains under European jurisdiction—is a concrete selling point for healthcare, finance, and public administration. This was emphasized in no uncertain terms by Pasquale Stanzione, President of the Italian Data Protection Authority (Garante per la protezione dei dati personali), in the annual report presented to the Chamber of Deputies on July 2, 2026: a document putting the relationship between artificial intelligence, protection of fundamental rights, and digital sovereignty at the center of what the President described as an epochal transformation, as reported by AgendaDigitale in its coverage of the presentation. It is not an endorsement of a specific product, obviously, but a clear signal that data sovereignty applied to AI has reached the highest institutional level, not just startup white papers.

Rizzo-pii and Annota AI, on their scale, embody this exact bet: the former turns a regulatory constraint into a technical feature—privacy by design from the very first document pass; the latter builds a European supply chain for training data, with compliance built right into the product.

Niches, Not Giants: The Real Opportunity

If there is one lesson to extract from these two cases, it is that verticality pays off more than generality, at least for those starting with limited resources. Deeply understanding a local domain—with its documents, regulations, and administrative practices—allows building a tool that giant international players have no interest in replicating, because the market is small by their standards. Legal tech and compliance, healthcare and welfare (with medical records and social security paperwork), finance and tax, public administration: these are all areas where an Italian company understanding the local context can build an advantage that would cost a generalist giant too much to replicate.

Rizzo-pii, from this perspective, works almost as a textbook case: it is not yet another generic model touted as revolutionary, but a tool designed from scratch for Italian documents and data categories. Nor is it an isolated case: a showcase of the best European AIs of 2026 reflects the same trend, small but targeted projects choosing to compete on specificity rather than scale.

Remaining Limits, and What Is Still Missing

It would be dishonest to close on a note of triumph. Rizzo-pii remains a tool heavily tailored to Italian: other European languages are covered less effectively or not at all, and every new document format or specialized domain requires additional validation, as demonstrated by the comparison between the base model and its fine-tuned security version. It is a small project managed by few maintainers: its strength—proximity to a specific problem—is also its fragility, as long-term continuity relies on the energy of those driving it, rather than a structured corporate budget. Visibility also remains a challenge: an Italian open-source project struggles to compete, in marketing terms, with products backed by multi-million-dollar international campaigns.

Moreover, something more structural is missing at the European level: shared standards and benchmarks to accurately measure PII detection efficacy and training dataset quality, along with practical guidelines connecting AI Act and GDPR requirements to concrete architectural choices (on-premise vs. European cloud, logging, auditing). And perhaps there is a lack of closer collaboration between vertical projects like this, which often arise in isolation rather than integrating into broader corporate annotation or RAG pipelines.

A Possible Roadmap, Not Just a Wish

Ultimately, the point is not whether Italy—or Europe—will ever have its own generalist model to compete on equal terms with OpenAI, Google, or major Chinese firms. Probably not, at least in the short term, and chasing that goal risks wasting time and energy. The real point is whether they can become the benchmark in three narrower but very real areas: privacy-by-design applied to LLMs (of which Rizzo-pii is a concrete, verifiable example); a compliant, high-quality data supply chain (as Annota AI aims to build); and the integration of AI into regulated sectors with a local, open approach.

For those working in companies or professions, the practical move is evaluating local-first tools for PII management before adopting cloud LLMs on sensitive documents. For software developers, contributing to Italian and European open-source projects, producing public benchmarks, and documenting real use cases remain the most concrete ways to grow an ecosystem currently made of scattered initiatives. For lawmakers, incentivizing open and local solutions in the most sensitive domains—perhaps through dedicated regulatory sandboxes—would mean turning a perceived constraint into a genuine competitive advantage. You don't need to win the capital war. You simply need to win the trust war.