What AI can do in a defense factory without a byte leaving

In more than one supply-chain company we have met, until a few months ago the use of artificial intelligence was left to individual responsibility. A technical office uploaded a specification into a free tool to get the clauses summarized. A quality manager asked an assistant to rewrite a non-conformity. Nobody had decided what could and could not be done, so everyone decided alone, with whatever account they had. The same companies had impeccable procedures on materials and on paper: the hole was only in software.

The reason defense SMEs don’t use AI, or use it in hiding, has little to do with technology. Nobody wrote the rules. And as long as the rules are missing, the only prudent answer a manager can give is “no,” which in practice means “yes, but without my knowing.” In the German sample of BearingPoint’s aerospace and defense survey, with Italy in the same study, only 7% of executives list artificial intelligence among their priorities and 44% name silos as the main barrier. The reason, more than lack of interest, is the lack of a perimeter to use it in. Annalisa Alberti of Rheinmetall Italia said it at the Manufacturing Forum: whoever doesn’t think about the smart factory “risks taking a step backwards.” The perimeter is the first step, and it takes one afternoon to draw.

Without written rules, a manager’s “no” to AI means “yes, but without my knowing.”

Four texts are enough to understand the perimeter. The NIS2 directive, transposed in Italy by Legislative Decree 138/2024, requires essential and important entities to govern supply-chain security: the list of relevant ICT suppliers was due by May 31, 2026, security measures must be in place by October 31, 2026, and the FAQ of the national cybersecurity agency says plainly that “contract clauses alone are not enough.” The supply-chain requirements fall on suppliers: whoever sells software to a defense company ends up on that list.

The AI Act excludes from its scope systems used exclusively for military, defense, or national security purposes. The same company, though, also uses AI to read contracts, manage staff, and select suppliers: those uses stay inside the regulation, with the literacy and transparency obligations that come with it. Export control on dual-use items, Regulation 2021/821, also covers technology and technical data: a model that receives a drawing and returns a specification is handling controlled material. And the AQAP standards that NATO customers require from suppliers demand traceability of what was done, by whom, and on what basis.

A note on company tools. The “enterprise” data protection of products such as Copilot, described in Microsoft’s documentation, applies to ordinary company data and to the EU data boundary; it does not make a tool fit for classified information, and the documentation itself does not claim so. The Ministry’s 2026 AI and Defense Strategy points the same way: open architectures against lock-in, an initial year devoted to data consolidation, an explicit role for mid-sized defense technology companies.

The first step is to classify information into four classes: public, internal, restricted, classified. The first two cover most of the daily work; the other two already have procedures and locked cabinets. Each class is matched with a class of tools: for public and internal, company tools with data protection and EU data residency; for restricted, only tools running inside the company perimeter; for classified, no AI tool until a specific authorization exists. The grid fits on one page and is filled in with management, in one afternoon.

The second step is the management charter: rules written by those who manage, not by IT. Ten signed lines that say what is allowed for each class, who approves a new tool, where the operations log ends up, how often it is reviewed. It is the document the NIS2 questionnaire and an AQAP audit will ask you to produce, and the first one an external consultant would ask you to write. The 30-day plan in AI governance for SMEs is the general version of this charter; here the difference is that classes matter more than departments.

The third step is the one place where know-how and rules live, owned by the company: procedures, decision rules with their source, recurring specifications, closed non-conformities and why. From there any model works, with an operations log, and swapping the model tomorrow costs nothing because the context stays yours. It is the company brain applied to a factory: the question “whose is it” has a forced answer when the data is restricted. The method to build it on files is the same as for any company; only where the files live changes.

The fourth step is the first process: a document one, not production. Specifications to read and compare with the company’s capabilities, non-conformities to classify and close with a customer reply, batch traceability to rebuild. These are processes with high volumes, internal or restricted data, and a result you can verify in weeks. Production, the bill of materials, and planning come later, once the operations log has shown that the perimeter holds.

Vertesa is a fictional company: precision mechanics, 120 people, components for aiming systems sold to two European primes. We use it as an example because no real client data can appear in this piece. Its management charter, filled in with the method above, is this.

Three things to notice. The rules are written in plain language, without product names, because they have to survive a change of tool. Every rule has an owner with a first and last name, omitted in the example. And there is a line for doubt: when you don’t know which class a piece of information belongs to, you treat it as restricted and ask. It is the line that closes the Wild West.

If your company is a NIS2 entity, or your prime is, the supplier questionnaire will come, and for AI software it will ask four questions. Which contract clauses cover security, incidents, and termination. Which evidence shows the measures actually exist: certifications, logs, tests. Which second-tier dependencies sit behind it, that is where the models run and who provides the infrastructure. And how replaceable the supplier is: what stays with the company if the contract ends.

The four questions are also a selection criterion. A supplier who arrives with the answers ready, data inside the perimeter, an operations log, and context owned by the customer, saves you the time of the questionnaire and, above all, does not leave you with a brain rented inside a product you don’t control. That is why the first piece of this series argued that the software defense needs must be sovereign; the third, on the invisible supply chain, takes the same principle out of the factory, to the suppliers.

1. [1]Agenda Digitale, “NIS2 e fornitori: cosa prevedono le FAQ ACN sui contratti”. www.agendadigitale.eu
2. [2]Cybersecurity360, “Direttiva NIS2 e supply chain: i nuovi requisiti per la catena di fornitura”. www.cybersecurity360.it
3. [3]EUR-Lex, Regulation (EU) 2024/1689 on artificial intelligence (AI Act). eur-lex.europa.eu
4. [4]EUR-Lex, Regulation (EU) 2021/821 on the control of exports of dual-use items. eur-lex.europa.eu
5. [5]Microsoft Learn, “Enterprise data protection in Microsoft 365 Copilot”. learn.microsoft.com
6. [6]Agenda Digitale, “Strategia IA e Difesa 2026: cosa cambia per imprese, filiere e sovranità tecnologica”. www.agendadigitale.eu
7. [7]BearingPoint, “European defense sector faces a major digital execution gap”. www.bearingpoint.com
8. [8]Startupbusiness, Manufacturing Forum 2026, Annalisa Alberti (Rheinmetall Italia). www.startupbusiness.it