Made in Italy and AI: protecting trade secrets in Italian districts

Prato for textiles, Arzignano for leather, Sassuolo for ceramics, Brianza for furniture: the Italian economy is built on its industrial districts. Istat counted 141 of them in 2011, accounting for more than a third of the country's manufacturing jobs. Mechanical engineering, textiles and clothing, home furnishings, leather and footwear: these are the sectors that make Made in Italy.

In these networks of small and mid-sized firms, value does not lie only in the machines. It lies in a dye recipe, a pattern, a list of reliable subcontractors, a price negotiated with a tannery. And that know-how now also flows into generative AI assistants, often without the owner knowing.

District know-how, a fragile asset

In a district, everyone knows everyone. Technicians move from one company to another, subcontractors work for several brands, and much of the know-how is written down nowhere. When it is, it lives in Excel files, technical sheets, emails with suppliers or scanned sketches.

That is exactly the kind of document an employee pastes into ChatGPT to save time: translating a technical sheet for a German client, summarising an exchange with a contract manufacturer, rewording a specification or asking for a cost analysis of a collection. The risk is not theoretical. It comes from everyday habits, which we described in the anatomy of an AI data leak.

What Italian law protects, and on what condition

In Italy, trade secrets are protected by Articles 98 and 99 of the Industrial Property Code (Legislative Decree No. 30 of 2005), amended by Legislative Decree No. 63 of 2018, which transposed EU Directive 2016/943. Article 623 of the Criminal Code also punishes the disclosure of scientific or commercial secrets.

But there is a decisive condition. To be protected, information must be secret, have economic value because it is secret, and be subject to reasonably adequate measures to keep it secret. A company that lets its formulas or price lists flow freely to external AI services will find it harder to show it took those measures on the day it wants to act against a competitor or a former employee.

Law No. 206 of 27 December 2023 on the promotion and protection of Made in Italy also shows how much weight the State gives to these supply chains.

The data that leaks most often

In textile, fashion, furniture or engineering firms, the most exposed information is rarely personal data. It is business data:

• technical sheets and bills of materials, with fabrics, weights and processes;

• sketches, patterns and visuals for a collection not yet shown;

• dyeing, finishing or surface treatment recipes;

• lists of suppliers and contract manufacturers, with prices, lead times and terms;

• commercial offers and margins by client or market.

A collection that leaks before a trade fair such as Pitti Uomo or the Salone del Mobile can lose part of its value. A supplier list in the wrong hands gives a competitor years of sourcing work.

Why traditional tools see nothing

Small firms in the districts have often invested in antivirus, a firewall and sometimes a backup solution. Few have a tool that can see what an employee pastes into a browser window. Network or email DLP, where it exists, does not read the content of a prompt sent over HTTPS to an AI assistant. We explain why in our article on why email DLP fails on ChatGPT.

Then there is storage. Depending on the tool and the plan, conversations may be retained or even used to improve the service. For a company that has protected a process for three generations, the choice of AI provider and where data is processed is not a detail. Our article on sovereign AI for European CISOs covers this.

The Garante and Law 132/2025 in the background

Italy's data protection authority, the Garante per la protezione dei dati personali, has shown it watches generative AI closely, notably with the 15 million euro fine imposed on OpenAI at the end of 2024. Law No. 132 of 2025 on artificial intelligence adds obligations for employers. Data about employees, clients and supplier contacts therefore remains subject to the GDPR, on top of trade secret law. We covered these rules in our article on the Garante, Law 132/2025 and employers.

A method that fits small firms

A few steps are enough to show reasonable measures:

1. Identify the secrets: formulas, patterns, supplier lists, margins, upcoming collections.

2. Write a short rule on what must never go into an external AI tool.

3. Choose approved tools with contractual guarantees on data retention.

4. Check at the moment of pasting: detect product references, internal codes or supplier names, then warn, anonymise or block.

5. Keep the logs: in a dispute, they prove the company was actively protecting its secrets.

Summary

The strength of Italy's districts lies in know-how that is rarely patented and often protected by secrecy alone. Italian law defends it, provided the company takes reasonable measures. Letting technical sheets, patterns and supplier lists flow into AI assistants without control weakens that protection. A control close to the user keeps AI as a working tool without giving away the heart of Made in Italy.

ZeusLock spots sensitive data, including your own product codes and supplier names, before it reaches an AI assistant, and keeps a record of every incident prevented. Book a ZeusLock demo to protect your company's know-how.