Three families of AI for Italian SMBs. Only one is insurable.

9 structural dimensions × 5 vendors.

Cells use ✓ / ✕ / ◐ / ? for native, excluded, conditional, or undisclosed. Every cell with a [n] points to a primary source listed at the bottom of the page.

EU-cloud subscription with a 2026 residency regression.

Microsoft 365 Copilot is a general-purpose copilot bolted onto the Microsoft Graph. It is sold per-seat at $18 (annual promo through Jun 2026) to $30/user/month, on top of a qualifying M365 base. It cites sources when the answer is grounded but does not refuse when grounding is missing — and Microsoft itself documents that the system "sometimes provides too much information — using any retrieved chunk whether relevant or not — which leads to a higher rate of hallucinations".

On 17 April 2026 Microsoft enabled Flex Routing by default (Message Center MC1269223): under peak load, Copilot inference can route outside the EU without admin consent for new tenants. The 4 November 2025 announcement of in-country Italian processing is opt-in only, and the Anthropic models added as a sub-processor on 7 January 2026 are explicitly out of scope of the EU Data Boundary. EchoLeak (CVE-2025-32711, CVSS 9.3, zero-click data exfiltration) and the January 2026 DLP-bypass incident on confidentiality-labelled emails are documented Copilot-specific security events.

For an Italian SMB the operational reality: deployer obligations under AI Act art. 50 fall on the company, the GDPR art. 30 register is the customer's own work, NIS2 D.Lgs. 138/2024 obligations are unrelated to Copilot — and per RGS rationale ("I canoni cloud non sono beni ammortizzabili") the subscription is excluded from the 2026 Hyper-amortisation 180% / 100% / 50% maxi-deduction.

Strong base model; weak Italian-fiscal coverage; Garante history.

OpenAI's enterprise tiers (Business at $20/user/month annual, 2-seat minimum; Enterprise opaque around $60 with 150-seat minimum) ship a no-training default on customer inputs and, since 16 January 2026, EU-region inference residency for new Projects. Existing workspaces cannot be migrated. ChatGPT Business does NOT get inference residency — only at-rest storage.

On Italian: ChatGPT is multilingual but not Italian-native. Independent INVALSI benchmarks (CLiC-it / ACL 2024) place non-OpenAI Llama-class models at the top on Italian comprehension. Italian fiscal artifacts — codice fiscale formula, partita IVA MOD-11 checksum, fattura elettronica XML schema 1.2.2, ATECO 2025, regime forfettario thresholds — have no native handling; they're processed as generic text unless an SMB builds a custom GPT.

Garante history matters: the 30 March 2023 ban (Provv. 9870832) and the 20 December 2024 €15M fine (Comunicato 10085432) are on record. The Tribunale di Roma annulled the €15M sanction on 20 March 2026 on proportionality, not on facts — the substantive findings on training-without-legal-basis and transparency violations stand for DPIA framing. ChatGPT Enterprise as a supply-chain dependency triggers NIS2 vendor risk assessment for any SMB ≥50 employees or ≥€10M turnover in 18 critical sectors.

Italy's #1 software house, opaque AI stack.

Zucchetti shipped Trinity AI (announced at the May 2025 "AI Love ERP" event), Follia (ZCS AI Platform with cloud + on-premise modes), and AI features in Ad Hoc Infinity, Ago Infinity, Bollicine Web and the HR suite. The catalog is real; the architecture is opaque. ZCS marketing says "vengono usati modelli locali, in modo che le informazioni processate dall'IA non passino attraverso provider esterni". The underlying LLM family is not publicly disclosed. Il Sole 24 Ore reports Zucchetti is developing a proprietary LLM that can be installed locally.

Pricing is contact-sales on every AI module: no published €/user/month anywhere on zucchetti.it or zcscloud.it. The cite-or-refuse contract is absent from the marketing — "risultati più accurati" is the strongest claim. No hallucination rate disclosed. The ZGDPR product is sold separately as compliance software; there is no native art. 30 register export from the AI modules.

On iperammortamento: Zucchetti does not publish a formal eligibility framing for its AI features. Follia on-prem mode with proper interconnection could in principle qualify under Annex V; the SaaS modules are excluded per the standard RGS rule. Adoption data for the AI features specifically is not broken out — Polimi Osservatorio AI numbers (7% small / 15% medium / 59% large) are vendor-agnostic.

Microsoft-Azure-backed, training-on-customer-data clause.

TeamSystem brands AI as "AI Edition" of existing suites (Enterprise, Studio AI, Studio HR AI, HR AI, Studio Legal AI, Hospitality, PEC Manager, Manufacturing) with 8 launched in 2025 and 20 in the pipeline. Shipped features are real but confined: counterparty suggestion, IVA code proposal, foreign invoice bookkeeping, bank reconciliation, fiscal scheduler — automation of bookkeeping-adjacent tasks, not a general copilot on full ERP state. The reported volume is 200,000 daily AI interactions, +37% QoQ.

Architecture is cloud, Microsoft-stack-aligned: TeamSystem joined the Ambizione Italia Cloud Region Partner Alliance in 2022 and runs Enterprise Cloud on Azure Milan. The specific AI engine — Azure OpenAI direct vs Azure-hosted custom — is not publicly disclosed, but the €250M / 5-year AI investment announced in July 2024 follows that direction.

The substantive divergence sits in TeamSystem's own privacy-rights page. Under «Diritto di opposizione» the policy reads, verbatim: «Puoi opporti al trattamento, compresa la profilazione ovvero l'utilizzo dei dati personali per le attività di addestramento di Sistemi di Intelligenza Artificiale» ("You may object to processing, including profiling or use of personal data for AI System training activities"). The user can object — meaning the activity exists by default. Under «Diritto di rettifica» the same page references «dati personali, anche quelli utilizzati per le attività di addestramento di Sistemi di Intelligenza Artificiale» ("personal data, including data used for AI System training activities"). Materially different posture from the no-training default that Copilot, ChatGPT Enterprise and Lemnia commit to. There is no documented cite-or-refuse policy; the SaaS suite is excluded from iperammortamento.

Every claim above traces to a primary source.

Numbered references. Vendor documentation, EUR-Lex, Garante decisions, INVALSI/CLiC-it benchmark papers, Italian press of record. Last verified May 2026.