AI Architecture

Architecture overview

The technological core of OpenCity AI is based on a RAG (Retrieval-Augmented Generation) architecture. Unlike systems based solely on generic artificial intelligence, this approach ensures that every answer is anchored exclusively to certain and verified data.

The solution is open source and agnostic with respect to the language model used (in the current configuration, we use Gemini). We adopt the MCP protocol to ensure interoperability with other solutions from the authority or third parties.

How it works

When the user interacts with the chatbot, the request is sent to the open source OpenCity AI component which processes and enriches it, analyzing the specific website content before sending it to an LLM via API: the software architecture is therefore a RAG (Retrieval-Augmented Generation), meaning the assistant performs a search (Retrieval) in a specific knowledge engine to provide an answer, then supplies the LLM with the question and the information to respond, and the LLM only handles giving a conversational form to this information (Generation).

1. The user reviews the privacy policy
2. The user’s request is sent to the OpenCity AI system which processes it internally
3. OpenCity AI anonymizes any personal data (names, emails, phone numbers) before passing it to the LLM
4. The enriched request is sent to an LLM via API
5. The LLM’s response is then filtered and enriched by the OpenCity AI system
6. The response is shown to the user with relevant sources

Knowledge base and indexing

OpenCity AI Chatbot is trained using the knowledge base of the authority’s website, and optionally other thematic websites of the authority. This ensures starting from accurate information guaranteed by the authority. After indexing these sources, the chatbot updates daily to index newly produced content.

The OpenCity AI crawler, responsible for periodic website scanning, operates in compliance with the standards and indexing rules adopted by traditional search engines (e.g., Google, Bing): the crawler respects the instructions in robots.txt and therefore, for example, data published in the Official Notice Board is removed from the semantic search engine at the end of the required publication period.

Privacy and data security

Personal data protection is a central element of the system, ACN-qualified. Any personal data entered by a user in the chat is processed only for the duration of the session.

Anonymization: before the request is sent to the external LLM, the OpenCity AI component acts as a security filter and actively removes any personal data (names, emails, phone numbers, etc.) entered by the user in the chat. This operational flow is designed to prevent an external system (LLM) from processing any personal data entered by the user within the chat.

Regulatory compliance

Artificial intelligence technologies designed in compliance with standards for public sector transformation:

1. Security, guaranteed by ISO 27001 certification and OpenCity Italia’s ACN qualification
2. Privacy, strict GDPR compliance and anonymization of any personal data sent to LLMs
3. Open source. The preferred choice according to technical rules for software procurement in public administration
4. Interoperability. Adoption of open standards (MCP)
5. User experience. Design guidelines and accessibility with Designers Italia UI kit adoption
6. AI technical rules in public administration. Compliance with Law 132/2025 and AI ACT (European AI Regulation)

Technological principles for AI

OpenCity follows the guidelines of the three-year plan for IT in public administration:

• Service improvement and cost reduction: AI must be used to make public services more efficient, effective and personalized for citizens, optimizing resources
• Risk analysis: before adopting an AI solution, public administrations must conduct a careful assessment of risks (technical, ethical, legal and security)
• Transparency and accountability: decision-making processes based on algorithms must be understandable, traceable and it must always be clear who is responsible for the final decision
• Inclusivity and accessibility: AI solutions must not create new forms of discrimination and must be accessible to all citizens
• Privacy and security: protection of personal data and system security from the design phase (privacy and security by design)
• Standardization: use of open standards to ensure interoperability between solutions
• Human-centric approach: the final decision and control must always remain with humans