
Why connected factory data is a target for hackers
One in four cyberattacks on manufacturing worldwide hits an Italian company. With NIS2, governing factory data becomes a legal obligation.
In 2025 the share of Italian companies with at least 10 employees using at least one artificial intelligence technology doubled compared with the previous year, rising from 8.2% to 16.4% (ISTAT, 2025). It is a sharp jump, the third consecutive increase after 5.0% in 2023, and it points to an adoption curve accelerating faster than the current narrative suggests. Yet the same ISTAT survey shows where that growth concentrates: marketing and sales, administrative process organisation, research and development. The areas a Direttore di Produzione would recognise as their own work, scheduling, quality control, scrap management, remain at the margins of the picture. The problem is not technology availability, now purchasable as a subscription from any cloud provider. It is that production is not yet giving AI something to work with.
While overall adoption doubles, its distribution tells a less linear story. The gap between large companies and SMEs in AI technology use, roughly 20 percentage points in 2023, rises to 25 in 2024 and reaches 37 percentage points in 2025 (ISTAT, 2025): companies above 250 employees reach 53.1%, small ones remain stuck at 15.7%. This runs opposite to the other digital indicators tracked by the same report, where size-related gaps are narrowing. AI, alone among the technologies observed, is widening the distance between companies that already have mature data structures and those that do not.
This is not a statistical footnote, it is the key to reading the whole phenomenon. Large companies arrive at AI after years of investment in MES systems, integrated ERP, digitised procedures: they already hold process data in a form an algorithm can query. Italian manufacturing SMEs, which make up the bulk of the national production fabric in a sector worth 15% of GDP and 35% of total investment (Industria Italiana, 2026), start from a different condition: process knowledge exists, but it lives in operators' heads, in outdated PDF manuals, in setup videos never catalogued. It is not a knowledge gap, it is knowledge in the wrong form.

A second ISTAT figure completes the picture, and it speaks directly to companies that have already evaluated the technology. Nearly 60% of companies that considered an AI investment without carrying it through cite a lack of adequate skills as the main reason (ISTAT, 2025). Not cost, not distrust of the technology: skills. Consistently, the Osservatorio Artificial Intelligence at Politecnico di Milano finds that knowledge management is today the area where generative AI's impact looks most immediate, precisely because the starting problem, tacit knowledge scattered across people's heads and heterogeneous documents, is what generative AI addresses most directly once it has data to start from (Osservatorio Artificial Intelligence, Politecnico di Milano, 2025).
The picture that emerges splits the problem into two distinct levels, often conflated in the public narrative about AI on the factory floor.
The distinction matters because it dismantles a widespread but mistaken equation: it is not true that a company must choose between staying as it is or spending years on digitisation projects before it can use AI in production. The opposite is closer to the truth: a poorly deployed AI system adds computing power to a problem that is not computational, but a correctly applied AI system can be exactly the tool that structures that data, not only the one that consumes it downstream. The difference between the two paths sits right here: on one side, the still-dominant idea that a traditional digitisation project, long and costly, has to come first, with AI only afterwards; on the other, the concrete possibility, available today, of using AI itself to turn what an operator does or explains into structured, versioned, queryable procedures in real time. It is the same principle already set out when discussing the factory's submerged data: the information asset locked inside operators' heads or in unstructured archives is not just a hidden cost, it is the structural reason digital transformation, when treated as a separate preliminary stage, stalls before it reaches the shop floor.
This is not confined to smaller or less structured SMEs. Even in companies with established technology investments, the specific knowledge of a single line, a single machine or a single customer has often never been put down in a systematic form, because as long as an experienced technician was managing it, the problem never felt urgent. It is when that technician retires, or when the company opens a second plant that has to reach the same level of competence, that the absence of structure becomes visible, and at that point no language-model subscription closes the gap on its own.

The risk, if the 2025 pattern holds, is not stagnation but polarisation. Companies that already have a structured data base will keep absorbing AI faster, gaining a competitive edge that in turn funds further investment in data structure. Companies starting from unstructured operational knowledge risk staying stuck in the experimental phase the same ISTAT report tracks, where the share of companies that say they use AI without being able to tie it to a specific business area rises from 15.5% to 33.4% in a single year: a sign of wider but still poorly integrated adoption (ISTAT, 2025).
For an Italian manufacturing SME, the practical consequence is not resigning itself to a separate digitisation project before it can even consider AI in production. Some companies are approaching this the other way round, using AI itself to digitise the operational knowledge already present on the shop floor: work videos, an experienced technician's verbal explanations, informal procedures are converted directly into structured, queryable documentation, without going through a separate preliminary project. The sequence "structure the data first, then add AI" compresses into a single step, and that changes the time and cost with which an SME can actually bring artificial intelligence onto its shop floor.
The 2025 ISTAT figures describe a real but partial transformation: artificial intelligence is entering Italian companies faster than ever, without yet solving the problem that weighs most on production. The question a manufacturing SME should ask is no longer "do I digitise first or adopt AI first", because framed that way the question almost always leads to the same paralysing answer, a digitisation project pushed to next year. The useful question is how much of its operational knowledge is already in a form an AI system can read, and how much of that structuring work AI itself is now able to do, if applied at the right point. It is a less headline-friendly distinction, but it is the one that will decide, in the coming years, who uses AI to produce better and who keeps using it only to write better emails.

One in four cyberattacks on manufacturing worldwide hits an Italian company. With NIS2, governing factory data becomes a legal obligation.

ISO 9001:2026 lands this autumn, but the real audit risk isn't the new clauses: it's documented procedures that no longer match how the work is actually done on the floor.

Industrial sensors (accelerometers, telemetry) excel at monitoring machines but remain blind to manual operations: they detect a signal, not the context of what the workforce is doing.