The questions we actually get asked, taken from support tickets and from negotiations — with the answers we actually give.
Some of them are “it depends”. Where that is the honest answer, we say what it depends on.
Costs and timescales
What does an access control system cost?
It depends on three things: how many gates, what kind of gate, and how much integration. For an order of magnitude: a single entrance with a reader and an electric lock on an existing door runs into the hundreds of euros; a tripod turnstile with readers on both sides runs into the thousands; a glass speed gate for a corporate lobby costs two to four times a turnstile. On top of that come the software, the installation and — almost always underestimated — the integration with the systems you already have. The line that makes the most difference to the total is not the hardware: it is how many different systems have to talk to each other.
How long does installation take?
For a standard installation in an existing building, two to six weeks from order, most of which is procurement rather than work on site. Mechanical gates have longer lead times than readers. If building work is needed — a plinth, a cable duct — that is what sets the schedule.
Is it better to buy or to rent?
Renting makes sense when the need is temporary — a construction site, an event, an office being relocated — or when you want to avoid the upfront investment. For a permanent installation, buying costs less over four to five years. In 2026 there is a third consideration: the enhanced depreciation (iperammortamento) under Italian Law 199/2025, which makes buying more attractive than it would normally be.
Are there incentives?
Yes. Enhanced depreciation applies to capital goods acquired from 1 January 2026 to 30 September 2028, under Article 1(427) and following of Italian Law 199/2025 and the MIMIT implementing decree of 7 May 2026. The uplift is banded: 180% on investment up to 2.5 million euros, 100% on the part between 2.5 and 10 million, 50% between 10 and 20 million, which is the overall ceiling. It covers assets interconnected with the company information system — a condition that access control and time and attendance systems meet when they are integrated with the management software.
Legal obligations
Is the construction site card mandatory?
An identification card on site has been mandatory for years. What Article 3 of Italian Law 198/2025 adds is that it must carry an electronically readable unique code — QR, RFID or NFC — and be interoperable with the national information system for social and labour inclusion. The penalty ranges from € 100 to € 500 per worker. ⚠️ The general extension depends on a ministerial decree that has not been published yet: anyone telling you that you are already in breach today is pushing it.
Does NIS2 oblige me to buy an access control system?
No, and be wary of anyone who says it does. Italian Legislative Decree 138/2024 requires security measures proportionate to risk, and among them it explicitly lists control of physical access to facilities. An access control system helps you meet that measure and demonstrate it with a verifiable log, but it does not “make you compliant”: compliance concerns the organisation as a whole.
What is the Machinery Regulation and why does it concern turnstiles?
Regulation (EU) 2023/1230 repeals and replaces the Machinery Directive (Directive 2006/42/EC) and applies from 20 January 2027, with limited transitional provisions for products already placed on the market. It treats motorised gates as machinery in the full sense, with requirements on risk assessment, technical documentation and — a significant addition — on the cybersecurity of components that affect safety. Anyone buying a gate in 2026 should check that the supplier is already getting there.
Does the AI Act apply to my time and attendance software?
If the software applies artificial intelligence to decisions about workers — hiring, task allocation, evaluation, termination — then yes: it falls under Annex III of Regulation (EU) 2024/1689 as a high-risk system, with the obligations applying from 2 December 2027. If the software simply records clockings and calculates balances, no: there is no artificial intelligence within the meaning of the Regulation. ⚠️ Either way, the Article 4 AI literacy duty already applies to anyone providing or deploying AI systems, whatever the risk level. Since Regulation (EU) 2026/1744 it is a duty to take measures supporting AI literacy rather than to guarantee a given level.
Privacy and data
Can I use facial recognition at work?
For time and attendance in Italy, in practice no: the Garante, the Italian data protection authority, has repeatedly found that using biometric data is disproportionate where less intrusive alternatives exist, and a card is one. For access to high-risk areas it is possible, but it requires a documented impact assessment, a solid legal basis and almost always a discussion with the workforce representatives.
Can my employer see what time I come in and leave?
Yes — to manage the employment relationship: that is what time and attendance exists for. The same data cannot be used for remote monitoring of work activity, which Article 4 of the Italian Workers’ Statute (Law No. 300/1970) permits only with a union agreement or an authorisation from the labour inspectorate, and then only for organisational, production or safety purposes — not to monitor performance.
How long do you keep the data?
In our systems retention is configurable and is decided by the data controller, which is the customer. What we recommend: six months for gate access logs, twelve months for attendance data beyond the current year, and the statutory retention period for whatever feeds into payroll. The defaults are the shortest ones: extending them is a decision, shortening them is not.
Where is the data physically held?
In our datacenter in Trieste, built into a former bank vault, with redundant UPS, a diesel generator, inert-gas fire suppression and geographic replication for recovery. The data from our cloud services is hosted there. For the artificial intelligence functions, which rely on third-party providers’ models, the list of providers and data flows is published on our transparency page.
Do you run AI on our employees’ data?
No. It is a board resolution: we do not do individual employee scoring, and our systems do not apply artificial intelligence to individual attendance data.
Technology and integrations
What is the difference between a turnstile and a speed gate?
A tripod turnstile is mechanical, costs less, takes little space and regulates flow one person at a time — but it can be climbed over. A glass speed gate lets more people through per minute, suits a corporate lobby better and is available in a wheelchair-accessible version, but it costs more and needs more maintenance. The full-height turnstile is the only one that physically prevents unauthorised passage: it is used where the gate is unstaffed.
Will the cards I already have work with a new installation?
It depends on the chip. If they are 125 kHz or Mifare Classic, technically yes but it is not advisable: they can be cloned with cheap tools, and reusing them means carrying the vulnerability forward. If they are Mifare DESFire, almost always yes. The check is done by reading a sample card: it takes minutes.
Does your software integrate with Zucchetti, TeamSystem or Inaz?
Yes — export to the main Italian payroll packages is a standard function, and integration with corporate authentication systems is available. Format and frequency are agreed with whoever runs the payroll: it is almost always they who set the terms, not us.
Can I use a smartphone instead of a card?
Yes, over NFC or Bluetooth. It works well, and it has one practical advantage: people leave a smartphone at home less often than a card. There are two limits to factor in: it needs the phone to be charged, and in some workplaces using a personal device for work has to be agreed with the unions.
What happens if the network goes down?
Gate controllers keep working on their own with the permissions stored locally, and they buffer the events, which are synchronised when the link returns. An installation that stops when the network drops is a badly designed installation.
AI, data and governance
Where should we start when introducing AI into our business?
Start with a real process, the users involved, the data you actually have and the outcome you want to improve — not with the model. A readiness assessment or a use case workshop helps define priorities, risks, integrations and success criteria before anyone picks a technology. The projects that fail almost never picked the wrong model: they never defined what “better” meant.
Can you integrate AI with our management software and legacy systems?
Yes, and it is the central part of the work rather than an appendix. Feasibility depends on architecture, data quality, permissions and the objective. The first system we did it on was our own: a legacy line-of-business application of the kind that runs in thousands of Italian companies, not an infrastructure designed for AI.
What are LLMOps and AI Engineering?
AI Engineering is the design, development, integration and operation of AI solutions. LLMOps is the set of practices that keeps an application built on language models manageable over time: versions, quality, costs, security, monitoring. The difference between the two shows up at month six, not at launch.
Can an AI agent perform tasks autonomously?
It can assist or automate defined activities, but the level of autonomy has to match the impact, the data, the roles and the controls. For sensitive processes, or anything with significant effects on people, human oversight and review are not an extra: they are the design.
Do you build knowledge bases and internal search systems?
Yes. We design knowledge bases and search systems that put documents, procedures and archives in the hands of authorised users, with contextual answers and verifiable sources. Sources, access rights, updates and what the system does when it does not know the answer are defined in the project, not discovered in production.
Is our data used to train public models?
It depends on the architecture, the suppliers and the configuration agreed for the project, and these are things to put in writing before starting: privacy roles, data processed, purposes, access, retention, location and the applicable contractual terms. Where data must not leave the organisation, the answer is a model running on your infrastructure or ours: it costs more and performs somewhat less, and it is a legitimate choice.
How do you address security in an AI project?
From the design stage: access, data, integrations, roles, logs, input protection and escalation flows. The specific measures depend on the context, the risk level and the responsibilities shared with you. What we will not tell you is that a system is protected against everything: that sentence is a warning sign wherever you read it.
Is Infordata’s AI compliant with the GDPR and the AI Act?
There is no single answer valid for every system and every project, and a supplier who gives you one is selling something. The GDPR and the AI Act apply according to data, purpose, role, capabilities and context of use. We can support mapping, documentation and governance with the appropriate legal and privacy functions involved — we ran the AI Act classification of our own systems first.
What is AI literacy and who needs it?
It is the ability to use and oversee AI while understanding its potential, limits, risks and responsibilities. Article 4 of the AI Act asks providers and deployers for proportionate measures for the people operating the systems on their behalf. Proportionate is the operative word: it is not automatically the same course for everyone.
Can you assess the bias and quality of an algorithm?
We can define and run technical and organisational controls on quality, robustness, traceability, limitations and possible bias. Scope, available data and the meaning of any resulting statement are agreed case by case: an audit is not a certification unless the engagement expressly says so.
When is computer vision useful?
When images or video help recognise objects, conditions or anomalies: quality control, asset monitoring, inspections, operational safety, predictive maintenance. What decides feasibility is the environment, the images you already have, the accuracy the process genuinely requires and the privacy considerations — in that order.
Does predictive maintenance eliminate failures?
No. It helps detect patterns and intervention priorities before some failures or degradation become critical. Effectiveness depends on data quality, continuity and coverage, as well as on maintenance processes and field expertise that have to exist anyway.
Can you integrate IoT sensors and field data into our systems?
Yes. We design integrations between devices, sensor networks, data platforms and operational applications. The project starts from the assets to monitor, the data needed, connectivity, security, interoperability and the people who have to act on the result. A sensor nobody acts on is an expense, not a measurement.
Do you offer training and onboarding support?
Yes. Adoption requires people to understand the process, the tools and the responsibilities. We can structure discovery, training, release support and ongoing assistance around roles and the project.
How can we request a demo or discuss a use case?
Contact us with the process, the goal, the users involved, the existing systems and the main constraints. That is enough for us to route the request to the right team and propose a useful next step instead of a generic call.
About us
How long have you been around?
Since 1997, in Trieste. We have been a Società Benefit — an Italian benefit corporation — since 10 December 2025.
How many of you are there?
About twenty-four employees plus a number of collaborators.
Do you only work in Friuli Venezia Giulia?
No. We install throughout Italy and we are partners in European projects with organisations from eight countries.
Can Italian public bodies buy from you?
Yes: we are listed on the Italian public administration electronic marketplace, GoPlanner is on the AgID cloud catalogue, and our cloud services hold the qualification of the National Cybersecurity Agency.
Do you provide support?
Yes, with our own technicians and a support portal with tickets. It is the part of the job customers really judge, and it is the part where we measure our response times.
⚠️ Notice. Answers referring to the AI Act, the GDPR and Italian legislation are informative and current as of 22 August 2026. They do not constitute legal advice: applicable obligations depend on role, system, data, context and sectoral rules.