Sold as innovation and reform, Albania’s AI rollout raises a deeper question: Who is in charge when decisions are shaped by algorithms?
When Albania appointed Diella as the new virtual minister of state for artificial intelligence and innovation, it marked an astonishing rise for a public servant who had only started working for the government eight months earlier.
But as a friendly and charming assistant for the “e-Albania” project, which brings everything from vehicle registrations to consular services into the digital age, Diella was incredibly efficient. According to the Prime Minister Edi Rama’s office, prior to the promotion Diella had logged 972,000 interactions with the public, issued 36,000 documents, and “set a new standard” for public administration.
Government officials saw the potential for even more in a ministerial role, and gave Diella – which means “sunshine” in Albanian – responsibility for public procurement, a sector long seen as highly vulnerable to corruption. Diella was also tasked with boosting citizens’ access to public services, digitizing documents, and introducing artificial intelligence to the most important sectors of the country.
But behind the allure, there are big questions about what Diella actually does, who oversees the new appointee, and what the benefits – and risks – might be.
Not Just a Pretty Face
Diella is charming, has superhuman work habits, and looks and sounds just like a famous Albanian actress. If this all seems too good to true, it is because it is – Diella is an AI-generated virtual avatar.
In announcing the appointment, the prime minister’s office described Diella as a “bold step” toward digital independence. And officials boasted that “she” could make public-procurement procedures “100% corruption-free.”
The world’s first “virtual minister,” and the fast expansion of a wide-ranging surveillance system, are being presented as signs that Albania is becoming a tech leader in the region. But together, they reveal a deeper issue: a lack of transparency in how these systems are built, managed, and connected. For a country aiming to join the European Union, it raises serious questions about data protection, democratic oversight, and who ultimately controls Albania’s digital future.
A Paradox At Work
Slow Media Albania, a Tirana-based outlet for in-depth investigative journalism, contacted Rama’s office for answers.
In a written response, the office explained that “Diella is an artificial intelligence system developed by the National Agency for Information Society (AKSHI) and integrated into the e-Albania platform to provide automated public services.”
The office also clarified that Diella has no real decision-making powers and is intended to be used as a support tool to assist public employees.
“Diella does not make administrative or legal decisions autonomously; the formal responsibility for any act or action arising from its use remains with the person or institution that interacts with and uses the system to make final decisions,” the message said.
But more questions were raised by the office’s explanation that the system “is not based on on-premise infrastructure” and that “data processing and the execution of artificial intelligence models are carried out within Microsoft Azure–managed environments.”
AKSHI also confirmed the reliance on Azure, a public cloud-computing platform operated by the U.S. tech giant Microsoft that provides data storage as well as AI and networking services.
According to Silva Arapi, a Tirana-based expert on data protection and AI governance, the use of the platform offers clear advantages, including “high levels of technical security, advanced encryption, 24/7 monitoring, protection against cyberattacks, and system resilience, which public administrations often cannot match without massive investment.”
However, the risks are also significant.
“When critical state data and AI processes are handled through foreign infrastructure, the state loses autonomy, becomes dependent on third parties, and faces concerns over foreign access, cross-border data transfers, and long-term costs flowing outside the country,” Arapi says.
Albania has recorded a significant increase in the number of cyber incidents, which broadly refers to any event – including denial of service and malware attacks – that affects the security of an information system or the data it stores or processes.
The country’s National Cyber Security Authority recorded 16 cyber incidents nationally in2019. In 2023, there were 42 such incidents, and last year 46 were recorded. The most affected sectors include digital infrastructure, energy, and transport – precisely the areas of government where digital systems are most heavily used and tightly linked together.
For Arapi, this is a clear warning signal that comes as malicious actors, including criminal and state-linked hacking groups, are rapidly employing more advanced technology and tactics.
“Rising cyber incidents significantly increase the need for stronger cybersecurity and risk management, especially for state systems processing citizens’ personal data and deploying AI,” she says.
But when it comes to technical details of how Diella and its new surveillance system works, how data is processed and stored, and who controls it, Albania reveals precious little information. AKSHI itself sets strict limits on transparency, citing national security and the protection of critical infrastructure.
Therein lies the paradox: the state is promoting AI as a transparency tool, while refusing to disclose how the system itself works.
Big Brother Is Getting “Smart”
Diella’s arrival on the AI front comes at the same time that Albania is quietly expanding a nationwide surveillance infrastructure that has resulted in the installation of thousands of cameras and other tools to monitor urban spaces, traffic systems, and public services across the country.
But like Diella, the so-called “Albania Smart City” project has drawn criticism for the lack of transparency and public input, foreign involvement, and questions over its legality and how it works. Official documents studied by Slow Media Albania show that even state institutions struggle to fully understand or control the technologies now shaping public administration.
The initiative was announced in April 2024, when former Interior Minister Taulant Balla reached a multi-year agreement with a company based in the United Arab Emirates, Presight. The company, part of the G42 Group that has ties to the Abu Dhabi royal family,advertises “AI-powered urban intelligence for future-ready nations” and promises to enable governments to meet modern challenges “with scalable, sovereign, and AI-native city intelligence platforms.”
According to the agreement, the company would implement an AI-powered “smart nation” program in 20 cities and 28 international border points across Albania. Presight did not respond to a request for comment on the company’s role in the Smart City project.
Smart City has been presented by the Interior Ministry and Rama’s office as a transparent, citizen-focused investment that uses artificial intelligence to improve public safety and prevent crime.
Rama, who formally signed off on the deal during a meeting in Tirana in February 2025 with UAE President Mohamed bin Zayed Al Nahyan, has boasted that the project will make Albania one of the safest countries in the world. “It will be very difficult, if not impossible, to move around Albania’s streets in order to commit wrongdoing,” he said at the time.
But to date, technical and financial details, any operational safeguards, and long-term access arrangements pertaining to the project have not been disclosed. Smart City appears to have benefited from legal loopholes that prevented public scrutiny, and information about the way it operates is shrouded in secrecy.
The procurement structure itself is unusual but legal, thanks to the exceptional Albanian law that exempts companies from the UAE from standard public-procurement procedures. The same legal mechanism has been used for other large strategic projects, including the redevelopment of the Port of Durres.
Freedom of information (FOI) requests filed by Slow Media Albania ran into more walls. The Interior Ministry confirmed that while the contract was not classified under the law on state secrets, it could not be released due to contractual confidentiality. AKSHI, the national body in charge of information, responded to FOI requests by saying it had no central registry relating to the surveillance system.
Other details regarding Smart City – including the key questions of whether it might employ invasive biometric cameras and who might process any resulting data – are kept from the public. AKSHI, for example, said it does not track which institutions use AI or biometric cameras that might utilize controversial technology like facial recognition, and keeps no list of such systems in operation. Even the list of critical digital infrastructure operators is classified and cannot be made public.
So, Who Controls the Cameras?
Signs that the project is in operation are popping up on street corners and highways across the country. In Tirana, for example, cameras have been installed in various high-traffic areas, but nobody appears to know – or is willing to say – who is responsible for them, which ones might be related to the Smart City project, and what technology they use.
When asked directly about biometric surveillance, state bodies respond with denials and deflections.
The National Cybersecurity Authority (AKSK) said that it does not maintain a list of surveillance systems and does not receive incident reports specific to AI-powered camera networks.
The Interior Ministry says the system is operated on Albanian soil and managed by the State Police. But in two separate written responses, the State Police stated that it does not operate, manage, or administer facial-recognition systems, and that the cameras under its control are standard CCTV systems, not biometric ones. The police further stated that they have no information about whether facial recognition cameras exist elsewhere and advised that questions be directed to other institutions.
Smart City includes the installation of 2,239 cameras for automatic license plate recognition and 2,602 “pan, tilt, and zoom” cameras for traffic monitoring, according to a public presentation of the project. But no state institution was willing to inform Slow Media Albania about their specific locations.
Data protection and AI governance expert Arapi says the lack of clarity reveals a “clear mismatch between public statements and official communications.”
“On the one hand, the police say only traditional CCTV systems are used. On the other hand, in official online communication, including the prime minister’s office website, the project is described as being based on ‘smart cameras,’ which in practice go beyond a classic CCTV system,” Arapi says.
Arapi explains that “smart cameras,” unlike passive CCTV systems, combine video capture with analytical software, including algorithms and sometimes artificial intelligence, to detect movements and unusual behavior and identify specific objects and vehicles in real time.
Data-Protection Rules Tested
Adding to the controversy is that Smart City might have been implemented in violation of both Albanian and EU law, and was approved without standard risk assessments or real public input.
“Under Albania’s data protection law, the data controller must respect the principle of transparency,” Arapi says. “Citizens have the right to know how their personal data are processed, for what purpose, with whom they are shared, how long they are retained, and whether they are transferred abroad.”
The authorities say that the public was informed about the $113.6 million project by way of official statements and media appearances, but there is no evidence of public consultation or debate before the nationwide surveillance system was approved.
The Interior Ministry has offered assurances that “the use of Artificial Intelligence systems will be carried out in compliance with the GDPR [EU General Data Protection Regulation].” Yet no documentation has been made public to verify this claim.
Likewise, no data-protection impact assessments (DPIAs) were conducted, according to the office of the Information and Data Protection Commissioner (IDPC). There has been no public explanation of whether Smart City analyzes behavior patterns or predicts risk, which would indicate the use of biometric technology. And there is no clarification on whether data is retained, shared, or reprocessed, and whether any of those processes would be in-country or abroad.
While the Interior Ministry suggested that it is a “sovereign” system, in keeping with Presight’s claims about its AI services, key parts of the project – including its design and technical evaluations – were developed together with an international consortium led by the UAE company. It remains unclear what happens after the system is installed, and Albanian officials have not explained whether foreign partners still have technical access to the system or any ongoing influence over how it operates.
The office of the IDPC, while confirming that no DPIAs was conducted in advance, says that the monitoring of how personal data is processed is “ongoing.” However, it provides no documents explaining how this monitoring is actually carried out.
Data Protection Without Real Enforcement
The IDPC noted that Albania adopted a new data protection law aligned with the GDPR in 2024, and began to apply it last year. But the authority admits that there are serious limitations on how the law works in practice.
Albania has also not yet adopted EU rules on artificial intelligence into its domestic laws.As a result, there were no public discussions or consultations before Diella and Smart City were introduced.
These technologies are considered high-risk, but officially the legal requirement to carry out formal privacy and data-protection checks will only take effect in 2027, according to the legislation.
According to Arapi, this creates serious risks: high-risk systems may be deployed without prior rights assessments, accountability becomes blurred when harm occurs, problematic technical and contractual practices may become entrenched, and public trust is weakened.
“DPIAs are a preventive tool,” she says. “Delaying them means Albania risks deploying powerful technologies for years without its main risk-management mechanism.”
The Serbian Precedent
Albania’s current trajectory of running before it can walk when it comes to modern AI technology has a precedent in the Western Balkans. Fellow EU candidate Serbia offers one of the most closely documented examples of how digital surveillance infrastructure can be introduced quietly and attempts can be made to normalize it before clear legal rules exist.
Beginning in 2019, Serbian authorities installed thousands of “smart cameras” across Belgrade and other cities, often justified as tools for traffic management and public safety. The systems were introduced through cooperation with foreign technology providers, in this case Chinese. Later investigations found that the project went ahead despite repeated warnings from the European Union and Serbia’s own data protection commissioner.
Between 2017 and 2022, authorities tried several times to change the law to permit biometric surveillance, but each attempt was blocked after strong opposition from civil society, legal experts, and public campaigns questioning its necessity and justification.
Authorities had insisted the systems did not use facial recognition, yet they did not release technical documentation or full impact assessments. Andrijana Ristic of a Serbian organization for digital rights, SHARE Foundation, says this uncertainty made it difficult to verify official claims.
In the end the surveillance infrastructure was installed, but the outcry prevented Serbia from passing legislation that specifically allows facial recognition in public spaces.
Serbia’s experience serves as a warning as the same patterns are emerging in Albania: systems introduced before clear rules exist, information withheld in the name of security, and oversight bodies that lack real power to intervene. But it is also important to note the precedent set when red flags were raised.
Ristic says the reason resistance worked in Serbia is simple. Public pressure began early, before biometric surveillance became something people saw as normal or inevitable. “Once these systems become routine, it becomes much harder to oppose them,” she says.
Albania is now facing the same risk. AI governance and surveillance technologies are advancing faster than institutions can regulate or oversee them.
Tirana-based journalist Inva Hasanaliaj is the founder of Slow Media Albania – the country’s first “slow journalism” platform for in-depth and multimedia investigations.
