A Government Assistant Learns to Listen
In mid-July 2026, Ukraine's Ministry of Digital Transformation added voice interaction to Diia.AI, the chat-based assistant embedded in the Diia state-services portal since its September 2025 launch. Citizens can now tap a microphone icon, ask a question aloud, and get a spoken answer that mirrors the text-based service exactly — switching between voice and typing mid-conversation (Biometric Update; dev.ua). The speech layer runs on partner technology from the AI startup ElevenLabs, with the voice interface built by the Ukrainian GovTech firm Kitsoft. Audio is deleted immediately after transcription — "Zero Retention," in the Ministry's own description on the official Diia.AI page — and never used to train outside models (Diia.gov.ua).
The more consequential engineering decision, though, predates the voice feature: Diia.AI's core reasoning model is Google's Gemini 2.0 Flash, run through Vertex AI, sitting inside a government-controlled architecture. Ukraine put a foreign, US-headquartered commercial LLM at the center of a national government-services product — during wartime, with a population deeply attuned to sovereignty risk — and did it in a way designed so the model itself never sees a citizen's real name, address, or tax number.
The Anonymization Layer, Concretely
According to the official Diia.AI page, personal data pulled from state registries is tokenized before it ever reaches Gemini: a citizen's name becomes a placeholder like [USER_FULL_NAME], an address becomes [FOP_ADDRESS], and so on. The model reasons over the placeholders and generates a response structured around them; Diia's own systems then substitute the real values back in before the answer reaches the user. The Ministry states plainly that "personal data texts from registries... are not transmitted to technology partners" (Diia.gov.ua).
The European Commission's Interoperable Europe Portal, which profiled the system for its Public Sector Tech Watch series, describes this as a "four-stage Personal Identifiable Information (PII) protection mechanism" layered on top of a hybrid-cloud design that combines "Google Vertex AI (Gemini 2.0 Flash)" with infrastructure the government fully controls (Interoperable Europe Portal). An earlier Ministry post makes the same point in one line: "no personal data is sent to Gemini — all user information is processed within Diia's secure perimeter" (digitalstate.gov.ua).
The Case for Caution — and Why It's Answerable
The skeptical case deserves a fair hearing before dismissal. Handing the reasoning layer of a national identity and services platform to a foreign commercial cloud provider creates real dependency: if Vertex AI has an outage, faces export-control friction, or Google changes commercial terms, a government service millions of Ukrainians now rely on for certificates, benefits, and consultations degrades with it. During an active war, that is not an abstract concern — it's the same logic that drives debates over data-center sovereignty and cloud-repatriation policy across the EU. A stricter regulator could reasonably demand a fully sovereign, domestically-hosted model before allowing this kind of integration into critical civic infrastructure, and several EU member states' digital-sovereignty frameworks lean exactly that direction.
But Ukraine's architecture is a reasonable answer to that objection rather than a dismissal of it. The anonymization layer decouples the compute dependency from the data dependency: Ukraine can, in principle, swap the underlying model — Gemini for another provider, or eventually a domestically-hosted model — without re-architecting how citizen PII is handled, because the tokenization and reinsertion logic lives entirely inside government-controlled systems, not inside Google's infrastructure. That is a materially different risk profile than sending raw citizen records to a foreign API, which is the pattern regulators are usually — correctly — worried about.
Why This Is the Right Default for Fast-Moving GovTech
The alternative to this approach is not a safer one — it's usually a slower one. Building and training a state-of-the-art, sovereign LLM from scratch, at the quality needed for natural-language government services, is a multi-year, capital-intensive undertaking few governments can justify, least of all one financing a war. Waiting for "good enough domestic AI" before digitizing services means citizens keep standing in lines and mailing paper forms in the interim. Diia.AI's roughly 35,000 early users and 1,000-plus generated certificates in its first weeks (digitalstate.gov.ua) sit on top of a Diia platform that had already reached more than 23 million users by October 2025 (digitalstate.gov.ua) — a base that makes even a modest per-interaction time saving compound into real public value quickly.
The regulatory lesson for other governments eyeing similar systems is not "avoid foreign LLMs" — it's "architect around them." Proportionate oversight here should focus less on which company's model sits behind the API and more on auditing whether the anonymization boundary genuinely holds: whether tokenization actually strips identifying data before every request, whether logs on the vendor side could ever be re-identified, and whether the reinsertion step is tamper-proof. Ukraine has published enough architectural detail — via the EU's own tech-watch program, notably — to make that kind of scrutiny possible. That transparency, more than the choice of vendor, is what other governments building AI-native public services should be copying.