NIS 2 Italy: Key Deadlines, Board Duties and What ACN Expects From Companies

NIS 2 Italy has moved from registration to enforcement. Entities listed in April 2025 have reached the 18-month deadline for the basic security measures this month, incident notification has been mandatory since January, and the annual cycle of declarations and updates now runs whether boards pay attention to it or not.

On 19 October 2026 these issues were discussed in a live session with Mr. Davide Nardacci, Deputy Head of the NIS and EU Regulations Division of the Italian National Cybersecurity Agency (ACN). Giulia Zappaterra opened with an overview of the state of play, and the Q&A that followed led by me, Giulio Coraggio, with most questions coming from the audience) focused on the practical problems organisations are facing right now. The recording, with subtitles in several languages, is available below, together with the slides.

The points that matter most for businesses are summarised here.

1. Where NIS 2 Italy stands today

Italy transposed Directive (EU) 2022/2555 through Legislative Decree 138/2024, in force since 16 October 2024. Since then ACN has built the regime through a series of determinations rather than a single implementing act, which explains why many companies have lost track of what applies when.

The milestones that shaped the first two years are the following:

1. first registration on the ACN portal by 28 February 2025;
2. inclusion in the NIS list and notification to entities in April 2025;
3. designation of the CSIRT contact person by 31 December 2025;
4. notification of significant incidents mandatory from 15 January 2026;
5. first categorisation of activities and services by 30 June 2026;
6. basic security measures due in October 2026 for entities listed in 2025 (18 months from the listing notice).

Entities listed for the first time in 2026 follow a different clock. Under ACN Determination 127434/2026, they must adopt the basic measures by 31 July 2027 and notify incidents from 1 January 2027.

Two moving parts deserve monitoring. The European Commission tabled a targeted amendment of NIS 2 on 20 January 2026, still under negotiation, and on 18 September 2026 ACN opened a consultation within the NIS Table on the enhanced measures that will sit on top of the basic ones.

2. NIS 2 Italy is now an annual compliance calendar

The most underestimated change is that NIS 2 does not end with a successful registration. Articles 7 and 30 of Legislative Decree 138/2024 and ACN Determination 127437/2026 set recurring windows that repeat every year:

1. 1 January to 28 February: annual declaration on the ACN portal (it becomes final after 10 days, and late declarations can be sanctioned);
2. by 31 March: ACN updates the NIS list, and the notice of inclusion starts the clock on obligations;
3. 15 April to 31 May: update of data and roles, plus the list of relevant suppliers;
4. 1 May to 30 June: categorisation of activities and services, with ACN responding within 90 days (extendable);
5. at any time: notification of significant incidents and update of data when something changes.

In practice, groups with several Italian entities fail on continuity more than on substance. The point of contact and the CSIRT contact person leave, nobody holds the delegation, and the window closes. An internal calendar with named deputies is the cheapest fix available.

3. Essential or important entity: the qualification drives everything

The distinction between essential and important entities changes the measures, the supervision and the exposure to sanctions:

1. Essential entities: 43 measures and 116 requirements, supervision both ex ante and ex post, maximum fine of EUR 10 million or 2% of worldwide turnover;
2. Important entities: 37 measures and 87 requirements, ex post supervision only, maximum fine of EUR 7 million or 1.4% of worldwide turnover.

The basic specifications sit in ACN Determination 379907/2025. Financial entities subject to DORA follow a special regime for measures and notifications and are exempt from the CSIRT contact person and categorisation requirements, although they may opt in voluntarily.

The recommended action is simple and rarely done properly: verify the qualification of each company in the group separately, because a holding company and its operating subsidiaries often fall into different categories with different deadlines.

4. Board duties under NIS 2 Italy: approval cannot be delegated

Article 23 of Legislative Decree 138/2024 requires management bodies to approve the way cybersecurity risk measures are implemented, oversee their implementation, answer for violations and undergo (and promote) periodic training.

ACN’s FAQ of July 2026 clarified several points that boards keep asking about:

1. approval is reserved to the management body and cannot be delegated, while execution can be;
2. the board approves the overall approach, not every single technical measure;
3. oversight must be continuous and supported by structured information flows;
4. training must be substantive, and a one-off awareness session does not meet the standard.

This is the area where personal exposure is concrete, as explained in the earlier analysis of directors’ personal liability under NIS 2. Boards should adopt a formal approval resolution, a training plan for the body itself and periodic reporting, with content and frequency defined internally and documented.

5. Supply chain and incident notification

Article 24 imposes an all-hazards approach covering risk analysis, incident handling, business continuity and backup, supply chain security, secure development, effectiveness testing, cyber hygiene and training, cryptography, access control and MFA. On suppliers, entities must assess vulnerabilities, product quality and the secure development practices of their providers, and from 2026 they must file the annual list of relevant suppliers (ICT or non-fungible) between 15 April and 31 May.

A recent ruling shows what happens when the supplier relationship is badly documented: in a ransomware case decided by an Italian court, half of the loss stayed with the client. Connected products raise similar issues, as discussed in the analysis of CRA and NIS 2 duties in the French refrigeration case.

For significant incidents, Article 25 sets four steps:

1. pre-notification within 24 hours of becoming aware of the incident;
2. notification within 72 hours, with an initial assessment of severity and impact;
3. an intermediate report, if the CSIRT requests it;
4. a final report (or a progress report, if the incident is still ongoing) within one month.

ACN’s guidelines of 31 December 2025 expect a phased process and a documented incident management plan. Where a breach also involves personal data, the 72-hour GDPR clock runs in parallel, and sector rules may add further deadlines. The escalation chain, and the availability of the CSIRT contact person at 2 a.m. on a Sunday, is where most plans break down.

6. What businesses should do now

1. Confirm the qualification and the deadlines of each group entity, especially those listed in 2025 whose basic measures fell due this month.
2. Build an internal calendar of the annual windows, with named deputies for every role on the portal.
3. Have the board formally approve the implementation approach and plan its own training.
4. Map suppliers and contracts, and align notification clauses with the 24-hour NIS 2 deadline.
5. Test the incident escalation chain end to end, including outside office hours.

The full recording of the session with ACN, with subtitles, is available below, and the slides can be downloaded here.

The Italian version of this article is available on Diritto al Digitale. On the topic, you can also read the article NIS 2 – Personal Liability of Directors For Lack of Compliance