Does it apply to your Italian subsidiary?
It depends on the sector and on the size of the entity. In most cases, an entity is subject to the rules of the Member State where it is established, so the Italian company deals with Italian law and with ACN. Some digital service providers follow different rules based on their main establishment. Group membership can also affect how size is calculated.
Even when the Italian entity is not in scope, its customers often are: they are required to manage supply-chain risk and will ask their suppliers for security questionnaires, contract clauses and evidence.
What an in-scope entity has to do
- Register on the ACN digital platform and update the registration every year, between 1 January and 28 February.
- Adopt risk-management measures: access control and MFA, backups, vulnerability management, incident handling, supply-chain security, training.
- Report significant incidents: an early warning within 24 hours, a notification within 72 hours and a final report within one month.
- Ensure management accountability: the management body approves the measures, oversees them, is liable for them and must attend cybersecurity training.
Key dates
- 16 October 2024: Legislative Decree 138/2024 enters into force.
- December 2024 – February 2025: first registration window on the ACN platform.
- From January 2026: entities listed by ACN in 2025 must notify significant incidents.
- By 31 October 2026: those entities must have the baseline security measures in place.
- Entities entering the scope later follow the same sequence, with deadlines counted from their own inclusion.
Fines for non-compliance can reach €10 million or 2% of worldwide annual turnover for essential entities and €7 million or 1.4% for important entities, whichever is higher.
How we help
- Scoping: is the Italian entity in scope, and in which category.
- Gap analysis of the Italian site against the required measures and your group baseline.
- Implementation and management of the technical measures.
- Incident procedures that connect the Italian site, your group team and the Italian notification process.
- Evidence and documentation in English for headquarters and customers.
This page is general information, not legal advice. For the legal assessment we work alongside your legal counsel.
Is your Italian entity ready for NIS2?
We can start with a short scoping call in English and a gap analysis of the Italian site.