NIS2by country

NIS2 in Italy

Decreto legislativo 4 settembre 2024, n. 138

Law in force since

Law
D.Lgs. 138/2024
Authority
National Cybersecurity Agency (ACN)
Classes
soggetto essenziale (essential), soggetto importante (important)
Register
ACN services portal
ISO 27001
Helps, not enough alone

Check your company for Italy

Get the NIS2 dates for Italy

  • 2 dates as a calendar file.
  • An alert when the rules change.

This site stores your email and emails you when the NIS2 rules in Italy change. Unsubscribe at any time.

The law

The decree took effect on 2024-10-16. ACN sets the detailed dates by decision.

Name
Decreto legislativo 4 settembre 2024, n. 138Legislative Decree 138/2024
In force
2024-10-16
Text
Read the D.Lgs. 138/2024

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Italy differs

  • Art. 3(4) D.Lgs. 138/2024 ACN can leave out partner and linked company figures. It looks at how independent your IT and your services are. The authority decides case by case.
  • Art. 3(10) D.Lgs. 138/2024 A group company is in scope at any size when it decides on the security measures of an NIS entity of the group, runs systems that entity depends on, runs its security operations, or provides it ICT or security services.

Registration

Register between 1 January and 28 February. The window opens every year. Update your information every year between 15 April and 31 May.

Portal
ACN services portal
Rule
Yearly registration window
Window
Every year from 01/01 to 02/28 (month/day)
You need
A portal account for the company's point of contact.

Incident reporting

  1. 24 hEarly warning
  2. 72 hIncident notification
  3. 1 monthFinal reportafter the notification

Send the reports to CSIRT Italia (ACN).

Measures and proof

Essential
ACN sets baseline measures by decision. Entities listed in 2025 report incidents from January 2026 and must have the measures by October 2026.
Important
The same baseline measures apply, with a lighter set for important entities.

The dates, in order

  1. Entities listed in 2025: incident notification starts
  2. Registration window opens
  3. Registration window closes
  4. Entities listed in 2025: baseline measures in placeDerived from a rule in the law
  5. Registration window opens Next
  6. Registration window closes

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

Fine ceilings, Art. 38 D.Lgs. 138/2024. The higher amount applies. Each "At EUR" figure is the ceiling at that worldwide turnover.
Class Ceiling At EUR 20mAt EUR 500mAt EUR 2bn
Essential EUR 10m or 2% EUR 10mEUR 10mEUR 40m
Important EUR 7m or 1.4% EUR 7mEUR 7mEUR 28m

The minimum is 1/20 of the maximum for essential entities and 1/30 for important entities.