Italian entities on the national NIS register have a deadline on 31 October, and the clearest guidance on it exists only in Italian. Here it is in English.
Italy transposed NIS2 by Decreto Legislativo 4 September 2024, n. 138, in force 16 October 2024. The security measures themselves are not in the decree. They sit in determinations issued by the Agenzia per la Cybersicurezza Nazionale, the national cybersecurity agency: determination of 14 April 2025 no. 164179, updated by determination no. 379907/2025, whose Article 4 governs the timing.
The deadline is 31 October 2026 for entities that appeared on the national list during 2025. The clock runs from the date ACN notified each entity of its inclusion, not from a single national start, which is why organisations compare notes and find different due dates. Entities first listed in 2026 work to a separate timetable set by determination no. 127434/2026 of 13 April 2026, with basic measures due in July 2027.
The measures are split by category. Important entities, soggetti importanti, carry 37 measures made up of 87 requirements. Essential entities, soggetti essenziali, carry 43 measures made up of 116 requirements. The difference is six measures and twenty-nine requirements, concentrated in vulnerability assessment, penetration testing, encrypted backups with tested restoration, and monitoring for abuse of privileged accounts.
The word that matters in the determination is functioning. Measures must be implemented and working, not written down and scheduled. In practice that means encryption of data at rest and in transit, identity and access management with multifactor authentication, supply-chain security requirements passed down to providers, and staff training delivered rather than booked. A policy document with a future implementation date is not compliance under this instrument.
Who is caught. Medium and large organisations in the sectors listed in the decree's annexes, which run well beyond the obvious energy and telecoms names into manufacturing, food, waste, postal services, chemicals and digital providers. Smaller companies are pulled in a second way, through the supply chain, when a listed entity passes its own requirements down a contract. A Veneto industrial components maker supplying German and Irish manufacturers may be caught directly by size, or indirectly by a customer, or both.
The annual cycle is fixed and easy to miss. Registration runs 1 January to 28 February. ACN notifies inclusion or exclusion by 14 April. The data update window runs 15 April to 31 May, with changes outside it reportable within 14 days. Activity categorisation runs 1 May to 30 June, under determination no. 155238/2026 of 20 April 2026. Supplier communication requirements sit in determination no. 127437/2026, also of 13 April 2026.
Incident notification became operative on 15 January 2026, on a three-step clock: pre-notification within 24 hours, full notification within 72 hours, final report within one month.
What changes on 1 November 2026 is the agency's posture. ACN moves from a support phase to an inspection phase. Sanctions under Article 38 of D.Lgs. 138/2024 reach EUR 10 million or 2 per cent of annual worldwide turnover for essential entities and EUR 7 million or 1.4 per cent for important entities, whichever is higher, with administrative measures available against leadership.
Questions on the 31 October ACN deadline
What is the 31 October 2026 deadline for?
It is the deadline for the basic security measures set by the Agenzia per la Cybersicurezza Nazionale to be implemented and working.
Who does the 31 October deadline apply to?
Entities that appeared on the national list during 2025.
Why do companies compare notes and find different due dates?
The clock runs from the date ACN notified each entity of its inclusion, not from a single national start.
We were first listed in 2026. What is our date?
Entities first listed in 2026 work to a separate timetable set by determination no. 127434/2026 of 13 April 2026, with basic measures due in July 2027.
Which law transposed NIS2 in Italy?
Italy transposed NIS2 by Decreto Legislativo 4 September 2024, n. 138, in force 16 October 2024.
Where are the security measures written?
Not in the decree. They sit in determinations issued by the Agenzia per la Cybersicurezza Nazionale: determination of 14 April 2025 no. 164179, updated by determination no. 379907/2025, whose Article 4 governs the timing.
How many measures do important entities carry?
Important entities, soggetti importanti, carry 37 measures made up of 87 requirements.
How many measures do essential entities carry?
Essential entities, soggetti essenziali, carry 43 measures made up of 116 requirements.
What is the difference between the two sets?
Six measures and twenty-nine requirements, concentrated in vulnerability assessment, penetration testing, encrypted backups with tested restoration, and monitoring for abuse of privileged accounts.
Does a written policy with an implementation date count?
No. The word that matters in the determination is functioning. Measures must be implemented and working, not written down and scheduled, and a policy document with a future implementation date is not compliance under this instrument.
What does implemented and working mean in practice?
Encryption of data at rest and in transit, identity and access management with multifactor authentication, supply-chain security requirements passed down to providers, and staff training delivered rather than booked.
Who is caught by the Italian decree?
Medium and large organisations in the sectors listed in the decree's annexes, which run well beyond the obvious energy and telecoms names into manufacturing, food, waste, postal services, chemicals and digital providers.
Are smaller companies caught?
They are pulled in a second way, through the supply chain, when a listed entity passes its own requirements down a contract. A Veneto industrial components maker supplying German and Irish manufacturers may be caught directly by size, or indirectly by a customer, or both.
When is the registration window?
Registration runs 1 January to 28 February.
When does ACN notify inclusion or exclusion?
By 14 April.
When is the data update window, and what if something changes outside it?
The data update window runs 15 April to 31 May, with changes outside it reportable within 14 days.
When is activity categorisation?
Activity categorisation runs 1 May to 30 June, under determination no. 155238/2026 of 20 April 2026.
Where are the supplier communication requirements set?
In determination no. 127437/2026 of 13 April 2026.
What are the incident notification deadlines?
Incident notification became operative on 15 January 2026, on a three-step clock: pre-notification within 24 hours, full notification within 72 hours, final report within one month.
What changes on 1 November 2026?
The agency's posture. ACN moves from a support phase to an inspection phase.
What are the sanctions?
Sanctions under Article 38 of D.Lgs. 138/2024 reach EUR 10 million or 2 per cent of annual worldwide turnover for essential entities and EUR 7 million or 1.4 per cent for important entities, whichever is higher, with administrative measures available against leadership.
More from ComplianceSME
- A machine fired the drivers. The bill is 824,990,000 euro.
- Europe Blamed the AI Act. The Delays Were Data Protection Law.
- The Two Rulebooks, the One Person, and the Answer That Is Already Out of Date
- The 24 hour clock that starts on 11 September
- The leaders who called compliance too complicated, and what the work costs
- ComplianceSME Completes the Free Business Compliance Libraries of All Twenty-Eight Nations
- The Digital Omnibus deferral: what moved, what did not, and what applies now
- Platform work's deadline is 2 December, and the rules reach past the couriers
- Software becomes a product on 9 December, and the liability follows it
- The AI Act did not pause, and two prohibitions start on 2 December
- Poland's cybersecurity register closed on 3 October, and the real work starts now
- Every verified deadline between now and the end of December
- Pay gap reporting arrives before the software does
- Six questions Irish companies keep asking, answered with the section that settles each