NIS2 in Italy: Obligations and Deadlines for 2026 and 2027

1. 11 January–28 February: registration. Register or confirm the registration on the ACN platform (art. 7, para. 1). Entities already listed get a pre-filled draft.
2. 2By 31 March: the ACN list. ACN draws up the list of essential and important entities and communicates inclusion, confirmation or removal through the platform (art. 7, paras. 2-3).
3. 315 April–31 May: annual update. IP space, domain names, Member States where you operate, the people responsible under art. 38(5), the substitute point of contact and, since 2026, the list of relevant suppliers (art. 7, para. 4; det. 314287/2026).
4. 4By 31 May of the listing year: substitute point of contact.
5. 51 May–30 June: categorisation. List and categorise your activities and services (art. 30). DORA financial entities are exempt.
6. 61 September–30 November: non-EU representatives. Entities outside the EU send the documentation of their NIS representative.
7. 731 December of the listing year: CSIRT referent. The point of contact designates the CSIRT referent and substitutes on the platform.
8. 8Within 14 days of any change: update the data already communicated.

For the first cohort, the clocks run from each entity's own listing notice, which ACN sent in spring 2025 (determinazione ACN 379907/2025, art. 3):

• January 2026: incident notification. Nine months after the notice, the obligation to notify significant incidents to CSIRT Italia applies.
• October 2026: basic security measures. Eighteen months after the notice, the measures in Allegato 1 (important) or Allegato 2 (essential) must be in place. ACN itself says "by 18 months (October 2026)"; several secondary sources write 31 October, but the exact day depends on when you received your notice.

Determinazione 127434/2026 confirmed that entities listed in 2025 keep these terms even if they remain on the 2026 list. If you are in this cohort, the measures are already due: what matters now is being able to show them.

Determinazione ACN 127434 of 13 April 2026 set a separate calendar for entities first listed in 2026:

• 31 December 2026: designation of the CSIRT referent.
• 1 January 2027: incident notification obligations start.
• 31 July 2027: basic security measures in place (Allegato 1 or 2). TLD registries and registrars also have the art. 29 duties by the same date.

The yearly windows still apply: registration again between 1 January and 28 February 2027, update from 15 April to 31 May 2027, categorisation from 1 May to 30 June 2027.

The basic security measures are in determinazione ACN 379907 of 19 December 2025, which replaced determinazione 164179 of 14 April 2025 and applies from 15 January 2026. They follow the structure of the Italian Framework Nazionale per la Cybersecurity e la Data Protection, 2025 edition: functions GV, ID, PR, DE, RS and RC, the same as NIST CSF 2.0, divided into categories, subcategories and numbered requirements.

• Allegato 1, important entities: 37 measures, 87 requirements.
• Allegato 2, essential entities: 43 measures, 116 requirements. The six extra measures are ID.AM-03, PR.AT-02, PR.IR-03, PR.PS-01, PR.PS-03 and RC.CO-03.

Among the measures most often asked about:

• GV.PO-01: security policies, including one on vulnerability management.
• GV.RR-02: roles and responsibilities, now including the CSIRT referent.
• ID.RA-06: a risk treatment plan.
• ID.RA-01 and ID.RA-08: vulnerability identification and a vulnerability management plan approved by the management body.
• PR.PS-02: security updates installed without undue delay.
• DE.CM-01: monitoring and detection, with the service levels that define incident type IS-3.
• PR.DS-11: backups, with restore tests for essential entities.
• ID.IM-01: for essential entities, a plan to evaluate the effectiveness of the measures, reported periodically to the management body.

The management body approves the measures and answers for their implementation (art. 23). See the d.lgs. 138/2024 guide.

This is where the two annexes differ most.

• Essential entities, ID.RA-01 points 2 and 3: for at least the relevant information and network systems, in line with the vulnerability management plan, activities to identify vulnerabilities "including at least vulnerability assessment and/or penetration testing" must be carried out periodically and in any case before the systems go into production. The activities are documented in reports with a description of what was done, the results, the vulnerabilities found and their impact level.
• Important entities, ID.RA-01 point 1: vulnerabilities are identified using the information monitored under ID.RA-08 (CSIRT Italia, sector CERTs and ISACs). VA/PT is not named, but the vulnerability management plan must say how vulnerabilities are identified, and ID.RA-08 requires them to be resolved promptly or the risk accepted and documented.
• Both: PR.PS-02 requires the latest security updates to be installed without undue delay, in line with the plan.

For an essential entity, the practical question is frequency and evidence: how often relevant systems are tested, and whether each report shows what was tested and what was found. The detail, with the text of each requirement, is in VA/PT and NIS2: d.lgs. 138/2024 and the ACN measures.

Article 25 of d.lgs. 138/2024 sets the steps for a significant incident, notified to CSIRT Italia:

• Pre-notification within 24 hours of becoming aware.
• Notification within 72 hours, with an initial assessment and indicators of compromise where available.
• Intermediate report if CSIRT Italia asks for one.
• Final report within one month of the notification; if the incident is still ongoing, monthly progress reports and a final report within one month of its end.

What counts as significant is defined in Allegati 3 and 4 of determinazione 379907/2025: IS-1 loss of confidentiality of the entity's digital data towards the outside, IS-2 loss of integrity with external impact, IS-3 breach of the service levels defined under DE.CM-01, and, for essential entities only, IS-4 unauthorised access or abuse of privileges on the entity's digital data. See the NIS2 article 23 incident timeline.

Two obligations became operational in 2026.

• Relevant suppliers. Since the 2026 cycle, the annual update between 15 April and 31 May includes the list of relevant suppliers (art. 18). The rules are now in determinazione 314287 of 20 October 2026, which applies from 25 October 2026 and replaced determinazione 127437/2026.
• Categorisation. Between 1 May and 30 June each year, entities list and categorise their activities and services (art. 30). Determinazione 155238 of 20 April 2026 defines the model: ten macro-areas and four impact categories (minimal, low, medium, high). ACN describes categorisation as the prerequisite for the future long-term measures.

The basic measures are the first step. D.lgs. 138/2024 provides for stronger, long-term measures that will integrate and replace them, scaled by the category of each activity and service. In September 2026 ACN opened a consultation with the sector tables. No draft text, number of measures or adoption date has been published yet, so any date you read for them is a guess.

What you can do now: keep the categorisation accurate, because it will decide which measures apply to which service, and build the evidence for the basic measures in a form that can be extended.

Under art. 38, para. 9, failing to adopt the security measures or to notify incidents can cost essential entities up to €10 million or 2% of worldwide annual turnover, whichever is higher, and important entities up to €7 million or 1.4%. Public administrations have fixed ranges instead. The procedure, from preliminary findings to the diffida, is in the NIS2 sanctions playbook.

What are the NIS2 basic obligations? The basic security measures in Allegato 1 (important entities) or Allegato 2 (essential entities) of determinazione ACN 379907/2025, the notification of significant incidents to CSIRT Italia, and the yearly registration, update and categorisation on the ACN platform.

What happened in January 2026? For entities listed in 2025, the obligation to notify significant incidents started, nine months after the listing notice, and determinazione 379907/2025 started to apply. The yearly registration window also opened on 1 January.

What is the October 2026 deadline? The deadline for entities listed in 2025 to have the basic security measures in place: 18 months from their listing notice.

I was listed in 2026: when are my measures due? By 31 July 2027, with incident notification from 1 January 2027 and the CSIRT referent by 31 December 2026.

Are penetration tests mandatory under NIS2 in Italy? For essential entities, yes: periodic vulnerability assessment and/or penetration testing on relevant systems, and before go-live, with reports (ID.RA-01). For important entities they are not named, but a vulnerability management plan and prompt remediation are.

When do the long-term obligations start? No date has been set. ACN is consulting the sector tables; the measures will depend on categorisation.

How can Zero Hunt help? Zero Hunt is an autonomous AI red team that runs on an on-premise appliance with its own models, in black-box and gray-box mode, so test data and evidence stay inside your perimeter. It can test relevant systems on a schedule and before go-live, every finding comes with signed evidence, and findings map to NIS2 among 34 compliance frameworks. It does not do your registration, categorisation or incident notification, and it does not replace the governance and policy measures.