Italy NIS2: basic security measures due in October 2026
Entities on Italy's 2025 NIS list have 18 months to adopt ACN's basic security measures, ending in October 2026. Those listed in 2026 have until July 2027.
Italy transposed NIS2 with Legislative Decree 138/2024, which has applied since 16 October 2024. For the first organisations on the national NIS list, the first big deadline is now: in its Vademecum for NIS entities of 11 September 2026, the National Cybersecurity Agency (ACN) says that the first deadline, in October, is the one for implementing the basic security measures for entities included in the NIS list in 2025.
Where the deadline comes from
ACN Determination no. 379907 of 19 December 2025 sets the basic specifications for the obligations of the NIS decree. It has applied since 15 January 2026 and replaced Determination no. 164179 of 14 April 2025. Article 3 sets two terms, both counted from the day the entity received ACN's communication that it was included in the NIS list:
- 18 months to adopt the basic security measures: Annex 1 for important entities, Annex 2 for essential entities;
- 9 months to meet the obligation to notify basic significant incidents, described in Annexes 3 and 4.
Because each term runs from the entity's own communication, the exact date can differ from one organisation to another. The communication itself is the document to check.
Entities listed in 2026
ACN Determination no. 127434 of 13 April 2026, applicable from 30 April 2026, sets fixed dates for entities included in the NIS list during 2026:
- the basic security measures must be adopted by 31 July 2027;
- the obligation to notify significant incidents applies from 1 January 2027.
Entities from the 2025 list that remain on the 2026 list keep the terms of Determination 379907.
Dates that come back every year
On its NIS portal ACN reminds entities that registration on the ACN platform is done or updated from 1 January to 28 February of each year, and that the information update runs from 15 April to 31 May.
What to check now
- Your communication date. Count 18 months from the day you received ACN's communication of inclusion in the list.
- The right annex. Important and essential entities have different sets of measures.
- Evidence. Once a measure is in place, keep the policy, the approval of the management bodies where required, and the records that show it works.
- Incident notification. For 2025 entities this obligation already applies; make sure the team knows who notifies CSIRT Italia and when.
Sources
- ACN: Online il Vademecum per i soggetti NIS (11 September 2026)
- ACN: Determinazione n. 379907 of 19 December 2025, specifiche di base
- ACN: Determinazione n. 127434 of 13 April 2026, terms for entities listed in 2026
- ACN: NIS, online le determine sugli adempimenti per i nuovi soggetti (13 April 2026)
- ACN: NIS portal (registration, obligations)
- Normattiva: Decreto legislativo 4 settembre 2024, n. 138
For information only, not legal advice. Last updated 22 October 2026.
Also available in: Italiano