Compliance dates · 31 October 2026 · EU (Italy)
Italian NIS2 entities must have basic security measures in place by 31 October 2026
31 October 2026 is the deadline for NIS2 essential and important entities in Italy to have adopted the basic security measures set by ACN determination. The measures come from the determination, so that document sets the standard.
The date also changes the regulator's posture. After it, ACN moves from support to inspection. The measures themselves come from the ACN determination, so this deadline is only as clear as that document has been read.
Entities on the Italian national NIS list
Over 20,000 Italian organisations on the national NIS list, of which more than 5,000 are essential entities. Being on the list is what brings the measures and the inspection risk.
Closing the gap before inspection starts
- Confirm whether your Italian entity is on the national NIS list, and as essential or important.
- Read the ACN determination and take the basic security measures from it directly.
- Compare each measure against what is in place today and record the gaps.
- Close the gaps before 31 October 2026.
- Hold the evidence in a form an inspector could be shown.
The NIS2 system
The ACN determination implements NIS2 in Italy, and the NIS2 system covers the Directive underneath it.
NIS2 Directive £3,000
Cybersecurity risk management and incident reporting for essential and important entities.
Directive (EU) 2022/2555 · European Union
Verified 19 August 2026.