Italy transposed the NIS2 Directive with Legislative Decree 138/2024, in force since 16 October 2024. For organisations listed as NIS entities in 2025, the period of preparation is over: incident reporting has applied since January 2026 and the basic security measures were due in October 2026. The National Cybersecurity Agency (ACN) is now moving from guidance to verification.
The key dates
| When | What |
|---|---|
| 16 October 2024 | D.Lgs. 138/2024 enters into force. |
| Every year, 1 January to 28 February | Registration and annual update on the ACN portal. |
| 15 January 2026 | Notification of significant incidents to CSIRT Italia becomes mandatory for entities listed in 2025. |
| October 2026 | Basic security measures due: 18 months after the ACN notice of inclusion in the list. |
| From autumn 2026 | ACN supervision and inspections. |
Entities listed for the first time in 2026 have their own deadlines, counted from their ACN notice. ACN also started consulting on enhanced security measures in September 2026; these do not change the basic-measure deadline.
Incident reporting in three steps
- Within 24 hours of becoming aware of a significant incident: pre-notification to CSIRT Italia.
- Within 72 hours: full notification with an initial assessment of severity and impact.
- Within one month: final report.
Without monitoring, an on-call process and pre-written templates, these windows are hard to meet.
What inspectors will look for
- Management body approval of security measures and its awareness and training.
- A documented risk analysis and the measures that follow from it.
- Incident handling and notification procedures that have been tested.
- Business continuity, backups and recovery.
- Supply chain security, including contract clauses with key suppliers.
- Access control, multi-factor authentication and encryption.
Sanctions can reach EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important entities.
Where AI fits into NIS2
NIS2 does not mention AI explicitly, but AI systems are part of the network and information systems you must protect. In practice:
- Risk analysis: chatbots, internal assistants and AI agents with access to data or systems belong in your risk register.
- Supply chain: model providers and AI APIs are suppliers. Assess them and cover security in the contract.
- Access control: agents should run with least privilege and their actions should be logged.
- Incidents: a data leak through an AI assistant can be a significant incident with the same notification duties.
- Testing: LLM security testing shows that AI risks are identified and treated.
If you are not ready yet
Start with a gap analysis on the ACN basic measures, set priorities by risk, make incident notification work first and document every decision. A credible plan with visible progress is much stronger in an inspection than a gap with no plan.
Setexe supports NIS2 compliance with engineers who also implement the technical measures. See our NIS2 compliance services and cybersecurity services, or contact us.
This article is general information and not legal advice.
