Relevant supplier (fornitore rilevante NIS)

A relevant supplier (fornitore rilevante NIS) is a supplier of services or products to a NIS2 entity that meets at least one of two criteria: the supply is ICT, or its interruption would have a significant impact because it cannot easily be replaced.

The two criteria

Determination 127437/2026 of ACN (Italy's National Cybersecurity Agency), Article 1(1)(ll), defines them as follows:

ICT supply: it falls within the activities of Annex I, points 8 and 9, of Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition (digital infrastructure, such as cloud and data centres, and managed ICT services);
non-fungible supply: its interruption or compromise would significantly affect the entity's ability to deliver its NIS services, also because there are no alternative suppliers.

The criteria apply alone or together, so a supply can be "ICT", "non-fungible" or "ICT and non-fungible".

In practice

If you are a NIS2 entity: from 15 April to 31 May, in the annual update on the ACN portal, you list your relevant suppliers with their name, tax code, country of registered office, the CPV codes of the supplies and the criterion used (Article 18). This is different from the supplier inventory required by the basic measures (GV.SC-04), which follows your own risk assessment.

If you are the supplier: being named in the list does not automatically make you a NIS2 entity. What changes straight away are your clients' contracts and questionnaires, because supply chain security is their obligation (Article 24(2)(d)). The decree does, however, allow ACN to identify systemic elements of the supply chain as NIS entities, regardless of size (Article 3(9)(f)).

Legal reference

Articles 1(1)(ll), 16 and 18 of ACN Determination 127437/2026; Articles 3(9)(f) and 24(2)(d) of D.Lgs. 138/2024.

Related terms

Sources

The sources are official texts, published in Italian.

The whole glossary