Management bodies (organi di amministrazione e direttivi, Article 23)

The management bodies (organi di amministrazione e direttivi; for an SME, usually the board of directors or the sole director) are, under Article 23 of Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition, the people responsible for the cybersecurity of the NIS2 entity: they approve the measures, oversee their implementation and are liable for infringements.

What Article 23 requires

Approve how the risk management measures of Article 24 are implemented.
Oversee the fulfilment of the obligations, including registration on the ACN portal.
Follow training in cybersecurity and promote regular training for employees.
Be informed of incidents and notifications, periodically or immediately when needed.
Be liable for infringements of the decree.

In practice

The basic measures turn approval into specific documents. The reading guide of ACN (Agenzia per la Cybersicurezza Nazionale, Italy's National Cybersecurity Agency), Appendix C, lists eleven to be approved: cybersecurity organisation, security policies, risk assessment, risk treatment plan, vulnerability management plan, compliance plan, business continuity, disaster recovery and crisis management plans, training plan, incident management plan. A dated resolution or set of minutes is the simplest way to prove it.

From 2026 the members of these bodies must also be listed on the ACN portal with their tax code and PEC (certified email address), and must accept the listing (Article 17 of ACN Determination 127437/2026).

Personal liability: if the entity fails to comply with a formal warning (diffida) from ACN, the Agency can impose on these people the ancillary penalty of temporary incapacity to hold management positions in the entity (Article 38(6)).