Important entity (soggetto importante)

An important entity (soggetto importante) is an organisation that falls within the scope of Italy's NIS2 law but is not classified as essential: it has the same kinds of obligations, with 37 basic measures instead of 43 and lower fines.

Who is important

Article 6(3) of Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition, defines it by difference: every entity within the scope (Article 3) that is not essential is important. The typical cases for an SME:

medium-sized enterprises in the sectors of Annex I (energy, transport, health, water, digital infrastructure, B2B managed ICT services, space and others);
medium-sized and large enterprises in the sectors of Annex II (postal services, waste, chemicals, food, manufacturing, digital providers, research). Even a large enterprise in these sectors remains important, unless ACN designates it otherwise.

Medium-sized, here, means exceeding the ceilings for a small enterprise: at least 50 employees, or turnover and balance sheet total both above €10 million.

In practice

The obligations are the same as for an essential entity (registration, basic measures, incident notification, training of the management bodies), but lighter in the detail: 37 measures with 87 requirements and three types of significant incident to notify (IS-1, IS-2, IS-3). ACN (Agenzia per la Cybersicurezza Nazionale, Italy's National Cybersecurity Agency) inspects an important entity only if it has evidence suggesting an infringement (ex post supervision).

Fines: up to €7 million or 1.4% of annual worldwide turnover, whichever is higher, with a minimum equal to one thirtieth of the maximum (Article 38(9)).

Legal reference

Article 6(3) and Article 38(9)(b), D.Lgs. 138/2024; measures: Annex 1 of ACN Determination 379907/2025.

Related terms

Sources

The sources are official texts, published in Italian.

The whole glossary