NIS2, drinking water and waste water: who must comply

Water service operators, drinking water distributors and waste water undertakings: who falls under D.Lgs. 138/2024 and what they must do.

Drinking water and waste water are two separate highly critical sectors (Annex I to Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition, points 6 and 7). They cover suppliers and distributors of water intended for human consumption and undertakings that collect, dispose of or treat waste water, if they are medium-sized or large enterprises: important if medium-sized, essential if large. Those for whom water is a marginal activity are excluded.

Who is in scope

Drinking water (point 6): suppliers and distributors of water intended for human consumption, as defined by Directive (EU) 2020/2184. Excluded are distributors for which the distribution of drinking water is a non-essential part of their general activity of distributing other commodities and goods.
Waste water (point 7): undertakings that collect, dispose of or treat urban, domestic or industrial waste water, as defined by Directive 91/271/EEC. Excluded are undertakings for which this activity is a non-essential part of their general activity.

In practice: the operator of the integrated water service and waste water treatment companies are the typical case; a manufacturer that treats its own discharges, as a rule, is not.

Essential or important

large enterprise (at least 250 employees, or turnover above 50 million and balance sheet above 43 million) → essential;
medium-sized enterprise (at least 50 employees, or turnover and balance sheet above 10 million) → important;
small enterprise → out, unless designated by ACN (Agenzia per la Cybersicurezza Nazionale, Italy's National Cybersecurity Agency) or identified as a critical entity.

Many water operators are companies owned or controlled by public bodies. For some of them the decree provides for fixed-amount fines, as for public administrations (Article 38(9)(c) and (d)), but only in the cases identified under Article 40(4): if this is your case, have the applicable regime checked.

Specific risks and obligations

Remote control and automation. Treatment, pumping and purification plants are run by automation and remote control systems, often spread across the territory. For the decree they are network and information systems in every respect: they go into the hardware inventory, which includes OT and IoT (ID.AM-01), and their remote access must be documented and protected (PR.IR-01) and logged (PR.PS-04).
All-hazards approach. Article 24 requires systems to be protected from physical events too: power and telecommunications outages, flooding, unauthorised physical access to the plants (PR.AA-06).
Service levels. To recognise a significant incident of type IS-3 you need defined, measurable expected service levels (DE.CM-01), for example on the availability of the control systems.
Sector authority: the Ministry of the Environment and Energy Security, for both sectors (Article 11).

Deadlines

Registration or update on the ACN portal: every year from 1 January to 28 February. ACN publishes the list by 31 March.
Annual update (IP addresses and domains, management bodies, deputy point of contact, relevant suppliers): from 15 April to 31 May.
Categorisation of activities and services: from 1 May to 30 June.
Basic measures: 18 months from ACN's notice for those added to the list in 2025 (October 2026); 31 July 2027 for those added in 2026.
Incident notification: already in force for the 2025 cohort; from 1 January 2027 for the 2026 cohort.
Any change to the registered data must be communicated within 14 days.

All the dates, ready to add to your calendar: NIS2 deadline calendar.

How Epic Assess helps

Epic Assess is the Mokka Studios platform for SMEs that need to comply with NIS2. It starts from the catalogue of ACN measures (43 for essential entities, 37 for important entities), shows you what is missing, keeps the deadline calendar, tracks the incident notification windows and prepares the files for the ACN portal, such as the list of relevant suppliers, in a format that follows the ACN template. The platform's proposals are drafts that you approve: compliance remains your company's decision.

Frequently asked questions

We are a food company with an in-house treatment plant: are we covered for waste water?

As a rule, no: Annex I excludes undertakings for which waste water treatment is a non-essential part of their general activity. You may however be covered for your main sector, for example food (Annex II).

We distribute bottled water along with other products: are we in the drinking water sector?

No, if the distribution of water is a non-essential part of a general activity of distributing other goods: point 6 expressly excludes it.

The water operator is an in-house company of the municipality: does anything change?

The security obligations are the same. What may change is the fines regime, which for some publicly owned or controlled companies is a fixed amount, and the sector authority for in-house companies identified through Annex IV is the Presidency of the Council of Ministers. Have your case checked.

Sources

The sources are official texts, published in Italian.

Back to NIS2