NIS2 and the food sector: who must comply and what to do

Industrial production, processing and wholesale distribution of food: who falls under D.Lgs. 138/2024 and with which obligations.

In the food sector NIS2 covers undertakings that produce and process food industrially or distribute it wholesale (Annex II to Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition, point 4). If your company is medium-sized or large, you are an important entity. Retail and catering are not mentioned.

Who is in scope

Annex II, point 4 ("Production, processing and distribution of food"), covers food businesses, as defined by Article 3(2) of Regulation (EC) 178/2002, that are engaged in:

industrial production and processing of food;
wholesale distribution of food.

Regulation 178/2002 defines a food business as any undertaking, public or private, whether or not for profit, carrying out any of the activities related to the production, processing and distribution of food. The NIS decree takes only part of it: industrial activity and wholesale.

Essential or important

Food is an Annex II sector, therefore:

medium-sized or large enterprise (at least 50 employees, or turnover and balance sheet both above €10 million) → important entity;
small enterprise → out, unless designated by ACN (Agenzia per la Cybersicurezza Nazionale, Italy's National Cybersecurity Agency);
essential only if designated by ACN (Article 6(2)) or identified as a critical entity.

In groups and in cooperatives with linked companies, size is as a rule calculated by adding up partner and linked enterprises (Recommendation 2003/361/EC).

Specific risks and obligations

Production and the cold chain. Packaging lines, dosing systems, temperature sensors and automated warehouses are network and information systems: the hardware inventory in the ACN measures includes OT and IoT devices (ID.AM-01), and their anomalies must be monitored (DE.CM-01).
Orders and shipments. Management software, order exchange with large retailers, delivery planning: if they stop, shipments of perishable products stop. You need offline backups of the relevant systems and restore tests (PR.DS-11), plus a continuity plan approved by the management bodies (ID.IM-04).
Service levels. To know when a stoppage is a significant incident to notify (type IS-3) you need expected service levels, defined in advance and measurable (DE.CM-01).
Suppliers. Plant maintenance firms, suppliers of management and logistics software: inventory, contractual requirements and risk assessment (GV.SC-04, GV.SC-05, GV.SC-07), and the annual list of relevant suppliers for ACN.
Sector authority: the Ministry of Agriculture, Food Sovereignty and Forests (Article 11).

Deadlines

Registration or update on the ACN portal: every year from 1 January to 28 February. ACN publishes the list by 31 March.
Annual update (IP addresses and domains, management bodies, deputy point of contact, relevant suppliers): from 15 April to 31 May.
Categorisation of activities and services: from 1 May to 30 June.
Basic measures: 18 months from ACN's notice for those added to the list in 2025 (October 2026); 31 July 2027 for those added in 2026.
Incident notification: already in force for the 2025 cohort; from 1 January 2027 for the 2026 cohort.
Any change to the registered data must be communicated within 14 days.

All the dates, ready to add to your calendar: NIS2 deadline calendar.

How Epic Assess helps

Epic Assess is the Mokka Studios platform for SMEs that need to comply with NIS2. It starts from the catalogue of ACN measures (37 for important entities, 43 for essential entities), shows you what is missing, keeps the deadline calendar, tracks the incident notification windows and prepares the files for the ACN portal, such as the list of relevant suppliers, in a format that follows the ACN template. The platform's proposals are drafts that you approve: compliance remains your company's decision.

Frequently asked questions

We are a food wholesaler with 80 employees: are we covered?

Yes, very probably as an important entity: wholesale distribution of food is expressly mentioned and you exceed the small enterprise thresholds. Confirmation comes with registration on the ACN portal and the Agency's notice.

We have a chain of shops or restaurants: are we in scope?

For the retail or catering activity, no: Annex II, point 4 mentions only industrial production, processing and wholesale distribution. If the group also has a wholesale or production business, assess it separately.

We are large: are we essential?

Not on the basis of the sector alone. Food is in Annex II and Annex II undertakings, even large ones, are important, unless designated by ACN or identified as a critical entity.

Should a small processing company worry?

As a NIS2 entity, as a rule no. But if you supply a NIS2 customer, for example a large processor or a wholesaler, you will receive requests about your cybersecurity in contracts and questionnaires.

Sources

The sources are official texts, published in Italian.

Back to NIS2