NIS2

Sector

D.Lgs. 138/2024, Allegato I, n. 1

Updated 23 September 2026

by Victor Mita

NIS2 and the energy sector: who must comply and what to do

Electricity, gas, oil, hydrogen, district heating and charging: who falls under D.Lgs. 138/2024 and with which obligations.

Energy is a highly critical sector (Annex I to Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition): it includes producers, distributors, suppliers and network operators for electricity and gas, as well as oil, hydrogen, district heating and charging points. If your company is medium-sized or large, NIS2 applies to you: essential if large, important if medium-sized.

Who is in scope

Annex I, point 1, lists five subsectors. In short, the types of entity are:

Electricity: undertakings that sell electricity to customers (the "supply" activity), distribution and transmission system operators, producers, nominated electricity market operators, market participants providing aggregation, demand response or energy storage, operators of recharging points that provide the service to end users;
District heating and cooling: the operators;
Oil: operators of oil pipelines, of oil production, refining, treatment, storage and transmission facilities, central stockholding entities;
Gas: supply undertakings, distribution and transmission system operators, storage and LNG system operators, natural gas undertakings, operators of refining and treatment facilities;
Hydrogen: operators of hydrogen production, storage and transmission.

Each type refers to the definition in the relevant European sector directive (for example Directive (EU) 2019/944 for electricity): if your case is borderline, the exact definition is there.

Essential or important

The rule is the general one in Article 6, applied to an Annex I sector:

large enterprise (at least 250 employees, or turnover above 50 million and balance sheet above 43 million) → essential entity;
medium-sized enterprise (at least 50 employees, or turnover and balance sheet above 10 million) → important entity;
small or micro enterprise → as a rule out, unless designated by ACN (Agenzia per la Cybersicurezza Nazionale, Italy's National Cybersecurity Agency) or identified as a critical entity.

Size as a rule also counts partner and linked enterprises: in energy groups this is often what shifts the category.

Specific risks and obligations

Plants and control systems. For the decree a "network and information system" is also any device that processes digital data automatically. The hardware inventory required by the ACN measures explicitly includes OT and IoT devices (ID.AM-01): remote control, automation systems, smart meters.
Remote access. Maintenance firms and suppliers that connect to the plants must be recorded, with access methods documented (PR.IR-01) and logged (PR.PS-04). Essential entities also need an inventory of network flows to the outside (ID.AM-03).
Continuity. Business continuity, disaster recovery and cyber crisis management plans, approved by the management bodies (ID.IM-04).
Regimes that add up. Those who were already operators of essential services under the old NIS (D.Lgs. 65/2018) keep the measures adopted on their OES systems; those within the National Cyber Security Perimeter (Perimetro di sicurezza nazionale cibernetica) follow that framework for the listed assets (Article 33); critical entities under Directive (EU) 2022/2557 are essential regardless of size.
Sector authority: the Ministry of the Environment and Energy Security (Article 11), which works alongside ACN.

Deadlines

Registration or update on the ACN portal: every year from 1 January to 28 February. ACN publishes the list by 31 March.
Annual update (IP addresses and domains, management bodies, deputy point of contact, relevant suppliers): from 15 April to 31 May.
Categorisation of activities and services: from 1 May to 30 June.
Basic measures: 18 months from ACN's notice for those added to the list in 2025 (October 2026); 31 July 2027 for those added in 2026.
Incident notification: already in force for the 2025 cohort; from 1 January 2027 for the 2026 cohort.
Any change to the registered data must be communicated within 14 days.

All the dates, ready to add to your calendar: NIS2 deadline calendar.

How Epic Assess helps

Epic Assess is the Mokka Studios platform for SMEs that need to comply with NIS2. It starts from the catalogue of ACN measures (43 for essential entities, 37 for important entities), shows you what is missing, keeps the deadline calendar, tracks the incident notification windows and prepares the files for the ACN portal, such as the list of relevant suppliers, in a format that follows the ACN template. The platform's proposals are drafts that you approve: compliance remains your company's decision.

Frequently asked questions

We sell electricity but we are a small company: are we covered?

As a rule, no: with fewer than 50 employees and turnover or balance sheet within 10 million you are a small enterprise, and NIS2 does not apply on the basis of the sector alone. Two exceptions remain: designation by ACN (Article 3(9)) and identification as a critical entity. And if you have NIS2 customers, you will still receive their requests as a supplier.

We operate charging stations: are we in scope?

Yes, if the charging service is provided to end users and you exceed the small enterprise thresholds: operators of recharging points are an explicit type in the electricity subsector. Medium-sized: important; large: essential.

We were already operators of essential services under the old NIS. What changes?

You remain in scope. According to ACN's Guide to reading the basic specifications, what was already adopted under D.Lgs. 65/2018 must be maintained on the OES systems; for the other network and information systems, the basic measures of the new framework apply.

Do industrial plants count, or only office IT?

Plants count too: the decree's definition of network and information system covers any device that processes digital data automatically, and the inventory required by ACN includes OT devices.

Sources

The sources are official texts, published in Italian.

Back to NIS2