NIS2

Sector

D.Lgs. 138/2024, Allegato II, n. 5

Updated 23 September 2026

by Alessandro Monego

NIS2 and manufacturing: which companies must comply

Medical devices, electronics, electrical equipment, machinery, vehicles and other transport equipment: who falls under D.Lgs. 138/2024 and who does not.

Not all manufacturing is covered by NIS2: Annex II of Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition, lists six specific subsectors, from medical devices to machinery and vehicles. If your company is medium-sized or large and its activity falls within one of them, you are an important entity, even if you are a large enterprise. A company making, for example, metal structures or furniture is not in scope on the basis of its sector alone.

Who is in scope

Annex II, point 5 ("Manufacturing"), covers companies that:

a) manufacture medical devices (Regulation (EU) 2017/745) or in vitro diagnostic medical devices (Regulation (EU) 2017/746), except those that are critical during public health emergencies, which belong to the health sector in Annex I;
b) manufacture computer, electronic and optical products (NACE Rev. 2, division 26);
c) manufacture electrical equipment (division 27);
d) manufacture machinery and equipment n.e.c. (division 28);
e) manufacture motor vehicles, trailers and semi-trailers (division 29);
f) manufacture other transport equipment (division 30).

Other industries have their own point in the annexes: chemicals (Annex II, point 3), food (Annex II, point 4, see NIS2 and the food sector) and pharmaceuticals (division 21, in the health sector of Annex I, see NIS2 and healthcare).

Essential or important

Manufacturing is an Annex II sector ("other critical sectors"), so:

medium-sized or large enterprise (at least 50 employees, or turnover and balance sheet both above €10 million) → important entity;
small enterprise → out of scope, unless designated by ACN (Agenzia per la Cybersicurezza Nazionale, Italy's National Cybersecurity Agency);
essential only in particular cases: designation by ACN (Article 6(2)) or identification as a critical entity.

In practice: 37 basic measures with 87 requirements, three types of incident to notify, and fines of up to €7 million or 1.4% of worldwide turnover, whichever is higher.

Specific risks and obligations

The production line is an information system. CNC machines, PLCs, supervisory systems and MES process digital data automatically: under the decree they are network and information systems. The hardware inventory required by the ACN measures includes OT and IoT devices (ID.AM-01).
Production stoppages. If you define expected service levels for production (DE.CM-01), a stoppage that breaches them is a significant incident of type IS-3 that must be notified. Setting them realistically is a choice best made beforehand, not in the middle of an incident.
Intellectual property. Technical drawings, process recipes and product data that leak to the outside are a loss of confidentiality (IS-1). The supplier risk assessment must also consider suppliers' access to intellectual property and data (GV.SC-07).
Remote maintenance. Machine builders and integrators often access plants remotely: that access must be documented, protected and logged (PR.IR-01, PR.PS-04).
Sector authority: the Ministry of Enterprises and Made in Italy (MIMIT) for letters b) to f), after consulting the Ministry of Infrastructure and Transport for vehicles and transport equipment; the Ministry of Health for medical devices (Article 11).

Deadlines

Registration or update on the ACN portal: every year from 1 January to 28 February. ACN publishes the list by 31 March.
Annual update (IP addresses and domains, management bodies, deputy point of contact, relevant suppliers): from 15 April to 31 May.
Categorisation of activities and services: from 1 May to 30 June.
Basic measures: 18 months from ACN's notice for those added to the list in 2025 (October 2026); 31 July 2027 for those added in 2026.
Incident notification: already in force for the 2025 cohort; from 1 January 2027 for the 2026 cohort.
Any change to the registered data must be reported within 14 days.

All the dates, ready to add to your calendar: NIS2 deadline calendar.

How Epic Assess helps

Epic Assess is the Mokka Studios platform for SMEs that need to comply with NIS2. It starts from the catalogue of ACN measures (37 for important entities, 43 for essential entities), shows you what is missing, keeps the deadline calendar, tracks the incident notification windows and prepares the files for the ACN portal, such as the list of relevant suppliers, in a format that follows the ACN template. The platform's proposals are drafts that you approve: compliance remains your company's decision.

Frequently asked questions

We are a large engineering company with 600 employees: are we essential?

Not on the basis of the sector alone. Manufacturing is in Annex II, and Annex II companies, even large ones, are important entities. You would become essential only if ACN designated you as such or if you were identified as a critical entity.

We make metal components to order: are we in scope?

It depends on the NACE division of your main activity. Annex II, point 5 covers only divisions 26 to 30 and medical devices. The manufacture of fabricated metal products (division 25), for example, is not listed. The ATECO code on your company registration record (visura) is the starting point: its first two digits correspond to the division.

We are not in scope, but an automotive customer is asking us about NIS2. Why?

Because your customer must manage the security of its supply chain (Article 24(2)(d)) and, if you are a relevant supplier, report you to ACN. You do not become a NIS2 entity, but you will have to demonstrate the measures it requires of you by contract.

Do we count only our own company or the whole group?

As a rule, the whole set of partner and linked enterprises, as provided by Recommendation 2003/361/EC, referred to in Article 3(4). The decree allows exceptions when the calculation is not proportionate, for example if your systems are independent from those of the group.

Sources

The sources are official texts, published in Italian.

Back to NIS2