NIS2 and waste management: who must comply and what to do

Collection, transport, recovery, disposal and brokerage: who falls under D.Lgs. 138/2024 and with which obligations.

Waste management is in Annex II of Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition ("other critical sectors"). It covers medium-sized and large companies for which waste management is their principal economic activity: they are important entities. Companies that produce waste, or manage it only as an ancillary activity, are not in scope for this sector.

Who is in scope

Annex II, point 2, covers companies carrying out waste management as defined in Article 3(9) of Directive 2008/98/EC: the collection, transport, recovery (including sorting) and disposal of waste, the supervision of those operations and the after-care of disposal sites, as well as operations carried out as dealers or brokers.

Companies for which waste management is not their principal economic activity are excluded. A manufacturer that handles its own scrap, for example, does not fall within this sector (though it may fall within its own).

Essential or important

medium-sized or large enterprise (at least 50 employees, or turnover and balance sheet both above €10 million) → important entity;
small enterprise → out of scope, unless designated by ACN (Agenzia per la Cybersicurezza Nazionale, Italy's National Cybersecurity Agency);
essential only if designated by ACN (Article 6(2)) or identified as a critical entity.

Many companies in the sector are owned or controlled by public bodies. For some of them the decree sets fixed-amount fines, as for public administrations (Article 38(9)(c) and (d)), in the cases identified under Article 40(4): if this applies to you, have the applicable regime checked.

Specific risks and obligations

Public service and continuity. For companies handling municipal collection, an outage of the systems for shift planning, fleet management or plant operation quickly becomes a visible disruption of service. You need defined expected service levels (DE.CM-01, to recognise an IS-3 incident) and a continuity plan approved by the management bodies (ID.IM-04).
Plants and vehicles. Sorting and treatment plants, weighbridges, vehicle tracking: OT and IoT devices to inventory (ID.AM-01) and, if suppliers manage them remotely, access to be documented and logged (PR.IR-01, PR.PS-04).
Digital traceability. Registers, waste forms and digital weighing records are data whose integrity matters: altering them with an impact towards the outside is a loss of integrity (type IS-2). Protected backups and restore tests (PR.DS-11) are the first line of defence.
Suppliers. Sector management software, vehicle telematics, plant maintenance contractors: inventory, security clauses and risk assessment (GV.SC-04, GV.SC-05, GV.SC-07).
Sector authority: the Ministry of the Environment and Energy Security (Article 11).

Deadlines

Registration or update on the ACN portal: every year from 1 January to 28 February. ACN publishes the list by 31 March.
Annual update (IP addresses and domains, management bodies, deputy point of contact, relevant suppliers): from 15 April to 31 May.
Categorisation of activities and services: from 1 May to 30 June.
Basic measures: 18 months from ACN's notice for those added to the list in 2025 (October 2026); 31 July 2027 for those added in 2026.
Incident notification: already in force for the 2025 cohort; from 1 January 2027 for the 2026 cohort.
Any change to the registered data must be reported within 14 days.

All the dates, ready to add to your calendar: NIS2 deadline calendar.

How Epic Assess helps

Epic Assess is the Mokka Studios platform for SMEs that need to comply with NIS2. It starts from the catalogue of ACN measures (37 for important entities, 43 for essential entities), shows you what is missing, keeps the deadline calendar, tracks the incident notification windows and prepares the files for the ACN portal, such as the list of relevant suppliers, in a format that follows the ACN template. The platform's proposals are drafts that you approve: compliance remains your company's decision.

Frequently asked questions

We are a waste transport company with 70 employees: are we in scope?

Very likely yes, as an important entity: transport falls within the definition of waste management and you exceed the small-enterprise thresholds, provided it is your main activity. Confirmation comes with registration on the ACN portal.

We only act as brokers, with no vehicles or plants: does that count?

Yes: the definition in Directive 2008/98/EC includes operations carried out as dealers or brokers. The size threshold and the principal-activity criterion apply here too.

We are the local multi-utility and also manage water and energy: which sector do we register in?

In every sector in which you carry out activities listed in the annexes: the registration states sectors, subsectors and entity types (Article 7). For the category, what matters is that you are an Annex I entity: if you carry out activities such as water or energy and you are a large enterprise, you are essential (Article 6).

Sources

The sources are official texts, published in Italian.

Back to NIS2