Resources
NIS2
Guide
Legislative Decree 138/2024
NIS2, explained without the jargon.
Understand whether it applies to you, what you have to do and by when - in plain language, no legalese. Who is in scope, the 6-step path, what’s at stake and the deadlines.
NIS2
Guide
Legislative Decree 138/2024
NIS2, explained without the jargon.
Understand whether it applies to you, what you have to do and by when - in plain language, no legalese. Who is in scope, the 6-step path, what’s at stake and the deadlines.
AI Act
Guide
The AI Act, without the jargon.
The AI Act (EU Reg. 2024/1689) is Europe’s first law on artificial intelligence. It regulates AI systems based on risk: the more a system affects people and decisions, the more obligations it carries. It also applies to companies that use AI in their work, not just those who build it.
NIS2
Guide
ACN basic measures for NIS2: what they are and how to tackle them
ACN basic measures (Det. 379907/2025): 43 with 116 requirements for essential entities, 37 with 87 for important ones. What they require and where to start.
NIS2
Guide
ACN inspections under NIS2: how they work and what evidence to keep ready
The ACN supervises via monitoring, checks, inspections and fines. Here is what it can ask you for and the evidence to keep ready for each basic measures area.
NIS2
In depth
How much NIS2 compliance costs an SME
There is no official price for NIS2 compliance. Public estimates run from a few hundred euros for a kit to tens of thousands for a first year with consultancy.
NIS2
Guide
How to choose NIS2 software for an SME
NIS2 software must work on the ACN measures, speak Italian, produce evidence and handle incidents and suppliers. Criteria and a comparison of the categories.
NIS2
Checklist
NIS2 deadline of October 2026: what you need to have ready
NIS2 basic measures must be adopted within 18 months of the ACN notice: if you received it in April 2025, that means October 2026. What to prepare.
NIS2
In depth
NIS2 fines in Italy: how much is at stake and who is liable
NIS2 fines reach €10 million or 2% of worldwide turnover for essential entities, €7 million or 1.4% for important ones. Plus what directors risk.
NIS2
Guide
NIS2 incident notification in Italy: 24 hours, 72 hours and one month
Pre-notify CSIRT Italia within 24 hours, notify within 72, send the final report within a month. Which incidents are significant and how to get organised.
NIS2
Guide
NIS2 relevant suppliers: how to compile the list for ACN
Every year, from 15 April to 31 May, NIS entities must send ACN their relevant suppliers: five data points per supplier and one row per CPV code.
NIS2
Guide
Registering on the ACN portal for NIS2: who, when and how
NIS2 entities register or update their data on the ACN portal from 1 January to 28 February; the annual update runs from 15 April to 31 May.
NIS2
Guide
Your client asks you for NIS2: what to do if you are a supplier
If a NIS entity client sends you a questionnaire, it is the client that must manage supplier risk, not you that must comply with NIS2. How to respond well.
NIS2
Tool
3 min
Find out in 3 minutes whether NIS2 applies to you.
Answer a few questions about your sector, size and activity, leave us your contact details and receive the full picture by email as a report. Free, no commitment.
NIS2
Tool
NIS2 deadline calendar 2026-2027
NIS2 deadlines by cohort: ACN registration, annual update, suppliers, categorisation, measures and notifications. Ready to add to your calendar.
NIS2
Tool
NIS2 fine calculator
Calculate the maximum and minimum NIS2 fines under Article 38 of D.Lgs. 138/2024 from category and turnover: up to €10 million or 2% for essential entities.
NIS2
Checklist
NIS2 checklist of the ACN basic measures
NIS2 checklist of ACN basic measures: 43 measures, 116 requirements for essential entities and 87 for important ones, with evidence and documents to approve.
NIS2
Templates
Free NIS2 policy templates (in Italian)
Free NIS2 templates built on the ACN requirements: incident management plan with a pre-notification sheet and security policy. In Italian, to adapt and approve.
Normattiva
Transposition decree
Legislative Decree 138/2024
The Italian text that transposes EU Directive 2022/2555 and sets scope, obligations and fines.
EUR-Lex
European directive (NIS2)
EU Directive 2022/2555
The original directive: the common security baseline for all member states.
acn.gov.it
ACN implementing act
ACN Determination 379907/2025
The act that defines the baseline security measures and their technical specifications.
acn.gov.it
National authority
ACN portal
The official ACN website: FAQs, forms, notices and the section dedicated to NIS.
EUR-Lex
European regulation (AI Act)
EU Regulation 2024/1689
The text of the AI Act: risk levels, obligations and application dates.
Links to official sources. In case of doubt, the current version published by the authority prevails.
Answers to the most common questions about NIS2.
Grounded in the official sources. For costs and your specific case, let’s talk it through in a demo.
It depends on sector and size. NIS2 (Legislative Decree 138/2024) covers 18 sectors and over 80 types of entity; the threshold generally kicks in at 50 employees or €10M in revenue. In Italy over 20,000 entities are already in scope, more than 5,000 of them essential. The self-assessment estimates where you stand from sector, size and activity.
The category is computed from sector and size - you don’t get to choose. Essential entities follow 43 ACN measures (116 requirements), important ones 37 measures (87 requirements). What changes is the breadth of obligations, the intensity of the checks and the maximum fine - the underlying principles stay the same.
Incident notification is mandatory from January 2026. Baseline measures must be in place by 31 October 2026 for entities already in the census, and by 31 July 2027 for those who entered scope in 2026. The list of relevant suppliers must be filed with ACN every year between 15 April and 31 May. The first ACN inspections are expected in the fourth quarter of 2026.
Fines up to €10 million or 2% of worldwide annual turnover, whichever is higher, for essential entities; up to €7 million or 1.4% for important ones. Beyond the fine, the management bodies are personally accountable and, if the company ignores an ACN warning order, can be suspended from their management functions.
Yes. There are three deadlines: early warning within 24 hours, notification within 72 hours, final report within 30 days. An incident must be reported when it crosses the thresholds set by law. It pays to have your CSIRT Italia notification drafts ready, so you don’t lose time at the worst moment.
Supply-chain security is an explicit obligation (art. 24, point d). You must identify your critical suppliers, collect their security assurances and keep a record. In the platform suppliers answer the questionnaire from a personal link, with no account, and their VAT number is checked against the EU VIES system; the list must be updated every year.
A traditional NIS2 consulting project typically costs €30,000–70,000 in the first year. We have one plan with full NIS2 coverage and a tailored price per company - never per asset - with no activation fees and no lock-in. We work out the exact figure together in a demo.
Eight terms to get your bearings.
The words that keep coming up in NIS2, explained in one line.
- Essential / important entity
- The two NIS2 categories, computed from sector and size. They set the breadth of obligations and the maximum fine.
- ACN
- The National Cybersecurity Agency: the Italian authority that oversees NIS2, publishes the measures and runs the inspections.
- CSIRT Italia
- The national computer security incident response team, part of ACN: it receives the early warning (24h), the notification (72h) and the final report (30 days).
- Baseline measures
- The security catalogue published by ACN: 43 measures for essential entities, 37 for important ones, mapped to the 10 points of art. 24.
- Art. 24
- The article of Legislative Decree 138/2024 that lists, in 10 points, the risk-management obligations: risk analysis, incident handling, supplier security and more.
- IRP · Inspection Ready Pack
- The inspection-ready pack: coverage index, documents, concrete evidence and notifications, always up to date and ready to show.
- VIES
- The EU VAT-number verification system. It checks that an EU supplier’s VAT number is valid and who it belongs to.
- Categorisation
- The list of your activities and services (art. 30), organised into the 10 ACN macro-areas, with a first look at what happens if they stop.