Registering on the ACN portal for NIS2: who, when and how

The windows in the year, access with SPID or CIE, the roles to designate and the data to prepare before you enter the ACN Services Portal.

In brief

If your organisation falls within NIS2, you must register, or update your registration, on the digital platform of ACN (Agenzia per la Cybersicurezza Nazionale, Italy's National Cybersecurity Agency) from 1 January to 28 February each year (Article 7(1) of Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition). This is done by the point of contact, who accesses the ACN Services Portal with SPID (Italy's public digital identity), CIE (electronic identity card) or credentials issued by ACN. If you are included in the list of NIS entities, from 15 April to 31 May you also carry out the annual update of your information.

The next registration window opens on 1 January 2027. Here you will find the calendar for the year, the roles and the list of data to prepare.

Who must register

Registration is required for public or private organisations that match one of the entity types in Annexes I and II of the decree and that, where required, exceed the size thresholds of Article 3 (FAQ REG.1). In practice, for most sectors you must be at least a medium-sized enterprise. Some types, however, fall within scope regardless of size, and linked enterprises also count.

Some points to know:

The individual company registers, not the group: each legal entity has its own obligation, even if it belongs to the same group (FAQ REG.8).
If in doubt, it is advisable to register, even if the activity is carried out only marginally, with some exceptions for drinking water, waste water and waste (FAQ REG.1).
You are a NIS entity even without registering: the obligations derive from the decree, not from registration (FAQ REG.3).

If you do not yet know whether you are in scope, start from the NIS2 guide or the self-assessment at the bottom of the page.

The calendar for the year

1 January to 28 February: registration or update of the registration (Article 7(1)).
By 31 March: ACN draws up the list of essential and important entities (Article 7(2)).
April: ACN informs each registered organisation, at its registered digital address (PEC, Italy's certified email), whether it has been included in the list, remains in it or leaves it (FAQ REG.3).
15 April to 31 May: annual update of information, including the list of relevant suppliers (Article 7(4); FAQ AGA).
1 May to 30 June: submission of the categorised list of activities and services (Article 30 of the decree, template from ACN Determination 155238/2026, FAQ “Categorizzazione” (categorisation)).
All year round: any change to data already submitted must be notified promptly, and in any case within 14 days (Article 7(7); FAQ AGA.1).

The deadlines for adopting the security measures and for notifying incidents run from the notice of inclusion in the list. You will find them in the guides to the basic measures and to the October 2026 deadline.

The roles on the portal

The rules on roles are in the FAQ “Ruoli e procedure” (roles and procedures). The platform's procedures are currently set by ACN Determination 127437/2026, which replaced Determination 379887/2025. Some FAQs still cite the articles of the previous determination.

Point of contact: this can be the legal representative, someone holding their general power of attorney (procuratore generale) entered in the companies register, or a delegated employee. The point of contact handles the fulfilment of obligations and deals with ACN, but liability for violations remains with the management bodies (FAQ PDC.3). The role cannot be entrusted to an outsider, but the point of contact can get help from consultants.
Deputy point of contact: designated in the same way and invited by the point of contact on the portal. The deputy can carry out the same actions on the portal as the point of contact (FAQ PDC.4). This role cannot be entrusted to an outsider either.
Secretariat: optional; it can view and update data but not submit it. If you do not appoint one, you must state this explicitly (FAQ RR.1).
Operators: optional, with the same limits as the secretariat (FAQ RR.2).
CSIRT liaison: the person who manages relations with CSIRT Italia (Italy's national CSIRT) on incidents. This can also be an outsider, for example whoever runs your SOC. The point of contact designates the liaison on the portal. Under ACN Determination 127434/2026, entities that joined the list in 2026 must designate one by the end of 2026.

How to access

The service is on the ACN Services Portal. You authenticate with SPID or CIE (FAQ PDC.5). Anyone who by law cannot have either SPID or CIE can ask ACN for personal credentials using a digitally signed form and an identity document (FAQ ACC.1). The request goes through the Service Desk; if it concerns the point of contact, it must be sent by PEC.

The three phases of registration

FAQ REG.5 divides registration into three phases.

Enrolment of the point of contact. First name and surname, place and date of birth, tax code (codice fiscale), citizenship, residence, email, PEC if available, telephone.
Association with the entity. You need the organisation's tax code. If the point of contact is neither the legal representative nor holds a general power of attorney, you must upload the letter of delegation. The association must be validated by the organisation through the procedure sent to its registered digital address (FAQ PDC.5).
Declaration. ATECO codes (Italy's classification of economic activities) for your activities, the EU sector legislation that applies, number of employees, turnover and balance sheet total, entity types from Annexes I to IV, self-assessment as essential, important or out of scope.

If you have linked or partner enterprises, or belong to a group, extra data is needed: parent company, linked enterprises and size calculated according to Recommendation 2003/361/EC (FAQ REG.7).

What to prepare beforehand

The letter of delegation signed by the legal representative, if the point of contact is an employee (ACN publishes a suggested template).
The company's registered digital address (PEC), monitored: the validation and the notice of inclusion arrive there.
Employees, turnover and balance sheet total, consolidated with linked enterprises where necessary.
The ATECO codes and the list of services that bring you within scope.
For the April and May update: deputy point of contact, members of the administrative and executive bodies, static public IP addresses and domain names, any information-sharing agreements and relevant suppliers (FAQ AGA.2).

If you are late

Organisations that did not register by 28 February 2025 were able to do so through “late registration” (registrazione tardiva), reopened by ACN from 14 April 2025 (FAQ RET.1). Even so, do not wait for the next window: failing to register, or registering late, is a violation. In these cases Article 38(13) provides that all the violations under paragraphs 8 and 10 are charged and the fine for the most serious one is applied, increased up to threefold. See NIS2 fines.

Where Epic Assess can help

Epic Assess gathers in one place the data you need for the ACN platform: point of contact and deputy, the people responsible under Article 38, domains and IPs, Member States, suppliers. It reminds you of the annual windows in its deadline calendar. Filling in the portal remains up to you: Epic Assess does not connect to the ACN platform.

Sources

The sources are official texts, published in Italian.

Back to resources