NIS2: ACN determinations for entities included in 2026
The ACN determinations of 13 April 2026 set the deadlines for entities entering the NIS scope in 2026: CSIRT contact by 31 December 2026, incident reporting from 1 January 2027, baseline measures by 31 July 2027.
On 13 April 2026 the Italian National Cybersecurity Agency (ACN) published two determinations implementing Legislative Decree 138/2024.
Determination no. 127434/2026: entities included in 2026
- Designation of the CSIRT Italia contact by 31 December 2026.
- Significant incident reporting from 1 January 2027.
- Adoption of the baseline security measures by 31 July 2027.
Determination no. 127437/2026: suppliers and categorisation
It introduces the list of suppliers relevant to supply-chain security and sets out how activities and services are communicated (Article 30 of Legislative Decree 138/2024). For entities included in 2025, the communication was due on the ACN platform between 1 May and 30 June 2026.
Related guides
Official sources
Information only, current as of the date shown. Not legal advice: obligations and deadlines should be checked against the official texts.