E-time | the software company
INDEX
- NIS2 Deadline of 31 October 2026: Which Entities Must Complete Compliance
- NIS2 Security Measures: Checks to Complete by October 2026
- NIS2 After 31 October 2026: How ACN Inspections Work
- Incomplete NIS2 Compliance: Fines, Responsibilities and Risks for Companies
- NIS2 in 2027: Upcoming Deadlines and Requirements to Plan For
NIS2 Deadline of 31 October 2026: Which Entities Must Complete Compliance
31 October 2026 represents a significant deadline for the first group of organisations included in the national NIS list in 2025. For these entities, the 18-month period established for the adoption of basic security measures begins upon receipt of the individual communication sent by the National Cybersecurity Agency (ACN).
The legislation applies to public bodies and private companies operating in the 18 strategic sectors identified by the directive, which meet the applicable size criteria — generally at least 50 employees or annual turnover exceeding €10 million — or provide certain digital services regardless of their size. Based on the relevance of their activities, organisations are classified as essential or important entities. The effects of NIS2 also extend to the supply chain: suppliers of the organisations concerned may be required to comply with specific security requirements. For entities included in the list in 2026, the deadline for implementing basic measures is instead set for 31 July 2027.
NIS2 Security Measures: Checks to Complete by October 2026
Ahead of the deadline, the organisations concerned must verify that they have effectively implemented the basic security measures established by ACN Determination No. 379907/2025. The level of requirements varies according to the classification: important entities are required to implement 37 measures comprising 87 requirements, while essential entities must comply with 43 measures and 116 requirements, as set out in Annexes 1 and 2, respectively.
The assessment must cover the ten security areas identified in Article 24 of Legislative Decree No. 138/2024. These include cybersecurity risk analysis and management, incident response, business continuity through business continuity and disaster recovery plans (BCP and DRP), supplier security, the protection of system development and maintenance activities, the assessment of the effectiveness of measures through audits and vulnerability assessments, staff training and cyber hygiene practices. The framework is completed by cryptography, human resources security and access management, including the use of multi-factor authentication (MFA).
NIS2 After 31 October 2026: How ACN Inspections Work
The deadline for adopting basic security measures does not mark the end of the NIS2 compliance process. After the deadline, organisations must be able to maintain active controls, document the procedures adopted and demonstrate ongoing compliance with their obligations. The National Cybersecurity Agency (ACN) carries out supervisory and verification activities in accordance with the procedures established for the different categories of entities.
The supervisory model distinguishes between essential entities, which are subject to proactive checks and periodic inspections, and important entities, which are primarily subject to subsequent checks and targeted supervisory activities. Inspections may concern the actual adequacy of security measures, the traceability of internal processes and the proper management and documentation of incident notifications. For organisations, this means preparing not only to meet the initial deadline, but also to demonstrate the robustness of their cybersecurity management system.
Incomplete NIS2 Compliance: Fines, Responsibilities and Risks for Companies
Failure to comply with NIS2 requirements may result in significant financial and organisational consequences. Legislative Decree No. 138/2024 establishes, in Article 38, the sanctions regime applicable to violations, with penalties varying according to the entity’s classification and the nature of the non-compliance.
For the most serious violations relating to governance, security measures and incident notification, administrative fines may reach up to €10 million or 2% of annual worldwide turnover for essential entities, and up to €7 million or 1.4% of annual worldwide turnover for important entities. In the cases provided for by law, measures may also be imposed on individuals holding senior management positions, including temporary suspension from their duties. These consequences are accompanied by potential commercial impacts: an insufficient level of security may jeopardise relationships with customers and partners, particularly in supply chains where NIS2 compliance is a relevant requirement for supplier selection.
NIS2 in 2027: Upcoming Deadlines and Requirements to Plan For
In 2027, organisations subject to NIS2 will also have to comply with the periodic requirements managed through the ACN platform. Planning these activities in advance helps keep the required information up to date and integrate regulatory obligations into business processes.
The compliance calendar includes the following timeframes:
- From 1 January to 28 February: registration or annual renewal on the ACN platform.
- From 15 April to 31 May: updating information and the list of suppliers relevant for NIS purposes.
- From 1 May to 30 June: notification and updating of the categorisation of activities and services, pursuant to Article 30 of Legislative Decree No. 138/2024.
Scopri tutte le soluzioni della suite E-time
