NIS2 in Italy: obligations, deadlines and what changes for cyber insurance

Fact sheet updated to 1 November 2026 on the NIS2 Directive and Italian Legislative Decree 138/2024: who is in scope, security and incident reporting obligations, fines, management liability and what it means for cyber insurance.

Regulatory fact sheet · updated 1 November 2026 · by cybercoverinsurance

Directive (EU) 2022/2555, known as NIS2, sets cybersecurity and incident reporting obligations for organisations that run services essential to the economy and society (EUR-Lex). Italy transposed it with Legislative Decree no. 138 of 4 September 2024, with the National Cybersecurity Agency (ACN) as competent authority (ACN). For those who take on cyber risk, NIS2 matters for three reasons: it makes mandatory measures that used to be good practice, it imposes very tight reporting deadlines and it takes responsibility for cybersecurity up to the board.

In the text, "Article" means a binding rule; "recital" means one of the introductory paragraphs that explain how to read it.

Who is in scope

NIS2 applies to public and private entities in the sectors listed in Annexes I and II of the directive, including energy, transport, banking, health, water, digital infrastructure, managed ICT services, public administration, postal services, waste management, chemicals, food, manufacturing and digital providers. As a rule, medium and large companies in these sectors are in scope; some categories are in scope regardless of size.

Entities are either essential or important. The difference affects supervision (ex ante for the former, ex post for the latter) and maximum fines. In Italy every entity must register on the ACN platform between 1 January and 28 February each year; ACN confirms inclusion in the list by 14 April (Diritto.it).

The main obligations

Security measures

Article 21 of the directive, mirrored in Article 24 of the Italian decree, requires technical, operational and organisational measures proportionate to the risk. The minimum list includes risk analysis, incident handling, business continuity and backup, supply chain security, vulnerability management, cryptography, access control and multi-factor authentication. ACN translated these principles into "basic security measures" with determination no. 379907 of 19 December 2025, applicable from 15 January 2026 (ICT Security Magazine).

Incident reporting

For a significant incident, Article 25 of the Italian decree sets three steps towards CSIRT Italia (ICT Security Magazine):

early warning within 24 hours of becoming aware of the incident;
notification within 72 hours, with an initial assessment and the indicators of compromise available;
final report within one month, or a progress report if the incident is still ongoing.

Management bodies

Article 23 of the Italian decree, which transposes Article 20 of the directive, requires management bodies to approve security measures, oversee their implementation and follow specific training. Directors can be held liable for breaches.

Deadlines

Entities listed in 2025: incident reporting since January 2026; basic security measures within 18 months of the notice of inclusion, so mostly by October 2026 (ICT Security Magazine).
Entities listed in 2026: reporting from 1 January 2027; basic measures by 31 July 2027 (ACN determination no. 127434 of 13 April 2026).
Every year: registration from 1 January to 28 February, information update from 15 April to 31 May, categorisation of activities from 1 May to 30 June.

From 2026 entities must also send ACN the list of their relevant ICT suppliers (determination no. 127437 of 13 April 2026).

Fines

For the most serious breaches of security measures or reporting obligations, Article 38 of the Italian decree provides a maximum of 10 million euros or 2% of worldwide annual turnover, whichever is higher, for essential entities, and 7 million euros or 1.4% of turnover for important entities (ICT Security Magazine). These are the same ceilings set by Article 34 of the directive. If the same breach has already been fined by the data protection authority under the GDPR, the NIS2 authority cannot impose a second fine.

What is changing at EU level

In January 2026 the European Commission proposed targeted amendments to NIS2 together with a revision of the Cybersecurity Act (European Commission). They include a new category of "small mid-caps" (fewer than 750 employees and less than 150 million euros of turnover), generally treated as important entities, and additional information in ransomware notifications, with authorities able to ask for details of the ransom demanded, the payment and the payment method (Covington). As of 1 November 2026 the proposal is before the European Parliament's ITRE committee and is not yet law (European Parliament, procedure 2026/0012(COD)).

What changes for cyber insurance

Reporting. The 24 hours of the early warning to ACN run alongside the notice duties in the policy. A NIS2 insured needs the policy's incident response service to start in the first hours, not after coverage has been checked. Costs of handling the notification usually fall under incident response costs, but the wording should be checked.

Fines. Many policies cover administrative fines only "where insurable by law". In Italy the insurability of administrative fines is not settled: the NIS2 maximum should not be assumed to be covered.

Directors. Management body liability shifts part of the risk to the D&O policy. It should be clear which policy responds to a claim against directors arising from a cyber incident, to avoid gaps or double cover.

Underwriting information. NIS2 produces documents the applicant already holds: ACN registration, risk analysis, list of relevant ICT suppliers, incident handling procedure. They are useful for the underwriting questionnaire and for estimating aggregation on shared suppliers.

Ransomware. If the proposed amendments are adopted, information on ransoms paid will also reach the authorities. Policies that reimburse a ransom will need to align their procedures with this new flow.

Impact for insurersHigh

NIS2 makes controls and reporting deadlines mandatory for thousands of Italian companies and takes responsibility for security up to the board.