In recent weeks I have been asked the same question at three different meetings: in Bolzano, in Merano and in a valley above Brixen. “Federico, we have until 31 October, don’t we?” It was asked by the owner of a family-run manufacturer, the administrative director of a trading company and the plant manager of a food business. They asked calmly, the way one asks about the deadline for a tax return.
I give all of them the same answer: no, not necessarily. And this is not a quibble about wording. If it were, I would not write an article about it.
What the calendar actually says
In September 2026 the National Cybersecurity Agency (ACN) published the new NIS Vademecum, an operational calendar of obligations for organisations that have been notified of their inclusion in the list of essential and important entities. I draw three points from it that I consider decisive.
First. For entities added to the list in 2025, the obligation to notify CSIRT Italia of significant baseline incidents has applied since January 2026, while baseline security measures must be completed “by October 2026”. But “by October” is not the same as 31 October. The precise deadline is tied to the date on which you received ACN’s notice of inclusion: 9 months for incident notification, 18 months for adopting the security measures. If the notice arrived in April 2025, the count starts there, not from the calendar.
Second. For entities added in 2026, everything moves by a year: notifications from January 2027, security measures by July 2027.
Third, and this is the point most often forgotten: there are recurring obligations that do not depend on the year of entry. Registration, or its update, must be done every year from 1 January to 28 February. Updating information from 15 April to 31 May. Categorisation of activities and services from 1 May to 30 June. And any change to data already submitted must be reported within 14 days. The data to keep current include the point of contact, the CSIRT representative, the members of the management and governing bodies and the list of relevant suppliers.
The baseline measures are those set by ACN determination no. 164179 of 14 April 2025, updated by determination no. 379907 of 19 December 2025 (applicable from 15 January 2026), implementing Legislative Decree no. 138 of 4 September 2024, by which Italy transposed the NIS2 directive: governance, asset inventory, gap analysis, incident management. For significant incidents the pre-notification to CSIRT Italia must be sent without delay and in any case within 24 hours of becoming aware, the full notification within 72 hours (ACN FAQ).
My opinion: the problem is not the date
I have worked with South Tyrolean companies long enough to recognise a pattern that repeats. When we talk about deadlines, we almost always talk about a single fear: “Will we make it in time?” That is a question about the calendar. But NIS2 is, first of all, a question of how a company is governed.
The directive explicitly places responsibility on management bodies: they approve the measures and answer for them. A director can no longer say “that is an IT matter”. This change of perspective matters more than any date. As long as cybersecurity was a technical problem, it was solved by the person with the passwords and the server in the basement. Today the question “what do we have, who is responsible for it and what happens if it stops” belongs to management, and the person who signs the answers is not the system administrator.
That is why I think it is wrong to begin the conversation with the date. The date answers “when”. I suggest beginning with “who”.
What has happened right here
We do not need theoretical scenarios: over the last two years South Tyrol has had concrete examples, reported in the press. I cite them because they teach more than any slide.
Rothoblaas, September 2024. The company from Kurtatsch/Cortaccia, a maker of building materials, was hit by the Akira ransomware group. As the company’s global IT head Stefan Trebo told RAI, the systems stopped and production was interrupted for three days. The attackers attempted extortion, which the company refused “on principle”. Trebo said the company employs 12 people in IT and that it was the first attack it had suffered; the systems were restored relatively quickly but downtime translates directly into damage. Source: RAI Alto Adige, 26 September 2024.
I draw an uncomfortable lesson from this case. Rothoblaas is not a small shop: it has an IT team of twelve. Yet three days of production stoppage came all the same, because a ransomware attack exploits a vulnerability, not a headcount. The question for an SME with two or three people in the office and an external support provider is unavoidable: if it can happen to a company with twelve IT staff, what would happen to us?
Province of Bolzano, June 2025. In the night between 23 and 24 June 2025 a cyberattack with a ransom demand hit several offices of the provincial administration, disabling telephone systems at civil-protection centres: the provincial traffic reporting centre, the emergency centre, the permanent fire brigade and the provincial radio service. President Arno Kompatscher announced that the ransom would not be paid and that citizens’ personal data did not appear to have been breached. Many operations were carried out manually, with additional staff at the emergency centre, and emergency calls remained active. Source: MB Time, 25 June 2025, reporting official communications.
Here I see a different and, in its own way, instructive example: an emergency plan that worked. When the systems were gone, a procedure existed to work by hand and keep the essential service running. That is exactly what NIS2 asks of organisations: not the impossible promise that “it will never happen”, but the ability to keep operating when it does.
There is a third case, outside the region but instructive for any SME: Lazio Region, August 2021. Ransomware blocked the vaccine booking platform and the work of the administration. According to the analysis published by Cybersecurity360, the attack started from the computer of a LazioCrea employee working from home, the backups were not isolated (offline) and administrative accounts had no two-factor authentication. The backup data had in the end only been deleted, not encrypted, and could be recovered with about 50 hours of work. It was a lucky ending, not a planned one. I mention it because the three shortcomings (backups not isolated, no second factor, unprotected remote working) are the same ones I meet in many companies of every size.
Three typical situations in our businesses
The South Tyrolean economy consists mainly of small and medium-sized family businesses, often with very deep specialisation and a very strong role for the individual: the owner who knows everyone by name and keeps half the processes in their head. It is a great competitive advantage, but for cybersecurity it has a cost. I describe three recurring patterns observed in SMEs; they are not client cases, they are typical situations.
The person as a single point of failure. A company whose systems were all configured by one trusted technician. As long as that person is there, everything works. The day they go on holiday or change jobs, the company discovers it cannot do anything on its own. NIS2 asks for an asset inventory and the assignment of roles. It is not bureaucracy: it is moving knowledge from one head into a document.
The multilingual environment. In the same company work colleagues who speak Italian, German and Ladin, and suppliers are on both sides of the Brenner Pass. E-mails asking you to “pay an invoice urgently” arrive in Italian and in German. Phishing training given in only one language protects only part of the team. If you plan a course, run it in at least two languages.
The supplier as an open door. Many South Tyrolean companies are closely tied to the German and Austrian markets, with customers, suppliers and logistics across the border. According to the Schwarz Digits Cyber Security Report 2026, reported by heise online (data on Germany, not Italy), one German company in two registers attacks on its suppliers and 75% do not check them regularly. I do not believe it is very different here. If you work with a German customer subject to NIS2, sooner or later it will ask how you protect data. Not to do you harm: it is its own obligation.
My advice for the coming weeks
I would not begin by buying software. In most cases four simple things are needed, which can be done in a few weeks and without large budgets.
Find ACN’s notice
Look for the date of the message of inclusion in the list and count 18 months from there. Write the real deadline where someone besides you can see it. If you cannot find the notice, log in to the ACN portal, NIS section, with the company’s credentials.
Appoint two people
The point of contact and the CSIRT representative, each with a deputy. This is not a formality: they will be the ones to act on the night something breaks. Do not appoint someone who is already overloaded: appoint someone willing to answer for this role for five years.
Prepare a one-page asset register
Which systems you have, where the data is, who has access, which suppliers support them. For a small business it is a table on one sheet, not a year-long project. Start with three columns: what, who is responsible, what happens if it stops for a day.
Run an “emergency drill” once
Gather management for an hour and discuss one scenario: tonight all files have been encrypted. Who calls whom? Who decides? Who notifies CSIRT Italia and within what deadlines? You will learn more about your preparedness in that hour than from ten pages of policy. After the Lazio case I add one essential point: check that at least one copy of the backups is outside the network and cannot be reached from a compromised account.
What I do not recommend: spending money on a “NIS2 certificate”. A NIS2 certificate does not exist. If someone sells you one, ask what exactly is being certified.
The matter of grants
I am often asked: “Can we get a grant?” Grant schemes exist and are useful. For example the Chamber of Commerce of Bolzano published in 2026 the “Digitalisierung 2026” call: 40% of eligible expenses, up to a maximum of 8,000 euro. But among the expenses not admitted, according to the call, are support services for adapting to legal requirements. A NIS2 consultancy therefore did not fall under it. My advice: do not build your budget on the hypothesis of “winning a grant”. Build it on real need and treat any grant as a bonus.
What I think, in conclusion
October 2026 is not the end of the road: it is the moment when compliance becomes verifiable. Those who arrive at this date with an asset map and clear roles have already done the hardest part. Those who have not are not late forever: they can still begin with an initial assessment.
Another thing seems more important to me. In South Tyrol we are used to building reputation over decades, on trust. Cybersecurity is the same question of trust, in its digital form. The customer who entrusts you with their data trusts that you will look after it. NIS2 simply asks that you be able to prove it.
A deadline gives you time to get organised, not to postpone the questions that management must ask itself anyway.
Three questions for management
Do we know the exact date of ACN’s notice and the real deadline for our security measures?
Without this date every plan is only an estimate.
If the person who “knows everything” about our systems leaves tomorrow, can the company keep working?
If the answer is no, the first intervention is not technical: it is organisational.
Who here notifies a significant incident to CSIRT Italia, and within what deadlines?
Pre-notification within 24 hours, full notification within 72: the people who must carry it out need to know the procedure.
Sources
ACN, NIS portal and NIS FAQ (in Italian); Diritto.it, NIS 2, scadenze 2026-2027 nel nuovo calendario ACN (17.09.2026); Legislative Decree no. 138 of 4 September 2024; ACN determination no. 379907 of 19 December 2025 (updating no. 164179 of 14 April 2025); RAI Alto Adige, Azienda altoatesina paralizzata da un attacco hacker (26.09.2024); MB Time, Attacco informatico alla Provincia di Bolzano (25.06.2025); Cybersecurity360, Regione Lazio e ransomware, lieto fine amaro (08.08.2021); heise online, German companies massively ignoring NIS2 obligations (05.03.2026); Handelskammer Bozen, Beiträge Digitalisierung 2026.