Bolzano, Italia

CONSULENZA GRATUITA

NIS2 · South Tyrol

NIS2 in South Tyrol: who is affected, what to do and by when

A guide for South Tyrolean SMEs: criteria, registration on the ACN portal, deadlines and obligations. Updated on 26 October 2026 on the basis of ACN’s NIS Vademecum (September 2026).

The NIS2 directive was transposed in Italy by Legislative Decree 138/2024, in force since 16 October 2024. The rules are national and also apply in South Tyrol. What changes is the context: bilingual businesses, supply chains that cross the border with Austria and Germany, and many SMEs without a dedicated IT department.

Who falls under NIS2

NIS2 concerns public and private entities operating in 18 sectors (11 of high criticality and 7 “other critical sectors”) which, in general, reach at least one of these thresholds:

  • at least 50 employees
  • more than 10 million euro in annual turnover or balance sheet total

Sectors include energy, transport, health, water, digital infrastructure, ICT services, manufacturing (machinery, medical devices, electronics, food), waste management, postal services and research. In South Tyrol, those affected include, among others, energy and water utilities, manufacturing and food companies, healthcare facilities and digital service providers. Some entities fall within scope regardless of size.

Even those not directly obliged may be so in practice: large customers in Italy, Austria and Germany increasingly ask suppliers for security requirements in line with NIS2.

Registration on the ACN portal

Registration is done online on the service portal of the National Cybersecurity Agency (ACN), through the contact person designated by the company. The first registration took place from 1 December 2024 to 28 February 2025. Since then, registration or update must be done every year from 1 January to 28 February. By 14 April each year, ACN notifies by certified e-mail (PEC) the inclusion, continued presence or removal from the list of NIS entities.

If your company meets the criteria but has not registered, it is worth checking the situation now, before the next registration window.

The main deadlines

16 October 2024

Legislative Decree 138/2024 enters into force.

1 Dec 2024 – 28 Feb 2025

First registration on the ACN portal.

Spring 2025

ACN notifies inclusion in the list of NIS entities by certified e-mail: the first-application deadlines run from that date (Art. 42 of Legislative Decree 138/2024).

January 2026 (9 months from the notice)

Entities included in 2025: obligation to notify significant baseline incidents to CSIRT Italia, with an early warning within 24 hours and a notification within 72 hours.

By October 2026 (18 months from the notice)

Entities included in 2025: adoption of the baseline security measures. The exact day depends on the date of your PEC.

January 2027 and July 2027

Entities included in 2026: incident notification from January 2027, baseline security measures by July 2027.

Every year

1 Jan – 28 Feb: registration. 15 Apr – 31 May: update of information (any change must be communicated within 14 days). 1 May – 30 Jun: categorisation of activities and services.

ACN may update the dates: always check the official source at acn.gov.it/portale/nis. Sources used: ACN NIS Vademecum v1.0 (September 2026); ACN, “Baseline procedures and specifications”; ACN determination no. 379907 of 19 December 2025, updating no. 164179 of 14 April 2025 (annex 1 for important entities, annex 2 for essential entities).

What NIS2 requires

  • governance and management accountability, with management being trained
  • cyber risk analysis and management
  • incident handling and notification
  • business continuity, backup and disaster recovery
  • supply chain and supplier security
  • access control and multi-factor authentication
  • staff training and awareness

Penalties reach, for essential entities, up to 10 million euro or 2% of worldwide annual turnover; for important entities up to 7 million euro or 1.4%. The liability of the company is joined by that of the management bodies.

What changes in South Tyrol

  • documentation, policies and training often need to be prepared in Italian and German
  • many companies work in cross-border supply chains with Austria and Germany, where customers already ask for NIS2-aligned requirements
  • many SMEs have no dedicated IT department: a Virtual CISO can cover the role

Frequently asked questions

Does NIS2 also apply to small South Tyrolean companies?

In general it concerns medium-sized and large companies in the sectors concerned. Smaller businesses can nevertheless be involved if they operate critical services or work in the supply chain of obliged entities, which pass the requirements on to suppliers.

How do I know whether my company is obliged?

It depends on the sector and size. With the free online NIS2 assessment (45 questions, about 10 minutes) you get an initial score; exact applicability is checked case by case in the first consultation.

Do I have to register on the ACN portal, and when?

If the company falls under NIS2, yes. Registration or update is done every year from 1 January to 28 February.

Does “by October 2026” mean by 31 October?

Not necessarily. For entities included in 2025 the exact deadline is 18 months from receipt of the notice of inclusion (9 months for notifications): the date depends on your ACN PEC message.

What must I do by October 2026?

Adopt the baseline security measures set out in ACN determination no. 379907/2025 (annex 1 for important entities, annex 2 for essential ones). In practice: an initial gap analysis, a roadmap with priorities and responsibilities, documented policies and procedures, training for management and staff, and an incident management plan.

How much does it cost to comply with NIS2?

It depends on the size and maturity level of the company. The price is set individually after the initial audit, with a written offer and no hidden costs.

Do you work in Italian and German?

Yes. Consulting, documentation and training can be delivered in Italian and German.

Do you only assist companies in South Tyrol?

Our office is in Bolzano, with another office in Milan. We assist SMEs in South Tyrol, Trentino and Northern Italy, as well as companies in Austria and Switzerland.

Updated on 26 October 2026. This page is for information only and does not constitute legal advice.

October 2026 update: what “by October” really means

The deadline for the basic security measures is not one single date for everyone. According to the NIS Vademecum published by ACN in September 2026, it is tied to the individual notice that confirms inclusion in the list of NIS entities: 9 months for incident notification and 18 months for adopting the security measures.

  • Entities listed in 2025 (registered by 28 February 2025, ACN notice in spring 2025): incident notification since January 2026 and basic security measures to be completed by October 2026.
  • Entities listed in 2026: incident notification from January 2027 and security measures by July 2027.

The exact day depends on the date of the notice your company received: check it in the ACN portal and in your certified email (PEC). So not every company has the same deadline on 31 October.

What to check in the final weeks

  • the date of inclusion in the list and the resulting deadline
  • that the basic measures are documented and evidence exists (policies, registers, minutes)
  • that the CSIRT Italia notification process (24 hours, 72 hours, final report) has been tested and has named owners
  • that management has been trained and has approved the measures
  • that the list of critical suppliers is up to date and requirements have been communicated
  • that registration data is ready for the January–February 2027 update