Official sources
NIS2 — Directive (EU) 2022/2555
The calendar of obligations and deadlines under the NIS2 Directive, including its Italian transposition via Legislative Decree 138/2024, with references to the primary texts.
Last verified: 29 July 2026 — latest act incorporated: Determinazione ACN 127434/2026
Calendar
31 July 2027
Security measures for entities first included in 2026
For entities that received their first notice of inclusion on the NIS list in 2026 (Article 7(3)(a) of the NIS decree), the deadline for implementing the security measures — set out in Annexes 1 and 2 of ACN Determination 379907/2025 — expires on 31 July 2027 (ACN Determination 127434/2026, Article 1(1)). Article 2 of the same determination also sets 31 July 2027 as the deadline for the obligations on the security, stability and resilience of domain-name systems for first-notice entities.
1 January 2027
Incident notification for entities first included in 2026
For entities that received their first notice of inclusion on the NIS list in 2026 (Article 7(3)(a) of the NIS decree), the obligation to notify significant incidents — described in Annexes 3 and 4 of ACN Determination 379907/2025 — runs from 1 January 2027 (ACN Determination 127434/2026, Article 1(2)).
October 2026
Basic security measures: deadline eighteen months after the inclusion notice
In the first application phase, the deadline for complying with the obligations under Articles 23, 24 and 29 — the basic security measures, in the terminology of ACN’s timeline — is eighteen months from receipt of the notice of inclusion on the NIS list (Article 42(1)(c) of Legislative Decree 138/2024): a deadline relative to each entity, not a calendar date fixed by the legislation. For the first cohort of notified entities (April 2025), the deadline falls around October 2026, as an arithmetic consequence.
30 April 2026
ACN Determination 127434/2026 on the deadlines for 2026 entities applies
ACN Determination 127434/2026, adopted after consulting the NIS Implementation Board (meeting of 9 April 2026), sets the deadlines for the obligations under Articles 23, 24, 25, 29 and 32 of the NIS decree for entities included on the NIS list for the first time in 2026. It applies from 30 April 2026 (Article 5). For entities remaining on the list, the deadlines of ACN Determination 379907/2025 stand.
January 2026
Incident notification: obligation nine months after the inclusion notice
In the first application phase, the deadline for complying with the notification obligations under Article 25 is nine months from receipt of the notice of inclusion on the NIS list (Article 42(1)(c) of Legislative Decree 138/2024): a deadline relative to each entity, not a single date for everyone. For entities that received the first notices (April 2025), the obligation runs from January 2026, as indicated in ACN’s implementation timeline.
19 December 2025
ACN adopts the baseline specifications for the NIS obligations (Det. 379907/2025)
ACN Determination No. 379907 of 19 December 2025 sets out the baseline specifications for complying with the obligations under Articles 23, 24, 25, 29 and 32 of the NIS decree, with annexes covering the security measures (Annexes 1 and 2) and the notification of significant incidents (Annexes 3 and 4). Its date and content are cited in the text of ACN Determination 127434/2026.
Determinazione ACN 379907/2025 · Determinazione ACN 127434/2026
15 April 2025
NIS-list inclusion notices and information updates
ACN notifies registered entities of their inclusion on the list via the platform (Article 7(3) of Legislative Decree 138/2024); from 15 April to 31 May of each year, entities that received the notice must provide or update the required information (Article 7(4)). Each entity’s relative deadlines run from the inclusion notice. The first notices were sent in April 2025, according to ACN’s implementation timeline.
31 March 2025
ACN draws up the list of essential and important entities
By 31 March of each year, the national competent NIS authority draws up the list of essential and important entities on the basis of the registrations received (Article 7(2) of Legislative Decree 138/2024): for the first cycle, by 31 March 2025.
28 February 2025
The registration window for entities closes
Article 7(1) of Legislative Decree 138/2024 sets the annual window for registering or updating on the ACN platform from 1 January to 28 February: for the first cycle, the window closes on 28 February 2025.
1 December 2024
Registration on the ACN platform opens
ACN Determination 38565/2024 on the NIS digital platform applies from 1 December 2024 (Article 15): from that date until 28 February 2025, contact points authenticate on the ACN Portal (Article 6) and file the entity’s registration declaration (Article 8), implementing Articles 7 and 40(5)(b) of the NIS decree.
17 October 2024
Deadline for transposition by all Member States
Deadline set by Article 41 of the Directive: by 17 October 2024 Member States must adopt and publish their transposition measures, applying them from 18 October 2024. From 18 October 2024 the previous NIS1 Directive is repealed (Article 44).
16 October 2024
The Italian transposition decree enters into force
Legislative Decree 138/2024 enters into force, making the NIS2 framework operational in Italy, with ACN as the competent national authority and single point of contact.
1 October 2024
The Italian transposition decree is published in the Official Gazette
Legislative Decree No. 138 of 4 September 2024, which transposes the NIS2 Directive into Italian law, is published in Official Gazette No. 230 of 1 October 2024.
16 January 2023
The NIS2 Directive enters into force at EU level
The Directive enters into force on the twentieth day following publication (Article 45). This is when the transposition period for Member States begins.
27 December 2022
NIS2 Directive published in the EU Official Journal
Directive (EU) 2022/2555 is published in the Official Journal of the European Union (OJ L 333 of 27.12.2022).
What changed, and when
No changes are recorded yet for this registry.