Cybersecurity law & regulation in Italy (2026)

Legal framework

Legislative Decree 138/2024 (transposing EU NIS2 Directive 2022/2555) and Law 90/2024 (national cybersecurity law), supervised by the Agenzia per la Cybersicurezza Nazionale (ACN) which also hosts CSIRT Italia; sectoral layers include DORA for financial entities (Banca d'Italia, CONSOB, IVASS) and GDPR enforcement by the Garante.

NIS2 & cybersecurity law in Italy

In Italy, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Italy implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Italy

1. 01NIS2 transposition in force

   Legislative Decree 138/2024 transposes NIS2 and entered into force on 16 October 2024. It covers roughly 18 sectors and over 80 entity types, classified as 'essential' or 'important', with scaled security, governance and reporting duties.

   acn.gov.it ezine.eversheds-sutherland.com

2. 02Competent authority: ACN / CSIRT Italia

   The Agenzia per la Cybersicurezza Nazionale (established by Decree-Law 82/2021) is the national NIS competent authority and single point of contact; CSIRT Italia, embedded in ACN, is the technical-operational hub for mandatory and voluntary incident notifications.

   acn.gov.it en.wikipedia.org

3. 03Incident reporting cadence

   Essential and important entities under NIS2 must submit an early warning to CSIRT Italia within 24 hours of a significant incident, a full incident notification within 72 hours, and a final report within one month. Public bodies and perimeter entities under Law 90/2024 face parallel 24/72-hour duties.

   swotlegal.com acn.gov.it

4. 04Registration and phased obligations

   In-scope entities had to register on the ACN national platform by 28 February 2025 (digital/cloud/MSSPs earlier, by 17 January 2025), update management-body information by 31 May 2025, implement baseline security measures by autumn 2026, with ACN inspections from October 2026.

   nis-solutions.eu hrcsrl.it

5. 05Law 90/2024 — National Cybersecurity Perimeter

   Law 90/2024 (in force July 2024) strengthens duties for public administrations and perimeter operators, expanding mandatory incident notifications. ACN's Determina of 9 February 2026 (Gazzetta Ufficiale, 17 February 2026) formalised the incident taxonomy that triggers reporting.

   aegister.com clearycyberwatch.com

6. 06Sectoral layer: DORA for finance

   Regulation (EU) 2022/2554 (DORA) applies to Italian financial entities since 17 January 2025. Banca d'Italia receives major ICT incident reports and significant cyber-threat notifications; Banca d'Italia, CONSOB and IVASS jointly supervise and run the TIBER-IT advanced testing framework.

   bancaditalia.it ivass.it

7. 07Penalties

   Under Legislative Decree 138/2024, essential entities face administrative fines up to €10 million or 2% of global annual turnover (whichever is higher); important entities up to €7 million or 1.4% of global turnover.

   nis-solutions.eu ezine.eversheds-sutherland.com

NIS2 in Italy: FAQ

Timeline of decisions

1. 15 Apr 2025Guidance · official
   ACN notifies in-scope NIS2 entities and sets minimum security measures

   Following the Dec 2024-Feb 2025 registration window, Italy's National Cybersecurity Agency (ACN) compiled and notified the list of essential/important entities under the NIS2 decree and began defining baseline security obligations, with full compliance phased through October 2026. This operationalized Italy's largest-ever expansion of cybersecurity duties across the economy.

   ACN

2. 16 Oct 2024Law
   NIS2 transposed via Legislative Decree 138/2024

   Italy's Legislative Decree No. 138 of 4 September 2024 (published 1 Oct, in force 16 Oct) transposed the EU NIS2 Directive, repealing the 2018 NIS framework and vastly expanding sectoral scope, governance duties, incident reporting and ACN supervision over 'essential' and 'important' entities. It is the cornerstone of Italy's current cybersecurity obligations.

   Digital Policy Alert

3. 17 Jul 2024Law
   Law 90/2024 strengthens national cybersecurity and cybercrime rules

   Approved 28 June and in force 17 July 2024, Law No. 90 widened mandatory incident-notification duties (24-hour reporting for public administrations), mandated cybersecurity contact points and cryptographic standards in the public sector, and raised criminal penalties for unauthorized access and interception. It tightened the domestic regime ahead of NIS2.

   Cleary Gottlieb

4. 1 May 2022Guidance · official
   National Cybersecurity Strategy 2022-2026 adopted

   ACN published Italy's first national cybersecurity strategy, setting 82 measures through 2026 around protection of strategic assets, threat/crisis response, and digital autonomy, backed by roughly €2.2 billion in funding. It established the strategic roadmap guiding all subsequent cyber policy.

   ACN

5. 18 Mar 2022Guidance
   ACN directs public bodies to drop Kaspersky/Russian software

   Amid the Russia-Ukraine war, ACN issued guidance urging public administrations to diversify away from antivirus and software from Russia-linked vendors (notably Kaspersky), citing national-security risk from highly invasive software. The move signaled supply-chain/technological-sovereignty as a core security concern.

   Decode39

6. 1 Aug 2021Incident
   Lazio Region ransomware attack cripples COVID systems

   A RansomEXX attack on LazioCrea encrypted the region's datacenter and took down the COVID-19 vaccination booking portal for days, traced to compromised admin credentials. The high-profile incident exposed public-sector vulnerabilities and accelerated cyber-governance reforms.

   Computer Weekly

7. 14 Jun 2021Law · official
   National Cybersecurity Agency (ACN) established

   Decree-Law No. 82 of 14 June 2021 created the Agenzia per la Cybersicurezza Nazionale, consolidating national cyber competencies, hosting the CSIRT Italia and serving as NIS authority; it began operations on 1 September 2021. ACN became the central pillar of Italy's cybersecurity architecture.

   ACN

8. 21 Sept 2019Law · official
   National Cybersecurity Perimeter created (Decree-Law 105/2019)

   Decree-Law No. 105/2019 (converted by Law 133/2019) established the Perimetro di Sicurezza Nazionale Cibernetica, requiring designated public and private entities running critical functions to inventory strategic ICT assets, meet security measures, notify incidents and submit ICT procurement for vetting. It built Italy's regime for protecting the most critical systems.

   ACN

9. 18 May 2018Law
   NIS1 Directive transposed via Legislative Decree 65/2018

   Italy's first dedicated cybersecurity law implemented the EU NIS Directive, imposing security and incident-notification duties on operators of essential services and digital service providers, creating CSIRT Italia and mandating a national cyber strategy. It laid the foundation later superseded by NIS2.

   DLA Piper

Sources

1. 1.acn.gov.it/portale/en/nis/la-normativa
2. 2.acn.gov.it/portale/en/w/si-rafforza-il-perimetro-nazionale-di-sicurezza-cibernet
3. 3.bancaditalia.it/compiti/vigilanza/dora-incidenti/index.html
4. 4.ivass.it/media/avviso/national-tiber-it-guide-update/
5. 5.ezine.eversheds-sutherland.com/eu-nis2-directive/italy
6. 6.swotlegal.com/insights_article/incident-reporting-obligations-in-italy-under-the-ni
7. 7.clearycyberwatch.com/2024/07/cybersecurity-law-enters-into-force/
8. 8.aegister.com/en/cms/insights/acn-incident-taxonomy-law-90-2024/
9. 9.nis-solutions.eu/countries/italy/
10. 10.en.wikipedia.org/wiki/Agenzia_per_la_Cybersicurezza_Nazionale
11. 11.hrcsrl.it/en/new-hrc/news/nis2-in-italy-obligations-for-2026/