September 8, 2026
The Cyber Resilience Act (CRA) is the first European Union regulation to introduce mandatory cybersecurity requirements for all connected hardware and software products, applying the principle […]
For organizations that receive notification from the ACN during 2025, 2026 marks the year when the obligations set out in the NIS2 directive fully enter the operational phase.
Following the initial deadlines related to incident management and governance alignment, the next step involves implementing the baseline security measures defined by the ACN, to be completed by October 31, 2026.
A new phase will therefore begin on November 1, 2026, during which the ACN may conduct verification activities and impose any applicable sanctions for non-compliance with the obligations.
The obligations regarding the verification and management of security incidents come fully into force.
Organizations must have aligned their governance processes and internal policies with the obligations set forth in the regulations.
The security measures required by ACN must be implemented by this date.
Starting from this date, the ACN may initiate checks on the actual compliance of organizations and apply the sanctions provided for by the regulations.
Please note: this schedule applies exclusively to entities that received notification from the ACN in 2025 regarding their inclusion within the NIS2 scope.
|
SECTOR
|
LARGE ENTERPRISE
|
SMALL-MEDIUM ENTERPRISE
|
|---|---|---|
|
SECTORS OF HIGH CRITICALITY
|
||
Energy
|
Essential
|
Important
|
Banking & Finance
|
Essential
|
Important
|
Healthcare
|
Essential
|
Important
|
Drinking Water
|
Essential
|
Important
|
Waste Water
|
Essential
|
Important
|
Digital infrastructure
|
Essential
|
Important
|
ICT service management (B2B)
|
Essential
|
Important
|
Aerospace
|
Essential
|
Important
|
|
OTHER CRITICAL SECTORS
|
||
Postal and shipping services
|
Important
|
Important
|
Waste management
|
Important
|
Important
|
Manufacture, production and distribution of chemicals
|
Important
|
Important
|
Food production, processing and distribution
|
Important
|
Important
|
Digital service providers
|
Important
|
Important
|
Manufacturing
|
Important
|
Important
|
Digital service providers
|
Important
|
Important
|
Research
|
Important
|
Important
|
|
ADDITIONAL TYPES OF ENTITIES
|
||
Central Public Administration
|
Essential
|
Essential
|
Regional and local public administration
|
Important
|
Important
|
Additional categories
|
Identification of the Competent Authority
|
Identification of the Competent Authority
|
Sanctions apply to organizations classified as “essential entities” or “important entities,” based on company size and the importance of the service provided.
For essential entities:
Financial penalties of up to €10 million or up to 2% of total global annual turnover (whichever is higher).
For important entities: Financial penalties of up to €7 million or up to 1.4% of total global annual turnover.
Failure to register: Penalties of up to 0.1% of turnover for failure to register or incorrect registration on the ACN portal.
Examples of violations that may incur penalties include failure to register on the ACN portal, failure to report incidents, inadequate security measures, or failure to cooperate with the ACN (e.g., not appointing a CSIRT contact person).
|
Classification
|
Maximum penalty
|
Percentage of total annual revenue
|
|---|---|---|
|
Essential entity
|
Up to 10 million euros
|
Up to 2%
|
|
Important entity
|
Up to 7 million euros
|
Up to 1.4%
|
|
Omitted or incorrect registration
|
|
Up to 0.1% of turnover
|
The NIS2 Directive and Legislative Decree 138/2024 impose direct responsibility for cybersecurity on corporate leadership, entailing obligations of due diligence and assurance. Delegating tasks does not exempt management from oversight duties, requiring specific expertise and a proactive approach.
Key obligations for management
Reaching the October 31st deadline with a coherent compliance strategy requires translating ACN Security Measures into actions that align with the organization’s technological scope and maturity level.
NIS2do supports this assessment by linking applicable requirements to the necessary compliance activities, enabling you to estimate the required effort and associated costs.
This allows risk managers to build a compliance plan tailored to the organization’s specific context, setting intervention priorities and evaluating financial feasibility in advance.
