Regulatory deadlines

NIS representative in Italy for non-EU digital providers

Digital service providers not established in the EU that designate their NIS representative in Italy send or update, by certified email (PEC), the documents listed on the ACN website.

Who it applies to: Providers not established in the EU of DNS services, top-level domain name registries, domain name registration services, cloud computing services, data centre services, content delivery networks, managed and managed security services, online marketplaces, online search engines and social networking services platforms, which designate their representative in Italy.

AI Act: marking of synthetic content for systems already on the market

Providers of systems generating text, images, audio or video placed on the market before 2 August 2026 have until 2 December 2026 to mark outputs as artificially generated (Article 50(2)). Systems placed on the market from 2 August 2026 must mark them straight away.

Who it applies to: Providers of generative AI systems, including general-purpose ones.

AI Act: new prohibitions on intimate imagery and child sexual abuse material

It becomes prohibited to place on the market, put into service or use AI systems that generate or manipulate realistic intimate images, video or audio of identifiable people without their consent, or child sexual abuse material (Article 5(1), points (ba) and (bb)). For providers the prohibition applies where this is the intended purpose, or where the output is reasonably foreseeable and adequate technical safeguards are lacking; for deployers, where they use the system to generate such material (Article 5(1a)).

Who it applies to: Providers and deployers of AI systems that generate images, video or audio.

Critical ICT third-party providers: certified turnover to the Lead Overseer

Each ICT third-party provider designated as critical sends the Lead Overseer its audited turnover generated in the EU with financial entities, which is used to calculate the oversight fee. The 31 December 2026 deadline covers 2025 turnover.

Who it applies to: ICT third-party service providers designated as critical by the European Supervisory Authorities.

CSIRT contact person, entities included in 2026

The point of contact names, on the ACN platform, the person who will deal with CSIRT Italia and submit incident notifications. It is needed before the notification obligation starts on 1 January 2027.

Who it applies to: Essential and important entities included in the NIS list in 2026. Financial entities subject to DORA are exempt.

Article 106 TUB intermediaries: parts of DORA apply under a simplified regime

Financial intermediaries entered in the register under Article 106 of the Italian Consolidated Law on Banking (TUB) become subject, under a simplified regime, to the DORA provisions listed in Article 6 of Legislative Decree 23/2025: ICT risk management, major incident reporting, testing, and the register of and contracts with ICT providers.

Who it applies to: Financial intermediaries under Article 106 TUB (competent authority: Bank of Italy).

Significant incident notification obligation starts, entities included in 2026

From 1 January 2027, entities included in 2026 notify significant incidents to CSIRT Italia: early warning within 24 hours, notification within 72 hours, final report within one month.

Who it applies to: Essential and important entities included in the NIS list in 2026. Not financial entities subject to DORA.

Registration or registration update, 2027

Organisations within the scope of NIS register, or update their registration, on the ACN platform. New in 2027: entities already on the list with no changes to report do not submit the declaration again.

Who it applies to: All public and private organisations to which NIS applies, including those not yet on the list.

Bank of Italy: annual submission of the register of information on ICT providers

By 15 March the register of all arrangements with ICT providers, with data as at 31 December 2026, is sent to the Bank of Italy via INFOSTAT. The Bank of Italy checks data quality and may request a resubmission.

Who it applies to: Financial entities that send the register to the Bank of Italy. The communication does not list the addressees.

The ACN draws up the 2027 NIS list

By 31 March the ACN draws up the list of essential and important entities; the list is adopted after the next meeting of the NIS implementation panel (Tavolo NIS), and entities are normally notified in April. Obligations run from that notification; those who disagree can request a review within 60 days of the certified email (PEC).

Who it applies to: This is a deadline for the ACN. It concerns all registered entities; the request for review is optional.

National councils of professional bodies: CPD rules to include AI courses

The national councils of Italian professional bodies update their continuing professional development rules to include AI courses. The obligation for members follows the new rules.

The decree allows six months from its entry into force (23 October 2026): the date is calculated.

Who it applies to: National councils of professional bodies; then their registered members.

Critical ICT third-party providers: annual oversight fee

Critical ICT third-party providers already under oversight on 1 January 2027 pay the annual fee to the Lead Overseer in a single instalment by 30 April.

Who it applies to: Critical ICT third-party service providers under oversight on 1 January 2027.

Bank of Italy: annual estimate of costs and losses from major ICT incidents

By 31 May the estimate of the previous year’s aggregated costs and losses caused by major ICT-related incidents is sent to the Bank of Italy via INFOSTAT.

Who it applies to: Intermediaries directly supervised by the Bank of Italy.

Annual update of information, 2027

As every year, the NIS entity confirms or corrects, on the ACN platform, its contacts, management bodies, public IP addresses, domain names, information-sharing arrangements and relevant suppliers. Until 14 April, changes are reported through continuous updating.

Who it applies to: Essential and important entities notified of their inclusion, or continued inclusion, in the NIS list. Financial entities subject to DORA do not update the list of members of management bodies.

Deputy point of contact, entities included in 2027

Entities that join the NIS list in 2027 designate by 31 May a second person, in addition to the point of contact, who can act on the ACN platform.

Who it applies to: NIS entities included in the list in 2027. It does not apply where the point of contact is the only person in the organisation.

Listing and categorisation of activities and services, 2027

The categorised list of activities and services is updated; entities that joined the NIS list in 2027 complete it for the first time. After 30 June the list can no longer be changed.

Who it applies to: Essential and important entities. Financial entities subject to DORA are exempt.

Domain name registration database (Art. 29), registries and registrars included in 2026

Registries and registrars included in 2026 must keep accurate and complete domain registration data and publish their verification policies and procedures, approved by their management bodies.

Who it applies to: Top-level domain name registries and registrars included in the NIS list in 2026.

Basic security measures, entities included in 2026

By 31 July 2027, entities included in 2026 must have adopted the basic security measures in Annexes 1 and 2 of ACN Determination 379907/2025, including the obligations of management bodies.

Who it applies to: Essential and important entities included in the NIS list during calendar year 2026. Not financial entities subject to DORA.

AI Act: general-purpose AI models placed on the market before 2 August 2025

General-purpose AI models placed on the market before 2 August 2025 must comply with the obligations in Chapter V (technical documentation, information for downstream providers, copyright policy, summary of training content) by 2 August 2027.

Who it applies to: Providers of general-purpose AI models.

Last day for a late declaration to count for 2027

Organisations that did not register by 28 February, or that amend their declaration after that date, can still do so: a declaration submitted by 1 September is examined for the current year. It is nonetheless late, and may be penalised, unless the delay is due to documented technical or operational problems not attributable to the organisation.

Who it applies to: NIS entities that did not register in the ordinary window or that amend their declaration after 28 February.

AI Act: high-risk systems in Annex III

For high-risk systems in Annex III, the classification rules, the requirements (risk management, data, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity) and the obligations of providers, importers, distributors and deployers apply. Systems already on the market or in service remain outside until their design undergoes significant changes. What counts is the type and model, not the individual unit: if a first unit was already on the market, later identical units follow the same rule (Article 111(2)). For those intended for use by public authorities the final deadline is 2 August 2030.

Postponed by Regulation (EU) 2026/1744: it was previously 2 August 2026.

Who it applies to: Providers, authorised representatives, importers, distributors and deployers of Annex III systems, including public bodies.

Last day of the RED cybersecurity requirements

Until 10 December 2027, radio equipment covered by Delegated Regulation 2022/30 must meet the cybersecurity requirements of the Radio Equipment Directive (RED); from 11 December 2027 the CRA replaces them. Units placed on the market between 1 August 2025 and 10 December 2027 can still be checked against the RED afterwards.

Who it applies to: Manufacturers, importers and distributors of radio equipment within the scope of Delegated Regulation 2022/30.

CRA: general application

The whole Regulation applies: essential cybersecurity requirements, vulnerability handling, technical documentation, conformity assessment, EU declaration of conformity and CE marking, obligations of importers and distributors, market surveillance and penalties. Units placed on the market before this date are outside its scope unless substantially modified, but Article 14 applies regardless. What counts is the individual unit, not the model: units placed on the market from 11 December 2027 must comply even if the model was already on sale.

Who it applies to: Manufacturers, authorised representatives, importers and distributors of products with digital elements.

CRA: obligations of open-source software stewards (Art. 24)

Legal persons that systematically provide sustained support for the development of open-source software intended for commercial activities must have a documented cybersecurity policy, cooperate with market surveillance authorities on request and report through the ENISA platform actively exploited vulnerabilities in products whose development they are involved in, and severe incidents affecting the systems they provide for that development.

Who it applies to: Open-source software stewards (for example, foundations).

CRA: latest end of validity of certificates and approval decisions issued under other EU legislation

EU type-examination certificates and approval decisions on cybersecurity issued under other EU product legislation (for example the RED, with Delegated Regulation 2022/30) remain valid until this date at the latest.

Who it applies to: Manufacturers holding such certificates or approval decisions.

AI Act: high-risk systems in Annex I (regulated products)

For AI systems that are products, or safety components of products, covered by the legislation in Annex I (for example toys, lifts, radio equipment, medical devices), the high-risk requirements and obligations apply. The date was postponed by Regulation 2026/1744: it was previously 2 August 2027. Systems already on the market or in service remain outside until their design undergoes significant changes. What counts is the type and model, not the individual unit: if a first unit was already on the market, later identical units follow the same rule (Article 111(2)).

Proposal COM(2025) 1023 is pending: it would move medical devices and in vitro diagnostic medical devices to Section B of Annex I, taking them out of this deadline. Until it is adopted, the current date and scope apply. The procedure

Who it applies to: Manufacturers and providers of products in Annex I, Section A; deployers.

Machinery with AI: requirements in the Machinery Regulation

With machinery leaving Section A of Annex I to the AI Act, the requirements for high-risk AI in machinery will become new essential requirements of Machinery Regulation (EU) 2023/1230, through delegated acts to apply by 2 August 2028 at the latest.

It depends on Commission delegated acts not yet adopted: the actual date will be the one they set.

Who it applies to: Manufacturers of machinery with high-risk AI systems as safety components.

AI Act: high-risk systems already on the market intended for use by public authorities

High-risk systems already on the market or in service and intended for use by public authorities must be brought into compliance by this date, even without changes. New systems follow 2 December 2027 or 2 August 2028.

Who it applies to: Providers and deployers of high-risk systems intended for use by public authorities.