Regulatory deadlines

Basic security measures, entities included in 2025

By this deadline, entities included in 2025 must have adopted the basic security measures in Annexes 1 and 2 of the ACN determination, including the obligations of management bodies.

The deadline is 18 months from the certified email (PEC) of inclusion in the list, which most entities received on 12 or 13 April 2025: the exact date depends on the day you received it. The ACN says “October 2026”.

Who it applies to: Essential and important entities included in the NIS list in 2025. Not financial entities subject to DORA.

Domain name registration database (Art. 29), registries and registrars included in 2025

Registries and registrars must keep accurate and complete domain registration data and publish their verification policies and procedures, approved by their management bodies.

As for the basic measures: 18 months from the certified email (PEC) of inclusion in the list, which most entities received on 12 or 13 April 2025: the exact date depends on the day you received it.

Who it applies to: Top-level domain name registries and registrars included in the NIS list in 2025.

Bringing information-sharing arrangements into line, entities included in 2025

Exchanges of cybersecurity information between NIS entities, and with their suppliers, must be governed by information-sharing arrangements. According to the ACN, the deadline for compliance is the same as for the basic measures.

The date comes only from an ACN FAQ, which aligns it with the deadline for the basic measures (“October 2026”).

Who it applies to: Essential and important entities included in 2025 that exchange cybersecurity information. Not banks or financial market infrastructures.

ACN Determination 314287/2026 on the NIS platform applies

The new determination replaces Determination 127437/2026. Main changes: entities already on the list with no changes do not submit the declaration again for 2027; late declarations submitted by 1 September count for the current year.

Who it applies to: All NIS entities and organisations required to register.

First listing and categorisation of activities and services

The NIS entity lists its activities and services on the ACN platform (“NIS Service/Categorisation”) and assigns each of them an impact category using the ACN model.

Who it applies to: Essential and important entities. Financial entities subject to DORA are exempt.

Deputy point of contact, entities included in 2026

Entities that joined the NIS list in 2026 designate by 31 May a second person, in addition to the point of contact, who can act on the ACN platform.

Who it applies to: NIS entities included in the list in 2026. It does not apply where the point of contact is the only person in the organisation.

Annual update of information, 2026

Each year the NIS entity confirms or corrects, on the ACN platform, its contacts, the members of its management bodies, public IP addresses, domain names and information-sharing arrangements. In 2026, for the first time, the list of relevant suppliers is included too.

Who it applies to: Essential and important entities notified of their inclusion, or continued inclusion, in the NIS list. Financial entities subject to DORA do not update the list of members of management bodies.

Notification of information-sharing arrangements signed before the NIS Decree

Arrangements for sharing cybersecurity information that were signed before the NIS Decree entered into force (16 October 2024) and are still in place must be notified to the ACN by 31 May 2026.

Who it applies to: Essential and important entities that take part in information-sharing arrangements.