By October 31, 2026, organizations subject to NIS2 (Network and Information Security 2) must implement the basic measures. ACN inspections will follow. <\/p>\n\n
The NIS2 Directive is no longer a future requirement but a concrete deadline. In 2026, Italian organizations will enter the actual implementation phase. The timeline established by the National Cybersecurity Agency (ACN) sets precise deadlines that can no longer be postponed. Furthermore, the new ACN Determination 379907\/2025, effective January 15, 2026, updates and consolidates the required security measures. The implementation framework as of July 2026 is structured around deadlines to be met, stakeholders involved, and operational obligations that are now in effect. Understanding the status of progress is essential for those responsible for managing cybersecurity at companies subject to these regulatory requirements.<\/p>\n\n
In 2026, NIS2 will enter its operational phase. Companies must implement security measures according to the schedule established by the ACN. <\/p>\n\n
NIS2 (Network and Information Security 2)<\/strong>: European Directive 2022\/2555 on cybersecurity. It strengthens the protection of businesses and public administrations in critical sectors. <\/p>\n\n 2026 is the year of implementation. Once entities have registered on the ACN platform, substantive obligations will take effect. Specifically, ACN Determination 379907\/2025 replaces the previous regulation from April 2025. It sets forth the basic measures and notification procedures in a binding manner. Therefore, every organization must translate these requirements into concrete plans. This regulatory push is also being driven by market forces. Companies are increasing their investments in security to address threats and comply with European regulations. However, the time available has been significantly reduced.<\/p>\n\n