--- title: "NIS2 in practice: the 2026 ACN deadlines and what Italian SMEs must actually do" description: "NIS2 in practice for Italian SMEs and MSPs: the 2026 ACN compliance calendar, the categorisation window closing at the end of June, incident notification and baseline measures. What to do now and where CyberAgent supports gap analysis." url: "https://www.noze.it/en/insights/nis2-sme-cyberagent/" lang: "en" alternate: "https://www.noze.it/insights/nis2-pmi-cyberagent/" published: "2026-05-27" updated: "2026-11-09" author: "noze S.r.l." keywords: "Cybersecurity, Compliance, Governance, NIS2" --- # NIS2 in practice: the 2026 ACN deadlines and what Italian SMEs must actually do NIS2 in practice for Italian SMEs and MSPs: the 2026 ACN compliance calendar, the categorisation window closing at the end of June, incident notification and baseline measures. What to do now and where CyberAgent supports gap analysis. 27 May 2026Updated 9 November 2026 ![Bar calendar of the 2026 NIS2 obligations: registration window in the first two months, categorisation closing at the end of June, baseline measure evidence by the end of October, and the incident notification clock at 24 hours, 72 hours and one month.](https://www.noze.it/images/insights/nis2-acn-2026-en.svg) The three 2026 windows for entities already on the register, with 27 May marked on the line: a little over a month is left before categorisation closes. Registration and categorisation stay the entity’s own obligations on the ACN platform. ## Where things stand The **Directive (EU) 2022/2555**, known as **NIS2**, was transposed in Italy through **Legislative Decree 138/2024**, in force since autumn 2024. The competent authority is the **ACN** — the National Cybersecurity Agency — which also acts as single point of contact and national **CSIRT**. A point that is often misread: obligations do not start when the law is published, but from the **individual notification** of inclusion in the register of NIS entities, which each organisation receives from ACN. Over the final months of 2025 the operating framework was consolidated through two ACN determinations: one on the workings of the **NIS Platform**, the other on **baseline security measures** and the handling of **significant incidents**. The 2026 calendar rests on that basis, and it is the calendar that makes NIS2 a concretely operational matter for many **SMEs** and for the **MSPs** that serve them. ## The 2026 ACN calendar, in order The 2026 obligations fall into a precise sequence: - **Registration and update** on the ACN portal: the annual window falls in the **first two months of the year**. Entities already listed confirm or update their data. - **Significant incident notification**: the obligation is operational. The schedule has three steps: **pre-notification within 24 hours** and **notification within 72 hours** of becoming aware, **final report within one month** of the notification. - **Categorisation of activities and services**: the relevant window closes at the **end of June**. Once that deadline passes, the categorised list is considered **settled**. - **Baseline security measures**: for entities already listed since 2025, documentary evidence is expected by the **end of October 2026**. Entities registered **for the first time during 2026** work to deferred terms: notification operational around **early 2027** (roughly nine months from the communication) and measures to be completed by **summer 2027**. ## What the categorisation model changes The **categorisation model** introduced by the April 2026 ACN determination structures self-assessment around **10 macro-areas** and **4 levels of relevance**: **minimal**, **low**, **medium** and **high** impact. Categorisation sets the risk profile recognised for the entity and, in turn, the intensity of the measures expected. It is also why the window closing at the end of June deserves priority — afterwards the list is fixed, and corrections become more costly. The **penalties** explain the urgency. For **essential entities** they reach up to **EUR 10 million** or, if higher, **2% of annual worldwide turnover**; for **important entities**, up to **EUR 7 million** or **1.4%**. The regulation covers **18 sectors** and captures many, though not all, SMEs based on **size** and **sector**. A **role in the supply chain** brings in those ACN identifies as a systemic element; a small-to-mid technology supplier is not in scope merely because it serves a NIS customer, but it may receive contractual security obligations from that customer. ## The minimum checklist to close now For an entity already on the register, the order of work in these weeks is clear: 1. **Verify registration** on the ACN portal and confirm that contact data is current. 2. **Complete categorisation** before the end-of-June window closes: map activities and services onto the macro-areas and assign the relevance level. 3. **Stand up the incident notification process** — roles, channels, runbook — because the 24/72-hour steps and the one-month report require a defined procedure. 4. **Build the documentary evidence** for the baseline measures, with an end-of-October 2026 horizon. Steps 1 and 2 remain **the entity’s responsibility** on the ACN platform: no tool performs them for you. Steps 3 and 4, by contrast, are the technical ground where gap analysis matters. ## Where CyberAgent helps (and where it does not) **CyberAgent** is a **vulnerability assessment** and **gap analysis** tool supporting the baseline security measures: continuous scanning, mapping of vulnerabilities to requirements, reports and checklists aligned to the frameworks, ready to produce **documentary evidence**. It is useful precisely on step 4 of the checklist, and supplies the technical material for step 3. More on the approach is in the [CyberAgent launch](https://www.noze.it/en/insights/cyberagent-launch/) and in our note on [automated vulnerability assessment for the CISO](https://www.noze.it/en/insights/ciso-automated-vulnerability-assessment/). One distinction remains firm: CyberAgent **does not replace** registration or categorisation, which stay the entity’s obligations on the **ACN platform**. No product delivers “automatic NIS2 compliance”. The tool reduces the technical workload and makes evidence repeatable; the formal responsibility stays yours. ## What this means in practice For an Italian SME or MSP the operational signal is the calendar, concrete and dated. The categorisation window closes at the **end of June** and the list is settled afterwards: that is the deadline not to miss right now. Incident notification is already live, and evidence of the baseline measures has an **end-of-October 2026** horizon. Start from the mapping — knowing whether you are in scope and at which level — then build the technical evidence. On that last stretch, [CyberAgent](https://www.noze.it/en/products/cyberagent/) is the support; the portal obligations are not. **Links**: [ACN — NIS legislation](https://www.acn.gov.it/portale/en/nis/la-normativa) · [ICT Security Magazine — NIS2 obligations](https://www.ictsecuritymagazine.com/notizie/nis2-adempimenti/)