NIS2 regulation - The deadlines

Let's discover together the steps to comply with the NIS2 standard

Registering individuals on the ACN portal

Registration on the ACN portal is required by article 7 of the decree and NIS and the procedures, terms and procedures are defined in Determination 38565/2024.

When?

Dal December 1, 2024 up As of January 31, 2025 It is possible to register through the ACN portal.

Who needs to register?

You must register on point of contact, that is:

  • the legal representative of the NIS entity;

  • one of the delegated NIS project attorneys general;

  • an employee delegated by the legal representative.

How should you register?

The registration takes place in three phases:

  • Contact point census;

  • Association with the registrant;

  • Complication of the NIS statement.

Role and responsibility of the point of contact

The point of contact is delegated by the legal representative and is therefore able to make decisions on his behalf, exercise control over the subject himself and ensure compliance with regulatory provisions. In fact, the point of contact must

Sign in to the ACN portal

Log in to the ACN portal and authenticate through SPID

Associate with the Subject in the perimeter

Associate with the subject by providing, if it is a PA, the IPA code and public and private entities the tax code.

Upload the legal title

Upload the act that enables the point of contact to operate on behalf of the subject in the NIS2 context.

Fill in the declaration

Fill in the four parts of the statement: context, characterization, types of subject, self-assessment.

View the summary

Review and check the information entered.

Accept the liability clauses

Accept what has been stated and the resulting responsibilities.

Transmit the statement

Send the statement to ACN.

Some important considerations

The census process of the point of contact and association with the NIS subject ends with the sending of a validation request link to the subject's digital home.

Subjects who recognize themselves in NIS 2 must register from January 1 to February 28 of each year.

The point of contact may be held responsible for non-compliance in the event of a violation of the rule by the person he represents.

Some individuals, such as cloud computing service providers, data center service providers, etc., must register by January 17. Failure to register is a violation of the rule.

Failure to update the contact point is a violation of the Implementing Decree and involves an administrative sanction (up to 0.1% of the Subject's annual worldwide turnover).

Next step - 31 March 2025

March 31, 2025 is the deadline in which the ACN draws up the list of essential and important subjects who are required to comply with the NIS2 Regulation and communicates it to the designated contact point through the platform.

The next deadlines to be met

From 15 April to 31 May 2025

Individuals must communicate and/or update the ACN regarding additional information if required.

By 31 December 2025

Subjects must comply with their obligations regarding the notification of incidents.

By September 30, 2026

Subjects must fulfill all other obligations defined in the regulations.