On 23 October 2026 the Italian National Cybersecurity Agency (ACN) announced the simplification of NIS registration from 2027. The rules are set out in the new determination of the Director General (no. 314287/2026), applicable from 25 October 2026, which updates and replaces the one of 13 April 2026. In short: entities already on the NIS register that have nothing to update do not have to file a new declaration. A word of caution, though: “nothing has changed” is a conclusion to be verified, not a starting assumption.
1. What changes with the 2027 registration
Every year, from 1 January to 28 February, NIS entities complete their declaration through the “NIS/Declaration service” on the ACN Portal. The determination provides that entities already on the register do not need to complete this step if nothing has changed compared with the information shared in the previous year’s declaration (or in any supplementary declarations submitted that year). Entities that do not file remain on the register for the current year, with the NIS status already assigned.
For those who do need to file, the platform proposes a pre-filled draft at the start, based on the information submitted and assessed in the previous calendar year. Once sent, the declaration becomes final and can no longer be modified after ten days (late declarations excepted).
2. The annual calendar
The windows set by the determination recur every year:
- 1 January – 28 February: registration through the NIS/Declaration service.
- 15 April – 31 May: annual update of information, pre-filled with the data submitted up to 14 April.
- 1 May – 30 June: listing and categorisation of activities and services.
- Within 14 days: any change to the information already submitted must be communicated promptly and, in any case, within fourteen days of the change.
The full picture of obligations is in our article on the NIS Vademecum.
3. Before concluding that “nothing has changed”
The simplification removes a duplicate filing, not the responsibility for keeping data correct. The declaration covers elements that can change without anyone noticing. Before deciding not to file, it is worth checking at least:
- Group and linked enterprises: membership of a group of companies and linked NIS entities.
- Activities and entity types: ATECO codes and the types listed in annexes I, II, III and IV of the decree.
- Size: turnover, balance sheet and number of employees, to classify the entity as a micro, small, medium or large enterprise.
- Corporate transactions: an entity resulting from a merger, including by absorption, must register, and the participating companies communicate the data of the resulting entity; in the case of a transfer of business branches, the transferor communicates the transferee’s data.
4. What does not change
- It does not apply to entities not yet on the register. New entities file in the 1 January – 28 February window; those that receive an identification notice from ACN register within 30 days of receipt, or in the following year’s window if the notice arrives after 31 July.
- The other obligations of the NIS decree remain. The determination governs the registration and update process, not risk-management measures or incident notification.
- Responsibility stays with top management. Administrative and management bodies oversee registration and are responsible for any breaches; failure to register, communicate or update is punishable under article 38 of the decree.
- Late declarations have their own rules. They are considered late unless the delay is due to documented technical or operational issues not attributable to the entity; those submitted by 1 September are treated for the registration of the reference year.
- Consistency checks continue. ACN may check information on a sample basis and request additions, to be answered within ten days.
5. What to do now
Some practical suggestions, inspired by the determination and by organisational common sense:
- Clarify who the point of contact is. This is the natural person designated by the entity (legal representative, general attorney or delegated employee) who accesses the ACN Portal with CIE, personal SPID, CNS or eIDAS. If they change, the new point of contact must be designated without unjustified delay and registered on the Portal.
- Compare last year’s declaration with the current situation, item by item, together with those who know how the organisation and its services have evolved.
- Keep a record of the comparison: a short note with date, owner and conclusion. This is good governance practice, not an ACN requirement.
- Inform top management, who oversee compliance.
- Follow the ACN Portal’s operating instructions when the window opens.
Not sure what to check in your organisation? Book a free intro call with FinGreenTech or write to info@fingreentech.com.
Sources: Italian National Cybersecurity Agency, Determination of the Director General under art. 7, para. 6, of Legislative Decree 138/2024 (signed 20/10/2026, applicable from 25/10/2026); Cybersecurity360, “NIS2 from 2027, simplified registration on the ACN portal: what changes for companies” (27/10/2026).
Transparency note. This article was drafted with the support of artificial intelligence tools and reviewed by the FinGreenTech Team, which is editorially responsible for it.
