Mexedia: NIS2 Directive in Italy Enters Operational Phase

A Compliance Timeline Staggered Until January 2028

The NIS2 Directive, which addresses the security of networks and information systems, was transposed into Italian law by legislative decree no. 138 of September 4, 2024. For entities listed on the NIS register in 2025, the eighteen-month deadline granted to adopt basic security measures expires in October. This deadline runs from the date of notification of their registration.

For entities identified in mid-2026, the obligation to report significant incidents will apply from April 2027, and basic measures must be adopted by January 2028. Mexedia notes that compared to the first European directive from 2016, the scope no longer limited to essential service operators and digital service providers.

It now extends to a much larger number of companies, classified as essential entities and important entities according to their sector and size. According to the statement, the criterion is proportional, but the principle is unique: the continuity of digital services constitutes an interest that transcends that of each individual company.

Director Responsibility, Sanctions and 24-Hour Notification

For Mexedia, the main evolution in the new framework concerns governance. The decree requires administrative bodies to approve the procedures for implementing security measures, to oversee their implementation, and to be accountable for violations. Directors themselves are subject to a specific training obligation.

For essential entities, financial penalties can reach 10 million euros or, if this amount is higher, 2% of annual global turnover. In case of non-compliance with orders issued by the authority, the decree also provides for disqualification from management functions for the natural persons responsible, until compliance is restored.

Significant incidents must be subject to pre-notification within 24 hours of discovery, notification within 72 hours, and then a final report within one month following notification. The ACN further asks NIS entities to identify and declare their significant suppliers. Mexedia, which operates in telecommunications and digital services and controls Stantup Service S.r.l., believes that for a group holding interests in this sector, the ability to ensure continuity and reliability of services becomes "an element of value, in addition to an obligation".

The group places NIS2 within a broader European framework. This includes the transparency obligations of the AI Act and the end-2027 deadline set by eIDAS 2 for the provision of European digital identity wallets. "Recent European regulations are asking companies to demonstrate, not just declare," said Anna Lisa Trulli, Benefit Unit Officer at Mexedia (translated from Italian).