Quick answer. NIS2 and industrial automation: if you program machines for a customer that falls under NIS2 in Italy, NIS2 usually doesn’t reach you directly. It reaches you through the contract: clauses on remote access, device inventories and incident reporting. You are in scope yourself if you are a machine builder that isn’t a small enterprise, if the national authority designates you as a critical supplier, or if you are an undertaking linked to a NIS entity that manages its systems, security or ICT services (Art. 3(10)). One case is open: you reach into the customer’s network with your own devices and you aren’t a small enterprise. That matches the authority’s managed-service-provider definition, but we found no act applying it to OT. As a manufacturer you also have direct duties that are not NIS2: from 11 September 2026, Art. 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847) requires an early warning within 24 hours for actively exploited vulnerabilities in your products. We don’t cover it here.
This is not legal advice. A PLC programmer wrote it for PLC programmers. It reports what the official texts say, with the article next to each point, and flags our own readings as ours. Whether your company is a NIS entity, or what you should sign, is a question for a lawyer or for the authority.
We cover the Italian transposition: Legislative Decree 138 of 4 September 2024, applicable from 18 October 2024 (Art. 41(1)). The authority is ACN, the national cybersecurity agency; incidents go to CSIRT Italia. The decree and ACN’s documents are in Italian: we paraphrase and give the reference. Other Member States set their own procedures and dates. Checked on 29 September 2026.
In particolar modo vedremo:
1. Who is in scope, and who isn’t
Directive (EU) 2022/2555 covers entities of the types in Annexes I and II «which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises» (Art. 2(1)). The Italian decree says it the other way round: it applies to entities above the small-enterprise ceilings (Art. 3(2)).
Recommendation 2003/361/EC, Annex, Art. 2(2) defines a small enterprise as fewer than 50 persons and annual turnover or balance sheet total not above EUR 10 million. Two details move the result. Staff is counted in annual work units, with part-time and seasonal work as fractions (Art. 5). And a company changes category only after two consecutive financial years over the line (Art. 4).
For machine builders the entry is Annex II, point 5: manufacturing, NACE divisions 26, 27, 28 (machinery and equipment n.e.c.), 29 and 30. ACN FAQ A2.5.d.1 looks at the company’s substantial activity and says these organisations are important entities. Each legal entity does its own self-assessment (FAQ REG.1), but for size, linked and partner enterprises are added in (Recommendation, Annex, Art. 6), unless disproportionate (decree Art. 3(4)).
What about suppliers? ACN FAQ AMB.GE.6 is clear: an organisation that doesn’t meet the Art. 3 criteria is not in scope just because it serves NIS entities. NIS entities, on the other hand, have to impose contractual obligations on their suppliers.
Supplying services to a NIS entity does not, by itself, bring you into scope: ACN FAQ AMB.GE.6 says so.
2. Deadlines and reporting times
Every year, from 1 January to 28 February, entities register or update their registration on the ACN platform (Art. 7(1)). From 15 April to 31 May they update their details, including a list of relevant suppliers (Art. 7(4); ACN Determination 127437/2026, Art. 16).
The deadline for the baseline security measures depends on the year the customer was added to the national list:
| Entity added | Baseline incident reporting | Baseline security measures | Source |
|---|---|---|---|
| in 2025 | 9 months from receipt of the notice of inclusion | 18 months from receipt; ACN’s own wording is "by October 2026" (its page on the regulation also shows "September 2026") | ACN Determination 379907/2025, Art. 3 |
| for the first time in 2026 | from 1 January 2027 | by 31 July 2027 | ACN Determination 127434/2026, Art. 1 |
For entities added in 2025 no exact day is published: it depends on the date of the certified e-mail (PEC) each entity received from ACN.
ACN had announced the long-term obligations, which follow the categorisation of activities and services, for April 2026. As of 29 September 2026 we found no determination adopting them in ACN’s list of implementing acts. If someone describes them in detail, ask which act they are quoting.
Reporting follows the directive, Art. 23(4): «within 24 hours of becoming aware of the significant incident, an early warning», an incident notification with an initial assessment «within 72 hours», and a final report within one month of that notification. The Italian decree (Art. 25(5)) makes the progress report monthly while an incident is still ongoing.
Who reports? The customer: ACN FAQ ISB.F.1 (example: HVAC maintenance) places the obligation on the NIS customer, which may then involve the supplier. FAQ ISB.F.3 asks for prompt reporting, but it was written for cloud providers; extending it to remote support on a PLC is our reading. None of the texts we read sets a number of hours for the supplier: the contract does.
3. Fines: whose are they?
The fines in Art. 38 of the decree hit the NIS entity. For breaches of governance, risk measures and incident reporting (Arts. 23, 24, 25):
- essential entities: up to EUR 10,000,000 or 2% of worldwide annual turnover, whichever is higher; the minimum is one twentieth of the statutory maximum;
- important entities: up to EUR 7,000,000 or 1.4%, whichever is higher; the minimum is one thirtieth of the statutory maximum (Art. 38(9)).
For administrative breaches, such as failing to cooperate with ACN, the cap is 0.1% of turnover for essential entities and 0.07% for important ones (Art. 38(10)–(11)). Failing to register, or registering late, means all breaches under paragraphs 8 and 10 are charged and the most serious penalty is increased up to threefold (Art. 38(13)). After an ignored formal warning, directors risk a temporary ban from management roles in that entity (Art. 38(5)–(6)).
Supervision is in Arts. 36 and 37 of the decree. For important entities, inspections only follow evidence of a possible breach (Art. 36(2)), and ACN cannot require them to run periodic security audits (Art. 37(3)(a)). A trap in the Italian text of the directive: Art. 32(2) and the title of Art. 33 swap essential and important entities. The English Art. 33 is correctly titled «Supervisory and enforcement measures in relation to important entities». For Italy, cite Arts. 36 and 37 of the decree.
Outside the scope, these amounts aren’t yours: you risk what you sign, meaning penalties and termination. Our reading, from FAQ AMB.GE.6.
4. Contractual obligation or direct obligation
The normal route: the contract
ACN’s baseline specifications (Determination 379907/2025, Annex 1) ask the NIS entity for an inventory of suppliers with potential security impact (GV.SC-04), security requirements in requests for quotation and contracts (GV.SC-05), and a risk assessment that also looks at how much access the supplier has to its systems (GV.SC-07). The decree adds that the entity must consider its suppliers’ practices, including their secure development procedures (Art. 24(3)).
Under ACN FAQs MSB.15 and MSB.16, requirements aren’t needed for every supply, nor must all of them go into the contract. A clause copied wholesale is negotiable.
The direct routes
- You are the NIS entity. A builder whose substantial activity is in division 28 and that isn’t a small enterprise is an important entity (FAQ A2.5.d.1). The measures cover the systems the company uses (Art. 24(1)). Our reading: engineering office, project server, remote support set-up. Not the machine you ship.
- Managed service provider. ACN treats work as active assistance or administration when there is a direct interconnection between the networks, for example when the supplier reaches the customer’s systems remotely through the supplier’s own devices. Typical activities include updating configuration, software or firmware (FAQ A1.9.2 and A1.9.3). Work on devices provided by the customer is excluded, and so are plain instructions to the customer’s staff. The definition applies above the small-enterprise threshold.
- Relevant supplier. Every year the NIS entity lists its relevant suppliers with name, tax code and CPV codes (Determination 127437/2026, Art. 18). A supply is also relevant when it is non-fungible: its interruption would have a significant impact on the customer, including because no alternative supplier is available (Art. 1(ll)). ACN’s news item of 13 April 2026 states the purpose: selecting the suppliers that will be identified as important or essential entities. Small companies can be designated too (Art. 3(9)(f)).
The open question: is an OT integrator doing remote support through its own router a managed service provider? Every link in the chain is written down; the conclusion isn’t, and we found no ACN FAQ or act applying the definition to OT integrators. If this is your situation, ask ACN.
NIS2 and industrial automation: three made-up profiles
| Profile | In scope? | What changes |
|---|---|---|
| Palletiser builder, 120 annual work units, designs and builds in-house | Yes, as an important entity, if its substantial activity is in division 28 (FAQ A2.5.d.1) | Registration 1 January – 28 February; baseline measures on its own systems (office network, TIA server, remote access to customers: this list is our reading); reporting its own incidents; plus customers’ clauses |
| Integrator, 60 annual work units, remote support through its own gateway in the customer’s cabinet | No text says so. Our reading: it fits ACN’s managed-service-provider definition (FAQ A1.9.2). Ask ACN | If the reading holds, it is a NIS entity in its own right: for that category the first registration deadline was 17 January 2025 (Art. 42(1)(a)). If it only worked on devices provided by the customer, the same FAQ would exclude it |
| Programming shop, 6 people, turnover EUR 900,000 | No, on size. ACN can still designate it as a systemic supplier (Art. 3(9)(f)) | Contract obligations only: questionnaires, a reporting clause, a list of remote accesses. It may appear by name and tax code on the customer’s list of relevant suppliers |
If the shop is the only one holding a plant’s software, we think that is a non-fungible supply. The customer fills in the list, though.
Example scenario: Line P1
This plant is made up. Line P1 is a palletising line with an S7-1500 PLC (192.168.10.10), a Comfort HMI panel (192.168.10.20), two ET 200SP stations (192.168.10.31 and .32), two switches, a service laptop (192.168.10.100) and a remote access gateway (192.168.10.2), on the plant network 10.20.0.0/16.
The customer, also made up, is an important entity added in 2026, so its baseline measures are due by 31 July 2027. It sends a questionnaire to the shop that programmed the line:
- Inventory (ID.AM-01). Hardware including IT, IoT, OT and mobile devices, the only mention of OT in the baseline specifications. You list the devices with order number and firmware, where the device exposes it: the unmanaged switches don’t.
- Remotely reachable systems (PR.IR-01). An up-to-date list of the systems that can be reached remotely, with how access works. Here: from gateway .2 you reach the whole 192.168.10.0/24, ET 200SP stations included, because Line P1 has no IP filter between gateway and machine.
- Logged access and MFA. Under PR.PS-04 every remote access is logged; under PR.AA-03 multi-factor authentication is used at least on relevant systems, in line with the customer’s risk assessment. See the articles on secure PLC remote access over VPN and the mistakes to avoid and on S7-1500 passwords and access levels.
- Backups. The directive lists «backup management» among the minimum measures (Art. 21(2)(c); Italian decree Art. 24(2)(c)). See the article on PLC and HMI backups after ransomware.
The deciding question: which devices do you connect from? FAQ A1.9.2 names the supplier’s active devices connected to the customer’s network and remote access from the supplier’s own devices. Our reading: here that means gateway .2, if the integrator owns it, and the integrator’s PC. It excludes work on the customer’s devices, such as laptop .100 if the customer owns it, and plain instructions. For the six-person shop little changes. For the 60-unit integrator this changes its legal position.
IEC 62443: an interpretation, not a legal reference
Questionnaires cite IEC 62443; the law doesn’t. We searched for «62443», «PLC», «SCADA» and «operational technology» in the directive (Italian and English), in Legislative Decree 138/2024 with its annexes, in Determination 379907/2025 with Annexes 1 and 2, in ACN’s FAQs on measures and reporting and in ENISA’s technical implementation guidance. Zero hits. In the English directive «network and information system» appears 63 times, so the search was working.
The link to standards is generic: the measures take into account «the state-of-the-art and, where applicable, relevant European and international standards» (Art. 21(1); Italian decree Art. 24(1)(a)). In Italy the baseline measures are built on the National Framework for Cybersecurity and Data Protection, 2025 edition.
Our reading: using IEC 62443 to demonstrate the measures on plant systems is a defensible technical choice. For an integrator the closest part is 62443-2-4, which IEC describes as requirements for the security processes IACS service providers offer the asset owner «during integration and maintenance activities of an Automation Solution». No official text requires it, though. If a customer writes "IEC 62443 compliant" into a contract, that is a contractual request, and you negotiate it as one. Which parts matter to a PLC programmer is in the article on IEC 62443 for PLC programmers.
What not to do
- Don’t agree to report incidents on the customer’s systems to CSIRT Italia yourself: ACN puts that on the customer (FAQ ISB.F.1). You warn the customer, within the time the contract sets.
- Don’t write "NIS2-compliant machine" in a quotation. NIS2 measures cover the systems an entity uses (Italian decree Art. 24(1)), not the products it sells.
- Don’t connect your own devices to a customer’s network without knowing what that means for the managed-service-provider definition.
- Don’t turn "October 2026" into a specific day: the customer’s ACN notice is what counts.
More in the practical PLC cybersecurity guide for machine programmers.
What this article doesn’t cover
We did not open Prime Ministerial Decree 221/2024 on corporate groups. The decrees on supervision and settlement tools: not found, ACN lists them without adoption details. The Cyber Resilience Act is a separate regulation, not covered here.
Sources
- Directive (EU) 2022/2555 (NIS2), OJ L 333, 27.12.2022
- Legislative Decree 138 of 4 September 2024, consolidated text on Normattiva (Italian)
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Art. 14 and Art. 71
- Commission Recommendation 2003/361/EC, definition of micro, small and medium-sized enterprises
- ACN, NIS legislation and implementing acts (Italian)
- ACN, NIS FAQ: scope, AMB.GE.6 (Italian)
- ACN, NIS FAQ: sectors and entity types, A1.9.2, A1.9.3, A2.5.d.1 (Italian)
- ACN, NIS FAQ: registration, REG.1 (Italian)
- ACN, NIS FAQ: security measures and incident reporting, MSB.15, MSB.16, ISB.F.1, ISB.F.3 (Italian)
- ACN Determination 379907/2025, baseline specifications (Italian)
- ACN Determination 127434/2026, deadlines for entities added in 2026 (Italian)
- ACN Determination 127437/2026, platform and relevant suppliers (Italian)
- ACN news item of 13 April 2026 on the determinations for new entities (Italian)
- IEC 62443-2-4, IEC webstore page
Last checked: 29 September 2026
“Semplifica, automatizza, sorridi: il mantra del programmatore zen.”
Dott. Strongoli Alessandro
Programmatore
CEO IO PROGRAMMO srl
