NIS2 relevant suppliers in Italy: what ACN determination 314287/2026 says

With determination 314287/2026, signed on 20 October and applicable from 25 October 2026, Italy’s cybersecurity agency ACN requires NIS entities to list their «relevant NIS suppliers» on its platform: name, tax code, country of registered office, CPV codes of the supplies and the relevance criterion used. If you sell IT, cloud or software services to companies covered by NIS2 in Italy, you may end up on such a list without having asked for it. Here is what the text says and how to prepare.

Facts checked against the text of ACN determination 314287/2026 (Italian; quotations are our translation) and the ACN news item of 23 October 2026. Updated 13 November 2026. This is not legal advice.

What a relevant NIS supplier is

The determination defines it as «an entity that provides services or products to a NIS entity» and that meets at least one of two relevance criteria.

1. ICT supply: the supply falls within the activities or services of Annex I, points 8 and 9, of the Italian NIS decree (Legislative Decree 138/2024).
2. Non-fungible supply: interruption or compromise of the supply has a significant impact on the NIS entity’s ability to deliver the activities or services for which it falls within the decree, including because no alternative suppliers are available.

The stated reason, in the preamble, is to identify «the systemic elements of the supply chain, including the digital one» of one or more essential or important entities.

What NIS entities must report

Article 18 provides that, through the «NIS/Annual information update» service, users list the relevant suppliers stating:

• name and tax code;
• the country of their registered office;
• the CPV (Common Procurement Vocabulary) codes of the supplies the NIS entity receives;
• the relevance criterion used.

The text does not place a direct duty to register or report on the supplier: the obligation is the customer’s. Still, a supplier can expect its NIS customers to ask for these details, and probably for assurances about the security of the supply.

What changes for IT, cloud and software vendors

If your customers are NIS entities, these are the details you may be asked for. A practical way to prepare without waiting for the request:

1. Prepare a supplier sheet: company name, tax code, registered office, list of services supplied and the CPV codes that describe them.
2. Document the measures you already apply: backups and restore tests, monitoring, access management, updates, incident handling.
3. Review contracts with NIS customers: service levels, incident notification times, subcontractors involved.
4. Identify non-fungible supplies: if one of your services going down stops an activity of the customer, that customer may flag it under the second criterion.

These are practical suggestions, not requirements imposed by the determination. Whether and how NIS2 affects you or your customers needs a case-by-case check with an adviser. On the technical side, our managed cloud for companies includes backups, monitoring and support, and the cybersecurity and NIS2 page explains how we approach network and systems security. For the simplest measures to start with, read our guide to cybersecurity for SMEs; and if you are weighing cloud and security investments, see Italy’s Cloud & Cybersecurity Voucher.

Frequently asked questions

My customer is a NIS entity: do I have to register on the ACN platform?

According to the text of the determination, the duty to list relevant suppliers belongs to the NIS entity, which does it through the «NIS/Annual information update» service. The supplier is not named as the addressee of a registration duty in that article.

When does determination 314287/2026 apply?

From 25 October 2026. It was digitally signed by ACN’s Director General on 20 October 2026 and updates and replaces determination no. 127437 of 13 April 2026.

What are CPV codes?

They are Common Procurement Vocabulary codes, referred to in the determination through Regulation (EC) no. 2195/2002, that classify supplies. The NIS entity states them for the supplies it receives.

Written by. The URETECH team: developers and consultants who design and integrate ERP systems, custom software, automations and managed cloud for SMEs. About us and how we work.