NIS2 Fines and Sanctions in Italy: What Your Business Needs to Know

Who enforces NIS2 in Italy?

In Italy, NIS2 was transposed by Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2). The national competent authority responsible for supervision and enforcement is the Agenzia per la Cybersicurezza Nazionale (ACN), which also acts as the single point of contact. Incident notifications are handled by CSIRT Italia, which operates within the ACN.

Under art 34, the ACN monitors and assesses compliance by soggetti essenziali (essential entities) and soggetti importanti (important entities) with the obligations of the decree. Its enforcement toolkit includes:

• monitoring, analysis and support (art 35);
• verifications and inspections (art 36);
• enforcement measures (art 37);
• administrative fines and accessory sanctions (art 38).

Importantly, art 34, comma 3 requires that supervision be effective, proportionate and dissuasive — meaning the size of a fine is tailored to each case.

Maximum fines: essential vs important entities

The core financial penalties are set out in art 38. The most serious violations — failures relating to management-body obligations (art 23), cybersecurity risk-management measures (art 24) and incident notification (art 25), as listed in art 38, comma 8 — carry the highest fines under art 38, comma 9.

These fines also carry a minimum amount: for essential entities the minimum is fixed at one-twentieth of the maximum, and for important entities at one-thirtieth of the maximum (art 38, comma 9, lettere a and b).

A second set of violations — for example failure to register, communicate or update information under art 7, failure to categorise activities and services under art 30, comma 1, or failure to cooperate with the ACN or CSIRT Italia — is listed in art 38, comma 10 and punished under art 38, comma 11:

• Soggetti essenziali: up to 0.1% of total worldwide annual turnover for the previous financial year;
• Soggetti importanti: up to 0.07% of total worldwide annual turnover for the previous financial year.

All turnover-based amounts are calculated in accordance with raccomandazione 2003/361/CE.

Public administrations: separate fixed brackets

Public administrations and certain publicly controlled entities are treated differently, with fixed euro brackets rather than turnover percentages.

For the more serious violations (art 38, comma 9):

• Public administrations that are essential entities: from €25,000 to €125,000 (lettera c);
• Public administrations that are important entities: the amounts above reduced by one-third (lettera d).

For the second category of violations (art 38, comma 11):

• Public administrations that are essential entities: from €10,000 to €50,000 (lettera c);
• Public administrations that are important entities: those amounts reduced by one-third (lettera d).

Repeated violations can substantially increase the penalty: under art 38, comma 12, in cases of specific repetition the sanction may be increased up to double, and in cases of non-specific repetition the sanction for the most serious violation may be increased up to triple.

Management and personal responsibility

One of the most significant features of the Italian regime is that liability reaches individuals at the top of the organisation.

Under art 23, the administrative and management bodies of essential and important entities must:

• approve the implementation of the cybersecurity risk-management measures adopted under art 24;
• oversee the implementation of the obligations of the chapter and of art 7;
• they are responsible for violations of the decree (art 23, comma 1, lettera c).

They are also personally required to follow cybersecurity training and to promote periodic training for their staff (art 23, comma 2).

Art 38, comma 5 goes further: any natural person responsible for an essential entity, or who acts as its legal representative with authority to make decisions on its behalf or to exercise control over it, must ensure compliance with the decree — and may be held liable for non-compliance where the entity breaches the decree.

Where an entity fails to comply within the deadlines set by a formal notice (diffida) under art 37, commi 6 e 7, the ACN can, under art 38, comma 6, impose an accessory administrative sanction on those individuals — including administrative and management bodies under art 23, and persons performing managerial functions at the level of managing director (amministratore delegato) or legal representative. This sanction is the temporary incapacity to perform managerial functions within that entity, applied until the entity remedies the deficiencies or complies with the notice.

For essential entities, the ACN may also temporarily suspend a certification or authorisation relating to some or all of the relevant services or activities (art 38, comma 4).

How fines are calculated and reduced

Fines are not applied mechanically. Under art 34, comma 6, the ACN must respect rights of defence and take into account the circumstances of each case, including at least:

• the gravity of the violation and the importance of the provisions breached (repeated violations, failure to notify significant incidents, obstruction of supervision and providing false or grossly inaccurate information are treated as particularly serious);
• the duration of the violation;
• any relevant previous violations;
• any material or immaterial damage caused, including financial losses and the number of affected users;
• whether the conduct was intentional or negligent;
• measures taken to prevent or mitigate the damage;
• adherence to approved codes of conduct or certification schemes;
• the level of cooperation with the ACN.

The decree also provides deflationary tools to resolve proceedings (art 38, comma 15), including:

• an invitation to comply (invito a conformarsi): if the entity brings its conduct into line within the set deadline, the sanctioning procedure does not continue (subject to exceptions such as prior diffida under art 37, comma 6);
• the option to settle by paying a reduced amount equal to one-third of the maximum sanction, or — if more favourable and where established — twice the minimum, within 60 days of notification of the charge.

Proceeds of fines imposed by the ACN are paid into the State budget and reassigned to increase the ACN's own budget (art 38, comma 16).

Not sure whether your organisation is an essential or important entity — and what your maximum exposure could be? Use our free scoping and gap-analysis tool to map your NIS2 status against D.Lgs 138/2024 and identify priority actions.