The changes introduced are not limited to technical aspects but also affect how the annual update cycle for the NIS list is managed. Specifically, for entities already included on the list, annual registration becomes a mandatory requirement only under certain circumstances; the ACN's audit powers are strengthened, with greater flexibility in conducting related audits, and a new internal review procedure is introduced, through the submission of a request for review.
Below, we analyze the main changes introduced by the new determination and their operational impacts on the affected organizations.
1. Registration (Art. 11): From an Annual Requirement to an "Exception-Based" Declaration
1.1 Exemption from Declaration for Entities Already Registered in the Absence of Changes
One of the most significant changes introduced by the determination concerns the annual declaration, for which a simplified mechanism is provided: entities already included in the NIS list are required to submit it only if there have been changes to the information contained in the declaration for the previous calendar year or in subsequent supplementary declarations. If there are no changes, the entity retains its previously assigned NIS status and receives a notification from the ACN that is purely for acknowledgment purposes (Art. 11, paras. 1 and 11; Art. 15, para. 4).
The procedural simplification established by the new determination means that each entity is required to independently verify whether, compared to the information already provided, any changes have occurred that would necessitate the submission of a new declaration. An incorrect assessment could, in fact, result in the failure to comply with the obligations set forth in Art. 7 of Legislative Decree 138/2024 (the "NIS Decree"), thereby exposing the entity to the penalties provided for in Art. 38. It is therefore advisable to conduct an annual internal review prior to the opening of the registration window and to maintain adequate documentary evidence of this review.
Furthermore, the coordination with the obligation of continuous updating provided for in Article 19 remains to be clarified. The determination, in fact, refers solely to "supplementary declarations" submitted as part of the procedure for the consolidation of the list, without specifying whether, for the purposes of exemption from the annual declaration, changes communicated through the continuous updating procedure are also relevant.
1.2 Enterprise Size
The determination also introduces a significant change in how enterprise size is reported: it is now up to the entity itself to classify itself as a micro, small, medium, or large enterprise, applying the criteria set forth in Recommendation 2003/361/EC. Information relating to revenue, the total balance sheet and the number of employees does not need to be reported unless the platform automatically detects any inconsistencies.
However, this operational simplification is accompanied by greater accountability for the entities, who are now required to ensure the accuracy of their self-assessments. The declaration is made pursuant to Presidential Decree No. 445/2000 and, in the event of false declarations, entails the consequences provided for by law, including criminal penalties. This requirement is particularly important for companies belonging to groups, since the calculation of company size must also include, in accordance with the rules of Recommendation 2003/361/EC, data from affiliated and associated companies. It is therefore essential to carefully conduct and document this assessment, retaining the criteria used and the related calculations, so as to be able to demonstrate the accuracy of the declaration in the event of inconsistencies or audits by the ACN.
1.3 Late Declarations
The determination also provides more specific guidance on late declarations, stipulating that those submitted by September 1 will still be considered for registration in the relevant calendar year (Art. 11, para. 8). This provides an opportunity for regularization during the year, allowing those who are late to be included in the relevant annual cycle without having to wait for the next registration window.
However, it is important to clarify that this provision does not constitute an extension of the standard deadline and does not preclude any penalties resulting from the delay. Furthermore, the consolidation mechanism provided for upon the expiration of the ten-day deadline does not apply to late filings (Art. 11, para. 9). The possibility of catching up on registration within the current calendar year should therefore not be confused with an amnesty for non-compliance.
1.4 Extraordinary Transactions: Mergers and Transfers of Business Units
Determination also expressly governs certain extraordinary transactions. In the event of a merger, including a merger by incorporation pursuant to Article 2501 of the Italian Civil Code, resulting in a new entity and involving at least one NIS entity, the entity resulting from the merger is required to register. The participating entities must also report, through the NIS Services, the identifying information of the resulting entity. In the event of transfers of business units related to activities that triggered the application of the NIS Decree, the transferor is instead required to report the identifying information of the transferee (Art. 11, paras. 12 and 13).
This provision confirms that NIS compliance must also be considered in the context of M&A transactions. In particular, it is advisable to include in due diligence activities a review of the NIS status of the companies involved and of the business units being transferred, as well as to stipulate in contractual agreements the obligations of cooperation between the parties and the allocation of responsibilities regarding the notifications to be made to the ACN.
However, the determination does not specify a deadline by which the entity resulting from the merger must complete registration, nor by which the transferor must provide the transferee's details.
Other extraordinary transactions, such as demergers and contributions in kind, remain unregulated. It will therefore be necessary to assess, on a case-by-case basis, the effects of such transactions on the NIS status of the entities involved, also in light of the principles underlying the provisions in question.
2. Identification by the ACN (Art. 13): Clear and Strict Deadlines
Article 13 of the determination further clarifies that entities identified by the ACN and not yet included on the list are required to register within 30 days of receiving the relevant notification. If the notification is received after July 31, registration must instead be completed during the regular registration window scheduled for the following calendar year. For entities already on the list, the notification specifies the procedures to be followed.
3. Consistency Checks (Art. 14): More Rigorous Controls and No Deadlines for the ACN
The determination also strengthens the tools available to the ACN to verify the accuracy and consistency of the information reported by NIS entities. In particular, Article 14 expressly provides for the Authority's ability to use automated tools as part of its ex officio verifications. Furthermore, during such checks, the ACN may request, through the NIS Services, additional information, amendments, or supplements, granting the entity a ten-day deadline to respond. In the event of a late response, the assessment is conducted "based on the information currently available" and may result in the assignment of a NIS Status different from the one previously recognized or resulting from the preliminary automated assessment.
At the same time, the new determination eliminates certain procedural safeguards provided for in the previous determination No. 127437/2026. In particular, the 30-day deadline, extendable by an additional 20 days, within which the ACN was required to rule on the declaration is no longer in effect, nor is the obligation to notify the entity of the positive or negative outcome of the review.
The new framework could lead to a significant imbalance in the management of the proceedings. On the one hand, the entity is required to provide any clarifications or additional information within a particularly short timeframe, and failure to comply may directly affect its NIS classification (consider, for example, the transition from an "important" entity to an "essential" entity, which entails being subject to a more intensive supervisory regime); on the other hand, the ACN is no longer bound by a deadline to complete the reviews and is not required to specifically communicate the relevant outcome, which is formally reflected only in the communications regarding the NIS list, governed by Article 15.
The use of automated tools also warrants attention, as it could allow the ACN to cross-reference the reported information with data available in public databases, such as the Business Register and filed financial statements. It therefore becomes even more important to ensure consistency between the information submitted to the Authority and that found in official sources.
From an organizational standpoint, it will therefore be advisable to ensure constant monitoring of the digital domicile and the ACN Portal, guarantee the availability of the alternate contact person, and establish internal procedures that allow for the timely collection and transmission of the requested information. In the absence of explicit guidance on how to calculate the deadline, it also seems prudent to consider the ten days as calendar days and to organize the handling of any requests from the Authority accordingly.
4. List of NIS Entities (Art. 15): New Annual Cycle and Introduction of the Request for Review
Article 15 of the determination has been completely rewritten, revising the procedures for updating the NIS list and for the consolidation of the list, and introducing a new review procedure. By March 31 of each year, the ACN updates the list for the previous calendar year, accounting for new additions, the continued inclusion of entities already listed (including any changes to their NIS status) and related removals. The entities concerned are then notified of the outcome of the procedure, which may consist of inclusion, retention, or removal from the list, or a determination that the requirements for inclusion are not met. The unique identification code, however, is assigned exclusively to entities included for the first time.
Determination also governs two distinct verification and review mechanisms. On the one hand, within 60 days of the notification, extendable only once for an additional 30 days, the ACN may, on its own initiative, conduct further random verifications. On the other hand, the entity concerned may file a request for review within 60 days of receiving the notification, under penalty of forfeiture. The ACN is required to issue a decision within 60 days, extendable by an additional 30 days, with the deadlines suspended in the event of a request for additional information, which must be provided within ten days. The process concludes with the consolidation of the list by December 31 of each year.
The introduction of the request for review represents one of the most significant changes in the determination, as it offers the entities concerned a specific tool to challenge their inclusion on the list or the NIS status assigned to them. However, its management requires particular attention: the 60-day deadline is subject to forfeiture, making it advisable to promptly begin assessing the organization's position upon receipt of the ACN's notification, preparing any supporting documentation for the request for review.
5. Access to the ACN Portal: CNS and eIDAS
The determination expands the methods of access to the ACN Portal, allowing not only the CIE and SPID but also the CNS and electronic identification tools recognized under the eIDAS Regulation. Furthermore, the requirement for users logging in with personal credentials to provide a national identification code as an alternative to the tax code has been eliminated (Arts. 1 and 8).
This change is particularly beneficial for multinational groups, as it also allows staff and representatives based in other Member States to access the platform. It remains advisable to verify the adequacy of the user accounts associated with the organization and to ensure that all parties involved have active credentials, thereby guaranteeing continuity in the management of ACN compliance obligations and requests.
