2026-10-28 - Who is inside NIS2: qualification, size and the clauses that change the scope
Second article in the
series NIS2 in Italy, beyond the deadlines
, introduced in the
first article on the method for reading the sources
. Sources updated as of 24 October 2026.
A small Italian company is part of a group. It does not operate on the market in any of the sectors listed by the NIS Decree, but it manages on a continuous basis the IT systems of an affiliate that is an essential entity. On the basis of size, the company would appear to be outside the scope. The Italian Decree, however, contains a rule that brings it in regardless of size, and that rule is not found in the articles of the Directive.
The case illustrates the thesis of this article. Qualification as a NIS entity is not a self-assessment to be carried out once and for all, but an assessment that is renewed every year with registration and the communication from the National Cybersecurity Agency. The reading errors to avoid do not concern the general rule, but the exceptions: groups, linked enterprises, entities included regardless of size.
The general rule and its sources
builds the scope on two elements: the type of activity, described in Annexes I and II, and size, measured with the parameters of Recommendation 2003/361/EC. As a rule, it applies to entities that are at least medium-sized enterprises (Article 2(1)). The same article lists the cases in which size does not matter, and allows Member States to extend application to local public bodies (paragraph 5).
Legislative Decree No. 138 of 4 September 2024 (NIS Decree)
takes up the structure in Article 3 and enriches it. The scope includes entities of the types in Annexes I, II, III and IV subject to national jurisdiction; for Annexes I and II the threshold is exceeding the ceilings for small enterprises (paragraph 2). The Directive and the Decree apply to individual legal persons, as the Agency recalls in the
: the analysis must be conducted entity by entity, even within a group.
Inclusions regardless of size
The Decree brings within the scope, regardless of size, several categories of entities.
- By type of activity (Article 3, paragraph 5): critical entities identified under the rules transposing the CER Directive, providers of public electronic communications networks or services, trust service providers, top-level domain name registries, DNS service providers and domain name registration service providers.
- Public administrations (paragraphs 6 and 7): the administrations falling within the categories of Annex III. According to the Agency’s FAQs, these are all central administrations and, among local ones, regions and autonomous provinces, metropolitan cities, municipalities with a population of more than 100,000 inhabitants, regional capital municipalities and local health authorities, together with other public bodies, including economic regulation bodies, bodies producing economic or welfare services, research bodies and institutions, and experimental zooprophylactic institutes. It is here that Italy exercised, for local authorities, the option under Article 2(5), point (a), of the Directive, which adds to the inclusion of regional-level bodies provided for by Article 2(2), point (f)(ii).
- By identification by the Authority (paragraphs 8, 9 and 13): entities of Annex IV and entities identified by the Agency, on a proposal from the sectoral authorities, because they are already operators of essential services, the sole national providers of an essential service, critical because of the impact of a disruption, or systemic elements of the supply chain of essential or important entities. I will return to this last case, which gives meaning to the list of relevant suppliers, in the article on relevant suppliers.
- Linked enterprises (paragraph 10): an enterprise linked to an essential or important entity falls within the scope, regardless of size, if it adopts or dominantly influences the decisions on that entity’s security measures, if it holds or manages systems on which the provision of its services depends, if it carries out its cybersecurity operations, or if it provides it with ICT or security services, including managed ones.
The last case deserves attention. It has no textual counterpart in the articles of the Directive and is, in my view, one of the most incisive choices of the Italian legislator, consistent with the minimum harmonisation allowed by Article 5 of the Directive. Its logic is clear: the security of an essential entity cannot depend on a group company that governs its systems and remains outside the framework. The practical effect is equally clear: in a group, the mapping of centralised functions, from IT management to security, is part of qualification.
Calculation within groups and the safeguard clause
To establish whether an entity is a medium-sized or large enterprise, the Decree refers to the criterion of the Recommendation (Article 3, paragraph 4). The aggregation of data depends on the type of relationship: an autonomous enterprise considers only its own accounts; the data of partner enterprises are added in proportion to the shareholding; those of linked enterprises are added in full (Annex to the Recommendation, Article 6). The parameters are the headcount and, as alternatives to each other, turnover or the balance sheet total. The result may be that a small company of a large group is considered, for NIS purposes, a large enterprise.
To avoid disproportionate outcomes, the Decree provides for the safeguard clause, which allows that calculation not to be applied, taking into account the entity’s independence from the linked enterprises as regards systems and services. The Directive provides its basis in recital 16. The criteria are set by
Decree of the President of the Council of Ministers No. 221 of 9 December 2024
; the request is submitted at the time of registration, under Article 12 of
(which replaced Determination 127437/2026 from 25 October 2026), and the outcome is communicated with the notice of inclusion or exclusion.
The Agency’s FAQs delimit its use: the clause does not concern autonomous enterprises, because they have no data to consolidate; it is not available to entities brought in as linked enterprises under paragraph 10; it cannot be granted when the entity’s systems depend, even residually, on those of the group. It is, in essence, a tool for those who demonstrate effective technical autonomy, not a size-based exemption.
Essential or important
Once inside the scope, the entity is either essential or important. Article 6 of the Decree qualifies as essential, among others, entities of Annex I that exceed the ceilings for medium-sized enterprises, critical entities under the CER rules, providers of electronic communications that are medium-sized enterprises, qualified trust service providers, top-level domain name registries and DNS service providers, central administrations. The Agency may also qualify as essential, regardless of size, entities brought in by other routes (paragraph 2). All the others are important (paragraph 3).
The distinction is not nominal. It determines the applicable baseline measures (Annex 1 or Annex 2 of
), the types of incident to be notified, the intensity of supervision and the amount of penalties. Each of these aspects will be the subject of the next articles.
Qualification as an annual process
The Decree does not provide for a qualification measure issued once and for all. It provides for a cycle (Article 7): registration or updating of registration from 1 January to 28 February of each year; drawing up of the list by the Agency by 31 March; communication to entities of inclusion, continued inclusion or removal. The
indicates that the communication arrives by 14 April.
Determination 314287/2026 specifies what is declared (Article 11) and, from the 2027 registration, exempts entities already on the list from a new declaration where no changes have occurred compared with the previous year’s declaration: in that case they remain on the list with the status already assigned (Article 11, paragraphs 1 and 11). The entity indicates whether it is part of a group and who the parent company is, lists the linked enterprises in respect of which one of the criteria of paragraph 10 applies and those that satisfy them in its regard, the ATECO codes, the relevant European sector-specific legislation, the data on turnover, balance sheet and employees, the types of entity to which it can be traced. The platform returns an automatic preliminary assessment, which the point of contact confirms.
Three procedural elements make the declaration demanding.
- It is made by the point of contact under Presidential Decree 445/2000 and the Determination refers to liability for false declarations (Article 3, paragraph 5). I confine myself to pointing out this aspect, which is criminal in nature.
- Ten days after submission, the declaration is definitively acquired and can no longer be amended, except in the case of late declarations, which are processed in the reference year only if submitted by 1 September (Article 11, paragraphs 8 and 9).
- The Agency, in agreement with the sectoral authorities, carries out sample consistency checks (Article 14), and a negative outcome does not relieve the entity of the registration obligation.
An outline of the criteria
.tbl-wrap{overflow-x:auto;margin:1.5rem 0}table.compare{width:100%;border-collapse:collapse;font-size:.92rem}table.compare th{background:#26215c;color:#fff;padding:.6rem .7rem;text-align:left;vertical-align:top}table.compare td{padding:.55rem .7rem;border-bottom:1px solid #ddd;vertical-align:top}table.compare tr:nth-child(even) td{background:#f4f4f8}table.compare td:first-child{font-weight:600}.tbl-note{font-size:.85rem;font-style:italic;margin-top:.4rem}@media(prefers-color-scheme:dark){table.compare td{border-bottom:1px solid #444}table.compare tr:nth-child(even) td{background:#1e1e2a}}
QuestionWhat mattersSource
Which legal person is being examined?The analysis is conducted for each individual entity, even within groups.ACN FAQs on scope
Does the activity fall within the Annexes?Types of entity in Annexes I and II; categories of Annex III for public administrations; Annex IV for the further types.Legislative Decree 138/2024, Article 3(1), (6) and (8)
Does the size exceed the thresholds?Exceeding the ceilings for small enterprises, with consolidated calculation within groups.Article 3(2) and (4)
Does an inclusion regardless of size apply?Types under Article 3(5); public administrations of Annex III; identification by the Agency.Article 3(5), (6), (9) and (13)
Is the entity linked to a NIS entity?Decisions on security measures, management of systems, security operations, ICT or security services.Article 3(10)
Is the group calculation disproportionate?Safeguard clause, only with effective independence of systems and services.Article 3(4) and (12); Decree of the President of the Council of Ministers 221/2024
Essential or important?Annex, size, type; possible qualification by the Agency.Article 6
Does a special framework apply?For financial entities subject to DORA, specific exclusions and exemptions.Article 3(14) and (15)
An example
Let us return to the initial case: a group company, small in size even after the aggregation of data, manages on a continuous basis the information systems of an affiliate qualified as an essential entity and does not provide services to third parties.
The first step concerns the activity. The continuous management of another entity’s systems corresponds in the abstract to a type in Annex I, that of managed service providers in the ICT service management sector; the Agency’s FAQs specify that services provided within the group are not distinguished from those provided to third parties, and that those who satisfy the criteria of paragraph 10 may also be traced to those types. By this route, however, the company remains outside the scope, because it does not exceed the ceilings for small enterprises.
The second step concerns paragraph 10, which disregards size. One of the four criteria is enough. The management of the systems on which the provision of the affiliate’s services depends satisfies point (b); the provision of ICT services, including managed ones, satisfies point (d), and the FAQs clarify that services offered residually are also relevant. The company therefore falls within the scope regardless of size. The safeguard clause is of no use to it: according to the Agency’s FAQs, it is not available to entities brought in as linked enterprises.
The affiliate’s declaration, which in its own registration lists the linked enterprises that satisfy the criteria of paragraph 10 in its regard, serves the Agency to identify the company; it is not what creates the precondition, which lies in the substantive relationship, and the company’s registration obligation remains in place (Determination 314287/2026, Article 11, paragraph 3).
If the affiliate were not a NIS entity, paragraph 10 would not operate. If the systems managed were not those on which the provision of the services depends, point (b) would fall away, but points (c) and (d), which do not require that dependence, would remain to be verified: the occasional nature of the service is not, in itself, an exclusion criterion provided for by paragraph 10.
Final remarks
In my view, the Italian scope is broader than the size rule suggests, for two reasons that operate together: the linked enterprises of paragraph 10, which bring in centralised group functions, and the local public administrations of Annex III, which derive from an option under the Directive exercised in an extensive sense. To this is added identification by the Agency, which allows the inclusion of entities critical for the supply chain.
The second point is procedural. Since qualification passes through annual declarations with significant legal effects, its correctness depends on the quality of internal information, particularly within groups, where size data, control relationships and centralised functions are often spread across several entities.
Practical guidance. The critical point is not the verification of the main activity, but the reconstruction of group relationships and centralised functions; one mistake to avoid is treating qualification as an established fact rather than as a declaration to be reconfirmed every year.
Reference documents
European Union
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3 and 5 and recital 16:
http://data.europa.eu/eli/dir/2022/2555/oj
- European Commission, guidelines on Article 3(4) of the NIS2 Directive:
Italy
- Legislative Decree No. 138 of 4 September 2024, Articles 3, 6 and 7:
- Decree of the President of the Council of Ministers No. 221 of 9 December 2024 (safeguard clause):
- ACN Determination 314287/2026:
- ACN Determination 379907/2025:
- ACN, FAQs on the scope of application:
- ACN, FAQs 1-5 on the details of the areas of application:
- ACN, FAQs on registration:
- ACN, NIS Vademecum:
This article is for general information purposes and does not constitute legal advice. The framework is updated as of 24 October 2026. The qualification of an entity depends on its specific situation and must be verified against the official texts.
New to Gemini? This capsule is best read with a Gemini client, such as Lagrange.