NIS2: ACN extension gives valuable time, but hackers (and penalties) don’t go on vacation
Good news. : In a May 23 statement, the National Cybersecurity Agency moved from May 31 to July 31, 2025 the deadline to update your data on the NIS2 registry-and for those who had not yet completed their initial registration, there is an “escape clause” until March 10, 2025. But beware of thinking that summer is a regulatory lethargy: while you’re dreaming of umbrellas, cybercriminals are scheduling attacks andACN continues to tally up fines.
The ACN waiver in three lines
- What is it? An official deferral to July 31, 2025 for the annual NIS2 update.
- For whom does it apply? For all NIS2 entities that have opened ACN support tickets or complete the procedure by the new deadline.
- Why does it pay off? Reduces (not eliminates) the risk of sanctions by up to 2 percent of global turnover for core entities and 1.4 percent for major entities.
Calendar (without vacations)
Fulfillment | Ordinary window | New dead-line | Operational Notes |
First registration | Dec 1, 2024 – Feb 28, 2025 | Mar 10, 2025 | Safeguard clause for practices already started |
Data update 2025 | May 31, 2025 | 31 Jul 2025 | Communication ACN 23 May 2025 |
Sanctions & co.
Legislative Decree 138/2024 provides for fines of up to 10 M€ / 2 % turnover (essential entities) and 7 M€ / 1,4 % (important). Late registration can mitigate the penalty, but other violations-incident-response deficient, governance absent-reopen the meter.
NIS2 roadmap: how we take you “from risk to outcome”
Phase | What NIS2 is asking for | How Eurosystem intervenes |
1. Applicability | Classification essential / important | ATECO + supply-chain assessment |
2. Gap analysis | Risk mapping & controls | ISO-27001-aligned audit, risk scoring |
3. Adjustment plan | Policy, encryption, MFA, business continuity | Dedicated project management and hardening |
4. Governance & training | Involve CDA, appoint contact point. | “Cyber in boardroom” workshop, continuous e-learning |
5. ACN registration & update | Initial entry, annual updates | Delegated management on the portal, document set |
6. Incident handling | Notification within 24 h / 72 h | Custom playbooks and shared threat-intel |
7. Continuous monitoring | Periodic audits, vulnerability mgmt | Quarterly reporting & evolutionary advisory |
Who we are : Our experts sit in the CYBER 4.0 government Competence Center and today we work alongside dozens of large companies Italians, guiding them through compliance and active advocacy programs and lifelong learning beyond NIS2.
Why act now
- Average cost of a ransomware attack for a large enterprise: 1,85 M€ . (i-com.co.uk)
- Each day of delay increases exposure to operational blockages, data loss, and reputational damage.
- Hackers do not wait for Ferragosto (nor ACN).
Conclusion
ACN extension is the air conditioning lowering the temperature, not the “turn off server” button. Put the NIS2 check on the agenda first get off for the vacations: with Eurosystem at the helm and CYBER 4.0 as an accelerator, your company can turn a regulatory obligation into a structural digital resilience upgrade.
Contact us for cybersecurity consulting.