NIS2 and software suppliers: what D.Lgs. 138/2024 really requires
Have you received a security questionnaire from a client who is a 'NIS2 subject'? D.Lgs. 138/2024 does not automatically make you a subject — a supplier falls within scope only in two specific cases — but it does require your client to assess your security practices, including secure development procedures. A technical reading for software suppliers: who is actually in scope, the ten minimum measures the questionnaire mirrors, the deadlines running from ACN notification, and the penalties, with cited articles.
The security questionnaire has arrived. Now what?
One of your clients is a «NIS2 subject» and asks you how you develop, update and protect the software you provide them. Legislative Decree 138/2024 read from the supplier's perspective: what really concerns you, what doesn't, and why.
This is a technical reading, not legal advice: every obligation and every term mentioned refers to the article of the decree from which it originates.
In summary: what you need to know if you provide software
NIS2, transposed in Italy by Legislative Decree 138/2024 (in force since 16 October 2024), does not automatically make a software supplier to a regulated company a «subject». What it does is more subtle: it obliges your customer to assess the security of their own suppliers — and that obligation reaches you contractually, in the form of questionnaires, clauses and requests for evidence.
- «If your customer is NIS2, so are you» is false: a supplier falls within scope only in two specific cases (art. 3) — individual designation by the ACN or a related company in a corporate sense.
- Your customer must nevertheless assess you (art. 24, par. 3): vulnerabilities, product quality, security practices — «including their secure development procedures».
- There is no single deadline: the timeframes run from the individual notification by the ACN to each subject (art. 42), not from a date on the calendar.
- Penalties also affect individuals: art. 38 provides for personal liability of management, not only of the company.
Who is subject to NIS2 (and who is not)?
Art. 3 defines the scope using two criteria that must be read together: what you do (the types of activities listed in Annexes I and II) and how big you are (above the thresholds for small enterprises). Both are required — with a few exceptions that are subject regardless of size: telecommunications, trust services, TLD registries, DNS, registrars (para. 5) and public administrations (para. 6).
The key takeaway for readers of this blog: a small generalist software house is not subject to NIS2. And those operating in financial sectors follow the DORA framework for the main obligations (paras. 14-15): two regimes that should not be confused.
The only two doors through which a supplier enters scope
«If your client is NIS2, so are you» is the most widely repeated phrase — and it is false. The decree does not provide for any automatic chain-of-supply contagion: a supplier becomes subject only in two cases, both written in art. 3.
-
Individual designation by the ACN
The Agency may designate a company as a «systemic element of the supply chain, including digital» (art. 3, c. 9, lett. f) — with individual notification (c. 13). It is a specific decision, not a general rule.
-
Company linked to the subject
The LINKED company in a corporate sense (rec. 2003/361/EC) that provides ICT services or manages systems of the regulated subject (art. 3, c. 10). Linked means shareholdings and control — not «has a contract with».
If you are not in either of these cases, the decree does not impose direct obligations on you. But this does not mean that NIS2 does not concern you — it means it reaches you through another door: the contract.
What your client is required to ask you (art. 24, c. 3)
The heart of the matter for software providers lies in a single paragraph. Regulated entities, when managing supply chain risks, «shall take into account the specific vulnerabilities of each direct supplier [...] and the overall quality of products and cybersecurity practices of their suppliers [...], including their secure development procedures» (art. 24, c. 3).
Read it from the right perspective: it is an obligation of the customer, not yours. But the customer can fulfil it in only one way — by asking you. This is where security questionnaires, contractual clauses on patching and incident response, and requests for evidence of development practices come from. Those who respond well and quickly become the supplier that makes life easier for the regulated customer; those who cannot respond become the risk to be replaced. The selection has already begun, and it is not driven by the ACN: it is driven by procurement departments.
The ten minimum measures reflected in the questionnaire (art. 24, c. 2)
The questionnaires you receive are not invented by the client: they almost always mirror the ten measures that the decree imposes on regulated entities. If you know how to answer these ten items — for your supplier perimeter — you know how to answer any NIS2 questionnaire:
- 1. Risk analysis and information systems security policies
- 2. Incident management
- 3. Business continuity: backup, disaster recovery, crisis management
- 4. Supply chain security — yes, including your suppliers
- 5. Secure development: security in acquisition, development and maintenance, vulnerability management
- 6. Effectiveness assessment of the measures adopted
- 7. Basic cyber hygiene and training
- 8. Cryptography and, where applicable, encryption
- 9. Personnel security and access control
- 10. Multi-factor authentication and secure communications
We have publicly answered these ten items, one by one, on the Security and compliance page: it is the questionnaire filled in before it even arrives.
Don't look for «the NIS2 deadline»: it doesn't exist
1/1 – 28/2
Annual registration
Entities register (or update their data) on the ACN platform; the list is established by 31 March (art. 7).
+9 months
Notification obligations
The obligations to notify incidents (art. 25) apply nine months FROM the individual communication by the ACN (art. 42, c. 1, lett. c).
+18 months
Measures and governance
The obligations under arts. 23, 24 and 29 — including the ten minimum measures — apply eighteen months from the same communication (art. 42).
1/1 – 28/2
Annual registration
Entities register (or update their data) on the ACN platform; the list is established by 31 March (art. 7).
+9 months
Notification obligations
The obligations to notify incidents (art. 25) apply nine months FROM the individual communication by the ACN (art. 42, c. 1, lett. c).
+18 months
Measures and governance
The obligations under arts. 23, 24 and 29 — including the ten minimum measures — apply eighteen months from the same communication (art. 42).
The practical consequence: two identical companies can have different deadlines, because the timer starts from the communication each one receives via the platform — not from a date in the Official Gazette. If your client is rushing you, the right question to ask them is: «when did you receive the ACN communication, and what does your plan provide?». The detailed operational specifications are in ACN determinations that we do not cite here: they must be verified on acn.gov.it in the current version.
The sanctions, with the source (art. 38)
For essential entities, sanctions reach up to 10 million euros or 2% of annual global turnover, whichever is higher; for important entities up to 7 million or 1.4%. Minor violations: up to 0.1% and 0.07% of turnover. For public administrations: from 25,000 to 125,000 euros. Repeated infringements may double or triple the amounts, and late registration compounds the violations.
However, the point that changes conversations in boardrooms is another one: paragraphs 5 and 6 provide for the personal liability of management and executive bodies. This is not an issue that can be delegated to IT: it concerns the director, not just the company. It is also the reason why supplier questionnaires are being filled in with increasing care — whoever signs is personally accountable. Keep in mind, however, the scope: these sanctions apply to regulated entities, not to their suppliers. For you, as a supplier, the risk is not the fine: it is losing the client.
Frequently asked questions about NIS2 and suppliers
No. A supplier falls within scope only in two cases (art. 3 of Legislative Decree 138/2024): if the ACN individually designates it as a systemic element of the supply chain, or if it is a corporate-related company providing ICT services to the regulated entity. A contract with a regulated client is not enough — but it brings with it questionnaires and security clauses, because the client is required to assess its suppliers (art. 24, c. 3).
It is the European cybersecurity directive, transposed in Italy by Legislative Decree 138/2024, in force since 16 October 2024. However, operational obligations do not have a single date: they run from the individual notification that each entity receives from the ACN — nine months for incident notifications, eighteen for security measures (art. 42).
A generalist small software house is not: it requires both a type of activity listed in Annexes I-II and a size above the small enterprise thresholds (art. 3). Exceptions, regardless of size, include telecommunications, trust services, TLD registries, DNS, registrars, and public administrations.
Art. 24, c. 3 requires taking into account the specific vulnerabilities of each direct supplier, the overall quality of products and security practices, «including their secure development procedures». In practice: questionnaires, contractual clauses on patches and incidents, requests for evidence.
For essential entities up to 10 million euros or 2% of global turnover; for important entities up to 7 million or 1.4%; minor violations up to 0.1%/0.07%; public administrations from 25,000 to 125,000 euros (art. 38). Paragraphs 5-6 provide for the personal liability of management bodies. Sanctions apply to regulated entities, not their suppliers.
Did you receive a security questionnaire?
We have already publicly answered the ten measures of art. 24, point by point. If your current supplier can't do the same — or if you are the supplier and want to understand how to get ready — let's talk.
Sources and methodological note
Primary source: Legislative Decree 138/2024 (Official Gazette, in force from 16 October 2024), Italian transposition of the NIS2 directive. Reference verification carried out on the text published on 3 August 2026. Articles cited: 3, 7, 24, 25, 38, 42.
This article is the technical reading of those who develop and supply software, not legal advice: for application to your specific case, the opinion of a professional is required. The operational determinations of the ACN ("basic specifications" and platform terms) are not cited as they must be verified on acn.gov.it in the current version. Information accurate as of the publication date.
