Key Takeaways
- Articles 20 and 21 of ACN Determination 127437/2026 regulate the procedural side of activity and service categorization on the ACN platform (ACN platform determination).
- The categorization window runs from 1 May to 30 June of each year through the
Servizio NIS/Categorizzazione(ACN platform determination). - The same determination states that the categories of relevance are defined by a separate ACN model adopted under Article 40, paragraph 5, letter
i)of Legislative Decree 138/2024. As of 15 April 2026, that model had not yet been published in the official sources used here (ACN platform determination). - ACN's news notice of 13 April 2026 says that the categorization-model determination and supporting material for the simplified BIA analysis will be published the following week (ACN news page).
- Financial entities falling under Regulation (EU) 2022/2554 and also within NIS scope are exempt from Article 20, with voluntary adherence still allowed (ACN platform determination).
Scope of This Article
This article explains what organizations can already say with certainty about the ACN categorization process for activities and services, and where the official documentation is not yet complete as of 15 April 2026.
The goal is practical:
- define the procedural obligations already published by ACN;
- separate those procedural obligations from the still-pending categorization model;
- help organizations prepare the underlying work without guessing the missing scoring logic.
The Short Answer: The Procedure Is Published, the Model Is Still Pending
The current official documentation already defines how the categorization process will work on the platform:
| Question | Current official answer |
|---|---|
| When does the process run? | From 1 May to 30 June of each year |
| Which ACN service is used? | Servizio NIS/Categorizzazione |
| Who confirms the submission? | The point of contact |
| Can the submission be modified after the deadline? | No, once the deadline passes it is treated as definitively acquired, subject to the rules on late submissions |
| Who defines the actual relevance categories? | A separate ACN determination adopting the categorization model |
What is not yet fully published, as of the date of this article, is the model that tells subjects how to assign the categories of relevance to activities and services. ACN's own news notice says that model and the related supporting material for the simplified BIA exercise will be published in the following week (ACN news page).
What Article 20 Already Requires
Article 20 of ACN Determination 127437/2026 defines the process for listing and categorizing activities and services (ACN platform determination).
The article already establishes five concrete points:
- from 1 May to 30 June of each year, NIS subjects communicate and update the categorized list of activities and services through the
Servizio NIS/Categorizzazione; - users compile the list of the subject's activities and services and assign the relevance categories defined by the separate ACN model;
- the point of contact confirms the information under Presidential Decree 445/2000 and transmits it electronically to ACN;
- a receipt copy is sent to the subject's digital domicile;
- after the deadline, the categorized list is treated as definitively acquired and no longer modifiable.
That is already enough to conclude that categorization is not an optional analytical exercise. It is a formal platform submission with a fixed annual window, a designated confirmer, and a digital-domicile evidence trail.
The Missing Piece Is the Categorization Model, Not the Obligation
Article 20 is explicit that the categories of relevance are the ones established by the model adopted through the ACN determination referred to in Article 40, paragraph 5, letter i) of the NIS decree (Legislative Decree 138/2024).
That matters because organizations should distinguish between two different layers:
- the obligation to produce and submit a categorized list, which is already published;
- the exact categorization methodology, which depends on the separate model determination.
As of 15 April 2026, ACN has publicly stated that the model determination and supporting information for the simplified BIA analysis will be published in the following week. Until that official model is available, organizations should not invent their own relevance scale and present it as if it were already aligned with ACN's final methodology.
ACN Has Already Framed the Exercise as a Simplified BIA
The ACN news page adds useful context. It states that the forthcoming model determination will be published together with informational material to support subjects in carrying out, in May and June, this simplified impact analysis, described as a simplified BIA shared in the sectoral tables (ACN news page).
This does not yet provide the scoring mechanics, but it does provide a defensible practical signal: the categorization exercise is expected to be impact-driven, not just a descriptive inventory of business activities.
Late Submission Is Possible but Operationally Unfavorable
Article 20 also addresses what happens after the ordinary window.
- Once the 1 May to 30 June window closes, the categorized list is treated as definitively acquired and cannot be further modified.
- Lists submitted after the deadline are considered late.
- Further modification of late lists is precluded unless the delay derives from documented technical-operational issues not attributable to the subject.
This is important for internal planning. A team that waits for the last portal days without aligning business owners, service owners, and evidence sources is not merely risking a rushed filing. It is risking a filing that becomes hard to refine afterward.
Point of Contact and Digital Domicile Are Built into the Control Chain
The procedural design mirrors the rest of the ACN platform workflow. The point of contact is the user who confirms the categorization submission, and the subject receives the receipt through its digital domicile (ACN platform determination).
In governance terms, this means categorization should not be treated as a purely analytical workshop with no formal owner. The output is a formal ACN filing. It needs a responsible internal chain from business analysis to point-of-contact confirmation.
Article 21 Adds a Post-Submission Review Layer
Article 21 regulates ACN's conformity checks on the categorized lists. ACN states that it will analyze, on a sample basis:
- the categorized lists transmitted by NIS subjects against the model determination; and
- the categorized lists transmitted by comparable NIS subjects.
The same article provides the review mechanics:
- ACN responds within 90 days from transmission of the categorized list;
- the term may be extended once for up to an additional 60 days if further analysis is needed;
- if ACN requests integrations, additional information, or changes, the timeline is suspended and restarts upon receipt of the requested material;
- requested integrations or changes must be provided within 30 days;
- omitted or late responses may be grounds for rejection of the categorized list.
ACN communicates the outcome through the NIS services to the subject's digital domicile, with either positive or negative verification.
Deemed Validation Matters
Article 21 also states that, in the absence of the positive-verification communication within the applicable timelines, the categorized list is deemed validated (ACN platform determination).
Operationally, this means the submission does not remain indefinitely open-ended. ACN's control model combines sample review, requests for integration where needed, and a defined validation consequence if no positive communication is sent within the applicable review timeline.
Financial Entities Under DORA Have a Specific Exemption
Article 20, paragraph 6, provides that financial entities under Regulation (EU) 2022/2554 that also fall within the scope of the NIS decree are exempt from the obligations set out in Article 20, while still being allowed to adhere voluntarily (ACN platform determination).
That exemption should be handled carefully. It is specific to Article 20. Organizations should avoid generalizing it to unrelated platform obligations unless the official documentation expressly says so.
What Organizations Can Prepare Before the Model Is Published
The absence of the final categorization model does not mean organizations should wait passively. There is still practical work that can be done without guessing ACN's criteria:
- build a clean inventory of activities and services that are relevant to the entity's NIS perimeter;
- identify internal owners for each activity or service;
- gather the underlying operational and dependency information that a simplified impact analysis is likely to require;
- align the point of contact, business owners, and compliance team on who will validate the final categorized list;
- prepare a filing workflow for the 1 May to 30 June platform window.
The important discipline is to stop at preparation and not convert preparatory hypotheses into asserted ACN categories before the model determination is officially published.
FAQ
Is the categorization obligation already in force even though the model is still pending?
Yes. The procedural obligation is already defined by Articles 20 and 21 of ACN Determination 127437/2026. What is still pending, as of 15 April 2026, is the separate determination containing the categorization model (ACN platform determination, ACN news page).
When does the categorization window open?
Article 20 states that the process runs from 1 May to 30 June of each year through the Servizio NIS/Categorizzazione (ACN platform determination).
Who submits the categorized list?
Users compile the list, but the point of contact confirms the information and transmits it to ACN. A receipt copy is then sent to the subject's digital domicile (ACN platform determination).
Can organizations already assign final relevance categories before the ACN model is published?
The published official documentation used here does not yet include that model. Details are defined in the official ACN categorization-model documentation announced on the ACN news page (ACN news page).
Conclusion
ACN has already published the procedural framework for activity and service categorization on the NIS platform: timing, transmission channel, confirmer, deadline effects, and post-submission review. What remains pending, as of 15 April 2026, is the official model that defines the categorization logic itself. The correct operational posture is therefore to prepare the inventory and governance workflow now, and align the final categorization criteria only once ACN publishes the model determination.