ACN NIS Platform: Registration, Annual Update, and Continuous Update

Key Takeaways

• The ACN platform does not manage one single filing. It manages a recurring compliance cycle: registration, annual update of information, and continuous update of changes.
• Under Article 11 of ACN Determination 127437/2026, registration runs from 1 January to 28 February of each year through the Servizio NIS/Dichiarazione (ACN platform determination).
• Under Article 16, annual update runs from 15 April to 31 May of each year through the Servizio NIS/Aggiornamento annuale informazioni (ACN platform determination).
• Under Article 19, continuous update is available only after the annual update has been completed and remains available until 14 April of the following year (ACN platform determination).
• The governing and management bodies remain responsible for supervising registration, communication, and information updates under Article 23 of Legislative Decree 138/2024 and Article 2 of the ACN determination (Legislative Decree 138/2024).

Scope of This Article

This article explains how the ACN NIS platform handles three different obligations that organizations often confuse:

1. initial or recurring registration;
2. annual confirmation and update of organizational information;
3. continuous update of changes occurring after the annual cycle.

The focus is operational. The goal is to help organizations structure an internal calendar, assign ownership, and avoid treating the platform as a one-off filing exercise. The detailed access model for point of contact, substitute, and CSIRT contact is covered in the dedicated article on roles and user association in this same series.

The Short Answer: The ACN Platform Follows a Yearly Compliance Cycle

For organizations that fall within the NIS scope, the ACN platform should be managed as a recurring governance workflow, not as a single annual deadline. The core sequence set by ACN Determination 127437/2026 is:

This lifecycle is supported by the ACN news notice published on 13 April 2026, which announced the new determinations on obligations for newly listed entities and access to the ACN platform (ACN news page).

Platform Use Is the Mandatory Channel

Article 3 of the platform determination states that subjects communicate with the national NIS competent authority, including for census, association, and registration, exclusively through the NIS services or the dedicated section of the ACN website, except where ACN expressly provides otherwise or in force-majeure situations (ACN platform determination).

In practice, this means the organization should not treat the platform as a front-end detail delegated at the last minute. The platform workflow is the formal channel through which registration and updates are executed and evidenced.

Registration: What Happens Between 1 January and 28 February

Article 11 provides that, from 1 January to 28 February of each year, users compile the declaration for the subject through the Servizio NIS/Dichiarazione, ensuring that the information provided is correct and updated (ACN platform determination).

The registration stage is not limited to basic identity data. The declaration includes, among other items:

• group-structure information if the subject is not an autonomous undertaking;
• information on linked undertakings relevant under Article 3, paragraph 10, of Legislative Decree 138/2024;
• ATECO codes describing the subject's activity;
• EU sectoral legislation used to identify the type of subject;
• turnover, balance-sheet, and employee-count information used to determine whether the subject qualifies as a medium or large enterprise, with the stated exception for public administrations on turnover and balance-sheet values;
• the subject types under Annexes I, II, III, and IV of the NIS decree to which the organization is attributable.

The platform can flag inconsistencies automatically during completion. Where inconsistencies are detected, the user must either correct the declaration or provide additional supporting information. At the end of completion, the point of contact confirms the information and transmits it electronically to ACN, with a receipt sent to the entity's digital domicile.

Two operational details matter:

• declarations submitted or modified after the ordinary registration window are treated as late, unless delay derives from documented technical-operational issues not attributable to the subject;
• after ten calendar days from submission, the declaration is treated as definitively acquired and can no longer be modified, except for declarations classified as late.

Annual Update: The Real Compliance Maintenance Window

Article 16 is the operational core for organizations already managed through the ACN platform. From 15 April to 31 May of each year, users update information through the Servizio NIS/Aggiornamento annuale informazioni and are responsible for its correctness (ACN platform determination).

This stage is broader than a simple contact refresh. For all NIS subjects, users must verify and update:

• point-of-contact data and, where required, the delegation granted by the legal representative;
• substitute point-of-contact data and related delegation where applicable;
• segreteria data, if a segreteria user is present;
• the subject's identity and contact data, including tax code, legal name, registered-office address, legal representative, list of general attorneys, phone number, digital domicile, and functional ordinary email address;
• the list of governing and management body members who are the natural persons responsible under Article 38, paragraph 5, of Legislative Decree 138/2024;
• where applicable, the list of services falling within Directive (EU) 2022/2555 and the Member States in which they are offered;
• public IP addressing space and domain names in use or available to the subject;
• the list of information-sharing agreements;
• the identifying data of the CSIRT contact and any substitutes;
• the list of relevant NIS suppliers.

Additional annual-update fields apply in specific cases:

• NIS subjects covered by Article 7, paragraph 5, of the decree must verify the list of their establishments in the Union and their addresses;
• subjects under Article 5, paragraph 1, letter b), that have designated a NIS representative in Italy must verify that representative's identity and contact data.

The practical implication is simple: annual update is not just a portal obligation. It forces the organization to refresh governance data, supplier data, technical perimeter data, and communication-chain data in one coordinated cycle.

Late Registration Changes the Follow-Up Timeline

Article 16, paragraph 11, adds an important exception. In case of late registration, the deadline to complete the annual update is set at 30 days from receipt of the communication referred to in Article 7, paragraph 3, letter a), of the decree (ACN platform determination).

That means an organization cannot assume the standard 15 April to 31 May calendar always applies in practice. If registration occurs late, the annual-update obligation compresses into a shorter follow-up window. This is one of the clearest reasons to prepare document ownership, contact data, governance records, and supplier information before the platform cycle opens.

Continuous Update: Not Optional Once Facts Change

Article 19 governs what happens after the annual cycle. Once the annual update has been perfected, if information transmitted under Article 16 subsequently changes, users must provide updated information through the Servizio NIS/Aggiornamento continuo informazioni (ACN platform determination).

Two points are operationally decisive:

1. continuous update is available only after completion of the annual update;
2. the service remains available until 14 April of the following year.

This design matters because it turns change management into a regulated compliance process. If the legal representative changes, if general attorneys change, if CSIRT contacts change, if digital-domicile data changes, or if other submitted information becomes inaccurate, the platform is the channel through which the subject should keep its information aligned.

Where the point of contact confirms a change to the legal representative or the list of general attorneys, that modification is subject to validation by the subject itself through the telematic procedure sent to the digital domicile. Receipts for subject changes are sent to the subject's digital domicile, while receipts for user-data changes are sent to the user's PEC or, secondarily, to the user's ordinary email address.

Governance Responsibility Sits Above the Platform Team

Article 2 of the ACN determination states that governing and management bodies supervise registration, communication, and information updates under Article 7 of the NIS decree and are responsible for related violations. The same article also recalls that failure to register, communicate, or update information is punishable under Article 38 of Legislative Decree 138/2024 (ACN platform determination, Legislative Decree 138/2024).

This is the right governance framing for boards and executive teams. The platform workflow can be operationally delegated, but legal accountability for registration and updates cannot be treated as a back-office matter with no board oversight.

How Organizations Should Structure the Workflow Internally

The ACN determination does not prescribe an internal project-management method. It does, however, make it clear which data families and approval chains must be reliable. A workable internal model usually includes:

• a pre-registration review of group structure, ATECO, sector qualification, and size metrics;
• an annual update package covering legal data, board and management bodies, supplier list, domains and public IPs, service footprint, and CSIRT contacts;
• a change-log process used after annual update to trigger continuous updates when submitted information changes;
• a documented check on digital-domicile ownership and message monitoring, because validations and receipts depend on that channel.

For many organizations, the operational bottleneck is not the platform itself. It is the lack of a maintained evidence base behind the platform data. That is where documentation structure, ownership mapping, and periodic control design become decisive.

FAQ

Is annual update the same thing as registration?

No. Registration and annual update are separate processes with different time windows and different ACN services. Registration runs from 1 January to 28 February under Article 11. Annual update runs from 15 April to 31 May under Article 16 (ACN platform determination).

Can an organization use continuous update without first completing annual update?

No. Article 19 states that continuous update operates after annual update has been perfected. It is not a substitute for the annual cycle (ACN platform determination).

What information is typically touched during annual update?

Annual update covers subject data, governance data, point-of-contact and substitute data, segreteria data where present, CSIRT contacts, domains, public IP space, information-sharing agreements, and relevant NIS suppliers. Details are defined in Articles 16 to 18 of the official ACN determination (ACN platform determination).

What happens if registration is late?

The determination states that, in case of late registration, annual update must be completed within 30 days of receipt of the communication under Article 7, paragraph 3, letter a), of the decree (ACN platform determination).

Conclusion

The ACN platform should be managed as a yearly control cycle with three distinct operational moments: registration, annual update, and continuous update. Organizations that map owners, maintain source records, and treat digital-domicile validations as part of governance will be better positioned to keep NIS information accurate and defensible over time.

Official Sources

• ACN news page: online the determinations on obligations for new subjects and access modalities to the ACN platform
• ACN Determination 127437/2026 on access modalities to the ACN platform and NIS services
• Legislative Decree 138/2024 implementing the NIS2 framework in Italy