Italy NIS2 Manufacturing: Why a 30-Employee Distretto Workshop Can Already Be in ACN’s Annex II Scope

Quick summary: If your business manufactures medical devices, electronics, electrical equipment, machinery, motor vehicles, or transport equipment in Italy, NIS2’s Annex II rules put you in scope as an “important entity” once you cross 50 employees or €10 million in turnover or balance sheet — full stop, regardless of how large you grow. But size isn’t always measured at your own front door. If your business is majority-owned by, or holds a majority stake in, another company, Italian and EU rules require you to add both companies’ headcounts and finances together before checking the threshold. In Italy’s manufacturing distretti — dense clusters of small, family-run workshops linked through holding structures, consortia, and supply contracts — that detail changes the answer for more businesses than the headline size test suggests.

This guide walks through Italy’s Annex II scope test, ACN’s categorization process once you’re in, the two ways a small workshop ends up covered anyway, and what the OT security reality looks like on an Italian factory floor.

Does NIS2’s Manufacturing Scope Apply to Your Business in Italy?

Italy transposed NIS2 through Legislative Decree No. 138 of 4 September 2024, in force since 16 October 2024. The decree confirms the National Cybersecurity Agency (ACN — Agenzia per la Cybersicurezza Nazionale) as Italy’s single competent authority, its national CSIRT, and the single point of contact for all NIS2 matters.^[1]

Manufacturing sits in Annex II of the Directive, under six defined sub-sectors:

Source: Annex II, Directive (EU) 2022/2555.^[4]

Size is measured against Article 2 of the Annex to Commission Recommendation 2003/361/EC: a medium-sized enterprise employs 50–249 people, or turns over more than €10 million, or holds a balance sheet over €10 million (up to the €43 million large-enterprise ceiling).^[2] Annex II sectors are also treated differently from sectors like energy or transport (Annex I): growing past the large-enterprise threshold doesn’t upgrade a manufacturer to “essential” status. Manufacturing entities stay classified as important entities at any size above the medium threshold, unless Italy specifically designates an individual company otherwise. That matters for expectations: important entities face reactive, evidence-triggered supervision rather than the proactive audits essential entities face — but the Article 21 security obligations and fine exposure are largely the same either way.

Does this apply to you? Quick decision tree:

• Do you manufacture in one of the six categories above? If no, Annex II manufacturing rules don’t apply (check other Annex I/II sectors separately).
• Do you, on a standalone basis, employ 50+ people or turn over/hold a balance sheet above €10 million? If yes, you’re in scope as an important entity.
• If you’re under 50 employees and €10 million standalone — are you majority-owned by, or do you hold a majority stake in, another company? If yes, see the aggregation rules below before assuming you’re excluded.
• Are you a direct or indirect supplier to a company that is itself in scope? If yes, see the supply-chain section below — you can be contractually pulled into security requirements even while remaining formally out of ACN’s registration scope.

The ACN Annex II Test — And Where “Linked Enterprises” Change the Answer

In plain terms: a small workshop’s own payroll isn’t always the number that decides NIS2 scope. If it’s tied by ownership to another firm, the two firms’ numbers may have to be added together first.

Italy’s manufacturing base is unusually concentrated in distretti industriali — more than 200 recognised industrial districts that together employ over two million people, roughly 40% of Italy’s entire manufacturing workforce and 60% of jobs in classic “Made in Italy” categories (fashion, home furnishings, food, mechanical engineering). These districts are built on what researchers call “network capitalism”: dense webs of small, often family-owned firms subcontracting to one another rather than one large integrated factory.^[9]

That structure creates a scope question NIS2’s headline size test doesn’t answer cleanly. Under Article 2(1), size is checked against the Annex to Recommendation 2003/361/EC, which distinguishes three relationships: autonomous firms (measured alone), partner enterprises (a 25%–50% non-majority stake, aggregated proportionally), and linked enterprises (a majority stake either way, fully consolidated).^[10] A 30-employee workshop that looks safely under the 50-employee threshold on its own books can be pulled over it the moment it’s majority-owned by — or holds a majority stake in — a partner firm in the same supply chain, because linked-enterprise data must be added together in full, not averaged or excluded.

Two things are worth being precise about here. First, being in a district is not the same as being linked: most distretto relationships are contractual subcontracting, not equity ownership, and contractual proximity alone doesn’t trigger aggregation. Second, Recital 16 of the Directive gives Member States room to weigh a firm’s actual operational independence from its partner or linked enterprises when assessing medium-sized status — a non-binding interpretive note, not a fixed formula, and ACN has not yet published district-specific guidance applying it.^[3][10] In practice, this means the safe move for a district workshop isn’t to assume the 50-employee line protects it — it’s to check whether a consorzio, family holding company, or cross-shareholding sits behind the workshop’s cap table before ruling NIS2 out.

How ACN Categorizes Your Factory Once You’re In Scope

In plain terms: registering with ACN isn’t the end of the process — you then have to categorize every activity your business runs, and that categorization drives how much security effort you actually need to show.

Once registered, ACN’s Determination n. 155238/2026 requires in-scope entities to categorize their own activities and services across ten predefined macro-areas: monitoring and control, production of goods and services, research/development/design, financial management, customer management, human resources, logistics, communication and marketing, administrative management, and other services.^[5] Manufacturing entities use Annex 1 of the determination (the model shared with traditional critical sectors), with each activity assigned one of four relevance levels — high, medium, low, or minimal — based on how disruptive a compromise would be to operational continuity. Categorization submissions were due by 30 June 2026, and ACN has stated categorizations can be revised later if a business documents an objective justification (a new production line, a changed technical dependency).^[5]

ACN clarified at an industry event in April 2026 that proportionality flows from these relevance levels, not just from essential/important status: a 60-employee manufacturer isn’t expected to run a 24/7 security operations centre, but it does need to show a systematic, documented approach to managing cyber risk in whichever macro-areas score high or medium relevance — typically “production of goods and services” for a factory floor.^[6] ACN also confirmed that the supplier-relevance assessment required under Article 21(2)(d) isn’t limited to IT vendors: “non-fungible” suppliers — those whose unavailability would meaningfully disrupt production, even if they supply components rather than software — count too.^[6] For a distretto manufacturer, that typically means the specialist tooling supplier or single-source component subcontractor down the road, not just the ERP vendor.

OT Security Realities: Legacy Machinery, District Supply Chains, and Article 21

For IT/OT teams: the compliance obligation and the operational reality don’t line up neatly on an Italian factory floor, and that gap is where the actual project work sits.

ACN’s own Cyber Index PMI 2025 survey of 1,500+ Italian SMEs put the average digital-security maturity score at 55 out of 100 — below the 60-point sufficiency threshold, though up three points from 2024. The weakest sub-score was risk identification, at 47/100, against a stronger 62/100 for having a stated strategic approach.^[7] That gap — companies that say they take cybersecurity seriously but score poorly at actually identifying where their risk sits — is exactly the pattern you’d expect on factory floors where 15- and 20-year-old PLCs and CNC controllers were never designed to run modern endpoint agents, and where IT and OT networks were connected for convenience long before anyone documented the connection.

The threat picture backs up the urgency, if not the panic: according to CLUSIT’s 2026 report, Italy absorbed roughly 9.6% of all cyber incidents recorded worldwide in 2025, with Italian attack volume up 42% year-over-year, and Italian manufacturers alone drew 16% of all attacks aimed at the global manufacturing sector.^[8] None of that means every distretto workshop is a live target — smaller shops without internet-facing OT are a lower-probability target than an export-facing assembly plant — but it does mean Article 21(2)(e)’s network security requirements and Article 21(2)(d)’s supply-chain obligations aren’t paperwork exercises for Italian manufacturing specifically.

Article 21(2)(d) is also the mechanism that pulls small suppliers into compliance work even when they’re formally outside ACN’s registration scope. Article 21(2)(d) requires in-scope entities to address “security-related aspects concerning the relationships between each entity and its direct suppliers or service providers,” and the Directive’s recitals push entities to weigh the cybersecurity practices of those suppliers, not just their own systems — in practice, that means passing security clauses down to subcontractors by contract, regardless of the subcontractor’s own headcount. A distretto workshop that never registers with ACN can still find itself asked to sign a supplier security declaration, provide incident-notification commitments, or submit to a security questionnaire because its customer’s supply-chain security policy requires it. For continuity planning specific to OT environments — where a cold SCADA or PLC restart can take days, not hours — see our manufacturing business continuity guide.

What Happens If You Get Italy’s Manufacturing Scope Wrong

In plain terms: the cost of guessing wrong on scope isn’t just a registration headache — it’s exposure to the same fine ceiling as any other important entity, plus the reputational cost of a customer finding out mid-audit that your supply-chain paperwork isn’t in order.

Under NIS2’s baseline (transposed into Italian law), important entities face fines up to €7 million or 1.4% of worldwide annual turnover, whichever is higher, with a minimum floor and escalating multipliers for repeat violations. We cover Italy’s specific fine mechanics, floor calculations, and enforcement posture in full in our Italy NIS2 penalties and enforcement guide — this article focuses on getting the scope call right in the first place, since a wrong scope assumption is what leads to a missed registration deadline, not the other way round.

A practical checklist for a distretto manufacturer assessing scope:

• Confirm your Annex II category against the six sub-sectors above (Low effort)
• Run the standalone size test — 50 employees, €10 million turnover or balance sheet (Low effort)
• Check your cap table for partner/linked ownership — consorzio membership, family holding structures, cross-shareholdings with other district firms (Medium effort — often requires a conversation with your commercialista or corporate lawyer)
• Review customer contracts for supply-chain security clauses even if you’re out of ACN’s direct scope (Medium effort)
• If in scope, register and complete ACN’s categorization across the ten macro-areas before the annual deadline (High effort first year, lower in subsequent years)

For a broader view of how the essential/important distinction and general registration mechanics work across all sectors, see our NIS2 scope and size-threshold guide and our Italy NIS2 country overview.

Frequently Asked Questions

Does a 30-employee workshop ever need to worry about NIS2 in Italy?

Only if it’s linked or partnered to another enterprise whose aggregated headcount or financials push the combined figure over the medium-enterprise threshold, or if a customer’s supply-chain security policy requires compliance-adjacent commitments regardless of formal ACN scope. A genuinely autonomous 30-employee workshop with no equity ties above the reporting thresholds is not, on its own, in Annex II scope.

Is manufacturing an essential or important entity category in Italy?

Important, in essentially all ordinary cases. Manufacturing sits in Annex II, and Annex II entities remain “important” regardless of size unless Italy specifically designates an individual company as essential under the Directive’s narrow criteria — which does not happen through growth alone.

What’s the actual ACN categorization deadline for manufacturers?

Categorization submissions under ACN’s Determination n. 155238/2026 were due by 30 June 2026 for entities already registered at that point; newly registered entities work from their own notification date. Categorizations can be revised later with documented justification.

Do I need to worry about NIS2 if I only supply an in-scope manufacturer, but I’m not registered myself?

You can still face contractual security obligations. Article 21(2)(d) requires in-scope entities to manage supply-chain risk down to their direct suppliers, and ACN has confirmed this covers non-fungible suppliers of components and services, not just ICT vendors. Expect security questionnaires, declarations, or clauses from customers even without a registration obligation of your own.

Sources

1. ACN — La normativa (Legislative Decree 138/2024)
2. NIS2 Directive, Article 2 — Scope
3. NIS2 Directive, Recital 16
4. NIS2 Directive, Annex II — Other Critical Sectors
5. GamingTechLaw — NIS2 Categorization in Italy: ACN’s Operational Guidance
6. Cybersecurity360.it — NIS2, i chiarimenti di ACN
7. ACN — Cyber Index PMI 2025
8. InnovationPost — Rapporto Clusit 2026
9. Fondazione Edison — Complessità e distretti industriali
10. Arthur Cox — NIS2 & SME guidelines: How do they apply and thresholds

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.