For organizations included in the NIS list during 2025, the adoption of basic security measures expires 18 months after receipt of the notification of inclusion. ACN reports that the first deadlines fall in October 2026, but the exact day must be obtained from the notification received from each entity: there is no single date in October valid for everyone. The framework derives from the determinations on the basic specifications and ACN clarifications; the vademecum of 11 September 2026 is an operational tool, not a new postponement of the deadline.

Adoption requires the concrete implementation of the requirements applicable to important or essential subjects, with documentary evidence, risk assessment, procedures and involvement of the administrative and management bodies. It is advisable to close the gaps identified in the technical audits, track decisions and responsibilities, align contracts and supplier oversight, and separately verify the incident notification procedures already in place. The mere formal approval of a policy does not demonstrate the implementation of the technical and organizational requirements.

The timetable differs for those who first entered the list in 2026: basic measures are due by 31 July 2027,  and the notification of basic significant incidents starts from 1 January 2027, according to ACN determination 127434/2026.