INDUSTRIES, TECHNOLOGY | Guidelines on the Safeguard Clause for Cybersecurity Obligations under the NIS 2 Directive Implementation in Italy

On 10 February 2025, the Decree of the Prime Minister No. 221 (Decree) has been adopted. The Decree provides detailed guidance on the safeguard clause (clausola di salvaguardia, under Italian law) set forth in Article 3.4 of Legislative Decree No. 138 of 4 September 2024, implementing the Directive (EU) No. 2022/2555 of 14 December 2022 (“NIS 2 Directive”) on measures for a high common level of cybersecurity across the Union. According to this provision, cybersecurity obligations apply to entities that are classified as medium or large enterprises in accordance with Article 6 of Recommendation (EC) No. 2003/361 of 6 May 2003 on the definition of micro, small and medium-sized enterprises (Recommendation), which includes affiliates of the relevant entities in the size assessment. The safeguard clause allows entities to exempt themselves from Article 6 of the Recommendation by demonstrating total independence of their IT systems and services from those of other companies within the same group. Entities may request the application of the safeguard clause during registration on the National Cybersecurity Authority (ACN) platform, by declaring compliance with the criteria established in the Decree. The ACN will assess the request and communicate its decision via the same platform. 

Newsletter n. 104 – February 2025