Cyber Resilience Act: Italy’s decree gives ACN market oversight

On 2 October 2026 the Italian Council of Ministers gave preliminary approval to the draft legislative decree that aligns Italian law with the Cyber Resilience Act (CRA, EU Regulation 2024/2847), the regulation on cybersecurity requirements for products with digital elements. The key point: the National Cybersecurity Agency (ACN) becomes the notifying authority for conformity assessment bodies and the market surveillance authority.

The full text is not yet available: what is known comes from the Council of Ministers press release no. 191, analysed by Cybersecurity360, ICT Security Magazine and Agenda Digitale. The draft now goes to the parliamentary committees and the Council of State for their opinions and may still change. Part of the European regulation, however, already applies and does not wait for the decree.

What the draft decree provides

• ACN as notifying authority: it notifies the Commission of the bodies that will carry out conformity assessments. Assessing and monitoring those bodies remains with the national accreditation body.
• ACN as market surveillance authority, with the option of calling on the Guardia di Finanza (Italy’s financial police).
• Other authorities within their remit: for products that are also high-risk AI systems, the authorities named in Italy’s AI rules; Bank of Italy, Consob and IVASS for supervised financial institutions; the Italian data protection authority for personal data. The authorities coordinate, including through information-sharing agreements.
• Consumers: they will be able to report vulnerabilities, incidents and threats directly to CSIRT Italia; CRA infringements are added to the matters covered by representative actions for collective interests.
• SMEs and start-ups: a dedicated advisory channel, defined by ACN and the Ministry of Enterprises and Made in Italy, and proportionate fees for conformity assessment.
• CRA sandbox: a regulatory sandbox supervised by ACN, with controlled test environments before products are placed on the market, priority access for micro and small enterprises, and coordination with the sandboxes for financial services and AI.

The designations were already set out in Article 15 of Law no. 36 of 17 March 2026 (the 2025 European Delegation Law). ICT Security Magazine points out that the delegation allows the decree to exceed the general €150,000 cap on administrative fines set by Law 234/2012: without that exception the CRA’s maximum fines could not be applied.

The open question on penalties

According to Agenda Digitale, the draft leaves each authority to apply penalties under its own procedures. ICT Security Magazine flags an open point: for ACN, the sanctioning procedure should be governed by a regulation provided for by Article 17(4-quater) of Decree-Law 82/2021, due by October 2024, which the publication could not find among published acts. Until it exists, Law 689/1981 applies. The publication presents this as a negative result on the sources it could consult, not as a certainty.

The European maximums (Article 64 of the CRA, applicable from 11 December 2027) reach €15 million or 2.5% of worldwide annual turnover, whichever is higher, for breaches of the essential requirements and of the obligations in Articles 13 and 14, and €10 million or 2% for a second group of obligations, including those of importers and distributors.

Already in force: reporting since 11 September 2026

The CRA entered into force on 10 December 2024 and applies in stages:

• 11 June 2026: Chapter IV, notification of conformity assessment bodies;
• 11 September 2026: Article 14, manufacturers’ reporting obligations;
• 11 December 2026: by this date Member States must ensure a sufficient number of notified bodies;
• 11 December 2027: general application, with the essential requirements of Annex I and the penalties.

Since 11 September manufacturers must report two kinds of events: an actively exploited vulnerability in the product and a severe incident affecting the security of the product. The deadlines run from when they become aware of it:

• early warning within 24 hours;
• notification within 72 hours;
• final report within 14 days after a corrective or mitigating measure is available, for vulnerabilities, or within one month of the notification, for incidents.

Reports go through the single reporting platform run by ENISA, via the endpoint of the coordinating CSIRT of the Member State where the manufacturer has its main establishment: in Italy this is CSIRT Italia, which operates within ACN. Separate obligations under the GDPR and NIS2 still apply.

The Commission’s guidelines on Article 14 (content approved on 27 July 2026, pending formal adoption in all languages) clarify two points. The obligation also covers products placed on the market before 11 December 2027 and continues after the end of the support period. A manufacturer “becomes aware” when, after an initial assessment, it reaches a reasonable degree of certainty about the exploitation or the incident, a notion aligned with NIS2 and the GDPR.

Impact for Italian and European companies

The CRA covers anyone who, in the course of a commercial activity, places on the market hardware and software with a data connection to a device or network. Manufacturer obligations also apply to importers and distributors that sell under their own name or trademark or that substantially modify the product; open source software distributed outside any commercial activity is excluded. Organisations that are also NIS2 entities may have to report the same event through more than one channel.

What to do now

1. Inventory your products with digital elements on the market, including those out of support: the reporting obligation applies to them too.
2. Write the reporting procedure: who assesses a suspicious event, who decides when the company “becomes aware”, who sends the early warning within 24 hours, and with what access to the platform.
3. Monitor exploited vulnerabilities in the components of your products, starting from the component list and public advisories such as those from CSIRT Italia.
4. Set up a channel for external reports from researchers and customers, with defined response times.
5. Coordinate CRA, NIS2 and GDPR in a single procedure that routes the same event to the right recipients.
6. Follow the decree’s progress: final text, sanctioning procedure, the SME channel and access to the CRA sandbox.

How ARXDOME helps

ARXDOME does not replace the product vulnerability handling process required by the CRA, but it helps on the infrastructure side. ARX Shield shows open vulnerabilities by machine and by package, highlighting those already exploited by attackers; ARX Horizon enriches events with threat lists and vulnerabilities. ARX Retain keeps logs for the required number of years, useful for reconstructing an incident timeline when it has to be documented within the deadlines.

Last updated: 8 October 2026