CRA for Italian Manufacturers: ACN, ACCREDIA, Legge 36/2026

Italian manufacturers face the same CRA obligations as every other EU manufacturer. This page is a country brief for Italy: how vulnerability and incident reports route through CSIRT Italia, how ACN sits as both the notifying authority and the market-surveillance authority under Legge 36/2026, where ACCREDIA fits as the accreditation step, how OCSI feeds into the European EUCC scheme, the Italian-language obligations, and which of the Transizione 5.0, PNRR, and SECURE funding lines are realistic for compliance investment. For the full manufacturer obligation set, see the manufacturer cluster guide.

When this guide applies to you

You are the target reader if your manufacturer "main establishment in the Union" is in Italy. That means the place where decisions related to the cybersecurity of your products with digital elements are predominantly taken. An Italian-registered sales subsidiary with engineering offshore is not the main establishment. If your engineering team, your SDLC governance, and the people approving security-update releases sit in Italy, this guide is for you.

If your main establishment is elsewhere in the EU and you only ship into Italy, your CRA reports route through the CSIRT of your main-establishment Member State, not CSIRT Italia. The Italian-language obligation for user-facing information still applies for any product placed on the Italian market.

ACN and CSIRT Italia: the Italian CSIRT route

CRA notifications route through the CSIRT designated as coordinator of the Member State where the manufacturer has its main establishment in the Union. For a manufacturer whose main establishment is in Italy, that CSIRT is CSIRT Italia, the national CSIRT operated within ACN.

ACN, established under Decree-Law 82/2021 (converted by Law 109/2021), is Italy's national cybersecurity authority. It reports to the Prime Minister's office and acts as the single national reference point for cybersecurity policy, certification, and regulation. CSIRT Italia publishes Italian-language vulnerability advisories and operates the consumer-product incident response stream.

The technical channel for the 24h / 72h / 14d reporting cadence is the ENISA single reporting platform, which goes operational on 11 September 2026. An Italian manufacturer files via that platform with CSIRT Italia as the receiving coordinator. The CSIRT designation is the routing. The platform is the transport.

Notified bodies: ACN notifies, ACCREDIA accredits

Important Class I products need a notified body (Module B+C or Module H) only where harmonised standards, common specifications, or a certification scheme do not fully cover them. Important Class II products use a notified body (Module B+C or Module H) or an available and applicable certification scheme. Critical products (Annex IV) follow Article 32(4): the Article 8(1) certification route where the Commission has triggered it, otherwise the same Article 32(3) routes.

The Italian institutional split is:

• ACN is the notifying authority that formally designates Italian notified bodies to the European Commission, anchored in Legge 36/2026 and operationalised by the implementing decree.
• ACCREDIA (Ente Italiano di Accreditamento) is the Italian national accreditation body and assesses the technical competence of a candidate under ISO/IEC 17065:2012. Accreditation is described by ACCREDIA as the preferred tool to attest competence and independence, although it is not a strictly mandatory prerequisite for notification under the CRA.

The CRA framework for notified bodies applies from 11 June 2026, after which designated bodies can begin issuing CRA conformity-assessment certificates. Italian candidates with relevant product-certification expertise include IMQ, RINA Services, Bureau Veritas Italia, and TÜV Italia. Final CRA designations are published in the European Commission NANDO database. An Italian manufacturer can use any EU-notified body, not only Italian-designated ones.

ACN: the CRA market-surveillance authority

Unlike Spain (where the ministry carries market-surveillance) and France (where ANFR does), Italy consolidates both notification and market surveillance inside ACN. Legge 36/2026 identifies ACN as the autorità di vigilanza del mercato under CRA Article 52, alongside its notification role under Article 36.

Every formal CRA interaction by an Italian manufacturer routes through ACN as the single counterpart: reasoned requests for technical documentation, document-language requests, on-site inspections, and the cessation-of-operations notice. The Codice del Consumo (Decreto Legislativo 206/2005) governs general consumer-product safety in Italy through the Ministero delle Imprese e del Made in Italy (MIMIT) and AGCM, but the formal CRA market-surveillance authority for products with digital elements is ACN.

Sanctions sit within the CRA's EU-level ceilings (up to 15 million euros or 2.5% of global annual turnover for the most serious infringements). The Italian implementing decree is expected to set the Italian fines scale within those ceilings.

OCSI and the European EUCC scheme

The Organismo di Certificazione della Sicurezza Informatica (OCSI) is Italy's Common Criteria certification body, housed within ACN since 1 July 2022 (transferred from the former Ministry of Economic Development). OCSI is accredited by ACCREDIA under UNI CEI EN ISO/IEC 17065:2012 to operate within the EUCC scheme adopted under EU Regulation 2019/881.

OCSI's national legacy schema ceased activity on 26 February 2026 and OCSI now operates solely under the EUCC. Under CRA Article 27, EU cybersecurity certification schemes can support presumption of conformity for covered requirements when the scheme is specified by a Commission delegated act. Until the EUCC route is specified for CRA purposes, treat an OCSI-issued EUCC certificate as strong evidence for the covered scope, not as a standalone live shortcut.

Italian-language requirements in practice

The CRA requires user-facing product information to be in a language easily understood by users and the local market-surveillance authority. For products placed on the Italian market, that is Italian. The Codice del Consumo independently requires Italian in consumer product information, so the CRA obligation aligns with a long-standing national rule.

Must be in Italian:

• The user instructions and product information shipping with the product.
• The manufacturer contact details, wherever they appear.
• The end-of-support date disclosure shown at the point of purchase.

Can be multilingual:

• The product label and CE marking.
• Packaging text.
• Online documentation, provided an Italian version is reachable.

English is normally accepted for:

• Internal technical documentation. ACN can request an Italian translation under reasoned request, so plan for that contingency.

The EU Declaration of Conformity may be drawn up in any EU official language, but expect an Italian translation request during any ACN inspection. German in South Tyrol, French in Aosta Valley, and Slovenian in the Friuli Venezia Giulia border zone are co-official under their regional statutes but not CRA-mandated. Regional procurement contracts or sector regulators may add their own language clauses, separately from the CRA.

Selling cross-border from Italy

Italian manufacturers selling into Germany, France, Spain, or any other EU Member State carry the same single-routing rule: your reports still go to CSIRT Italia, because routing follows main establishment, not per-shipment destination. You do not file with the German, French, or Spanish CSIRT.

The language obligation does fan out per market. A product shipped into the French market needs French user-facing content. A product shipped into the German market needs German content. The single Italian-language pack does not cover those markets.

Each receiving Member State's market-surveillance authority can also request your technical documentation in a language easily understood by that authority. If your supply runs broadly across the EU, expect requests in at least one widely-used working language, and treat early translation of the most-requested technical-documentation sections as a practical hedge.

National funding programmes

The funding picture for Italian manufacturers planning CRA investment in 2026 has SECURE, sector-specific regional lines, and the closing Transizione 5.0 and PNRR windows. Be precise about what is still open and technically admissible before you plan a line item against any of these.

• Piano Transizione 5.0 is a MIMIT-administered tax-credit programme with a 6.3 billion euro envelope, tied to eligible digital and energy transformation of production processes. For 2026 planning, verify residual status and technical admissibility before relying on it; do not treat it as a new open-ended cybersecurity or compliance fund. CRA-driven SBOM tooling, vulnerability-handling platforms, and security-by-design infrastructure may fit only where the cybersecurity work is part of eligible production-process transformation.
• SECURE (Strengthening EU SMEs Cyber Resilience) is a new EU-funded project explicitly built to support SME CRA implementation. Total budget around 22 million euros, of which 16.5 million euros is direct financial support to SMEs. ACN is the Italian partner in a 7-country consortium. The first call ran from 28 January to 29 March 2026 with a maximum of 30,000 euros per project. Manufacturers, importers, distributors, and software developers are all eligible. Watch the ACN announcements stream for the next call.
• PNRR (Piano Nazionale di Ripresa e Resilienza) is in its closing window. All NextGenerationEU-funded projects must be executed by 31 August 2026, with Italy's final payment requests due by 30 September 2026. PNRR is therefore not a viable planning vehicle for the 11 December 2027 CRA compliance deadline.
• Regional digitalisation vouchers run through the chambers of commerce remain operational in 2026, typically capped between 20,000 and 30,000 euros per beneficiary. Useful for an initial diagnosis, not for the full CRA programme.

For compliance investment dated against the 11 December 2027 obligation deadline, the realistic public funding picture in Italy is SECURE (and follow-up EU SME programmes), residual or successor Transizione 5.0-style production-transformation incentives where technically admissible, and sector-specific regional lines.

This article is for informational purposes only and does not constitute legal advice. Consult qualified legal counsel for specific CRA compliance guidance.