Legislative Decree No 138 of 4 September 2024, which transposed Directive (EU) 2022/2555, the NIS2 Directive, has been in force since 16 October 2024 and requires the entities falling within its scope to register, or to update their registration, on the platform of the Italian National Cybersecurity Agency (ACN) from 1 January to 28 February of each year (Normattiva). For manufacturing, the annexes identify certain sectors by the economic activity code of the NACE Rev. 2 classification. A medium-sized undertaking producing ceramics, rolled metal products, plastic goods or paper does not find its code in that list and may be led to conclude that it is excluded. The conclusion may be hasty: point 3 of Annex II looks not at the code but at the role of the undertaking under Regulation (EC) No 1907/2006, REACH.
The manufacturing divisions listed by code
In the Directive, Annex I, among the sectors of high criticality, includes in the health sector the entities manufacturing basic pharmaceutical products and pharmaceutical preparations in division 21 of NACE Rev. 2. Annex II, in point 5, devoted to manufacturing, lists medical devices and in vitro diagnostic medical devices, identified by reference to the respective regulations, and undertakings carrying out the activities in divisions 26 (computer, electronic and optical products), 27 (electrical equipment), 28 (machinery and equipment n.e.c.), 29 (motor vehicles, trailers and semi-trailers) and 30 (other transport equipment); point 4 concerns food businesses engaged in wholesale distribution and industrial production and processing (EUR-Lex). The annexes of Decree No 138 of 2024 reproduce the same approach (Normattiva). According to the Agency’s FAQs, for these subsectors what matters is the substantial economic activity attributable to any group, class or category of the division indicated (ACN).
Among others, the manufacture of paper and paper products (division 17), of chemicals (division 20), of rubber and plastic products (division 22), of other non-metallic mineral products (division 23) and the manufacture of basic metals (division 24) remain outside the list by code (EUR-Lex). The absence of the code from the list does not close the assessment, which continues on the ground of chemicals legislation.
Point 3 of Annex II: three roles defined by REACH
Point 3 of Annex II, “Manufacture, production and distribution of chemicals”, covers “Undertakings carrying out the manufacture of substances and the distribution of substances or mixtures, as referred to in Article 3, points (9) and (14), of Regulation (EC) No 1907/2006” and “undertakings carrying out the production of articles, as defined in Article 3, point (3), of that Regulation, from substances or mixtures” (EUR-Lex). The text does not identify a product sector, but three legal positions defined by another act.
REACH defines as manufacturer any person established within the Union who manufactures a substance within the Union; as distributor any person who only stores and places on the market a substance, on its own or in a mixture, for third parties; and as article “an object which during production is given a special shape, surface or design which determines its function to a greater degree than does its chemical composition” (EUR-Lex). The third category, the production of articles, is the one that may extend the scope well beyond the chemical industry in the strict sense, because the definition of article describes most of the finished products of manufacturing.
The Agency’s FAQs specify that the sector includes, as important entities, organisations that exceed the ceilings for small enterprises, “to which Regulation 2006/1907/EC (REACH) applies” and which fall within at least one of the types of manufacturer of substances, distributor of substances or mixtures, producer of articles; they add that entities exempted from the registration obligations of Title II of REACH, under its Article 2, do not fall within the Decree for this sector (ACN). The scope therefore depends, ratione materiae, on qualifications belonging to chemicals legislation.
The size thresholds: beyond the small enterprise
Under Article 2(1), the Directive applies to entities in Annexes I and II that qualify as medium-sized enterprises under Recommendation 2003/361/EC or that exceed its ceilings (EUR-Lex). The Italian Decree formulates the same threshold the other way round: it applies to entities that exceed the ceilings for small enterprises in Article 2(2) of the Annex to the Recommendation (Article 3(2)), and for linked or partner enterprises it refers to the aggregation of data provided for in Article 6(2), unless this is not proportionate (Article 3(4)) (Normattiva). The Recommendation defines a small enterprise as one which employs fewer than 50 persons and whose annual turnover or annual balance sheet total does not exceed EUR 10 million (EUR-Lex).
The Agency clarifies that the obligation concerns the individual legal persons, the legal entity, and not the group, without prejudice to the size calculation that takes account of linked and partner enterprises (ACN). For the sectors in Annex II, an undertaking exceeding the threshold is as a rule an important entity, because Article 6 of the Decree reserves the status of essential entity, among others, to Annex I entities that exceed the ceilings for medium-sized enterprises (Normattiva).
Cases for self-assessment: non-metallic minerals, basic metals, rubber and plastics, paper
On the basis of these definitions, we consider that certain high-impact sectors should conduct the assessment with particular care. These are hypotheses, not conclusions: the outcome depends on the activity actually carried out and on the position of the undertaking under REACH.
A non-metallic minerals undertaking that obtains tiles, slabs or shaped products from mixtures of raw materials may find itself in the position of producer of articles. A metallurgical undertaking must ask itself whether what it places on the market qualifies as a substance, a mixture or an article, because the answer determines its role. Those who process polymers into rubber or plastic components, and those who produce paper and paper products, may fall within the same category of producers of articles. In each case, the precondition set by the FAQs, the applicability of REACH to the organisation, and any exemption under Article 2 of that Regulation remain to be verified. For many manufacturing undertakings the decisive question is not what their code is, but what role they play under REACH.
An undertaking may fall within the scope by more than one route: a machinery manufacturer in division 28 is included by code and, for products with digital elements, is also affected by other Union acts, in line with the overlap of scopes that we examined in relation to NIS 2, DORA and the Cyber Resilience Act.
The registration deadlines on the Agency’s platform
Article 7 of the Decree sets an annual timetable. From 1 January to 28 February entities register or update their registration; by 31 March the Agency draws up the list of essential and important entities and notifies registered entities of their inclusion, continued inclusion or removal; from 15 April to 31 May the entities included provide further information, including the public IP address space, domain names and the persons responsible; any change must be notified within fourteen days (Normattiva). The Agency recalls that the first deadline was 28 February 2025 (ACN). An undertaking that now recognises that it falls within the chemicals sector therefore faces the window opening on 1 January 2027, with a registration that, in our view, will be late in respect of the years already elapsed. Once registered, it will also be exposed to the Agency’s supervisory activity, which we discussed in relation to NIS 2 inspections.
Critical aspects: the burden of self-assessment and the cost of omission
The first aspect concerns the allocation of the burden. The Agency’s FAQs indicate that organisations, before registering, must carry out a three-step self-assessment, concerning jurisdiction, size and attributability to the types of entity (ACN). The burden of establishing whether one is in or out falls entirely on the undertaking, and in the case of point 3 the assessment requires expertise in chemicals law that often does not belong to those who deal with cybersecurity within the company. In our view the self-assessment should be documented in writing, with the contribution of those who manage REACH compliance, even when it concludes with exclusion.
The second aspect concerns the consequences. Article 38(10)(a) of the Decree penalises the failure to register, communicate or update the information provided for in Article 7; for important entities the penalty may reach 0.07 per cent of the total worldwide annual turnover of the preceding financial year, without prejudice to the statutory minimum amounts in paragraph 9 (paragraph 11(b)). Paragraph 13 adds that, in the event of failure to register or late registration, “all the infringements provided for in paragraphs 8 and 10 are in any event charged” and the penalty provided for the most serious infringement applies, increased up to threefold (Normattiva). Those who fail to register do not remain outside the regime, but are charged with all the infringements in paragraphs 8 and 10, including those relating to risk management and incident notification.
Conclusions
For a manufacturing SME, membership of the NIS2 scope is not exhausted by comparing its activity code with the divisions listed in the annexes. Point 3 of Annex II opens a second route, which passes through the REACH categories and, in particular, through the production of articles from substances or mixtures. The undertaking remains responsible for qualifying its own role under REACH, for the size calculation and for the decision to register; the Agency’s FAQs on the chemicals sector do not, at present, contain sector-specific indications that reduce the uncertainty. It is advisable to carry out and document the self-assessment before the January window, involving together the functions responsible for cybersecurity and those that manage chemicals compliance, so as to approach registration, or its reasoned exclusion, with a verifiable assessment.
Author: Valentina Grazia Sapuppo
