Italy's 'Legal Requirement' to Follow ACN's PQC Guidance Doesn't Exist. The Real Mechanism Is Less Specific and More Powerful.

A specific legal claim circulates about Italy's post-quantum cryptography posture: that Italian law requires entities to verify their cryptographic solutions comply with ACN's guidance. We checked. That specific requirement doesn't exist. What does exist is less precisely targeted and, in a real sense, more consequential.

The claim that doesn't survive checking

ACN (Agenzia per la Cybersicurezza Nazionale), Italy's National Cybersecurity Agency, published "Crittografia Post-Quantum e Quantistica: Preparazione alla Minaccia Quantistica" in July 2024 -- a real, substantive overview of post-quantum and quantum cryptographic alternatives and international developments. ACN also joined a joint statement with roughly 21 other EU national cybersecurity agencies (an initiative led by Germany's BSI, November 2024), addressing PQC transition scenarios, main vulnerabilities, and precautions, tied to ongoing cooperation in the EU's NIS Cooperation Group.

Both documents are real and worth reading. What isn't real is a specific legal requirement sometimes attributed to them: that Italian entities must verify their cryptographic solutions comply with ACN's guidelines, as a standalone statutory obligation. We checked directly, and no such specific law exists tying verification duties to this particular guidance document.

What actually governs instead

The real mechanism is broader and less precisely aimed at PQC specifically. Italy's NIS2 transposition decree, D.Lgs. 138/2024, designates ACN as the national competent and supervisory authority with general power to set baseline security measures -- cryptography among them, alongside incident response, supply-chain security, and other standard NIS2 elements -- for regulated NIS entities. ACN can conduct compliance inspections under this authority, with the enforcement phase beginning October 2026.

That's a meaningfully different kind of power than "follow this specific PQC guidance document." It's general supervisory authority that happens to cover cryptography as one baseline measure among several, exercised against a defined regulated population (NIS2-covered entities), with a real inspection mechanism and a concrete start date. The guidance document gives ACN's technical thinking; the NIS2 decree gives ACN actual teeth -- they're not the same instrument, and conflating them overstates what the guidance itself requires while understating what the decree actually does.

Banca d'Italia is doing real work, just not regulatory work

Italy's central bank has substantive PQC engagement that's easy to mistake for supervisory guidance. Banca d'Italia participated in BIS Project Leap Phase 2, testing quantum-resistant cryptography in real-world payment systems -- the same multilateral pilot Germany's Bundesbank is involved in, giving Italy direct technical visibility into live cross-border PQC implementation rather than secondhand roadmap references. That's genuine, dated, substantive work.

It's not a circular. Banca d'Italia hasn't required Italian banks to adopt PQC or produce a cryptographic inventory -- the Project Leap work is research and experimentation, not supervisory instruction. If you're a Banca d'Italia-regulated institution looking for a binding requirement here, there isn't one yet, even though the central bank is clearly paying close technical attention to the problem.

CONSOB (securities) and AGCOM (telecom) haven't engaged at all -- CONSOB's cybersecurity material is general operational-resilience content with no PQC specifics, and no AGCOM deliberation or circular on the topic was found.

What to do with this

If you're a NIS2-regulated entity in Italy, October 2026's inspection phase is the actual compliance event to prepare for -- not a PQC-specific audit, but a general baseline-security review where cryptographic practices are one element ACN can examine. Treating ACN's July 2024 guidance as the de facto expectation for that review, even without a direct statutory link, is a reasonable and low-risk approach given ACN wrote both the guidance and holds the inspection authority.

If you're a Banca d'Italia-regulated bank, there's no PQC requirement today, but the central bank's direct involvement in live cross-border testing is a stronger signal about future direction than most countries' banks get from their regulators at this stage.

The Italy country page tracks both tracks with their primary sources.