Does Italy have a post-quantum cryptography (PQC) law?

Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is ACN (Agenzia per la Cybersicurezza Nazionale).

What is Italy's PQC migration deadline?

None. No migration deadline has been published for Italy by any regulator we checked, including ACN (Agenzia per la Cybersicurezza Nazionale).

Does Italy require a Cryptographic Bill of Materials (CBOM)?

No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.

ITRegulated

Italy

Italy's ACN has published PQC transition guidance (July 2024) and joined a 21-agency EU joint statement, but there is no binding, economy-wide PQC mandate, no published migration deadline, and no explicit CBOM/inventory requirement. Enforcement teeth exist only indirectly via NIS2's general supervisory regime (D.Lgs. 138/2024, inspections from Oct 2026), not via this guidance itself.

Italy's post-quantum cryptography posture is classified as regulated, led by ACN (Agenzia per la Cybersicurezza Nazionale). It scores 30/100 on this tracker's rubric, an early-stage or narrowly-scoped rule, and that is not a measure of how secure or advanced the country actually is.

What's verified

ACN (Agenzia per la Cybersicurezza Nazionale) published guidance titled "Crittografia Post-Quantum e Quantistica: Preparazione alla Minaccia Quantistica" (July 2024) on preparing for the quantum threat, giving an overview of post-quantum/quantum alternatives and international developments. Separately, ACN joined other EU national cybersecurity agencies (on the initiative of Germany's BSI) in a joint statement (co-signed by ~21 agencies, Nov 2024) on the transition to post-quantum cryptography, describing transition scenarios, main vulnerabilities, and precautions, and referencing ongoing PQC cooperation in the EU NIS Cooperation Group (this joint statement is published by ACN as a separate document, "PQC-joint-statement-ita.pdf," distinct from the guidance PDF cited as the source). However, there is no specific Italian law requiring entities to "verify cryptographic solutions comply with ACN guidelines" in the sense asserted. What exists is broader: Italy's NIS2 transposition decree (D.Lgs. 138/2024) designates ACN as the national competent/supervisory authority with general powers to set baseline security measures (including cryptography) for regulated NIS entities and to conduct compliance inspections (enforcement phase from Oct 2026), a general regulatory-supervision framework rather than a standalone legal mandate tied specifically to this PQC guidance document.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	10/20	ACN's PQC material is non-binding guidance, but Italy's NIS2 transposition decree (D.Lgs. 138/2024) gives ACN binding supervisory power to set baseline security measures (including cryptography) for regulated NIS entities, with an enforcement/inspection phase from Oct 2026, i.e. binding for a regulated subset, not economy-wide, so 10 not 20.
Deadline concreteness	0/20	The source states no specific year(s) for a PQC migration deadline, only that NIS2 enforcement phase begins Oct 2026 for general supervision, and no transition year is given anywhere in the cited ACN guidance or joint statement, so 0.
Scope of coverage	10/20	Coverage is tied to NIS2-regulated entities under ACN's supervisory authority (D.Lgs. 138/2024), a specific regulated population rather than economy-wide or all critical infrastructure, matching the 'specific regulated sectors' tier.
Inventory/CBOM requirement	0/20	No explicit cryptographic inventory or CBOM mandate is named in the source; the evidence only describes guidance on PQC transition scenarios and vulnerabilities, with no risk-assessment obligation described that would plainly require an inventory, so 0.
Regulatory activity	10/20	ACN is the named competent/supervisory authority under NIS2 with a described inspection mechanism starting Oct 2026, but the cited PQC guidance itself carries no enforcement teeth and the verifier notes no statute ties verification obligations specifically to this document, so teeth exist only at the general NIS2 level, warranting 10 rather than 20.
Total	30/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

Banca d'Italia (Bank of Italy)
In progress, no guidance yet
Banca d'Italia's activity is research/experimental (participation in cross-border PQC pilots, including BIS Project Leap Phase 2 testing quantum-resistant cryptography in real-world payment systems) rather than a supervisory circular requiring banks to adopt PQC or produce a cryptographic inventory.
"Project Leap Phase 2: results of testing quantum-resistant cryptography in real-world payment systems" →
CONSOB (securities regulator)
Not yet addressed, a gap to watch
CONSOB's cybersecurity page covers general operational-resilience material with no PQC or CBOM content.
AGCOM (telecom regulator)
Not yet addressed, a gap to watch
No deliberation, circular, or dated concrete step attributable to AGCOM on this topic was located.

FAQ: Italy and PQC

Does Italy have a post-quantum cryptography (PQC) law?: Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is ACN (Agenzia per la Cybersicurezza Nazionale).
What is Italy's PQC migration deadline?: None. No migration deadline has been published for Italy by any regulator we checked, including ACN (Agenzia per la Cybersicurezza Nazionale).
Does Italy require a Cryptographic Bill of Materials (CBOM)?: No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.