A million euros for compliance through data: the 1 and 30 October 2026 deadlines
7 min read
If you build or buy systems that make somebody else’s compliance automatic — document checks, regulatory filings, traceable data exchange — you have two days for a decision that cannot be undone. On Thursday 1 October, at 17:00, the European filing window closes on a call that describes your trade precisely. The one million euros Italy has placed alongside that call closes a month later, on 30 October. But nobody reaches the second appointment having skipped the first: this is not a queue, it is a turnstile.
Two dates, and the filter between them
The MIMIT directorial decree of 22 September 2026 (ref. R.0002694), signed by the Directorates-General for Business Incentives and for New Enabling Technologies, opens national co-funding on the DG CONNECT call under the Digital Europe programme: DIGITAL-2026-AI-DATA-10-COMPLIANCE, Digital solutions for regulatory compliance through data, rendered in the decree’s Italian as «soluzioni digitali per la conformità normativa attraverso i dati».
First date. The deadline for the proposal to DG CONNECT, through the EU Funding & Tenders - Portal Submission System, «è stata fissata alle ore 17:00 del 1° ottobre 2026». Second date. The national application goes in «entro e non oltre le ore 17:00 del 30 ottobre 2026, in via esclusivamente telematica tramite l’indirizzo di posta elettronica certificata dgiai.div06@pec.mimit.gov.it», with the Annex 1 form and the documents listed in Annex 2, «il tutto firmato digitalmente […] pena l’irricevibilità»: all digitally signed, on pain of inadmissibility.
Between the two sits Article 2(4): «Possono accedere alla fase istruttoria nazionale solo i progetti di ricerca e sviluppo presentati secondo le modalità di cui al precedente comma 2 e che abbiano superato la selezione a livello transnazionale» — only projects that cleared the transnational selection reach the national appraisal. The million is not a scheme of its own: it is an appendix to Thursday’s filing.
The million, the 50% and a ranking that does not weigh the science
The resources «ammontano a € 1.000.000,00, a valere sulle economie delle risorse di cui al Decreto Ministeriale»: what is left of the NRRP investment on European research and innovation partnerships (Mission 4, Component 2), activated by the ministerial decree of 16 December 2022 and amended on 13 June 2023. The Ministry «si riserva la facoltà di integrare […] con ulteriori risorse europee e nazionali disponibili»: an option to top it up, not a commitment.
The aid comes «nella forma del contributo diretto alla spesa, per una percentuale nominale dei costi e delle spese ammissibili pari al 50%» — a direct grant on a nominal 50% of eligible costs — within the GBER maximum intensities (Articles 25, 25a and 25c). One million at 50% covers few projects, and the decree says what happens then: under Article 3(6) a national ranking does not reassess scientific quality — Brussels has weighed that — but the applicant’s economic and financial solidity over the last two approved sets of accounts: coverage of fixed assets, financial independence, the weight of financial charges and of gross operating margin on turnover. In the Annex 6 table that block is worth 27 points out of 100 (four awarded automatically, since no subsidised loan is on offer). On a tie, «prevale il progetto con il minor costo presentato»: the cheaper project wins. The pass mark is 70 points, with minimums of 20, 20 and 13 across the three criteria.
Who may apply, and who finds out too late
The decree does not list the beneficiaries: it refers back to Article 10(1) of the ministerial decree of 16 December 2022. The list is readable in the Annex 5a declaration, already published: undertakings under Article 2195(1) and (3) of the Civil Code, artisan firms included; agro-industrial firms whose activity is mainly industrial; firms with the ancillary activities of point (5) for the former; research centres. Research organisations get their own definition in Article 1 — universities, institutes, technology transfer agencies, with separate accounting for any economic activity — and separate treatment: their assessment stops at technical and organisational capacity, and they file no accounting declaration.
Three requirements exclude more applicants than they seem: ordinary accounting records, at least two approved sets of accounts (own, consolidated, or the parent’s), and a project not yet started at the date of application. Joint projects need the network contract of Article 3(4-ter) of decree-law 5/2009 — or another associative form with a mandate to the lead partner — as a public deed or authenticated agreement, attached to the application or produced within 15 days of a positive appraisal. And one requirement many still have open: being in order with the catastrophe insurance obligation under Article 1 of decree-law 39/2025, declared through Annex 5d.
The file, and the stamp that stays in the safe
The templates are no longer an announcement: as we write, the ministerial page publishes the annexes numbered 1 to 12 — from the application form to the development plan, from the eligibility declarations to the anti-money-laundering one — plus an archive for reporting. Annex 2 lists twelve items, among them the accounting declaration countersigned by the board of statutory auditors or the auditor, and the proposal filed in Brussels. As with the Cloud & Cybersecurity voucher window, the material already exists: it is scattered.
Then the detail that tells you the rest. The 16.00 euro duty stamp is cancelled by entering its identification number on the application, and «deve essere conservata in originale presso la sede o gli uffici del soggetto richiedente per eventuali successivi controlli»: kept in the original at your premises for any later check (Article 12 of presidential decree 642/72). It is not attached. It is kept. What leaves by certified email on 30 October is not the file: it is the first page of one somebody will reopen years from now.
What you are actually signing
The award decree goes back signed within ten days, on pain of forfeiture. From there run 36 months at most, with the project started within three months of the decree, on pain of revocation. Payments arrive «in non più di 5 soluzioni, più l’ultima a saldo» — five at most — against progress reports «relativi a un periodo temporale pari a un semestre o a un multiplo di semestre», a half-year or a multiple: the first within eighteen months of the decree, again on pain of revocation. An advance of up to 30% is possible against a guarantee payable on first demand, and 10% is held back to the balance.
Financial reporting is not a summary sheet. Hours, says Annex 12, «devono essere rilevate in appositi registri di presenza (timesheet)», signed by the individual and their line manager and countersigned by the project manager; the CUP project code goes on every administrative and accounting document; evidence is kept «presso la propria sede, in originale». Of the fifteen grounds for revocation in Article 9, two deserve a line at board level: ceasing or relocating the activity outside the territory within five years of completion (three for SMEs), and a relocation operation under Article 16(1) of the Incentives Code, legislative decree 184/2025. Full revocation, repayment and interest.
The awkward symmetry
The call asks you to automate somebody else’s compliance and, in doing so, hands you three years of compliance of your own: half-years, countersigned timesheets, project codes, originals in a safe. Run by hand, by the same people meant to be writing the product.
That is the work we turn into a control in operation. The October file, and every progress report after it, pass under a check that runs on your own documents: which annex is missing, which digital signature has expired, which hour is not covered by a countersigned register — leaving a dated trace to put in front of an on-site inspection. The second axis weighs more: the data sitting today in five places — payroll, the fixed-asset register, the VAT ledger, contracts with research organisations, deliverables — enters a single operating model, on which AI agents prepare the half-year, reconcile costs and flag deadlines, with a human operator in command. In the two delivery modes we always offer: on-premise on self-contained machines that need no deep integration into your network, or a dedicated cloud with a data centre in Italy, run jointly with you — you need no model administrators already on staff. The method is here; the rest of the dates are in the calendar.
If you sell compliance through data, and want to see what it takes to withstand it yourselves, write to us.