---
title: "Legislative decree 134/2024: the list of critical entities cannot be read, by law"
description: "Legislative decree 134/2024 identifies critical entities through a list that article 8 excludes from access by law: an entity learns it is on it only through a private notice, which also starts the nine months for the risk assessment."
url: https://csidia.com/en/notes/soggetti-critici-elenco-decreto-non-pubblicato/
lang: en
date: 2026-09-04
label: "Regulation"
publisher: CSIDIA S.r.l. (https://csidia.com/)
italiano: https://csidia.com/note-operative/soggetti-critici-elenco-decreto-non-pubblicato/
---

# Legislative decree 134/2024: the list of critical entities cannot be read, by law

An entity does not find out on its own that it is a critical entity: there is no register to consult, only a letter that may or may not arrive. That is the structure of legislative decree 4 September 2024, no. 134, Italy’s transposition of directive (EU) 2022/2557 on the resilience of critical entities — signed, among others, by the ministers of Defence and the Interior, Crosetto and Piantedosi, in force since 18 October 2024. Every deadline in it runs from an act that almost never coincides with a date knowable in advance.

## Who identifies whom, against which thresholds

Article 2 defines a critical entity as a public or private body identified under article 8 among the categories operating in Annex A’s sectors: from energy to transport, healthcare to digital infrastructure. The sectoral competent authorities (ASC) identify the critical entities in their own sector by 17 January 2026 and report them to the single point of contact (PCU), at the Prime Minister’s Office. The thresholds the ASCs apply, though, are set elsewhere: article 9(2) assigns them to a prime ministerial decree, proposed by the Interministerial Committee for Resilience (CIR), due by 17 July 2025, with only an optional thirty-day parliamentary opinion before it can be adopted regardless (paragraph 3).

## The list the entity concerned cannot read

Based on the reports it receives, the PCU compiles the list of critical entities (article 8(3)); here the law changes register. Paragraph 4 sets its adoption by prime ministerial decree, after hearing the CIR, by 17 July 2026, and adds: «Il decreto di cui al primo periodo non è soggetto a pubblicazione ed è escluso dall’accesso» (*The decree referred to in the first sentence is not subject to publication and is excluded from access*). Not a delay, not de facto secrecy: an exclusion written into the very provision creating the list. An entity on it learns of it only through the notice the PCU must send within thirty days, naming the responsible ASC (paragraph 5). Within the same thirty days the PCU also reports every critical entity’s identity to the National Cybersecurity Agency (paragraph 6); the full list also goes to Italy’s intelligence bodies — DIS, AISE, AISI, under articles 4, 6 and 7 of law no. 124/2007 (paragraph 7). The single entity gets a notice about itself alone; intelligence and the cyber agency see the whole perimeter.

## Nine months inside ten

The notice also starts the clocks. Duties under chapters III and IV take effect ten months after notification (paragraph 5), subject to exceptions the same paragraph carves out — article 13(1) among them. That is where the second clock sits: «Fermo restando il termine di dieci mesi […], i soggetti critici […] effettuano una valutazione del rischio entro nove mesi dal ricevimento della notifica […], e, successivamente, […] almeno ogni quattro anni» (*Without prejudice to the ten-month period […], critical entities […] carry out a risk assessment within nine months of receiving the notification […], and, subsequently, […] at least every four years*). Nine months inside ten, not as an alternative: the shorter deadline bites first, closing the risk assessment before the chapter III duties generally apply.

## The dates, had the calendar held

Today, 4 September 2026, the 17 July 2026 deadline for the list expired forty-nine days ago. Had the decree been adopted on time, the notice would have arrived by 16 August 2026, the risk assessment would fall around 16 May 2027, and the chapter III and IV duties would take effect around 16 June 2027 — conditional hypotheses, pure arithmetic: the actual adoption date is not public, by design. An indirect clue comes from the other decree, on thresholds, due a year earlier, on 17 July 2025: trade press reports that on that same 17 July 2026 the Council of State gave a favourable opinion, with numerous observations, on its draft — still a draft, a year past deadline.

## Silence that denies

Article 15 introduces checks on people: a critical entity may request the European criminal record certificate under article 28-bis of presidential decree 313/2002, for sensitive roles, for staff authorised remote or on-site system access, and for candidates to such roles (paragraph 1), via a reasoned request to the ASC (paragraph 2). Here the law inverts the best-known rule of Italian administrative procedure: «Nel caso in cui la ASC non fornisca risposta entro dieci giorni […] l’autorizzazione […] si intende negata» (*If the ASC does not respond within ten days […] authorisation […] is deemed denied*). Not silence-as-consent: silence-as-refusal. A third decree, after hearing the data protection authority, will set retention periods for the certificates (paragraph 3): the authority already gave a favourable opinion on the draft on 29 January 2026 — at that date, still a draft.

## Twenty-four hours, thresholds elsewhere

On incidents, article 16 requires notification «entro ventiquattro ore» (*within twenty-four hours*) of becoming aware of it, barring operational impossibility (paragraph 2). What makes an incident significant — beyond the general parameters of users affected, duration and geographic area (paragraph 3) — is decided by sector-by-sector thresholds under that same article 9(2) decree (paragraph 4): still stuck at draft stage. The twenty-four hours already exist; the yardstick for whether they apply, for now, does not. Resilience here is not only digital: article 14 covers physical protection too — fencing, barriers, perimeter and access-control systems (paragraph 2(b)) — with fines up to €125,000 for failing to assess risk, adopt measures, or notify incidents (article 21).

## What we have not verified

Whether the list was adopted by 17 July 2026 cannot be verified from public sources, nor could it be by design: the provision excludes that decree from publication and access. We record this as a fact of the law, not a suspicion of non-compliance, without speculating on a list we have not read and could not read. On the thresholds decree, direct searches turned up nothing: the Official Gazette’s internal search engine returns no useful results, senato.it responds with an anti-bot challenge, and the Chamber of Deputies’ documenti.camera.it endpoint returns a 404. We found the Council of State’s 17 July 2026 opinion only through trade press (Staffetta Quotidiana and Staffetta Acqua): no official text of the opinion, and no confirmation that the decree has since been published.

## Sources

- [Legislative decree 4 September 2024, no. 134 (Normattiva, text in force)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;134!vig=)
- [Article 8 — list of critical entities (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;134~art8!vig=)
- [Article 9 — application thresholds (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;134~art9!vig=)
- [Article 13 — risk assessment (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;134~art13!vig=)
- [Article 14 — resilience measures (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;134~art14!vig=)
- [Article 15 — personnel checks (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;134~art15!vig=)
- [Article 16 — incident notification (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;134~art16!vig=)
- [Article 21 — penalties (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;134~art21!vig=)
- [Directive (EU) 2022/2557, resilience of critical entities (EUR-Lex)](https://eur-lex.europa.eu/eli/dir/2022/2557/oj)
- [Italian Data Protection Authority, opinion of 29 January 2026 on the draft decree under article 15(3) (doc-web 10245641)](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10245641)
- [Staffetta Quotidiana, «Soggetti critici: il Cds chiede più chiarezza sulle soglie» (*Critical entities: the Council of State wants more clarity on the thresholds*), 17 July 2026](https://www.staffettaonline.com/articolo.aspx?id=406121)

Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/soggetti-critici-elenco-decreto-non-pubblicato/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com