Getting Compliant Has Never Been More Accessible

NIS2, GDPR, AI Act: the European regulatory framework is becoming increasingly structured, and companies that delay compliance find themselves a little more exposed every day. It's not alarmism — the risks tied to outdated infrastructure and non-compliant processes are real, and they grow with time.

The good news is that today there's tangible support. Italy's MIMIT has allocated €150 million to help SMEs and professionals adopt cloud and cybersecurity solutions, with vouchers covering 50% of expenses up to €20,000. An opportunity to turn what seems like an obligation into a real investment.

New solutions only, no maintenance of the existing

The program exclusively funds the adoption of new and additional tools compared to those already in use. The goal is a quality leap, not maintaining the status quo.

€71 million is reserved for Southern Italy: Abruzzo, Basilicata, Calabria, Campania, Molise, Puglia, Sardinia, and Sicily.

Who can apply

• SMEs with fewer than 250 employees, turnover under €50 million (or total assets under €43 million)
• Self-employed professionals with VAT registration, enrolled in professional registers where required

Requirements include: minimum 30 Mbps download connectivity and valid natural disaster insurance coverage.

Eligible investments

50% contribution, capped at €20,000, minimum spend €4,000. Three areas:

• Cybersecurity — Anti-DDoS, next-gen firewalls, IPS, antimalware, encryption, SIEM.
• Cloud IaaS/PaaS — Cloud infrastructure and platforms to replace legacy environments.
• Cloud SaaS — ERP, CRM, process digitization, digital identity, archiving, integrated AI, virtual PBX.

Up to 30% of the expenditure can cover professional configuration and monitoring services — the program recognizes that technology, without the expertise to implement it, remains an empty box. Providers must be ACN-qualified (QC1) or ISO-certified.

How it works

Providers: registration to the ministerial list from March 4 to April 23, 2026.

SMEs and professionals: dates to be defined by directorial decree.

Providers are qualified first, then applications open. This ensures you can choose from partners already vetted by the Ministry.

Those who have been postponing now have one fewer reason to keep doing so.