Sovereignty · Updated 10 November 2026 · 9 min read

Italy's ACN cloud qualification: levels QC1 to QC4 explained

How Italian public bodies classify data, which ACN level each class needs, what providers must prove to qualify, and who sits in the catalogue today.

View as Markdown

ACN qualification is the check Italy's National Cybersecurity Agency, the Agenzia per la cybersicurezza nazionale, runs on cloud services that private companies want to sell to Italian public administrations. A service is qualified at one of four levels, QC1 to QC4, and a public body may only use it for data and services whose classification that level covers. Qualified services are published in the ACN catalogue, and a qualification is valid for 36 months.

The rules live in a single regulation, ACN Decreto Direttoriale n. 21007/24 of 27 June 2024, which has applied since 1 August 2024. It replaced the earlier AgID and ACN rules from the transitional period. This page summarises it and isn't legal advice.

The four levels at a glance

Level	Data classes it may host	Standards Annex 4 asks private providers to show	Extra at this level
QC1	Ordinary	A self-declaration of ISO 9001 quality management, plus certified ISO/IEC 27001 with the 27017 and 27018 extensions or CSA STAR Level 2	Baseline security, portability and service levels from Annex 3, including 99% monthly availability
QC2	Ordinary, critical	Self-declared conformity with ISO 22301 business continuity and ISO 20000 service management	Annex 3 measures for critical data
QC3	Ordinary, critical, strategic	Certified ISO 22301, ISO/IEC 20000 and CSA STAR Level 2	Annex 3 measures for strategic data
QC4	Ordinary, critical, strategic	Everything required at QC3	Hold Your Own Key encryption, with every key generated and managed by the administration in a hardware security module, and every data flow approved and monitored with the administration

Each level includes everything required by the levels below it. The table follows Article 17 and Annex 4 of the regulation.

How public bodies classify data

Article 3 of the regulation sorts every public data set and digital service into one of three classes, based on the harm its compromise would cause:

Ordinary: a compromise wouldn't cause the harm described for the other two classes.
Critical: a compromise could damage functions that matter for society, health, public safety or the country's economic and social wellbeing.
Strategic: a compromise could harm national security.

Data that falls under Italy's national cybersecurity perimeter law is automatically strategic. Data covered by Legislative Decree 65/2018, Italy's transposition of the first NIS directive, is critical, or strategic when it has national relevance. A digital service that hasn't been classified can't be offered to end users at all.

Once a body knows the class, the rule in Article 17 is direct: ordinary data may go on QC1 to QC4, critical data on QC2 to QC4, strategic data on QC3 or QC4.

What a provider has to prove

The qualification chain. A qualified service must run on a platform that is itself qualified or declared compliant at the same level or higher. A SaaS built on a PaaS needs a qualified PaaS underneath, and ACN's FAQ says the application names only the nearest layer the service runs on.
European location. Annex 3 requires the administration's data to be processed on infrastructure located in the EU, and that includes outsourced business continuity and disaster recovery unless a documented legal or technical reason applies. Metadata derived from the administration's data stays in the EU under the same exception, while metadata used only to run the infrastructure may be processed outside it.
Foreign access requests. For strategic data, the provider must tell ACN and the administration about any request from a non-EU entity to reach the data or metadata, and may grant access only with the administration's explicit authorisation.
Accredited certificates. For applications filed more than six months after the regulation took effect, certificates must come from a certification body accredited by Italy's national accreditation body or one covered by mutual recognition.
Reporting. Requirement MON-01 obliges qualified providers to send ACN, every six months, the list of administrations that use their services.

How the procedure works

The provider registers on ACN's service portal and links its account to the company. Non-Italian companies ask to be registered by email with ACN's company form, and people without SPID, CIE or eIDAS can request separate credentials.
It files the application in the portal's Cloud area and answers a questionnaire on each requirement for the level it wants.
ACN checks conformity within 60 days, with at most two 30-day extensions. When ACN asks for more information the clock stops, and the provider has 15 days to answer or the procedure closes.
ACN communicates the outcome within 15 days of the end of the procedure and, when positive, publishes a service sheet in the catalogue.
The qualification is valid for 36 months from the date it's granted. Renewals are filed 90 days before expiry, and ACN can let the provider keep operating until it decides.

Services run by public bodies themselves, their in-house companies, or publicly controlled companies designated by law don't go through qualification. They follow a separate adequacy procedure based on a signed self-declaration, with levels named AC1 to AC4 for services and AI1 to AI4 for infrastructure. ACN monitors both qualified and declared services during the 36 months.

Administrations then buy qualified services under the public procurement code, for example through Consip's MEPA marketplace. ACN also states that qualification doesn't allow a provider to use the agency's logo for marketing.

What the catalogue shows today

ACN publishes the catalogue as open data, updated in real time. On 10 November 2026 the CSV listed 2,342 service sheets: 1,980 SaaS, 195 IaaS and 167 PaaS. By level, 1,796 were at level 1, 534 at level 2, three at level 3 and nine at level 4.

Provider in the catalogue	What's listed	Level
Polo Strategico Nazionale	Nine IaaS and PaaS services, such as IaaS Shared, DBaaS and CaaS	4
Aruba	Aruba Virtual Private Cloud and Aruba Hosted Private Cloud	3
OVHcloud	Public Cloud, Dedicated Server and Hosted Private Cloud, listed under OVH srl	2
AWS	23 services under Amazon Web Services EMEA SARL	2
Google Cloud	63 services under Google Cloud Italy	2
Heroku	Salesforce Heroku, a PaaS	2

Polo Strategico Nazionale is the national cloud set up to give public administrations secure infrastructure, and it's the only provider with level 4 services in the open data. Several qualified services are run by US-owned groups, so qualification and the CLOUD Act are separate questions. EU region vs EU company covers the second one.

Where Eurobase fits

Eurobase isn't ACN-qualified at any level and can't be offered to an Italian administration as a qualified service. Two requirements stand in the way. QC1 needs ISO/IEC 27001 with the 27017 and 27018 extensions, or CSA STAR Level 2, and Eurobase's ISO 27001 and SOC 2 work hasn't finished yet. The qualification chain also needs the layer underneath to be qualified, and Scaleway, the French provider that runs the European infrastructure Eurobase uses, doesn't appear in the catalogue's open data.

That rules Eurobase out whenever an Italian public body is the buyer. It can still host apps for Italian companies, agencies and startups whose work doesn't need ACN qualification. Eurobase is a business registered in Warsaw, Poland, and keeps apps, functions, containers, files and logs in the EU. GitHub and GitLab Inc. become US subprocessors only if you connect them. The EU hosting guide lists what runs where, and data residency vs data sovereignty explains how to test a sovereignty claim.

How to use this as a buyer or supplier

If you work for a public body, classify the data first, then filter the catalogue by the level that class needs and check the expiry date on the sheet.
If you sell SaaS to Italian administrations, pick an IaaS or PaaS that is already qualified at the level your customers need, because your own qualification depends on it.
If your customers are private companies, ACN qualification doesn't apply to them. Contracts under NIS2 or DORA are the more likely checklist, and where to host a web app in Italy covers the hosting choice itself.

Frequently asked questions

Is ACN qualification the same as a certification?

No. It's an administrative qualification granted by ACN after checking the service against the regulation. Certifications such as ISO/IEC 27001 are inputs to it, issued by accredited bodies, and ACN adds its own security, portability and location requirements on top.

Which level do I need for health data?

The regulation doesn't assign levels by topic. The administration classifies each data set as ordinary, critical or strategic using ACN's model, and the class decides the level. Data whose compromise could damage public health fits the definition of critical, which needs QC2 or higher.

Can a non-Italian cloud provider get qualified?

Yes. ACN's FAQ describes how non-Italian companies get registered on the portal and how staff without Italian digital identity get credentials. AWS, Google Cloud and OVHcloud services appear in the catalogue through their European or Italian entities.

How long does ACN qualification take?

ACN has 60 days to check an application, extendable twice by 30 days. The clock stops while the provider answers requests for information, and the outcome follows within 15 days of the check.

Is ACN qualification the same as SecNumCloud?

No. SecNumCloud is a separate French qualification issued by ANSSI, and the Italian regulation doesn't mention it. An Italian administration needs a service listed in the ACN catalogue at the right level. SecNumCloud explained covers the French scheme.