Data centres in Italy: growth, grid access and operational resilience

Demand for cloud services, digital infrastructure and compute-intensive applications is driving Italy's data centre market. The scale of interest is visible in figures from transmission system operator Terna: at the end of January 2026, it reported 449 data centre grid-connection requests with a combined requested capacity of 78.79 gigawatts. These figures describe requests, not operating IT capacity or guaranteed grid connections. [1]

For developers and operators, the distinction matters. A prospective site is viable only when grid access, the timing of power availability, an approvable facility design and the future security operating model align. Italy introduced a single authorisation procedure for the construction, expansion and operation of certain data centres under Decree-Law 21/2026, as amended by Law 49/2026. Bringing environmental, water, emissions and planning considerations into the procedure does not remove the underlying requirements. [4]

Milan is a major Italian interconnection location, anchored by the Milan Internet Exchange (MIX). Demand, networks and data centre services converge in this market. [2] In June 2026, Lombardy also adopted its own legislation on data centre development, addressing issues including land use, energy supply, water consumption and waste heat. Further implementing administrative rules followed in August 2026. [5]

One issue is easy to overlook: large standby generation installations can affect the environmental authorisation route and the competent authority. Lombardy's guidance distinguishes installations by the thermal input of combustion equipment. That is not the same as IT electrical load or the grid connection rating. The requirements must be assessed against the actual project. [5]

Milan's established position makes it attractive for connectivity. However, operators should distinguish logical redundancy from genuine independence of network routes. Different carriers and contracts do not by themselves prove separate cable ducts, handover points or failure domains.

Other parts of Italy provide complementary network functions. MIX operates regional interconnection services, including in Rome. Around Palermo, the Open Hub Med ecosystem is being developed for traffic exchanged between Europe, Africa, the Middle East and Asia, with participants highlighting the area's submarine cable links. [3] A geographically distributed design can strengthen resilience, but only where transport paths, network operators and operational dependencies are sufficiently independent in practice.

Electricity and cooling are the technical foundations of a data centre. Their dependability also rests on building management systems, access control, maintenance contractors, remote connectivity and the ability to respond. An isolated IT network, for example, provides limited reassurance if critical building controls can be accessed remotely without appropriate safeguards or several redundant services depend on the same switching or control function.

Natural hazards also require a site-specific assessment in Italy. ISPRA publishes national evidence on flooding and landslides, while the INGV provides seismic hazard information. [11][12] National hazard maps cannot, however, determine the risk of an individual plot on their own. What matters is the local exposure, facility design and the resilience of supply and recovery arrangements.

Italy transposed the NIS2 Directive (EU) 2022/2555 through Legislative Decree 138/2024. Depending on the circumstances, it covers providers of data centre and cloud services as well as telecommunications undertakings. The actual services, legal entity, size and special rules, and the competent authority determine how the regime applies. National registration and implementation of security requirements operate within the framework administered by the Agenzia per la Cybersicurezza Nazionale (ACN). [6]

Separately, Commission Implementing Regulation (EU) 2024/2690 specifies technical measures and significant incidents for certain digital providers. [7] Italy's Legislative Decree 134/2024 transposes the Critical Entities Resilience Directive (EU) 2022/2557. This does not automatically designate every data centre as a critical entity; the national identification process is decisive. [8]

Energy and sustainability information is another distinct obligation. Under Article 16 of Decree-Law 131/2024, as amended by Law 166/2024, Italy requires operators with installed IT power demand of at least 500 kW to publish specified information. Exceptions cover certain data centres serving defence and civil protection exclusively, and information protected by confidentiality and trade-secret rules. This 500 kW threshold belongs to this publication requirement; it must not be used as a threshold for NIS2 or planning permission. [9][10]

For new developments, credible assumptions on grid connections and permissions should inform the final security architecture. For existing facilities, the priority is to identify common-mode dependencies in power, cooling and connectivity, govern third-party remote access, and coordinate security, facilities, IT and service providers. Compliance evidence must match the operator's actual role and services. Regulated customers may also introduce contractual requirements, including those associated with DORA (Regulation (EU) 2022/2554) in financial services. [13]