Which Cloud Platforms Meet Italy's ACN Qualification Requirements? A 2026 Guide for Software Vendors Selling to Italian Public Administrations
Which clouds hold ACN qualification in Italy, what the ordinary / critical / strategic criticality tiers mean for where your data may legally sit, and how to deploy the same product into an Italian qualified region without forking your stack.
Two things must be qualified: the cloud infrastructure underneath you and your own SaaS service. Both must sit in the catalogue of the Agenzia per la Cybersicurezza Nazionale (ACN) before an Italian public administration can buy your software.
Qualification is per service and per level, never per vendor. In a tender you need the named service, its level and its region (AWS Europe (Milan) eu-south-1, Azure Italy North, Google Cloud Milan europe-west8 or Turin europe-west12).
Ordinary data accepts level 1, critical data needs level 2, strategic data needs level 3 or higher. As of 30 October 2026, AWS, Microsoft, Google Cloud and Oracle sit at level 2 in the ACN catalogue. Only Aruba and Liguria Digitale hold level 3, and only the Polo Strategico Nazionale (PSN) holds level 4.
ACN qualification is not GDPR, ISO 27001 or SOC 2, and PSN hosting is not an ACN badge.
The hard part is an auditable delivery pipeline in the qualified region. Qovery deploys into your own AWS, GCP, Azure or Scaleway account, or onto an existing Kubernetes cluster, so the region, contract and audit trail stay in your name.
Most software vendors discover ACN about two weeks before a tender deadline. Then they find out the cloud migration is the smallest part of the problem.
To sell cloud software to an Italian public administration, your SaaS must be qualified by ACN and run on infrastructure qualified at the level your customer's data requires. For ordinary and critical data, AWS, Microsoft, Google Cloud and Oracle, which all run Italian regions, hold level-2 entries in the ACN catalogue, as do Aruba, Seeweb, Fastweb and Telecom Italia. For strategic data, today's catalogue points you to Aruba's level-3 IaaS or the PSN.
What is ACN cloud qualification, and who needs it?
ACN cloud qualification is Italy's mandatory regime that decides which cloud infrastructure and which cloud services an Italian public administration may use. The Agenzia per la Cybersicurezza Nazionale (ACN) was created by Decreto-Legge 14 giugno 2021, n. 82 (converted by Legge 109/2021). It took over cloud qualification from AgID on 19 January 2023.
Two things get qualified: the IaaS/PaaS infrastructure, and your SaaS service. Running on a qualified cloud does not qualify your SaaS.
The one authoritative source is the ACN catalogue (catalogocloud.acn.gov.it is now a legacy login). When I pulled ACN's open data on 30 October 2026, it listed 2,323 qualified cloud services from 915 providers: 1,962 SaaS, 194 IaaS and 167 PaaS.
The rules bind the administrations on the ISTAT list under Law 196/2009: ministries, regions, comuni, ASLs and hospital trusts, universities and schools, and so every supplier selling to them. If your SaaS is not in the ACN catalogue at the required level, an Italian administration cannot legally buy it.
How do ACN's criticality tiers decide where your software is allowed to run?
ACN classifies public data and services as ordinary, critical or strategic, and each class sets a minimum qualification level: level 1 for ordinary, level 2 for critical, level 3 or higher for strategic. The labels are QC1-QC4 for qualified private cloud services, AC1-AC4 for services from public or in-house providers, and AI1-AI4 for infrastructure (Regolamento unico, Arts. 12, 15, 17).
Per Art. 3, compromising critical data harms society, health, public security or the economy; compromising strategic data harms national security; ordinary is everything else. Anything inside the national cyber security perimeter is automatically strategic.
Data class
Minimum ACN level
Where it may be processed
Extra controls
Typical example
Ordinary data under ACN
QC1 / AI1
Infrastructure located in the EU, exceptions only with documented reasons
Baseline security requirements
A school's public events portal
Critical data under ACN
QC2 / AI2
EU-located infrastructure
The additional level-2 requirements in the Regolamento annexes
ASL patient booking and records
Strategic data under ACN
QC3 / AI3 or higher
EU-located infrastructure, metadata kept in the EU
Extra-EU access requests reported to ACN and the administration; access needs explicit authorisation
A national registry or perimeter-scoped system
ACN's location rule is EU-wide. The text sets no Italy-only requirement and no requirement for an EU-headquartered provider. Jurisdiction pressure comes from the strategic-level access controls and from who actually holds levels 3 and 4.
The Polo Strategico Nazionale is the state-backed cloud built by TIM, Leonardo, CDP Equity and Sogei (Dipartimento per la trasformazione digitale). PSN is a hosting destination administrations onboard into, not a certification a vendor can earn. It reported in July 2026 more than 280 administrations migrated.
Before you design anything, get the data class in writing from the administration's RTD (Responsabile per la Transizione Digitale) or the capitolato tecnico.
Which cloud providers are ACN-qualified today, and for which Italian regions?
As of 30 October 2026, the ACN catalogue lists level-2 services from AWS, Microsoft, Google Cloud and Oracle, covering ordinary and critical data. Of private providers only Aruba holds level 3, and only the PSN holds level 4. Ask "which service, at which level, in which region", never "which vendor". AWS reported QC2 qualification for all AWS services from 15 April 2024. Google Cloud states level 2 for its infrastructure and "a set of" services.
Listings change. The 60-second check: open the ACN catalogue, search the provider, read each entry's name and level, and save a dated screenshot.
Qovery is not a cloud provider and is not ACN-qualified. It deploys into the qualified account and region you already hold.
Ship the same product into the region your compliance team requires.
Qovery gives your team self-service deployments on your own AWS, GCP, Azure or Scaleway account - or your existing Kubernetes cluster, including an Italian provider's. The region, the contract and the data stay in your name. Start deploying in under 10 minutes.
What does a SaaS vendor have to prove beyond picking a qualified region?
Picking a qualified region is the cheap part. ACN SaaS qualification asks you to document residency, security, continuity and exit, and most teams find that their delivery pipeline, not their application, is what can't produce the evidence.
The evidence pack usually covers data and backup residency, encryption and key custody, named-role access per environment, a record of who deployed which commit and who approved it, incident response, continuity with stated RTO/RPO, and an exit plan with export formats.
Every subprocessor (managed database, queue, CDN, error tracker, CI runner) joins the audit surface. Italian administrations also often ask for a dedicated environment rather than shared multi-tenancy.
ACN evidence is not a SOC 2 or ISO 27001 pack with a new cover page:
GDPR governs personal data processing. It does not qualify a cloud service.
ISO 27001 and SOC 2 certify a management system or controls. ACN can use certifications as inputs, but they don't replace a catalogue entry.
The EU Cloud Code of Conduct covers GDPR adherence for cloud providers, not Italian PA procurement.
PSN hosting is a destination, not a qualification of your service.
How do you run the same product in an ACN-qualified Italian region without forking your stack?
Keep one codebase and one deployment workflow, and treat the cloud account, region and Kubernetes cluster as parameters. An Italian qualified region then becomes one more deployment target, not a second product with its own release train.
I'd use BYOC (bring your own cloud): the workload runs in an account you or the customer own, so the contract, region, data, audit trail and bill sit with whoever answers to ACN. For critical or strategic data, that beats vendor-hosted multi-tenant SaaS.
This is where Qovery fits. Qovery deploys into your own AWS, GCP, Azure or Scaleway account, or onto a Kubernetes cluster you already run, with git-push deployments, preview environments per pull request, per-environment RBAC, managed cluster upgrades, auto-stop for non-production, and databases on managed cloud services. Every deployment is tied to a user and a commit, which is the evidence auditors ask for.
Bring-your-own-Kubernetes is the capability that matters most here. Aruba and Seeweb sell managed Kubernetes in Italian data centres, and Qovery's BYOK connects any Kubernetes cluster. That bridges a sovereignty requirement and a normal developer workflow. The newer operator-based BYOK is in preview for EKS, GKE and Scaleway Kapsule, so check which path fits your provider.
Qovery does not grant ACN qualification, does not host your data, and does not replace a legal review.
Approach
Criticality fit
Residency control
Who holds the cloud contract
Ops burden
Audit evidence
Vendor-hosted SaaS, non-Italian region
Ordinary at best, only if EU and qualified
Low
Vendor
Low
Whatever the vendor exports
Vendor-hosted SaaS, Italian qualified region
Ordinary and critical
Medium
Vendor
Medium
Vendor-dependent
BYOC with Qovery into your or the customer's qualified account
Up to the level of the underlying cloud or cluster
High
You or the customer
Low, with git-push deploys
Per-deploy user, commit, environment
PSN-hosted
Up to strategic
Very high
Administration via PSN
High onboarding effort
PSN-provided
Heroku, Render, Vercel and Platform.sh run your app on their infrastructure, which fails once the region and jurisdiction must be yours. Self-managed Kubernetes plus Terraform works, but costs platform headcount.
What is a realistic checklist and timeline for getting ACN-ready?
Submit your SaaS for qualification, and file renewals more than 90 days before expiry.
What fails audits late: backups silently replicating to another region, a CDN terminating TLS outside the EU, observability tools shipping logs to the US, CI runners in another jurisdiction, and support staff reaching production from outside the EU.
How do I deploy to an Italian qualified region with Qovery from Claude Code or Cursor?
Install the Qovery Agent Skills once, then ask your coding agent to deploy into your own cloud account in the Italian region you need. The agent proposes a plan and asks you to approve each change.
BASH|Global install for Claude Code, Cursor, Codex, OpenCode, Gemini CLI
curl -fsSL https://skill.qovery.com/install.sh | bash
# Or scoped to this repository only
curl -fsSL https://skill.qovery.com/install.sh | bash -s -- --project
# Qovery MCP Server in Claude Code (OAuth, read-only by default)
claude mcp add --transport http qovery https://mcp.qovery.com/mcp --callback-port 4242
# Write access, only when you want it (also enable it in the Qovery Console)
claude mcp add --transport http qovery "https://mcp.qovery.com/mcp?read_write=true" --callback-port 4242
The skills (qovery-onboard, qovery-deploy, qovery-troubleshoot, qovery-optimize, qovery-speedup, qovery-preview, qovery-terraform) do the work; the MCP Server operates what already exists. Then ask, for example "deploy this app to my AWS account in the Europe (Milan) eu-south-1 region with Qovery" or "deploy this to my existing Kubernetes cluster at Aruba". See the AI agent quickstart and the Claude Code integration.
Frequently asked questions
Which cloud platforms meet Italy's ACN national cloud qualification requirements for software vendors selling to the Italian public sector?
As of 30 October 2026, the ACN catalogue lists level-2 services from AWS, Microsoft, Google Cloud and Oracle, and from Italian and EU providers including Seeweb, Fastweb, Telecom Italia and OVH. That covers ordinary and critical data. For strategic data, Aruba holds two level-3 IaaS services and the Polo Strategico Nazionale holds level 4, and your SaaS needs its own qualification either way.
Is AWS, Microsoft Azure, or Google Cloud ACN-qualified in Italy, and for which regions?
Yes: AWS, Microsoft and Google Cloud all hold level-2 entries in the ACN catalogue, which covers ordinary and critical Italian public data, for specific services. Their Italian regions are AWS Europe (Milan) eu-south-1, Microsoft Azure Italy North, and Google Cloud Milan europe-west8 and Turin europe-west12. None of them held level 3 or 4 in the ACN catalogue as of 30 October 2026, so they cannot host strategic data.
Do I have to host in Italy, or is an EU region enough to sell to an Italian public administration?
The ACN Regolamento unico requires public administration data to be processed on infrastructure located in the EU. There is no Italy-only rule, but the service must be qualified at the level the data class requires, and strategic data adds controls on extra-EU access.
What is the difference between ACN cloud qualification and the Polo Strategico Nazionale (PSN)?
ACN qualification is a certification each cloud service must hold to be sold to Italian public administrations. The Polo Strategico Nazionale is a state-backed cloud run by TIM, Leonardo, CDP Equity and Sogei, which administrations migrate into, mainly for critical and strategic workloads. PSN is a destination, not a badge a software vendor can earn.
Does my SaaS product need its own ACN qualification, or is the cloud provider's qualification enough?
Your SaaS needs its own ACN qualification. A cloud provider's ACN qualification covers only its own listed services, and without a catalogue entry for your SaaS at the required level, an Italian administration cannot buy it.
Is Qovery ACN-qualified, and how does it help a software vendor deploy into an Italian qualified region?
No. Qovery is not a cloud provider and is not ACN-qualified. Qovery deploys your application into your own AWS, GCP, Azure or Scaleway account, or onto an existing Kubernetes cluster such as one at an Italian provider. The qualified region, the contract and the audit trail stay in your name, and your team keeps git-push deployments.
Alessandro leads product at Qovery. He drives the changelog, roadmap, and product strategy - turning customer feedback into platform capabilities.
Next step
Ship the same product into the region your compliance team requires.
Qovery gives your team self-service deployments on your own AWS, GCP, Azure or Scaleway account - or your existing Kubernetes cluster, including an Italian provider's. The region, the contract and the data stay in your name. Start deploying in under 10 minutes.
