Italy's Ministry of Enterprises and Made in Italy has opened the pre-compilation window for a cloud and cybersecurity voucher aimed at small and medium enterprises and self-employed workers. The grant covers 50% of eligible spending, up to a maximum of 20,000 euros, for purchases of cloud services and digital security tools from an approved ministerial registry. Pre-compilation opened at 12:00 on October 20; actual submission runs from 12:00 on November 10, 2026, to 12:00 on January 20, 2027, on a first-come, first-served basis. Of the total 150 million euro budget, according to our calculation, around 47% is ring-fenced for projects in southern Italy.
Why It Matters for Small Businesses
Cyber threats don't spare smaller targets. High-profile cases like the 36-million-euro AI voice-cloning fraud at Fideuram and the fake government request that exposed Revolut user data show that even well-resourced organizations get caught out. A small business or professional firm is far more exposed, and a successful attack can halt operations for days. Off-site backups, network protection, and updated software are the starting points. This voucher covers half the cost of those investments, though with precise rules on what can be bought and from whom.
Who Can Apply
Eligible applicants include SMEs and self-employed workers, including freelance professionals, operating anywhere in Italy. At the time of application, a broadband contract with a minimum download speed of 30 megabits per second is required. Companies subject to the obligation must also show proof of the catastrophic-risk insurance introduced by the 2024 Budget Law. Each applicant may submit only one application. The grant falls under the EU de minimis state-aid regime, capped at 300,000 euros over three years: anyone who has already received other aid must verify they have room remaining. A supplier listed in the approved registry may also apply, provided they purchase from a different listed supplier.
What Can (and Cannot) Be Purchased
The August 4, 2026, ministerial decree identifies five eligible spending categories. The first covers security hardware: firewalls, routers, switches, and intrusion-detection systems. The second covers security software, from antivirus tools to network monitoring, encryption, and vulnerability management. The third covers cloud infrastructure services: virtual machines, storage, backup, and databases. The fourth covers cloud-based business software for accounting, HR, ERP, e-commerce, CRM, and telephony. AI-powered productivity tools and training platforms fall within this category, though training content itself does not. The fifth category covers configuration, monitoring. Support services, capped at 30% of the total plan and only permitted when linked to other eligible purchases.
This is not a blanket bonus for any AI software. Only products and services listed in the approved supplier registry, published via a July 29 ministerial decree and viewable on the Invitalia platform according to Finanza e Fisco, are eligible. Excluded are tools that duplicate existing ones, minor version upgrades, and additional licenses or seats for software already in use: the voucher must fund genuinely new or more advanced solutions. AI-powered tools also deserve careful evaluation, given the emerging risks documented in cases such as AI agent access to live systems recorded by India's CERT.
How Much Is the Grant, and How Is It Calculated
The voucher covers 50% of eligible costs. Per Edotto, the minimum eligible spend is 4,000 euros (VAT excluded), and the maximum grant is 20,000 euros. A 4,000-euro plan receives 2,000 euros; a 10,000-euro plan receives 5,000. The ceiling is reached at 40,000 euros of spending, beyond which the grant amount does not increase. Purchases can be made outright, with full payment within 12 months of the grant award, or via subscription, with a minimum duration of 24 months and only the fees for those 24 months counted as eligible. A hybrid approach combining both methods is also allowed. The chosen method must be stated in the application and cannot be changed afterward.
How to Prepare the Application, Step by Step
The entire process is online, on the ministry's website, and runs in two phases. During pre-compilation, which opened October 20 at 12:00, applicants log in with SPID, CIE, or CNS and provide a certified email address (PEC). They then enter: current digital maturity and planned improvements, codes for chosen services and suppliers, declarations covering all eligibility requirements including connectivity, and proof of the required insurance. Supplier quotes must be attached, referencing catalogue codes, along with a description of the applicant's starting situation. The phase closes with a digitally signed PDF and generates an application preparation code.
Using that code, from 12:00 on November 10 to 12:00 on January 20, 2027, the applicant submits the full application and receives a receipt carrying the project's CUP code. The ministry, with Invitalia's support, reviews applications in strict chronological order and completes checks within 60 days. If funding runs out before the window closes, the portal shuts early and unfunded applications remain on hold: they lapse if no new resources are allocated.
What Happens After the Grant Is Awarded
Eligible spending must begin after the application date. Subscription contracts must be signed within 30 days of the award notice and reported within 60 days, or the grant is forfeited. Payment requests can be submitted no earlier than three months after the award, in one or two tranches: the first when at least 50% of the plan has been spent, the final balance (or single request) within 30 days of the plan completion deadline. Required documentation includes invoices bearing the CUP and service code, payment receipts, and the connectivity contract. Infratel Italia may also be involved in verification checks.
How Much Is Reserved for Southern Italy
Of the total 150 million euro budget, 71,065,813.34 euros (roughly 47%, per our calculation) are reserved for projects carried out in Abruzzo, Basilicata, Calabria, Campania, Molise, Puglia, Sardinia, and Sicily. This share comes from the 2014-2020 Cohesion and Development Fund, covers the operating costs of Invitalia and Infratel, and could be increased with new allocations, including EU funds. Our reading is that the ring-fencing primarily prevents southern projects from running out of money if applications from other regions arrive first, given the first-come, first-served structure.
Cloud and Cybersecurity Voucher at a Glance
What is confirmed, what isn't
- Confirmed: 150 million euros total, 71 million ring-fenced for southern Italy; 50% grant up to 20,000 euros with a minimum spend of 4,000 euros; pre-compilation from October 20, submission from November 10 to January 20, 2027, in chronological order; purchases only from the approved supplier registry.
- Not specified: how many suppliers and services are in the registry, how many applications can be funded, when funds might run out.
- Watch for: any early closure of the portal, updates to the supplier registry, and ministry clarifications on open interpretation questions.
The Bigger Picture
With first-come, first-served review, being ready on November 10 matters as much as being fast. Without a clear description of the starting situation, supplier quotes referencing catalogue codes. Compliant insurance documentation, an application simply won't go through. The less visible risk, for small businesses, is buying to claim the grant rather than buying to solve an actual problem. The right starting point is identifying what's genuinely missing, whether backup, network protection, or both. Only then choosing a supplier. Supplier choice carries its own weight, particularly as European supervisory authorities have flagged European finance's dependence on foreign AI providers. The voucher is also not the only tool available: Simest financing for SME AI investments offers a complementary route worth exploring.
Three signals will be worth tracking in the coming weeks: whether the ministry publishes the full supplier registry figures, the pace of applications after November 10, and any announcement of early portal closure. For businesses that sell online, a separate deadline is imminent: the digital euro pilot is open for merchant applications until October 27.
