Cloud & Cybersecurity
MIMIT Voucher 2026

Micro, small and medium-sized enterprises (SMEs) registered with the Italian Business Register and self-employed professionals with an Italian VAT number, including newly formed businesses with no filed accounts yet. The MIMIT FAQs of 25 September 2026 clarify who is left out: associated professional practices (the individual professionals in the practice, with their own VAT number, can apply), professional orders and their foundations, primary agricultural producers, except for secondary activities with an ATECO code already active. Eligible: tax assistance centres (CAF) set up as companies, consortia that qualify as SMEs, credit guarantee consortia (Confidi) and SMEs subject to NIS2, including for compliance investments. A fixed internet connection with at least 30 Mbps download is required: fibre, VDSL, FWA or satellite, not a SIM or a mobile connection.

The voucher covers 50% of eligible expenditure, up to a maximum of €20,000 per beneficiary. The minimum eligible spend is €4,000. The grant is non-repayable.

The voucher covers five categories: cybersecurity hardware (firewalls, NGFW, IPS), cybersecurity software (antivirus, SIEM, encryption), cloud IaaS and PaaS (VMs, storage, backup, VPN), cloud SaaS (ERP, CRM, Microsoft 365, e-commerce) and professional configuration and support services (up to 30% of the spending plan).

No. Supplier FAQ 52 of 12 October 2026 excludes consumption-based billing, even through prepaid credit, usage allowances or detailed consumption reports: the amount must be determinable already in the application. Purchases are only possible as a direct purchase at a set price or as a subscription with predetermined fees of at least 24 months, so cloud services too, IaaS, PaaS and SaaS, must be offered at a predetermined price. Supplier FAQ 51 clarifies instead that within a subscription hardware and licences can remain the supplier’s property, as rental, free loan or right of use, provided the beneficiary has them for the whole minimum term.

Yes, as long as whoever submits the offer and invoices is a supplier on the MIMIT list: vendors and distributors upstream do not need to be. Supplier FAQ 50 of 12 October 2026 clarifies this for the vendor, distributor, reseller or system integrator, customer chain. If the reseller is accredited for the product type, its own code goes in the offer and in the application, including for brands not on the list (supplier FAQ 44). If it is not, the offer names the original accredited supplier and its code, which must also appear in the application (beneficiary FAQ 28), while the offer and the invoice remain the reseller’s. The MSP model, with licences in the partner’s name resold as a service, counts as SaaS if the partner is accredited and the service is listed (supplier FAQ 43). An agent who neither contracts with nor invoices the beneficiary does not need to register (supplier FAQ 9).

The dates are set by the directorial decree of 4 August 2026: application drafting opens at 12:00 on 20 October 2026 on the MIMIT online procedure (you need SPID/CNS/CIE, an active certified email address and a digital signature, through to the issue of the preparation code); submission runs from 12:00 on 10 November 2026 to 12:00 on 20 January 2027, with applications processed in chronological order until funds run out. The most important point: expenses are eligible only if incurred after the application has been submitted: buying earlier means losing the grant.

The application must include a declaration of the actual cloud and security starting point and the expected improvement, with evidence of the new technological solutions. A quote is not enough: suppliers’ offers must also carry the service identification codes and describe the starting point and the guaranteed upgrade. The plan is excluded in four cases: services similar to those already in use, a version upgrade without substantial improvement, an extension of an existing licence, or an increase in seats or user accounts. A serious approved supplier builds the offer with this logic from the start.

The voucher can only be used with suppliers listed in the Ministry’s official directory, available on the Invitalia platform: purchasing services from a non-approved supplier means the grant cannot be claimed. In the application, each service must be indicated with the supplier’s identification code. AtWorkStudio is listed with code VCCFA2600000145.

Yes, under precise conditions. A supplier connected to or part of the same corporate group as the beneficiary is not automatically excluded: beneficiary and supplier must be distinct legal entities, the transaction must be real and economically justified, and all the other conditions of the scheme must be met (beneficiary FAQ 26). The same applies to a supplier in the same network contract, that is a business network without legal personality and without a common asset fund: it is not in itself a ground for ineligibility, provided the two entities are distinct and independent and the contractual relationship is genuine and traceable; the Ministry reserves the right to check the independence of the parties involved (beneficiary FAQ 27). In any case the supplier must be on the MIMIT list.

Yes. AtWorkStudio is an approved supplier in the list defined by the MIMIT directorial decree of 29 July 2026, with code VCCFA2600000145, for all five categories of the scheme: cybersecurity hardware, cybersecurity software, cloud IaaS/PaaS, cloud SaaS and professional services (23 approved services in total). The company is certified to ISO 9001, ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018 and has ACN-qualified services.

Twelve things, all in the checklist above: the legal representative’s digital identity (SPID, CNS or CIE), an active certified email (PEC) and a digital signature, a connectivity contract of at least 30 Mbps active at the time of application, a regular DURC at the time of disbursement, the declaration on catastrophe risk insurance for SMEs (Law 213/2023, without which the application is inadmissible, on the MIMIT form, beneficiary FAQ 30), the starting point in cloud and security with the planned improvement, the supplier’s offer with identification codes and the upgrade described, a spending plan of at least €4,000 with professional services within 30% and the direct purchase or subscription choice already made (art. 8 para. 4 of the Directorial Decree), the full scope of the project (there is only one application and it cannot be amended after submission), and a check of the de minimis headroom in the National Register of State Aid. And no purchases before submitting the application: expenses are eligible only afterwards.

MIMIT closes the window and announces it. Applications already submitted but without funding are suspended pending resources freed up by withdrawals, revocations or reassessments; if none become available, they lapse and the applicant is notified. That is why it pays to submit on 10 November, not in January. Of the €150 million, €71,065,813.34 is reserved for spending plans carried out in eight southern regions (Abruzzo, Basilicata, Calabria, Campania, Molise, Puglia, Sardinia and Sicily): in the rest of Italy the effective budget is just under €79 million.

Yes, the Chambers of Commerce periodically publish digitalisation grants for micro, small and medium enterprises: in 2026 the Digital Innovation Grant 2026 (PI26) of the Emilia Chamber of Commerce closed its window on 30 July. Grants can coexist with the MIMIT voucher as long as they are allocated to different expenses. We follow new calls in our news.

The Ministry updates the official FAQs in rounds, without touching dates or amounts. The rounds, most recent first:

• 17 October 2026: the slides of the 15 October webinar and Invitalia’s interactive guide to the platform were published. Before drafting, the company must be registered in “Anagrafica e deleghe” by the legal representative, who can delegate read or write access; only items from the supplier’s published catalogue, with their code, can enter the spending plan; the application is submitted once. The desk is Invitalia’s reserved area, where the application is drafted from 12:00 on 20 October, as Invitalia’s page on the incentive of 16 October states; MIMIT’s page does not show the link yet. Invitalia contact centre on the toll-free number 800 775397.
• 12 October 2026: the supplier section grew to 52 answers and the beneficiary section was split into four subsections, with unchanged numbering: no pay-per-use or prepaid-credit cloud (supplier FAQ 52); hardware and licences can remain the supplier’s within a subscription (FAQ 51); in supply chains the code of whoever is accredited for the product type counts, while the offer and the invoice remain the reseller’s (FAQ 50).
• 8 October 2026: the Ministry published the application template, the supplier offer template and a template declaration on catastrophe insurance, and corrected FAQ 35: the offer attached to the application must be signed by the supplier.
• 1 October 2026: the beneficiaries section was reorganised and expanded to 42 answers, with new numbering: the catastrophe insurance obligation also covers rented, leased or loaned assets, unless the owner already holds equivalent cover; for a subscription, the spending plan shows the sum of the fees for the first 24 months; to request payout you must have incurred and paid at least 50% of the approved plan.
• 25 September 2026: a first section of 36 FAQs for beneficiaries: no SIM or mobile connections for the 30 Mbps; associated practices excluded, individual professionals admitted; one application per legal entity, with de minimis calculated on the Single Undertaking; expenses eligible only after the application is submitted; the offer must state supplier, identification codes, cost items and starting point; a supplier can include services of another accredited supplier by stating its code and name; grant paid in two instalments or in one.
• 2 and 15 September 2026: the 30 Mbps is the nominal download speed of the contract, not a guaranteed bandwidth; there are no standard price lists, the supplier’s offer must be tailored and describe the starting point and the guaranteed improvement, which the beneficiary declares in the application; configuring equipment you already own, for example a VPN on an existing firewall, is not eligible on its own, because professional services must accompany new products in categories A-D, which account for at least 70% of the plan; an approved supplier can also provide products of unlisted brands, as long as they belong to the type it is accredited for.

On 15 October MIMIT held the webinar on the submission platform: slides and interactive guide are in the checklist above; the application is drafted in Invitalia’s reserved area from 12:00 on 20 October, as Invitalia’s page on the incentive states; MIMIT’s page does not show the link yet. The details are in the news on the beneficiary FAQs.

As a reimbursement, after you have paid the supplier in full, with receipted invoices (beneficiary FAQ 37 and 38), and not before three months from the grant decision (art. 7 of the Directorial Decree of 4 August 2026). You can request it in two instalments, the first after incurring at least 50% of the expenses and the second at the end of the plan, or in a single payment. Invoices must show the CUP of the application and the identification code of the service or product. Deadlines: for direct purchases, expenses must be incurred within 12 months of the grant decision; for subscriptions, the contract must be signed within 30 days of the decision and notified to the Ministry within 60 days, on pain of forfeiture (art. 4 para. 5), and the expenses of the first 24 months count, even if paid in advance for one or more years (beneficiary FAQ 40); in mixed cases both deadlines apply and the project lasts at most 24 months from the signing of the subscription (beneficiary FAQ 42). The final report is submitted within 30 days of completion, and the project is complete when the expenses are invoiced and paid, without waiting for the 24 months of subscription to end (beneficiary FAQ 41). To submit a payout request, even for a single payment, you must have incurred and paid at least 50% of the approved plan (beneficiary FAQ 39 of 1 October 2026).

Yes, with a delegation. The legal representative registers the company on the platform, creates the delegate in the “Anagrafica e Deleghe” function, generates the delegation form and signs it digitally: from then on the delegate operates within the authorisations received (beneficiary FAQ 31). The digital signature of the application form, however, remains with the legal representative, or the self-employed person applying for themselves: only a special attorney registered in the system can sign in their place (beneficiary FAQ 32). To fill in the application you need SPID, CIE or CNS, a digital signature, an active PEC, the description of the initial situation and the expected improvement, the suppliers’ offers with identification codes and, for SMEs, the declaration on the catastrophe insurance policy on the MIMIT form (beneficiary FAQ 30).

Both have a role, and they are distinct. The Ministry’s supplier FAQ 48 and art. 5 para. 4 of the Directorial Decree of 4 August 2026 state that the supplier’s offer must contain a description of the applicant’s starting point in terms of cloud and cybersecurity and the improvement guaranteed by the products and services offered: so the supplier must first verify the real situation, with a documented assessment, and then write it into the offer. The beneficiary, when applying, declares the actual starting point and the expected improvement, and may attach supporting documentation: the declaration, and the responsibility that comes with it, is theirs. No countersignature is required by the Ministry. As its own practice, AtWorkStudio works like this: technical assessment before the offer, a document on the situation found countersigned by the customer, an offer that cites the assessment and attaches its evidence. That way what the customer declares and what AtWorkStudio writes coincide, and there is a record of who verified what.

With our free check tool at assessment.atworkstudio.it/en/mimit-voucher, 40 questions in three steps, no registration. You get a traffic light on the eligibility requirements (company size, region, connectivity, digital identity, de minimis, with a warning for DURC and catastrophe insurance, which count at disbursement), a first description of your starting point in cloud and cybersecurity across the five categories of the decree, the estimated grant on your spending plan with a check on generic hardware that is not eligible, a box with the points to clarify before the offer (equipment you already own, ERP modules, shared premises), the deadlines after the grant decision and an application checklist built on your answers. The result stays online with a personal link you receive by email and is the basis of AtWorkStudio’s offer: the starting point is then verified with the customer and put in writing, an AtWorkStudio practice to meet what supplier FAQ 48 requires of the offer.