Innovative Startups Sector

Innovative Startups, Innovative SMEs and University Spin-offs

Hands-on support for innovative startups, innovative SMEs, university spin-offs and certified incubators: entry and filings in the special section of the Italian companies register, incentives, preparation for investor due diligence, data protection and security of the digital product.

Italian companies register – special section
MIMIT (Italian enterprise ministry)
Agenzia delle Entrate (Italian revenue agency)
Garante (Italian data protection authority)
Consob (Italian securities regulator)
ACN (Italian cybersecurity agency)
Italian Decree-Law 179/2012 (converted by Law 221/2012) – innovative startups
Italian Decree-Law 3/2015 (converted by Law 33/2015) – innovative SMEs
Italian Law 193/2024 – annual market and competition law 2023
GDPR – Reg. (EU) 2016/679
NIS2 – Italian Legislative Decree 138/2024
AI Act – Reg. (EU) 2024/1689

Request a consultation

Sector challenges

The pressure points

A status to be maintained, not merely obtained

Entry in the special section of the companies register calls for several requirements laid down by Italian Decree-Law 179/2012 to be met together, plus at least one of the alternative requirements on research and development, qualified staff or industrial property rights and registered computer programs. Continued registration has to be confirmed through periodic attestations: if one requirement lapses, the incentives attached to the status fall away with it.

Incentives that depend on the evidence

Tax relief for those who invest in the share capital, work for equity, the Fondo di garanzia per le PMI (the Italian SME guarantee fund), public funding calls and support schemes: every benefit rests on eligibility requirements, corporate resolutions and documentation to be produced and retained. Imprecise accounting for research and development costs puts the investor’s relief at risk, not only the company’s own.

Investor due diligence

A funding round turns on what can be documented: the cap table and convertible instruments, shareholders’ agreements, title to the intellectual property developed by founders, employees, freelancers and suppliers, customer contracts, the data protection compliance of the product. Gaps that surface in the data room translate into a discount on the price, warranties or conditions precedent.

Valuing a business with no track record

Before recurring revenue, value cannot be read from past accounts: it has to be built on the business plan, product metrics and comparison with comparable transactions, with assumptions stated openly. Term sheets, liquidation preference, anti-dilution and option clauses need to be understood before they are signed, because they bear on control and on the founders’ return.

Security the market asks for before the law does

The first enterprise customer arrives with a security questionnaire, a request for a data processing agreement and often the expectation of ISO/IEC 27001 certification; public tenders ask for much the same. For a small business this is an immediate commercial constraint, not a matter for the future.

Obligations triggered by growth

Providers of cloud services, data centres or managed services may fall within the scope of NIS2: as a rule where the service is one of the types covered and the size thresholds are met, though Italian Legislative Decree 138/2024 also sets out criteria for inclusion that are independent of size, so applicability has to be checked case by case. Those developing or integrating artificial intelligence systems have to establish which role they take on, provider or deployer, and which risk level the system falls into, because the applicable obligations follow from those two classifications. A Decree 231 Model becomes relevant once the business takes part in public tenders or institutional investors come on board.

Areas of work

How we work, in practice

Qualification, the special section and periodic filings

We check that the requirements are met under the rules as currently in force, prepare the documentation for entry in the special section and set the calendar of periodic confirmations and updates, with the supporting evidence for each alternative requirement. Where continued registration is about to expire or a requirement is at risk, the question is best addressed early, while it can still be managed.

Incentives, finance and public support schemes

We build up the picture of the benefits available: tax relief for those investing in the share capital, work for equity for directors, contractors and suppliers, equity crowdfunding on authorised platforms, the Fondo di garanzia per le PMI, funding calls and support schemes. We take care of eligibility requirements, resolutions and the documentation to be retained, so that the benefit holds up under a later inspection.

Preparing for the round and business valuation

We put in order what the investor will examine: cap table, convertible instruments, shareholders’ agreements, the chain of title to the intellectual property, contracts with founders and contractors, customer contracts, data protection compliance. We build the valuation using several methods and stated assumptions, and work alongside the founders in reading the term sheet.

Privacy by design in the digital product

We bring data protection into the development cycle: the legal basis for each processing operation, notices and consents within the product, minimisation and retention periods, the record of processing activities, an impact assessment where required. We settle the role of the business when it processes data on behalf of its customers and draw up the contracts that follow from it, together with the map of transfers outside the EU and of sub-processors.

Application security and the certifications customers ask for

We put the product, the APIs and the cloud infrastructure through vulnerability assessment and penetration testing, with a remediation plan ranked by priority. Where the market calls for it, we guide the business towards an information security management system conforming to ISO/IEC 27001 and prepare the responses to customers’ security questionnaires.

NIS2, the AI Act and the Decree 231 Model, when they become relevant

We check whether the business falls within the scope of Italian Legislative Decree 138/2024 on the basis of sector, size and classification, and where it does we handle registration with the ACN (the Italian cybersecurity agency), the risk management measures and incident notification. For artificial intelligence systems we establish the role and the risk level under Regulation (EU) 2024/1689. The Decree 231 Model comes in when public tenders or investors make it necessary.

Procedures and controls proportionate to size

We write the few procedures that are genuinely needed: access management, development and release, incident handling, onboarding of suppliers and contractors, recurring contracts. With the shareholders we agree a small number of indicators that can be read at a glance – for instance incidents opened and closed, access revoked when a working relationship ends, contracts signed with unauthorised departures from the standard terms – and update them in step with board meetings.

The context

An innovative startup is not a commercial label: it is a legal status. Italian Decree-Law 179/2012 (converted by Law 221/2012) established the special section of the companies register and, in the text now in force, makes entry conditional on several requirements being met together: an unlisted limited company of micro, small or medium size, an innovative corporate purpose of high technological value, a value of production within the statutory limit, a ban on distributing profits, and at least one of the alternative requirements on research and development, qualified staff or industrial property rights.

Requirements that are in part similar, with differences that are far from trivial, apply to innovative SMEs (Italian Decree-Law 3/2015, converted by Law 33/2015). Certified incubators are subject to requirements of a different kind, concerning premises, the skills of the management team and links with research; in university spin-offs the university’s own rules on shareholdings and on title to results also come into play.

The status has to be confirmed over time: the periodic attestation of the requirements and the update of the information filed with the register are the condition for remaining in the special section. The annual market and competition law 2023 (Italian Law 193/2024) amended the conditions for access and the period of continued registration, so the version now in force has to be read case by case.

A system of incentives revolves around the status, from tax relief for those investing risk capital to the Fondo di garanzia per le PMI (the Italian SME guarantee fund): every benefit rests on requirements and documentation, and how well it holds is measured in a later inspection.

Then there is the compliance that the market imposes before the law does. A digital product processes personal data, often on behalf of its customers, and the position of the business, whether controller or processor, has to be settled before signing. The contract demands assurances before the legislation does, through data processing agreements and security questionnaires. Growth can bring further obligations into play: NIS2 (Italian Legislative Decree 138/2024) for providers of cloud services, data centres or managed services, where the conditions set out in the decree are met, since the decree looks at the type of service, at size and also at criteria independent of size; the AI Act (Regulation (EU) 2024/1689) for those developing or integrating artificial intelligence systems; and the Decree 231 Model, once public tenders or institutional investors arrive.

Our hands-on support

We work with the founders and with the early management team, not in their place. The starting point is the stage the business has reached: registration, a first funding round, the first enterprise customers, a capital increase. From there comes a plan with a few priorities, clear responsibilities and deadlines, rather than a compliance programme that consumes resources the product needs.

The guiding criterion is proportionality. In young businesses the risk is not the absence of rules, but the presence of rules written for someone else: copied manuals that nobody applies and that, in a due diligence exercise, document the distance between what is written and what actually happens. So we write only the procedures that the real processes call for, with the controls built into the tools already in use.

On capital we work on two fronts: the evidence the investor will ask for in the data room, and the estimate of value built with explicit methods where the track record is short, as set out in business valuation and acquisitions. On the product we bring data and security into a single workstream, because GDPR compliance and security testing answer the same questions from customers and investors.

The scope is defined together and can change: a one-off engagement ahead of a round or an important contract, periodic oversight of the obligations, or continuous support while the organisation takes shape. The decisions remain with the founders: we bring regulatory insight, method and the ability to deliver.

Why a single partner

One guiding hand on themes that interlock: status and incentives, capital, data, security and processes concern the same business and the same product; handled together, they avoid documents that contradict one another.
Ready for scrutiny by those who matter: the same evidence serves the investor in due diligence, the customer filling in a security questionnaire and the authority checking an incentive.
Proportionality: procedures calibrated to the present size, designed to grow with the business rather than to be rewritten at the first round.
Continuity: the rules on innovative businesses and the European framework on data and artificial intelligence change often; we stay alongside the business to keep requirements and evidence up to date.

Frequently asked questions

Answers to the questions we hear most often

How is innovative startup status maintained over time?

Through continuous oversight, not an annual filing rushed through at the last minute. The requirements have to be checked against the company’s real figures: value of production, research and development costs actually incurred and documented, the composition of qualified staff, ownership, filing or licensing of industrial property rights and title to any registered computer programs, together with the ban on distributing profits. On that basis we prepare the periodic attestation and the update of the information filed with the companies register, and keep a file of evidence up to date. Since the rules were revised by the annual market and competition law 2023 (Italian Law 193/2024), the requirements and the period of continued registration have to be read in the version currently in force and applied to the individual company: where a requirement is at risk, it is better to decide early how to act.

Which documents does an investor ask for in due diligence, and how does a company prepare?

In this order: an up-to-date cap table including convertible instruments and incentive plans, the articles of association and shareholders’ agreements, corporate resolutions, the chain of title to the intellectual property (contracts with founders, employees, freelancers and agencies, open source licences used in the product), customer contracts and the service levels promised, the data protection documentation for the product, the status of the incentives obtained, litigation and the tax and social security position. Preparation means gathering these elements into an orderly data room, correcting what can still be corrected and documenting transparently what remains: a disclosed risk can be negotiated, whereas a risk uncovered by the investor weighs on the price and on the warranties.

How is a company valued when it has no significant revenue yet?

Not with a single formula, but with a range of value built on several methods and stated assumptions: the business plan and expected cash flows, multiples from comparable transactions in the same segment, methods that weight the probability of different scenarios, sensitivity analysis on the variables that really matter (conversion rate, customer churn, acquisition cost). The result serves two purposes: giving the founders a defensible reference point in the negotiation, and making the decision on the stake to be sold an informed one. The final price remains the outcome of the negotiation, and the term sheet has to be read in full, because preference, anti-dilution and option clauses bear on the return more than a few points of valuation.

Is ISO 27001 certification necessary in order to sell to enterprise customers?

It is not a legal obligation, but in many negotiations it is a requirement in practice: large customers and contracting authorities ask for it in order to qualify suppliers that handle their data. The useful sequence is a gradual one: first measure the real state of security with vulnerability assessment and penetration testing on the product and the infrastructure, then put the essential procedures in order, and finally build the management system and face the audit by the certification body. In the meantime, security questionnaires are answered with verifiable evidence, which in many negotiations allows matters to move forward while the certification process is still under way.

Does a Decree 231 Model make sense for a company with few employees?

Italian Legislative Decree 231/2001, on the administrative liability of entities, does not require an organisational model to be adopted, but a model that is adequate and effectively implemented is the entity’s principal defence where an offence is committed in its interest. For a small company it becomes a concrete matter in specific situations: taking part in public tenders and applying for public funding, the arrival of institutional investors who ask for it during due diligence, dealings with the public administration, exposure to computer crime or tax offences. In those cases we build a proportionate model, with protocols calibrated to the processes actually in place and a supervisory body compatible with the structure, avoiding standard documents that would not withstand scrutiny in court.

Related services

Nexaura expertise for this sector

Strategy

M&A: valuation and acquisitions

Strategic support in corporate transactions: business valuation, due diligence, negotiation and post-acquisition integration.

Find out more

Governance

GDPR Compliance

Compliance with EU Regulation 2016/679 and the Italian Privacy Code: assessment, record of processing, DPIA, policies and training.

Find out more

Cyber Security

Penetration Testing & Vulnerability Assessment

Technical security testing of networks, applications and infrastructure: we find vulnerabilities before an attacker does.

Find out more

Sustainability

ISO Certifications

Design, implementation and maintenance of certifiable management systems: ISO 9001, 14001, 45001, 27001, 37001, 50001 and the main sector and supply chain schemes.

Find out more

Strategy

Business Process Engineering

Mapping, analysis and redesign of business processes: we remove waste, reduce operational risks and prepare the ground for digitalisation.

Find out more

Let’s talk

Together, let’s build your tomorrow.

Tell us your business priorities: in a first meeting with no obligation we look at your context and propose a concrete way forward, with clear timescales and measurable results.

Request a consultation

info@nexaura.it