AGCOM blocking orders: five working days or thirty minutes? It depends on the article
7 min read
If you supply access, hosting or DNS resolution in Italy, you may already be party to proceedings without having received anything. No certified email, no service of notice: where the addressees are too many, the opening is notified by publication on a web page, and the deadline to reply runs anyway. Five days. They are working days, but the article setting it does not say so: another article, at the end of the regulation, does. And in the procedure next door, on the same operator, the deadline is not five days. It is thirty minutes.
Five days, counted in a different article
The regulation on copyright protection over electronic communications networks is annex B to resolution 680/13/CONS, last amended by resolution 209/25/CONS of 30 July 2025. Article 7(4) sits in the ordinary procedure of chapter III: providers, the uploader and the managers of the page and the site, if they wish to reply, must send the directorate every useful element «entro il termine di cinque giorni dalla ricezione della comunicazione di cui al comma 1» — within five days of receiving the notice under paragraph 1.
Five days, and the article does not say which ones. The rule sits two chapters on, among the final provisions. Article 15(1): «Nel computo dei termini di cui al presente regolamento si tiene conto esclusivamente dei giorni lavorativi, fatto salvo quanto previsto al capo IV.» — only working days count, save as provided in chapter IV. Chapter IV is articles 11 to 13, on media service providers: there the deadlines are ninety, one hundred and fifty, and seventy days.
Resolution 68/26/CSP, adopted on 10 September 2026 and published on the 23rd, confirms this and adds an awkward detail: nobody filed a reply «entro cinque giorni lavorativi decorrenti nel caso di specie dal 3 agosto 2026» — within five working days running here from 3 August 2026. The detail is the date: the same act places the notice of opening on 4 August 2026 and runs the deadline from the 3rd. A day of drift does not change that outcome. It changes how you reconstruct your deadline: not from the date you hold in-house, but from the act.
Thirty minutes, and they sit in article 10
The other clock is article 10, the interim procedure for live audiovisual content. Under paragraph 5 the Authority verifies the reports and passes them through Piracy Shield to the addressees of the interim order, who «immediatamente e comunque non oltre 30 minuti dalla ricezione, disabilitano l’accesso ai nomi a dominio e indirizzi IP segnalati» — immediately, and within 30 minutes of receipt, disable the domains and IPs reported, with automatic redirection to an Authority-specified page.
Paragraph 6 closes the way out. Those not involved in the accessibility of the unlawful site or services must still act «non oltre 30 minuti dalla notificazione del provvedimento di disabilitazione» — no later than 30 minutes from service of the disabling order — taking every technical measure to hinder the content’s visibility, de-indexing from search engines in every case. Being outside the chain does not take you off the list: it changes the duty, not the stopwatch.
Article 10 sits in chapter III, not chapter IV: the chapter that article 15 carves out of the working-day count is not the one where the thirty minutes live. Our reading: a deadline written in minutes is not counted in days, the working-day rule does not touch it, and those thirty minutes run at night, on a Saturday, and through the August holidays.
Between the two extremes there are three more. «I prestatori di servizi ottemperano agli ordini entro tre giorni dalla notifica» — compliance within three days of service (article 8(2)). The accelerated procedure brings that down to two days (article 9(1)(f)), and two days is also what the interim order under article 9-bis allows. The one on live content is executed within a deadline set by the Authority, no more than 24 hours from service (article 10(2)). Five deadlines, three in working days and two on a running clock, all on the same party — the same scale as the significant incident, where the threshold is one hour.
Article 10(4) holds the clause on whoever reports: the rights holder «è tenuto a non segnalare risorse che presentano un alto rischio di overblocking» — must not report resources with a high overblocking risk. Then a sentence that names no target: «In caso di mancato rispetto dei requisiti e delle condizioni che regolano il funzionamento della piattaforma Piracy Shield, l’Autorità provvede alla sospensione dell’accreditamento» — the Authority then suspends accreditation. It sits among the duties of whoever reports; but accreditation is a condition of everyone on the platform, and the provision draws no distinction.
How you end up in the file without being called
The September decision starts from an application by the holder of rights in a photographic work, servers outside national territory. The opening was notified to the providers under article 4 of the regulation and the intermediaries under article 2 of the anti-piracy law by publication on the Authority’s website, under article 8(3) of law 241/90, «in ragione dell’elevato numero di destinatari, circostanza che rende particolarmente gravosa la comunicazione personale» — given the high number of addressees, which makes personal notification particularly onerous. Three contacts were reached personally: the domain requester, the hosting provider, and the party the servers trace to. Everyone else was informed by a web page.
The investigation reconstructs the chain. The registrar is a US company, which registered the domain for an unidentifiable party. In front of the hosting sits a reverse proxy, which in the act «appare essere fornitore di hosting in quanto opera come reverse proxy» — appears to be the hosting provider because it acts as a reverse proxy; queried, it names the actual provider, in Hong Kong, whose servers are in Amsterdam. Three jurisdictions for one photograph. What identifies you in the file is not your name: it is where your routing, your resolver or your disk space sits in that chain.
The outcome should be read first. Article 8(2-bis) covers the case where the infringement is there but the order cannot be given: the collegiate body «dispone l’archiviazione degli atti e dà comunicazione della violazione accertata agli organi di polizia giudiziaria» — closes the file and reports the infringement to the criminal police — under article 182-ter of the copyright act. That is what happened. The infringement was established and the work still accessible after the notice of opening; but the site carries «una molteplicità di contenuti dell’ordine dei milioni», content in the order of millions, and the infringement concerns a single work, so blocking the whole site would be disproportionate. File closed, papers to the criminal police.
The point
Thirty minutes is not a technical response time: it is an organisational one. Article 14 says communications are made «esclusivamente mediante posta elettronica, ove possibile, certificata» — solely by email, certified where possible — and, where provided, through the platform: the stopwatch starts on a mailbox, not on an API. In the compliance specifications we deliver, that mailbox becomes a watch with a shift, a named recipient and a measured acknowledgement time; and disabling leaves a trace — what, on which resource, at what time, with which redirection — verified at acceptance like a measurement. It is needed on the way out too: article 10(11) has the Authority order routing unblocked to IP addresses blocked for at least six months.
On the other axis: the article 8 .txt list, platform lists, resolver configurations, routing filters, blocking and re-enabling logs sit in systems that do not talk. With us they converge into a single map of the network and its nodes, where an AI compares the list ordered with the list applied and flags the order executed on one node and not the next, or the resource nobody re-enabled. Where an AI is needed on that data, it runs inside the client perimeter — on-premises or in a dedicated cloud with data centres in Italy — with CSIDIA, the other company in the group. Our own teams, no subcontracting.
Do you know who reads the mailbox a disabling order lands in, and how fast? Talk to one of our engineers: the site visit is free of charge, and a watch is designed to hold up at two in the morning, not to exist on paper.