Alloggiati Web and SIRED: Registering Guests in Sardinia

Every guest who sleeps in your property has to be reported to the Italian police, and separately counted for regional statistics. Two systems, two authorities, two deadlines — and neither of them is done for you by Airbnb or Booking.com.

Last checked: 5 October 2026. These rules change, and one of them changed in court. Before acting, check the official sources linked throughout this guide.

Two obligations, two authorities

Owners arriving from outside Italy usually discover these two systems in the wrong order: they hear about one, assume it covers everything, and find out in August that it did not.

	Alloggiati Web	SIRED / ROSS 1000
Who runs it	Polizia di Stato, Ministry of the Interior	Region of Sardinia
Purpose	Public security	Tourism statistics, for ISTAT
What it records	Each named guest, with document details	Arrivals and overnight stays, as numbers
Deadline	24 hours from arrival, 6 hours for stays of 24 hours or less	24 hours
How you get in	Apply to the Questura of your province	Automatically, through the regional RLO declaration
If you had no guests	Nothing to send	You still declare zero, if the property was open
If you get it wrong	A criminal offence	A statistical breach

The second column is national and applies wherever your property is in Italy. The third is Sardinian. If your property is in Olbia, Porto Rotondo or anywhere else in Gallura, you need both.

What Alloggiati Web is

Alloggiati Web is the Polizia di Stato’s portal for reporting the identity of everyone who stays overnight in accommodation. It is not a tourism system and not a tax system: it exists so that the police know who is sleeping where.

The obligation itself is older than the portal. Article 109 of the consolidated public security act — the TULPS, Royal Decree 773 of 1931 — says that the people listed in it may give accommodation only to people holding an identity card or another document suitable to prove their identity, and must report those identities to the territorially competent Questura, the provincial police headquarters.

Does it apply to a short let?

Yes, and the point has been settled by statute rather than left to interpretation. Article 19-bis of Decree-Law 113 of 2018, converted into Law 132 of 2018, states that article 109 is to be read as applying also to landlords and sublandlords letting property, or parts of it, under contracts of less than thirty days.

The Polizia di Stato’s own FAQ puts it plainly: managers of accommodation are obliged to report the identities of guests staying for periods of under thirty days too. The Questura of Sassari, which covers Olbia, lists “private apartments for tourist use and/or short lets” among the categories subject to the obligation, alongside hotels, B&Bs and holiday-home businesses.

It applies to every guest, including Italian nationals, and including children. There is no minimum number of nights and no exemption for occasional letting.

The two deadlines

Article 109 sets one deadline and then a shorter one inside it:

• Within 24 hours of arrival, for ordinary stays.
• Within 6 hours of arrival, where the stay is not longer than 24 hours.

The six-hour rule was added by Decree-Law 53 of 2019, converted into Law 77 of 2019, and it is the one that gets missed — because it applies to the guests you see least. Someone arriving at eleven at night for an early flight out of Olbia Costa Smeralda is a six-hour case: reported by five in the morning, not the following day.

The portal enforces this architecture rather than trusting it. The official user manual notes that the application only accepts today’s date or yesterday’s as the arrival date, precisely because the law requires the data to reach the Questura within those windows.

Getting your credentials: the part a non-resident can actually do

Here is the good news, and it is a real contrast with the national tourism database. Alloggiati Web credentials do not require SPID or an Italian electronic identity card. They are issued by the Questura, by email, after you send in a form.

For a property in Olbia the competent office is the Questura of Sassari, since the former province of Olbia-Tempio was merged into Sassari. The procedure it publishes is:

1. Choose the right form. A private apartment or single room let for under thirty days, without a business, uses the Istanza Appartamenti Privati – Affitti Brevi. Accommodation businesses use the Istanza Strutture Ricettive.
2. Attach a copy of your identity document. Any valid one; it does not have to be Italian.
3. Attach one — the form says one only — of: the notification of occasional letting stamped by the Comune; the declaration for the attribution of the IUN; or the stamped receipt for tourist-tax registration. Where the municipal form carries no stamp, the emailed or certified-email confirmation of having sent it is accepted, as is the Region’s reply containing the IUN / ROSS1000 code.
4. Send it as a PDF to the address the Questura publishes, or hand it in at its public enquiries office.
5. Wait. The Questura states that credentials are sent to the email address you gave within 30 days of the request.
6. Enable the service. After the credentials arrive there is a separate activation step inside the portal before you can send anything.

Two things follow from that list. The first is sequencing: the Questura wants evidence that you have already dealt with the Comune or the Region, so this is not the step to start with. The second is timing: thirty days is the published term, so a letting season planned in June around credentials requested in May is a season planned badly.

Note the order in which the Questura will accept your evidence — the municipal notification or the IUN. That is the same chain described in our guide to the IUN and the CIN in Sardinia, and it runs in the same direction.

What you actually send

The technical annex to the ministerial decree lists the fields: date of arrival; number of days of stay; surname; first name; sex; date of birth; place of birth; citizenship; type of identity document; document number; and place of issue.

Guests are entered as a single guest, a head of family or a head of group. Where a family or a group travels together, one person is entered with full details and the others are attached to them — which is how children are reported.

There are three ways to transmit: typing each record into the portal, uploading a text file built to the published record layout, or letting management software send the data through the portal’s web service. For one or two properties the portal is enough.

The receipt, and the data you have to delete

This is the part most owners get backwards, and the law is unusually explicit about it.

Every transmission generates a receipt, downloadable as a PDF, digitally signed with a QR control code by the Polizia di Stato. The decree says the receipt “counts as attestation that the obligation has been met”. The portal’s FAQ gives the retention period: receipts are to be kept for five years, in digital form.

And the mirror of that duty: once the system has generated the receipt, the manager is required to delete the transmitted digital data. Keeping scans of your guests’ passports in a phone folder or a messaging thread is not extra protection. It is a pile of other people’s personal data that you have made yourself responsible for, in a system that asks you to do the opposite.

Keep the receipt. Delete the rest.

The question that decides whether you can run this remotely

If you live abroad, everything above is manageable from a laptop. This part is not, and it is the most contested point in the whole subject.

On 18 November 2024 the Chief of Police issued a circular to all Prefects and Questori — protocol number 38138 — confirming that managers of accommodation of every kind must verify guests’ identity de visu, by checking in person that the people staying match the documents provided, and excluding the legitimacy of remote check-in procedures.

What the circular targeted was described by the courts as the practice of collecting copies of identity documents by electronic transmission and then granting access through automated door codes or key boxes at the entrance.

It was challenged, and the outcome went both ways:

• The Regional Administrative Court for Lazio, in judgment 10210 of 27 May 2025, annulled the circular, holding it contrary to article 109 and disproportionate.
• The Council of State, third chamber, deciding the Ministry’s appeal after a hearing on 9 October 2025 and filing its decision on 21 November 2025, upheld the appeal, reformed that judgment and dismissed the original claim.

So, as things stand, the circular is in force. A check-in where nobody ever looks at the guest, and a key box code is simply emailed over, is the specific practice the Ministry ruled out and the Council of State allowed it to rule out.

There is one qualification, and it comes from the Council of State itself. The court observed that identification de visu does not necessarily mean the owner standing in the doorway: it could be carried out through video-link devices installed at the entrance, provided they are capable of establishing, there and then, that the guest really is the holder of the document shown or transmitted — it gave a digital spyhole or a QR code capturing a still image as examples. The court then noted that the circular neither addresses these solutions nor rules them out.

That is as far as the official sources go. They do not approve any particular product, and we are not going to pretend otherwise. What they do establish is the line: a visual check of the person against the document, at the point of access, is required; emailing a code to an unverified person is not enough.

Can a property manager do this for you?

Yes, and there are two routes in the official texts rather than one.

The ministerial decree of 16 September 2021, which rewrote the 2013 rules, says that the credentials issued to the property “must be used personally by the managers of the accommodation or be handed to an identified person, specifically appointed to carry out the transmission, with the relevant instructions”. The decree then refers throughout to “the manager of the accommodation, or the person specifically appointed”. So a named, instructed delegate using the property’s credentials is expressly contemplated.

Separately, the Questura of Sassari’s published procedure for accommodation businesses asks estate agencies and property managers to attach their company registration extract to the application — which tells you that a manager applying in that capacity is a recognised case.

What none of this changes is where responsibility sits. The obligation under article 109 is on the person giving accommodation. Delegating the task does not delegate the consequence. Before handing anything over, the question worth asking a manager is narrow and practical: do you send me the receipts?

SIRED and ROSS 1000: the regional half

You will see both names, often together. The Region titles the service SIRED / ROSS 1000 and describes ROSS 1000 as the current version of the SIRED platform — so this is one system with two labels, not an old system and a replacement. The Region describes it as the information system for collecting data on accommodation capacity and tourist movements, built to simplify both the statistical obligations towards ISTAT and the public security communication to the Questura.

You do not apply for it separately. For occasional lets, registering the property on the regional RLO platform enrols you automatically, and the access credentials arrive when the Region finishes processing your file — the same second email that carries the IUN process to its end. Accommodation businesses started through SUAPE receive their credentials the same way.

The regional deadline is also 24 hours.

Three rules in the Region’s own guidance catch people out:

• Zero still has to be declared. A property that is open in a given month but had no guests must report the absence of movement as zero. Being empty is an answer, not an exemption.
• Children count. All of them, whatever their age, even if they do not occupy an actual bed. So do guests in extra beds.
• Not everyone staying is a tourist. The Region excludes people using the property as a permanent residence, workers employed locally, people housed after a natural disaster, guests who stay only a few hours — a stay has to exceed three hours to count as a presence — and anyone on a contract longer than a month.

The mistake that costs the most

ROSS 1000 can generate a file for the Questura, and that is genuinely useful. It does not make the two obligations one obligation.

The Questura of Sassari states the consequence in terms that leave no room: errors or malfunctions generated by third-party software, including SIRED / ROSS 1000, will not be accepted as valid reasons for failing to enter guests in the portal, and in that case the records must be entered manually in Alloggiati Web.

In the same place it sets out that Alloggiati Web is the sole channel to the Questura: the data cannot be delivered on paper, or in any other form, to the Questura, the Comune or any other police force. Transmission by certified email or fax is allowed only where a technical problem with the portal itself prevents the normal route, and an unjustified use of the alternative is treated as a failure to comply.

What happens if you do not

This is not an administrative fine. The Questura of Sassari states it in capitals: breaches of the obligation to report to the public security authorities are prosecuted criminally, under articles 17 and 109 of the TULPS read together.

We are not going to attach a figure to that here, because the penalty sits in a provision whose current wording we have not verified directly for this guide. The point that matters for a decision is the category: this is the obligation where a missed entry is not a bill to pay later.

A checklist for the season

Step	Where	When
Notify the Comune, and obtain the IUN	Comune, then the regional RLO platform	Before anything else
Apply for Alloggiati Web credentials	Questura of your province — Sassari for Olbia	Allow 30 days
Enable the service in the portal	Alloggiati Web	Before the first guest
Check SIRED / ROSS 1000 access works	Regional platform	Before the first guest
Decide who performs the visual check at arrival	The property	Before the first booking
Report each guest	Alloggiati Web	24 hours, or 6 for stays up to 24 hours
Download and file the receipt	Alloggiati Web	Keep for 5 years
Delete the transmitted data	Your own files	Once the receipt exists
Report arrivals and nights	SIRED / ROSS 1000	24 hours, and zero when empty

Frequently asked questions

What is Alloggiati Web?
It is the Polizia di Stato’s portal for reporting the identity of everyone who stays overnight in accommodation in Italy, including short lets. The obligation comes from article 109 of the TULPS; the portal is the only channel for meeting it.

Do I need SPID to register guests in Italy?
No. Alloggiati Web credentials are issued by the Questura of the province where the property is, by email, after you send an application form with a copy of your identity document. That document does not have to be Italian. This is different from the national tourism database, which does require digital identity or a dedicated accreditation for foreign citizens.

How long do I have to report a guest?
Twenty-four hours from arrival, and six hours where the stay is not longer than twenty-four hours.

Is Alloggiati Web the same as SIRED or ROSS 1000?
No. Alloggiati Web is national and exists for public security; SIRED / ROSS 1000 is the Sardinian regional system and exists for tourism statistics. They are separate obligations, and a failure in the regional platform is not an accepted excuse for missing the police one.

Can I use a key box and let guests check themselves in?
The Ministry of the Interior’s circular of 18 November 2024 ruled out check-in procedures where documents are collected remotely and access codes or key boxes are handed over with no visual check. The Council of State upheld that circular in a decision filed on 21 November 2025. The court did observe that a visual check could in principle be performed through video devices at the entrance capable of matching the guest to the document in real time, and that the circular neither addresses nor excludes such solutions.

Do I have to keep copies of my guests’ passports?
No, and the decree says the opposite: once the system has generated the receipt, the transmitted data is to be deleted. What you keep is the receipt, for five years.

Can my property manager report guests for me?
Yes. The 2021 decree allows the property’s credentials to be handed to an identified person specifically appointed to carry out the transmission, and the Questura of Sassari’s procedure recognises applications from estate agencies and property managers. Responsibility for the obligation stays with whoever gives the accommodation.

Where this leaves you

Of all the obligations attached to letting a property in Sardinia, this is the one with the shortest clock and the sharpest consequence. The codes and the tax questions can be fixed late. A guest who slept in your property without being reported cannot be reported properly afterwards.

Own a property in north-east Sardinia? Once it is ready to be let, AirAffitti can help you organise and run the operational side: listings, guest communication, pricing, check-in coordination, cleaning between stays and the day-to-day management of apartments and rooms in Olbia, Porto Rotondo and along the coast. What our management covers sets out what is included.

What we are not is a law firm or a tax practice. Nothing on this page is legal or tax advice. For your own position the official sources linked above, and a qualified Italian lawyer or accountant, are the right places to go.

AirAffitti editorial team