In brief: NIS2 applies in Romania through Government Emergency Ordinance 155/2024, amended by Law 124/2025 and Law 123/2026. If your company operates in a sector listed in the annexes and has at least 50 employees or a turnover above EUR 10 million, you probably fall into the essential or important entity category. The deadlines do not run from the date of the law, but from the decision you receive from DNSC, and fines start at 1,000 lei, not at millions of euros.
Who falls within the scope of NIS2
Two conditions must be met at the same time: the sector of activity and the size of the company.
The sector. The law splits the fields into two annexes. Essential entities come from sectors such as energy, transport, banking and financial market infrastructures, health, drinking and waste water, digital infrastructure, public administration. Important entities cover postal and courier services, waste management, the food industry, manufacturing and chemicals, digital service providers, research. Law 124/2025 extended the list, for example towards certain distributors and resellers in the pharmaceutical area, identified through NACE codes.
The size. The general rule is “medium and above”: at least 50 employees or an annual turnover above EUR 10 million. Some providers fall within the scope regardless of size, for example trust service providers or certain digital infrastructure services.
If you operate in two or more sectors from the annexes, the law requires you to apply the measures of the highest level that applies to you. You do not get to choose the lighter regime.
The deadlines run from the DNSC decision, not from the law
This is the most frequent confusion. The only deadline tied to the ordinance entering into force was the first notification window. Everything else is calculated differently.
- Notification to DNSC: 30 days from the date the provisions become applicable to your company. A company that grew beyond the thresholds above in 2026 has its own 30-day window; it has not missed a deadline from January 2025.
- The DNSC decision: 60 or 150 days. The Directorate issues the identification and registration decision within 60 days of your notification for essential entities, and within 150 days for important ones.
- Designating the security officer: 30 days from communication of the decision. This is the responsabil cu securitatea rețelelor și sistemelor informatice, the person who implements and oversees the measures.
An important entity can find out after almost five months that it is an important entity. Only then does its own calendar of obligations start.
What you have to notify
Notification is made through the NIS2@RO tool and the NIS2@RO platform, in the form established by Order 1/2025. It contains the identification and contact details, the sector and subsector from the annex, the member states in which you provide services, and your company’s public IP address ranges.
In practice, the last item is what most often delays the notification. Many companies have not documented which public IP addresses they use and through which providers. If you cannot answer that question right now, it is a good reason to take an inventory, independently of NIS2.
The obligations of management
The law places responsibility on the management body, not on the IT department. Three distinct obligations:
- Accredited professional training for members of management, sufficient to identify risks and assess cybersecurity risk-management practices. An internal briefing does not discharge this requirement; the course must be accredited. All staff must be trained regularly.
- Permanent means of contact and allocated resources for implementing the measures.
- Designating the security officer, within 30 days of the DNSC decision, with the designation recorded.
Incident reporting: 24 hours, 72 hours, one month
The clocks run from the moment you become aware of the significant incident, not from the moment it occurred.
- 24 hours: the early warning to the national CSIRT at DNSC, stating where applicable whether the incident appears to be caused by unlawful acts or could have cross-border impact.
- 72 hours: the incident report, with an initial assessment of severity and impact and, where available, indicators of compromise.
- One month from the incident being handled: the final report, with a detailed description, the threat type or root cause, the measures applied and any cross-border impact.
An incident is significant if it has caused severe operational disruption of services or financial loss to the entity, or considerable material or non-material harm to others. Either situation is enough on its own.
Decide in advance who has the authority to declare an incident significant. On a Saturday morning, 24 hours pass quickly.
The annual self-assessment
Romania added a recurring obligation that many national transpositions do not have: an annual self-assessment of the maturity of the risk-management measures, submitted to DNSC and endorsed by management.
Essential entities then have 30 days to draw up and submit a plan of measures to remedy the deficiencies identified. Failing to notify that the plan has been implemented, or failing to supply the supporting evidence within the undertaken deadline, are contraventions in their own right. A company can be technically secure and still be sanctioned for missing the annual cycle.
The fines: the real figures
The EUR 10 million and EUR 7 million figures that circulate in the press are the ceiling of two bands out of five. The law sets a scale in lei, with a minimum for each band.
| Category | Range |
|---|---|
| Important entity, breaches of risk management and reporting | from 5,000 lei, up to EUR 7,000,000 in lei equivalent or 1.4% of worldwide turnover |
| Essential entity, the same categories | from 10,000 lei, up to EUR 10,000,000 in lei equivalent or 2% of worldwide turnover |
| Important entity, the second group of obligations | 1,000 – 300,000 lei |
| Essential entity, the second group | 1,500 – 500,000 lei |
| Any entity, the third group | 1,000 – 100,000 lei |
For most contraventions, the range that actually applies to a company in Romania is 1,000 – 300,000 lei. Serious breaches, meaning a repeated act, obstructing an audit or supplying false information, are sanctioned with 3,000 – 600,000 lei, and on repetition the limits are increased by half.
Where to start, in practice
- Establish whether you fall within the scope, by sector and by size. The NIS2@RO tool published by DNSC, an Excel file you complete locally, helps with self-assessing your classification and generates the notification form.
- Inventory the infrastructure: which systems support the services, which public IP addresses you use, who has access to what, where the data is.
- Notify DNSC on time and note the date of the decision, because the other deadlines run from it.
- Designate the security officer and enrol management in an accredited course.
- Put the technical measures in place: multi-factor authentication, network segmentation, a configured firewall, endpoint protection, backups with restore tests, logging and alerts.
- Document the reporting procedure and decide who declares an incident significant.
- Put the annual self-assessment in the calendar, not in the project plan.
What we do and what stays with you
PRO IT implements and administers the technical side: risk assessment with a report for management, Fortinet firewall, Sophos endpoint protection, multi-factor authentication and access policies, backups with restore tests, monitoring and infrastructure documentation. To prepare the decisions we have the IT audit, which shows you where you stand against the requirements above.
The legal classification, the notification to DNSC, the formal designation of the officer and management’s endorsement of the documents remain the company’s responsibility, usually together with its legal adviser. We do not sell “NIS2 compliance” as a product; no IT provider can guarantee compliance in place of management.
This article is for general information and reflects the legislation in force at the date of publication: GEO 155/2024, approved with amendments by Law 124/2025 and amended by Law 123/2026, together with DNSC Orders 1/2025 and 2/2025. It does not constitute legal advice. For the exact classification of your company, consult the legal text on Portal Legislativ, the official information on the DNSC website and a legal adviser.
