In brief: NIS2 does not end with the notification to DNSC. After the registration decision come the entity risk-level evaluation and then the maturity self-assessment, each with its own deadline and both recurring. On 30 September 2026 DNSC announced its first contravention sanction for failing to meet the notification obligation, in the amount of 50,000 lei. The information stage is over.
The first fine, as a signal
The decision was issued on 29 September 2026 against a legal entity in the public administration sector, for missing the notification deadline set by the ordinance. The amount, 50,000 lei, is useful as a reference point: nowhere near the million-euro ceilings written about in the press, but a real sum, applied for an administrative delay rather than for a security incident.
The practical conclusion is that the authority checks deadlines, not only incidents. A company can be well protected technically and still be sanctioned for a document not sent on time.
The chain of deadlines, in order
Every deadline after the notification runs from the date of the DNSC decision, not from the date of the law. This is the source of most of the confusion.
| Stage | Deadline |
|---|---|
| Notification to DNSC | 30 days from the moment the provisions become applicable to the company |
| DNSC identification and registration decision | 60 days for essential entities, 150 days for important ones |
| Designating the security officer | 30 days from communication of the decision |
| Entity risk-level evaluation | 60 days from the DNSC decision |
| Maturity self-assessment of the measures | 60 days from the risk-level evaluation |
For an important entity, almost eleven months can pass between the notification and the last deadline. That is long enough to forget, and the calendar is precisely what gets forgotten.
The tools and what each is for
- The NIS2@RO platform, the portal for enrolment, information and cooperation. An account here is mandatory, whatever method you used to send the notification.
- The NIS2@RO tool, the file that checks your classification and generates the notification form.
- ENIRE@RO, the tool for evaluating the entity’s risk level.
- The maturity self-assessment tools, for the following stage.
- PNRISC, the platform through which significant incidents are reported. This one is separate and runs on the 24-hour, 72-hour and one-month deadlines.
We covered classification and notification in the NIS2 guide for companies in Romania. This article continues from there.
What the risk-level evaluation does
Starting from the relevant attack and threat types, the size of the entity and the estimated impact and likelihood, the methodology produces a score. The score establishes the level of measures you have to implement: basic, important or essential.
The consequence matters for the budget. Not every entity owes the same set of measures, and the level produced here is what later justifies what you did and what you did not.
The maturity self-assessment
It is an assessment across the functions of the security framework: identify, protect, detect, respond, recover and govern. You give each a maturity score, and the result is submitted to the authority and endorsed by management.
The part many companies miss comes afterwards. Essential entities have 30 days to draw up and submit a plan of measures for the deficiencies identified. Failing to notify that the plan has been implemented, and failing to supply the evidence within the undertaken deadline, are contraventions in their own right. An honest self-assessment effectively commits you to a plan you will then owe.
What to prepare so it is not painful
- An inventory of assets and services. Which systems support which services, on what equipment, in which locations.
- The public IP address ranges, required from the notification onwards and rarely documented in advance.
- The written policies: access, passwords, backup, incident handling, remote work, suppliers.
- Evidence, not statements. Screenshots from administration consoles, update reports, logs, exported configurations.
- Training records, including the accredited course for management, with the supporting documents.
- The report of the last restore test, with the date and the measured duration.
- The list of critical suppliers and what you verified for each.
If you gather these once and keep them current, the self-assessment becomes a day’s work. If you go looking for them at the deadline, it becomes a month.
The mistakes that repeat
- Treating it as a paper exercise. Documents with no measures behind them show at the first inspection.
- An inflated score. A maturity level declared too high spares you the plan of measures today and leaves you defenceless at an inspection.
- Missing evidence. Stating that you have two-step authentication is worth nothing without the export that shows it.
- Nobody puts the deadlines in the calendar. The DNSC decision arrives by correspondence, and every other deadline starts from it.
- Management signs without understanding. Responsibility sits with the management body, not with the IT department.
What we do and what stays with you
PRO IT prepares the technical side and the evidence: the infrastructure inventory, the security configurations, logging, restore tests with a written report, the required documentation. The measures themselves sit within the cybersecurity and maintenance services, and the current state is established by the IT audit.
Filling in the tools, submitting to the authority, the legal classification and management’s endorsement remain the company’s, usually together with its legal adviser. We do not sell NIS2 compliance as a product, because no IT provider can guarantee it in place of management.
This article is for general information and reflects the legislation in force at the date of publication: GEO 155/2024, approved with amendments by Law 124/2025 and amended by Law 123/2026, together with DNSC Orders 1/2025, 2/2025 and 3/2025. The deadlines indicated derive from the DNSC orders; verify them for your own situation. It does not constitute legal advice. The official texts are on Portal Legislativ and on the DNSC website.
