NIS2 in Romania: the complete 2026 guide for companies

NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. It replaces the first NIS directive, greatly widens the range of sectors and companies covered and puts the emphasis on management accountability, risk management and incident reporting. Member States had to transpose it by 17 October 2024.

Romania transposed the directive through OUG 155/2024, an emergency ordinance adopted at the end of December 2024 and approved with amendments by Law 124/2025. The national competent authority and national CSIRT is DNSC — the National Cyber Security Directorate. Some sectors also have sectoral authorities with their own remit; check dnsc.ro to see who you deal with in your sector.

The general rule is the size cap: in scope are medium and large entities operating in the sectors listed in Annexes I and II of the directive. Size follows the EU SME definition — broadly, from 50 employees or above the financial thresholds of a small enterprise.

• Annex I — sectors of high criticality: for example energy, transport, banking, financial market infrastructures, health, drinking and waste water, digital infrastructure, ICT service management (B2B), public administration, space.
• Annex II — other critical sectors: for example postal and courier services, waste management, chemicals, food, manufacture of certain products (medical devices, electronics, electrical equipment, machinery, motor vehicles), digital providers, research.

Some entities are in scope regardless of size, among them: qualified trust service providers, DNS service providers, top-level domain name registries, providers of public electronic communications networks or services, and entities that are the sole provider of a service essential to society or the economy.

The directive splits in-scope entities into two categories. The difference is not in what you have to do — Art. 21 measures and incident reporting apply to both — but in how you are supervised and in the level of penalties.

The category is more than a label. It determines how ready you must be at any moment: an essential entity has to be able to produce evidence on request, without waiting for an incident, while an important entity will usually be checked only when there is a reason. In practice both have every interest in keeping documentation and evidence current — ex post supervision starts at the worst possible moment, right after an incident. Record the reasoning behind your scoping and revisit it when the business or its size changes.

1. Register with DNSC within the deadline set by national law (30 days from qualifying, per the Romanian implementation), with the data required by Art. 27 — steps in the DNSC notification guide.
2. Risk-management measures under Art. 21(2) — ten areas, from risk analysis to MFA, translated into technical controls.
3. Significant incident reporting (Art. 23): early warning within 24 hours, notification within 72 hours, final report within one month.
4. Governance (Art. 20): management approves the measures, oversees implementation, follows training and can be held liable — see management accountability.

These four obligations reinforce each other. Registration makes you visible to the authority, Art. 21 measures reduce the likelihood of an incident, the reporting procedure protects you when an incident happens anyway, and management involvement secures the budget and decisions without which the first three stay on paper.

The clock starts when the organisation becomes aware of a significant incident, not when the investigation is complete. Besides the authority, you may need to inform recipients of your services about significant cyber threats that could affect them. Prepare a template and decide in advance who submits.

The directive sets floors for the maximum fines Member States must be able to impose: for essential entities at least up to EUR 10 million or 2% of worldwide annual turnover, for important entities at least up to EUR 7 million or 1.4% — whichever is higher in each case. The exact amounts applicable in Romania are those in national law.

Beyond fines, authorities can issue warnings, binding instructions and remediation deadlines. For essential entities, the directive even allows a temporary prohibition on a person discharging managerial responsibilities (at CEO or legal-representative level) from exercising those functions until the deficiencies are remedied.

1. Scoping: record sector, size and category (essential/important) in writing.
2. Registration: submit your data to DNSC on the official form and appoint someone to keep it current.
3. Inventory and assessment: list your assets and assess them against the ten Art. 21 measures.
4. Remediation plan: prioritise by risk — MFA, tested backups, patching, supplier access.
5. Incidents: written procedure, register, templates and a tabletop exercise.
6. Management: formal approval, training for management body members, periodic review.