NIS2 in Romania — who is in scope, and what the obligations are

A company operating in Romania in energy, transport, health, digital infrastructure, managed IT services, manufacturing or any other sector the NIS2 Directive covers has concrete cybersecurity obligations under Romanian law, and answers to the Romanian authority, DNSC — whatever the group does elsewhere. This article sets out who is in scope, what the Romanian implementing rules add, and the fines.

The legal framework

NIS2 (Directive (EU) 2022/2555) is the European cybersecurity framework for critical and important sectors. It replaced the first NIS Directive of 2016, extended the number of sectors and organisations covered and tightened obligations and sanctions.

Romania transposed it by Government Emergency Ordinance no. 155/2024, approved with amendments by Law no. 124/2025, in force since 10 July 2025. The competent authority is the National Cyber Security Directorate (DNSC), which registers entities, supervises them and imposes sanctions. Two DNSC orders in force since 20 August 2025 complete the framework: Order no. 1/2025 on registration and Order no. 2/2025 on the risk assessment methodology.

For a foreign group, the jurisdiction rule matters. Under Article 26 of the Directive, an entity falls under the Member State where it is established. A Romanian subsidiary in a covered sector is therefore subject to DNSC even if the parent complies with NIS2 elsewhere. The exception is a group of digital providers — DNS, top-level domain registries, cloud, data centres, content delivery networks, managed IT and security services, online marketplaces, search engines and social networks — which fall under the Member State of their main establishment in the EU.

Is the company in scope?

Three tests apply together: the sector of activity, the size of the company, and, in some cases, the critical nature of the service.

Size. As a rule, only medium and large companies are in scope. Medium means 50 or more employees, or turnover and balance sheet both above 10 million EUR. Large means 250 or more employees, or turnover above 50 million EUR and a balance sheet above 43 million EUR. Micro and small enterprises are generally outside the scope.

Exceptions to the size rule. Some entities are in scope whatever their size: qualified trust service providers, top-level domain registries, DNS service providers, public administration bodies and critical entities under the resilience legislation. A smaller company can also be designated if it is the sole provider in Romania of a service essential to society or the economy, or if a disruption of its service would have a significant impact.

Essential or important?

The classification follows from the same tests. In general, essential entities are large companies in Annex 1 sectors, plus the entities covered regardless of size listed above. Important entities are the other in-scope companies: medium-sized companies in Annex 1 sectors, and medium or large companies in Annex 2 sectors.

The obligations are largely the same for both. The difference lies in supervision — essential entities can be inspected proactively, important entities mainly after an incident or on evidence of non-compliance — and in the level of the fines. DNSC confirms the classification by a decision after registration.

The obligations

• Registration with DNSC

  Entities in Annex 1 and Annex 2 sectors notify DNSC for registration under Order no. 1/2025. The initial window ran for 30 days from 20 August 2025; a company that comes into scope later has 30 days from that moment. The notification includes a self-assessment of the impact a disruption of its services would have.

• Risk level assessment

  Under Order no. 2/2025, the entity assesses its cybersecurity risk level and files the result with DNSC within 60 days of being notified that it has been identified as essential or important. The risk level determines which set of measures applies. A maturity self-assessment and a remediation plan follow.

• Risk management measures (Article 21)

  Policies on risk analysis and information system security, incident handling, business continuity and crisis management, supply chain security, security in development and maintenance, assessment of the effectiveness of measures, cyber hygiene and training, cryptography, human resources security and access control, multi-factor authentication.

• Management accountability (Article 20)

  The management body approves the risk management measures, oversees their implementation and can be held liable for failures. Its members must follow cybersecurity training. Law no. 124/2025 also requires the management body to appoint persons responsible for the security of network and information systems, within 30 days of the DNSC decision on identification and registration.

• Incident reporting (Article 23)

  For a significant incident: an early warning to DNSC within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report within one month of the notification.

• Supply chain

  Security risks arising from suppliers and service providers have to be assessed and addressed, including through contractual clauses.

NIS2 and the GDPR overlap at the point of an incident. A significant incident that also affects personal data is reported twice: to DNSC on the NIS2 timeline, and to ANSPDCP within 72 hours under Article 33 GDPR. One internal procedure should cover both.

The fines

Beyond fines, members of the management body can be held liable, and DNSC can order corrective measures. For essential entities, the authority can, as a last resort, have a certification or authorisation suspended and temporarily bar a person in charge from managerial functions. The percentage is calculated on the turnover of the undertaking, which for a subsidiary may mean the group.

Where to start

• 1
  Establish whether the company is in scope

  Check the NACE codes actually carried out, not only the main one, against Annex 1 and Annex 2, then the size of the Romanian entity. A free NIS2 checker is available in Romanian on this site.

• 2
  Check the registration with DNSC

  If the company was in scope in August 2025 and did not register, the delay should be addressed now. If it came into scope later, the 30 days run from that moment.

• 3
  Assess the current level of security

  Identify the policies, procedures and technical measures already in place, including those inherited from the group, and the gaps against Article 21 and the measures set by the risk level.

• 4
  Involve management

  NIS2 places responsibility on the management body. The board has to approve the measures and follow the training; this is not a matter for the IT department alone.

The checker: NIS2 applicability checker (in Romanian).

Frequently asked questions