NIS2 in Romania: who must comply, by when, and what happens if you don't

On a Tuesday morning, a director gets an email from the company's largest client. It isn't an order. It's a security questionnaire, forty questions long, with a two-week deadline.

He forwards it to the company's IT contact, with a one-line note: "can you take a look at this?" That's the normal reflex. It's also the first mistake.

The law behind that questionnaire contains a clarification almost nobody reads. Added in the summer of 2025, two lines long, it rules out both the general meeting of shareholders and the board of directors: neither is a "management body" within the meaning of the ordinance.2 Accountability doesn't climb to the shareholders and doesn't drop to the IT department. It stays with executive management.

The rest of this article is about how you find out whether it applies to you, what you have to do, and in what order.

What NIS2 is, and what it actually asks of a company

NIS2 is a European law about cybersecurity. It came out of a simple observation: when one company is attacked, the effect rarely stops there. If an energy supplier, a hospital, or a company that keeps other companies' systems running goes down, their customers go down with them. The law tries to raise the minimum level of security in exactly the sectors the rest of the economy depends on.

What it asks comes down to three things:

• Make yourself known. You register with the national authority, so it knows who you are and which service you keep running.
• Keep your risks under control, and be able to prove it. Tested backups, control over who has access to what, two-step authentication, a clear process for incidents, training for your employees, attention to your suppliers.
• Say something when it breaks. A significant incident is flagged through an early warning, within 24 hours.

Worth saying what it doesn't ask: it doesn't tell you which products to buy and it doesn't require a particular certificate. It requires that measures exist, that they're documented, and that you can show them to someone who asks.

Which is also why the subject goes beyond compliance. That list is, almost word for word, the list of things that separate a two-hour incident from a two-week one. Companies that already have them have little to do. Companies that don't would need them anyway, law or no law.

Which law implements NIS2 in Romania

NIS2 is an EU directive from 2022, and directives don't apply to companies directly: each country rewrites them into its own law, and the national version is the one that binds you.

Here, that act is Government Emergency Ordinance no. 155/2024. It has been in force since 30 December 2024 and was approved, with amendments, by Law no. 124/2025, published in the Official Gazette on 7 July 2025.12

You'll find material online that pins NIS2 on Law no. 58/2023, Romania's general law on cybersecurity and cyber defense. That isn't the act that binds your company. It's worth checking the legal basis every time you read about NIS2, because a lot of what's online was written before the rules settled.

The concrete rules only arrived a year later, through DNSC Orders no. 1 and no. 2/2025, published on 20 August 2025.34 The first says how you register. The second, how your risk level is calculated.

The last piece arrived in August 2026, through DNSC Order no. 1/2026, published in Official Gazette no. 712 and, with its annexes, in no. 712 bis of 27 August 2026. It approves the actual list of security measures and the methodology you use to assess for yourself how far you are from them, and it also amends the risk-assessment methodology from Order no. 2/2025. Publication didn't bring a general grace period: each company stays on the deadlines that follow from its own DNSC decision.7

The framework was filled in straight away. DNSC Order no. 2/2026, in force since 18 September 2026, sets how many controls can be declared not applicable and how companies that belong to a group are assessed. DNSC Decision no. 3/2026, published on 21 September, spells out the group rules.10

If what you're reading on NIS2 stops at the 2025 orders, it's missing precisely the part that tells you what to do. And if it stops at 27 August, it doesn't yet know which controls you can leave out.

Does NIS2 apply to my company? Five questions

The questions below are a quick orientation, not an official classification.

If you answered yes to the first two, you have a serious reason to verify your classification formally, before concluding that the law doesn't apply to you.

That formal check can be started today, with the official tool. DNSC publishes an Excel file, the NIS2@RO instrument, which you download and fill in locally. It gives you a preliminary read on your classification, and the registration form is generated from the same file. Further down we cover where to get it and how it works.6

Why classification is more complex than it looks

The five questions above point you in the right direction. They don't give you a classification, because the law builds one in several steps, and the order of those steps matters.

• Activity first, size second. You check first whether the activity you actually carry out falls into one of the sectors in the law, and only then whether the company crosses the thresholds. What counts is what you do, not every activity code you happen to have registered.
• Size isn't calculated on your company alone. The thresholds follow the rules in small and medium enterprise legislation, which require the data of linked and partner enterprises to be included, meaning the companies that own you, that you own, or with which you share control.1 The company in our example has 45 employees of its own, but 80 together with the warehousing company in the group. It crosses the threshold without hiring anyone.
• Some entities are in scope whatever their size. Sole providers of a service someone else depends on, entities individually designated by the authority for their strategic role or systemic impact, and those classified as critical under critical entity resilience legislation.1
• Others are excluded entirely. Institutions in the fields of defense, public order and national security don't fall under this ordinance.1
• The assessment is done per service, not per company. You look at each service you provide that might fall into the annexes of the law, not at the company as a block. A company can have one service in scope and everything else outside it.1
• Classification isn't permanent. You redo it whenever something changes: you cross a threshold, enter a new sector, buy or sell a company.

Four recommendations, so you don't get the classification wrong

• 1. Don't start from the headcount. Start from what the company does, day to day. If the activity isn't in a listed sector, the rest of the discussion doesn't matter.
• 2. Ask your accountant for the group-level calculation. With linked and partner enterprises included. This is the single most common place where a company believes it's out of scope and isn't.
• 3. Document the analysis, with a date and the name of whoever did it. In a review, what counts is that you analyzed it and when, not only what you concluded.
• 4. Don't decide on your own that it doesn't apply to you. It's the one conclusion in this whole process that can't be corrected retroactively. The other steps can be caught up late; a classification that's wrong on the low side usually surfaces when it's too late.

A note on who does what, so you don't ask either side for something they can't give. Legal classification, the notification and the paperwork are handled with a consultant or a lawyer. A managed IT provider, which is what we are at Risksoft, can tell you what equipment you have, who has access to what, and which security measures are missing. These are two separate conversations, and mixing them is the most common way to lose time.

Essential or important entity? What the difference means

The two terms run through the whole law, and both the deadlines and the fines depend on them. Almost nobody explains what they mean, so here goes.

Essential entities are mainly large companies, meaning 250 employees or more, or over EUR 50 million in turnover and over EUR 43 million in balance sheet total, in the high-criticality sectors: energy, transport, banking, financial market infrastructure, health, drinking water and wastewater, digital infrastructure, public administration. A few categories named explicitly in the law also land here whatever their size, from sole providers to critical entities.1

Important entities are the other companies in scope: generally medium-sized enterprises in the high-criticality sectors, and medium or large companies in the other sectors, such as digital services, waste management, food production, postal and courier services.1

The category has to be verified against the sector and the criteria that apply to your company, and DNSC makes the decision.

The company in our example, transport, medium-sized: most likely an important entity. That means 150 days before DNSC decides, and a lower ceiling on fines. The security obligations, however, stay the same as for an essential entity.

What that changes in practice:18

The difference is in oversight and penalties, not in effort.

Careful: "essential" means two different things

This is the most common confusion in NIS2 conversations, and it comes from the same words being used in two contexts that aren't directly connected.

• The classification of the entity: essential or important. It follows from the sector you operate in and from your size, and DNSC confirms it through a decision.
• The assurance level: Basic, Important or Essential. It follows from the risk score calculated under the methodology in Order no. 2/2025, and it tells you how many security measures you have to implement.4

In other words, you can be classified as an important entity and still land on the Essential assurance level, if your risk score comes out high. Or the other way round. When someone tells you "you're essential", ask which of the two they mean, because the implementation effort depends on the second, not the first.

What measures the law actually requires

So far we've covered who is in scope and by when. Next comes the question everyone asks immediately after: what do I actually need to have in place?

Article 11 of the ordinance requires technical, operational and organizational measures, proportionate to the risk, to the size of the company, and to the impact an outage of your service would have.1

Until August 2026, that was all it said. Since 27 August 2026, through DNSC Order no. 1/2026, there's a closed list: 218 controls, grouped into six functions, Govern, Identify, Protect, Detect, Respond and Recover, each control with its own code and implementation guidance.7

You don't have to implement all of them. The number depends on the assurance level that comes out of your risk assessment, and the levels are cumulative: what Basic requires, Important requires too, and so on.7

Below are those same areas, translated into documents and practices you either have or don't have. It's the map you walk before you open the official catalog:

• Risk analysis and security policy. A document setting out which systems you have, what can happen to them, and what you do to stop it happening. Approved by management, with a date on it. Without this document, none of the other measures has anything to rest on.
  On the technical side: an up-to-date list of computers, servers, network equipment and cloud services, another of the software and services you use, and a record of where the company's data lives. All three are required from Basic.
• Incident handling. A written procedure saying who decides an event is an incident, who you call in the first hour, what gets recorded, who informs affected clients, and who submits the report to the authority. Walked through at least once as a drill, not merely written.
  On the technical side: the logs of your protection tools, the antivirus and the firewall for example, are switched on, kept for a set period and reviewed regularly. It's a key measure from Basic. From Important, you also have to detect unauthorized connections to critical systems and data leaks, both key measures. At Essential, the network is monitored continuously.
• Continuity and recovery. Backups that run automatically, are kept separately from the main system, and are test-restored periodically. Plus a committed time in writing: how long each service has to be back after an outage.
  On the technical side: backups of important data are stored on a different system from the original data. It's a key measure from Basic. From Important, backups are tested regularly and kept in a separate location, protected as well as the main systems. Essential adds committed recovery targets (how fast each service comes back and how much data you can lose, at most), and system backups are kept apart from data backups.
• Supply chain security. A list of the suppliers who touch your data or systems, what access each has and for how long, plus security clauses in their contracts. This also covers the rules for acquiring, developing and maintaining systems.
  On the technical side: remote maintenance by suppliers, your IT provider included, is approved in advance and logged, uses strong authentication, and the connection is closed when the work is done. The activity of external service providers is monitored. All of this is required from Important.
• Access control, assets and authentication. An inventory of equipment and accounts. Rights granted by role rather than by person, and reviewed periodically. A procedure for closing access when someone leaves. Two-step authentication on admin accounts and on those with access to sensitive data.
  On the technical side: two-step authentication is mandatory for any remote access to the company network; nobody uses admin rights for everyday work; everyone can reach only what their tasks require. All three are key measures from Basic. Also from Basic, Wi-Fi networks, the guest network included, are configured securely and monitored. From Important, accounts with admin rights are monitored too.
• Cyber hygiene and employee training. Updates applied on time, minimum rights, passwords that aren't reused, encryption wherever data leaves the company. Training for employees, with a record of who attended and when.
  On the technical side: security updates for operating systems and critical components are installed; computers run up-to-date antivirus; the firewall, the filter between the company network and the outside, is active on every company network and on the computers; the network is split into zones, so an attack can't easily reach critical systems; email and web browsing go through filters. Four of these are key measures from Basic. On training, Essential also asks for evidence that the training actually changes how employees work.
• Checking that the measures work. Procedures for periodically testing whether what you implemented actually holds, plus the cybersecurity audit, at a frequency set by DNSC order.1
  On the technical side: system logs are kept, documented and monitored. It's a key measure from Basic. From Important, there's a written plan for vulnerabilities, the weak spots in software and equipment: how they're found, in what order they're fixed and who is told. That's a key measure too. Essential adds vulnerability scans and tests run by specialists.

A simple test for each of them: if an auditor asked you for the evidence tomorrow, what would you show? If the answer is "I'd explain how we do it", the measure doesn't exist yet.

That test is no longer just common sense, it's official methodology. In the self-assessment, every control gets two marks, on a scale from 1, Initial, to 5, Optimizing: one for documentation, one for implementation, each justified in writing. The scores have to clear the threshold for your level: 2.5 at Basic, 3 at Important, 3.5 at Essential. A company that falls short draws up a remediation plan.7

Two marks, not one. You can have the policy file in perfect order and still fail on implementation, because the second half isn't solved by a document. It takes someone who actually looks at the alerts, confirms them and acts.

The detail that changes the inventory conversation: on request from DNSC, the company has to provide the list of relevant assets, meaning the equipment, systems and applications the service depends on, together with the list of risks identified in the analysis.1 In other words, an inventory of equipment and access is no longer a good practice you postpone. It's a document you can be asked for.

Two clarifications from the order, for special cases. Banking and financial market infrastructure entities covered by the EU's DORA regulation are exempt from the risk-level assessment and apply the DORA measures instead. The same goes for digital infrastructure and business-to-business ICT service management companies designated under that regulation as critical ICT third-party service providers. And where sector-specific rules apply, the requirements implemented under them are recorded in a statement of applicability drawn up by the company.7

The 13 key measures at Basic are all technical

Of the 218 controls, 29 are marked in the order as key measures, chosen on the basis of common types of attack. They're mandatory, can't be declared not applicable, and each has to clear the level's threshold on its own: 2.5 at Basic, 3 at Important and at Essential. A good total score doesn't make up for a weak key measure.710

Thirteen of them apply from Basic. None of them is a document:

The evidence examples are ours, not the order's. Policies can be written at a desk. These 13 measures can't: they take configuration on every computer, account and network device, plus proof that it works. On our cybersecurity page we show how we cover part of them, in five layers.

Which controls can be declared not applicable

DNSC Order no. 2/2026 lets you mark some controls as not applicable, N/A, when they have nothing to do with what your company does. Only within fixed limits, though, and every exclusion has to be justified in writing and recorded in the statement of applicability.10

The same order, detailed in DNSC Decision no. 3/2026, settles how companies inside a group are treated. Controls can be inherited from the group or shared with it, and a group-level policy can count in your assessment, as long as it formally applies to your company and the evidence and metrics showing it works exist locally. The burden of proof stays with your company.10

For the transport company in our example, this cuts both ways: the group is what brought it into scope, and the group can also supply part of its policies. The proof that they work inside the company is something it has to produce itself.

And one more requirement that touches the org chart, for essential entities: the person responsible for network and information system security has to operate independently of the company's IT structures. Public administration, small and micro enterprises are exempt.1

How you register with DNSC and what deadlines follow

The general registration deadline fell in September 2025. The rule that matters now is a different one: you have 30 days from the moment you come into scope, whether you reach 50 employees, enter a listed sector, or complete an acquisition.

From there, everything is counted in days, and each deadline starts from the one before it. They add up faster than they look:

Running through all of it, permanently: a significant incident has its own clock. These are calendar days, not working days. An incident on a Friday evening doesn't wait until Monday. Reporting goes through the national platform, PNRISC, at pnrisc.dnsc.ro, whose flow was simplified in April 2026.19

Where to download the DNSC tools

For each stage, DNSC provides two mechanisms: one online, the NIS2@RO platform, with a user account at platformanis2.ro, and one downloadable for when the platform is unavailable. They all start from the official pages on entity registration and obligations of registered entities.56

What the NIS2@RO instrument actually does

Two things, in this order. First it shows you where you stand: you enter the company details, average annual headcount, net turnover, total assets and the services you provide, by sector and sub-sector. At the end you get a preliminary assessment: out of scope, important entity, or essential entity. Then it generates the notification form, ready to be signed and submitted. It's an Excel file that runs locally; if you reuse it, reset everything you filled in first.6

Two points from its own instructions, both counterintuitive. The preliminary assessment isn't a classification: the form goes to DNSC whatever the result, so the authority can confirm your status. And if the result is "out of scope", DNSC recommends registering voluntarily for companies in important sectors that aren't in the annexes, and for those expecting to cross the thresholds soon.6

How the form is submitted, in four steps

1. You fill in the data, either on the platform or in the downloaded instrument.
2. You save the notification form as a PDF.
3. Your company's legal representative signs it: with a qualified electronic signature if you submit it electronically, or a handwritten signature if you submit it on paper.
4. You send it to evidenta@dnsc.ro, together with supporting documents where applicable, or you deliver it on paper to the DNSC office at Strada Italiană 22, sector 2, Bucharest.6

If you used the downloadable instrument because the platform was unavailable, you're still required to create an account on the NIS2@RO platform once it becomes available.6

Who to call at DNSC

• Records and support: (+40) 316.202.167
• Verification and control: (+40) 316.202.156
• Auditor accreditation and authorization of training providers: (+40) 316.202.182
• evidenta@dnsc.ro, where the notification form is sent
• nis@dnsc.ro, where you ask for help with identification, amendment or removal

Who is legally accountable: management or the IT department?

Management. And it's stricter than most owners expect.

Article 14 of the ordinance says that management bodies approve the security measures, supervise how they're put into practice, and are liable if they aren't. Members of management are also required to complete cybersecurity training.1 And the yearly self-assessment and the remediation plan go to DNSC signed off by management.7

This is where the clarification from the opening of this article comes in, added by Law 124/2025: the general meeting of shareholders and the board of directors aren't "management bodies" within the meaning of this ordinance.2

What that means for you: responsibility can't be handed over wholesale to the IT department, nor pushed up to the shareholders. Exactly which individuals count as "management bodies" is determined by each company's legal form and management structure, so it's worth establishing who they are in your case before anyone signs anything.

That isn't a legal detail. It's the reason security can no longer be a budget line you approve once and forget. It's also the reason the notification form requires the legal representative's signature, not the IT contact's.

If there's another director or partner who signs contracts, this is the section worth passing on to them.

We're not in scope, but clients ask for proof. What now?

You answer the questionnaire. Not because the law requires it, but because your client does.

NIS2 requires companies in scope to manage the risks coming from their suppliers too. And they do that the only way they can: through contracts.

In practice, for a 40-employee company in none of the listed sectors: at contract renewal with a larger client, you receive a security questionnaire. As a rule, it asks for:

• written security policies;
• evidence that you take backups and that you test them;
• two-step authentication;
• a clear process for incidents;
• sometimes, a certificate.

In practice it makes no difference that this is a commercial requirement rather than a legal one. If you can't answer, you lose the contract. For most small and mid-sized companies, that's the closest cost of this subject, not the fine.

NIS2 fines in Romania

Sanctions are set out in Article 60 and come in two tiers.1

• Fixed fines, for administrative failures, meaning you didn't submit the registration, the risk assessment, or the self-assessment on time: between RON 1,000 and RON 300,000 for important entities, between RON 1,500 and RON 500,000 for essential ones.
• Fines for breaching the security obligations themselves: up to EUR 7 million or 1.4% of worldwide annual turnover for important entities, and up to EUR 10 million or 2% for essential ones, whichever is higher.

Note the word "worldwide": the percentage is calculated on the whole group's turnover, not just on what you do in Romania.

The first fine DNSC issued was an administrative one. On September 29, 2026, a central public administration body was fined RON 50,000 for sending its registration notification late.11 It wasn't fined for an attack or for an unreported incident, as a few outlets reported. So the first thing checked was the simplest one to get right: telling the authority on time that you fall under the law. The general deadline passed on September 22, 202512, and a company that comes into scope later has 30 days from that moment.

Three things you can do today

• Find out whether someone has already registered the company with DNSCIt happens often: a consultant or a colleague submits the notification, and management knows neither that it was sent nor what was declared in it. Start with your accountant and with your IT contact.
• Download the NIS2@RO instrument and fill it in with your accountant's figuresIt's an official Excel file, filled in locally, and it gives you a preliminary read on your classification the same day. Ask your accountant for the average annual headcount, net turnover and total assets, at group level. The result isn't an official classification, but it tells you whether this conversation is urgent or not.
• Ask someone to tell you, within ten minutes, how many computers the company has and who uses themIf the answer takes longer, no risk assessment has anything solid to stand on. And the asset list is exactly the document DNSC can ask for.

The transport company in our example found out it was in scope only when its accountant ran the calculation at group level. Until then, the client's questionnaire sat unopened on the IT contact's desk.

NIS2 questions we get asked most

Where do I download the DNSC notification form?

You don't download it ready-made. You generate it, either on the NIS2@RO platform or from the NIS2@RO instrument, the Excel file DNSC publishes on its entity registration page. You fill it in, save the result as a PDF, have the legal representative sign it, and send it to evidenta@dnsc.ro or deliver it on paper to the DNSC office.6

The instrument says I'm out of scope. Am I done?

No. The instrument's own instructions call for the form to be submitted to DNSC regardless of the result, so your status can be confirmed. What you get is a preliminary assessment that guides you through the notification. On top of that, if your company sits in an important sector that isn't in the annexes, or you expect to cross the thresholds soon, DNSC recommends registering voluntarily.6

Does NIS2 apply to companies with fewer than 50 employees?

As a rule, no. The exceptions are companies providing a service with no substitute, and those individually identified by the authority. And the headcount is counted at group level, not just for your own company. If you supply a larger company in a listed sector, you aren't bound by the law, but you'll receive the requirements through your contract.

Do we have to implement all 218 controls in DNSC Order no. 1/2026?

No. The number depends on the assurance level that comes out of your risk assessment: 34 controls at Basic, 133 at Important and all 218 at Essential. The levels are cumulative, and being classified as an essential or important entity doesn't set the level on its own.7

Can some controls be declared not applicable?

Yes, within strict limits set by DNSC Order no. 2/2026: at most one control at Basic, three at Important and five at Essential. Key measures can't be excluded at any level, and at Essential neither can the management-aspect controls. Every exclusion is justified in writing and recorded in the statement of applicability. An excluded control still counts in the score, with a value of 2.5 at Basic and 3 at Important and at Essential.10

Does NIS2 require 24/7 monitoring?

DNSC Order no. 1/2026 doesn't use the terms "24/7" or "round-the-clock". At Basic, it requires the logs of your protection tools to be kept and reviewed regularly. Important adds detecting unauthorized connections to critical systems and data leaks. Continuous network monitoring is required at Essential. Your level comes out of your risk assessment.7

What counts as a "significant incident"?

Not every phishing email. The law targets incidents with real effect: those causing serious disruption to the service or financial loss, and those affecting other people or organizations through material or other damage. One infected laptop, isolated in ten minutes, doesn't belong here. An outage of the service you provide to clients does. If you hesitate, ask before letting the 24 hours run out.1

What happens if I missed the registration deadline?

The deadline passing doesn't remove the obligation to register, and DNSC has started enforcing it: the first fine, RON 50,000, was issued on September 29, 2026 for exactly that, a notification sent late. If you're past it, the situation is worth reviewing and putting right as soon as possible, documenting when the company established the obligation and when it started the process. For a specific case, ask a consultant or a lawyer before you submit anything.

What fine can a company get under NIS2?

It depends on the obligation and on how the company is classified. For administrative failures, meaning the registration, the risk assessment or the self-assessment not submitted on time, fines range from RON 1,000 to RON 300,000 for important entities and from RON 1,500 to RON 500,000 for essential ones. For breaching the security obligations themselves, the fine can reach EUR 7 million or 1.4% of worldwide annual turnover for important entities, and EUR 10 million or 2% for essential ones, whichever is higher. The details are in the section on fines.

How long does it take to prepare for NIS2?

It depends where you start. Add up the statutory deadlines and you get several months from registration to self-assessment, in the best case. The part that takes longest isn't the paperwork. It's the inventory: who uses which device, what access they hold, and who closes it when they leave. We wrote about that part separately, in the article on the accounts of an employee who leaves the company.

Does ISO 27001 make me NIS2 compliant?

No. These are two different things. One is a standard for managing information security, the other is a legal obligation with deadlines, notifications, and a register held by the authority. A certified system helps, because part of your practice is already documented, but it doesn't save you a single step of the legal procedure.

We have the policies written. Is that enough?

No. In the maturity self-assessment, every control gets two separate marks, one for documentation and one for implementation. A complete policy file raises the first one. The second is scored on what actually works in the company: who looks at the alerts and when, who confirms an incident, how long it takes until it's stopped, whether the last test restore of your backups actually worked. The score has to clear the threshold for your level: 2.5 at Basic, 3 at Important, 3.5 at Essential.7