NIS2 in Romania

Key facts at a glance

Is your company in scope? Common Romania scenarios

Two worked examples of how NIS2 scoping plays out in Romania. Not sure where you land? Run the free NIS2 scope checker.

What Romania businesses need to know

• Romania transposed NIS2 with Government Emergency Ordinance No. 155/2024 (OUG nr. 155/2024), in force since its publication in Monitorul Oficial nr. 1332 on 31 December 2024, approved with amendments by Legea nr. 124/2025 and completed by Legea nr. 123/2026. It repealed Legea nr. 362/2018, the NIS1 law (Art. 66(1)(a)), and the European Commission closed its infringement case INFR(2024)0294 on 8 October 2025.

• DNSC (Directoratul Național de Securitate Cibernetică) is the competent authority, the national CSIRT and the single point of contact (Arts. 24(1) and (2), 40(1)); it keeps the register of essential and important entities and decides on each registration (Art. 18). ANCOM is the sector authority for internet exchange points, data centres, public electronic communications networks and services and postal and courier services, and ADR for trust service providers (Art. 37(1)).

• Size is measured with the national SME law, Legea nr. 346/2004 (medium: 50 to 249 employees and net turnover up to EUR 50 million or total assets up to EUR 43 million), without its rule on enterprises 25% controlled by public bodies (Art. 8). An enterprise under 50 employees whose turnover and total assets both exceed EUR 10 million, without exceeding both medium ceilings, falls in none of that law's categories, and no DNSC reading of the case is on record.

• DNS providers, qualified trust service providers, TLD registries, central public administration and critical entities are essential at any size (Art. 5(1)), and so is a medium-sized managed security service provider (Art. 5(4)), where the directive makes it important. Public electronic communications providers and trust service providers are important at any size unless essential (Art. 6(2)).

• Through Art. 9 an entity of an annex sector can be essential or important whatever its size, and Ordin DNSC nr. 2/2025 turns it into a self-assessment: the sole provider in Romania of an Annex 1 service is essential, of an Annex 2 service important, and for the impact criteria of Art. 9(b) and (c) the entity assesses itself against thresholds in its notification.

• An entity that qualifies notifies DNSC for registration within 30 days of the date the OUG applies to it (Art. 18(2)), with a form generated by DNSC's Instrument NIS2@RO or completed on the Platforma NIS2@RO and signed by its legal representative; when the platform is unavailable, Ordin DNSC nr. 1/2025 provides for e-mail to [email protected] and, failing that, filing on paper at DNSC. DNSC decides within 60 days for an essential entity and 150 days for an important one (Art. 18(4) and (5)).

• DNSC's registration decision starts a chain of national deadlines: 30 days to designate the officers responsible for network and information system security (Art. 14(3)), 60 days to send the risk-level assessment (Art. 18(6)), then 60 days more for a maturity self-assessment, repeated every year (Art. 18(7), Art. 12(4)); an essential entity sends DNSC a remediation plan within 30 days of each self-assessment (Art. 12(5)).

• The national catalogue, the annex to Ordin DNSC nr. 1/2026 in force since 27 August 2026, sets 218 controls in three cumulative assurance levels, Bază (34 controls), Important (133) and Esențial (218), with 29 mandatory key measures. The level an entity implements follows its risk score under the methodology of Ordin DNSC nr. 2/2025, not its class (Ordin DNSC nr. 1/2026, Art. IV). Reglyze assesses Romanian organisations on the NIS2 substrate and does not yet carry the DNSC catalogue as a checklist.

• Significant incidents go to DNSC, as national CSIRT, through PNRISC, for every sector (Arts. 15(2), 24(2)): an early warning (avertizare timpurie) within 24 hours and an incident notification (raportare a incidentului) within 72 hours of becoming aware of the significant incident, an intermediate report at DNSC's request and a final report at the latest one month after the notification (Art. 15(7)); trust service providers report within 24 hours (Art. 15(8)). A national limit the directive does not set: any information that lets DNSC establish a cross-border impact is reported at the latest 6 hours after becoming aware of it (Art. 15(3)).

• Management bodies (organele de conducere) approve the risk-management measures, oversee their implementation and are responsible for breaches (Art. 14(1)); their members follow accredited professional training courses, with no frequency and no accrediting body named, and the entity ensures the regular training of all its staff (Art. 14(2)). The general meeting of shareholders and the board of directors are not management bodies within the meaning of the OUG (Art. 50(4)).

NIS2 in Romania: frequently asked questions

Is NIS2 in force in Romania?

Yes. OUG nr. 155/2024 entered into force on 31 December 2024, the day it was published in Monitorul Oficial nr. 1332 and deposited with the Senate (Constitution Art. 115(5)). Parliament approved it with amendments by Legea nr. 124/2025, and Legea nr. 123/2026 completed its Art. 36. DNSC's orders on registration and on the Art. 9 thresholds have applied since 20 August 2025, and its catalogue of measures since 27 August 2026.

How do Romanian entities register with DNSC?

An entity of the annex sectors that qualifies as essential or important notifies DNSC within 30 days of the date the OUG applies to it (Art. 18(2)). The notification form is generated by DNSC's Instrument NIS2@RO or completed on the Platforma NIS2@RO, signed by the legal representative and filed on the platform; when the platform is unavailable, by e-mail to [email protected], and failing that on paper at DNSC (Ordin DNSC nr. 1/2025). DNSC decides within 60 days for an essential entity and 150 days for an important one (Art. 18(4) and (5)), and tells an entity outside the scope that it is not registered.

Where and how fast does a Romanian entity report a significant incident?

To DNSC, as national CSIRT, through PNRISC, the national platform for reporting cybersecurity incidents (Art. 15(2)), whose reporting page offers a path for entities registered under OUG 155/2024. From becoming aware of the significant incident: an early warning within 24 hours, an incident notification within 72 hours (24 for trust service providers), an intermediate report if DNSC asks and a final report at the latest one month after the notification (Art. 15(7) and (8)). Any information that lets DNSC establish a cross-border impact is reported within 6 hours of becoming aware of it (Art. 15(3)). The detailed reporting norms of Art. 15(17) were not on the Portal Legislativ on 29 October 2026.

Which level of the DNSC measures catalogue applies to a Romanian entity?

The level follows the entity's risk score, not its class (Ordin DNSC nr. 1/2026, Art. IV). The methodology of Ordin DNSC nr. 2/2025 multiplies size, the nature of the attack, impact and probability over five threat actors and five attack categories: 0 to 99 points means the Bază level (34 controls), 100 to 199 the Important level (133) and 200 to 1,500 the Esențial level (218). Each sector has a default score; an entity changes its impact or probability values only with a reasoned request DNSC validates, and recomputes its score every three years.

Who counts as the management body under the Romanian NIS2 ordinance?

The OUG does not name it, but it rules two bodies out: the general meeting of shareholders and the board of directors are not management bodies within its meaning (Art. 50(4)). The management bodies approve the risk-management measures, oversee them and are responsible for breaches (Art. 14(1)); their members follow accredited professional training courses, with no frequency and no accrediting body named (Art. 14(2)).