Free, no account, with official sources
NIS2 guide for companies in Romania
GEO 155/2024, as amended, most recently by Law 123/2026, applies to medium and large companies in 18 sectors. Fines reach 10,000,000 EUR or 2% of worldwide turnover, and incidents are reported within 24 hours. Here you find the law in plain words and three free tools.
- Maximum fine
- 10,000,000 EUR or 2% (essential entities)
- Incident early warning
- within 24 hours (Art. 15)
- Officer designated
- within 30 days of the DNSC decision
- Self-assessment
- yearly, signed off by management
Free tools
What you can check here
Is your company under NIS2?
Sector, size and special categories, with the legal basis for the result.
Free NIS2 self-assessment
22 questions, a score per area and actions, before the official self-assessment.
NIS2 deadline calendar
Your dates after the DNSC decision, with a calendar file.
The tools ask for your name, company and email so they can send you the result. The articles stay open to everyone. This is not an audit under GEO 155/2024 and does not replace one.
What is NIS2 in Romania?
NIS2 is the EU cybersecurity directive. Romania transposed it through GEO 155/2024, approved by Law 124/2025 and most recently amended by Law 123/2026. The law sets who is covered, which security measures apply, how incidents are reported and which fines DNSC, the national cybersecurity directorate, can apply.
Which companies does NIS2 apply to in Romania?
It applies to medium and large companies in the sectors of Annexes 1 and 2 of GEO 155/2024, so from 50 employees up, plus a few categories at any size, such as DNS providers. Since 2025 pharmacies, pharmaceutical wholesale and food distribution are named explicitly as well.
What are the NIS2 fines in Romania?
Important entities can be fined from 5,000 lei up to 7,000,000 EUR or 1.4% of worldwide turnover, and essential entities from 10,000 lei up to 10,000,000 EUR or 2%, whichever is higher (Art. 60(2)). These are the upper limits, not typical amounts.
Does NIS2 require offline backups in Romania?
Art. 13(h) requires backup management. The DNSC order on mandatory measures states that at least one backup copy should be kept fully offline or physically isolated. The word used is "should". The backup guide explains what that means in practice, with the exact text of control PR.DS-11.
Frequently asked questions
Does this site sell anything?
No. The site is informative. The only commercial link is a labelled link to AirVault, the offline backup service the person behind this site is involved in, shown only in the backup guide and on the tool results.
Do the tool results have official value?
No. This is not an audit under GEO 155/2024 and does not replace one. The result shows where you stand before the official DNSC procedures, and DNSC sets the final entity class.
How current is the information?
The legal texts were last checked on 5 November 2026, against the consolidated text on legislatie.just.ro. Each page shows the date it was updated.
Who is DNSC?
The National Cyber Security Directorate is the competent NIS2 authority in Romania. It keeps the register of entities, issues the technical orders, carries out inspections and applies fines.
What if I do not know whether my company is covered?
Use the free check. If you are unsure, you can notify DNSC; DNSC decides and tells you if you are out of scope.
Updated: 5 November 2026 · Legal texts last checked: 5 November 2026 · Information, not legal advice; check the official text.