Free tool
NIS2 deadline calendar
Every deadline in GEO 155/2024, with its article, is below for everyone. The form builds your personal calendar from the date of the DNSC decision, and an .ics file for Outlook or Google Calendar.
Your calendar
Remind me of these deadlines by email, 7 days before each date. I can stop the reminders at any time.Enter your details to use the calculator. We email you the full result.
What are the NIS2 deadlines after the DNSC decision?
From the date the DNSC decision is communicated (T0) you have 30 days to name the officer and 60 days for the risk-level assessment. The maturity self-assessment follows within a further 60 days, then yearly. Essential entities file a remediation plan within 30 days of each self-assessment, under Art. 12, 14 and 18.
| What | When | Basis |
|---|---|---|
| Notification to DNSC | within 30 days of coming under the law | Art. 18(2) |
| DNSC decision (T0) | within 60 days for essential, 150 days for important entities | Art. 18(4)–(5) |
| Security officer designated | T0 + 30 days | Art. 14(3) |
| Risk-level assessment | T0 + 60 days | Art. 18(6) |
| Maturity self-assessment | 60 days after the risk-level assessment, then yearly, signed off by management | Art. 18(7), 12(4) |
| Remediation plan (essential entities only) | within 30 days of each self-assessment | Art. 12(5) |
| The officer's accredited course (essential entities) | within 12 months of designation | Art. 14(4)(e) |
| Changes to registration data | within 2 weeks or 3 months, depending on the item | Art. 18(8) |
Which deadlines apply to an incident?
Once you become aware of a significant incident, send the early warning within 24 hours, the notification within 72 hours and the final report within one month (Art. 15). Information on cross-border impact goes within 6 hours. These deadlines run from when you become aware, not from a DNSC decision.
| Step | Deadline | Basis |
|---|---|---|
| Early warning | 24 hours | Art. 15 |
| Incident notification | 72 hours | Art. 15 |
| Final report | one month | Art. 15 |
| Information on cross-border impact | 6 hours | Art. 15(3) |
Which deadlines follow a DNSC inspection?
Audit results go to DNSC within 5 days (Art. 46(8)), and the remediation plan within 15 working days of the report (Art. 57(8)). After a finding note you have 3 days to respond, at most 10 days, then 15 working days for the plan (Art. 47). Proof follows the deadlines you set.
Working days skip weekends and Romanian public holidays, from a table updated every December.
Frequently asked questions
What does T0 mean?
T0 is the date the DNSC identification and registration decision is communicated. The deadlines for the officer and the risk-level assessment run from that date.
What if I have not received the decision yet?
Enter the notification date: the calendar shows the expected window, 60 days for essential and 150 days for important entities (Art. 18(4)–(5)).
Are the dates exact?
They are indicative. The DNSC decision and the official texts prevail. For deadlines that run from another date, such as the actual filing of the risk assessment, adjust by hand.
What is in the .ics file?
One event per deadline, with an alert 7 days before. It is generated in your browser, not on the server, and can be imported into Outlook, Google Calendar or Apple Calendar.
Can I get reminders by email?
Yes, if you tick the separate reminder box in the calendar. Emails go out 7 days before each deadline, and each one has a stop link.
Updated: 5 November 2026 · Legal texts last checked: 5 November 2026 · Information, not legal advice; check the official text.