Sector guide
NIS2 for energy companies
Energy is a high-criticality sector, in Annex 1 of GEO 155/2024. Large companies are essential entities, medium ones are important, and the standard risk scores are 190 and 285. Fines reach 10,000,000 EUR or 2%.
- Sector
- Energy, Annex 1
- Large company
- essential entity
- Medium company
- important entity
- Standard score
- 190 and 285
DefinitionA critical entity is one identified under the resilience law. For NIS2 it is an essential entity whatever its size (Art. 5(1)(c)), which matters in energy, where smaller operators can also play critical roles.
Which energy companies are under NIS2 in Romania?
Medium and large companies in electricity, district heating or cooling, oil, gas and hydrogen are in scope, plus beneficiaries of the Modernisation Fund (GEO 60/2022). From 50 employees you are covered. Large companies are essential entities and medium ones important, under GEO 155/2024. CAEN codes are only hints.
| Subsector | Activities | CAEN hint |
|---|---|---|
| Electricity | Generation, distribution, supply, charging points | 35.1 |
| Heating and cooling | District heating or cooling | 35.3 |
| Oil | Pipelines, refining, storage, transport | 06, 19 |
| Gas | Supply, distribution, transport, storage, LNG | 35.2 |
| Hydrogen | Production, storage, transport | – |
When is an energy company essential?
A large company in Annex 1 is essential. Large means from 250 employees, and the test also looks at turnover of 50 million EUR and a balance sheet of 43 million EUR. Whatever their size, critical entities and those identified by DNSC under the Art. 9 criteria are also essential.
What risk level does an energy company have?
The standard energy scores in the annex to the methodology in DNSC Order 2/2025 are 190 for a medium company and 285 for a large one. That usually means Important level and Essential level respectively. The real score comes from ENIRE@RO until DNSC's NIS2@RO platform is operational, and decides which controls you apply.
| Size | Standard score | Range | Level |
|---|---|---|---|
| Medium | 190 | 100–199 | Important |
| Large | 285 | 200–1,500 | Essential |
At Essential level, key measures must reach at least 3 and the overall target is 3.5. See the guide to DNSC Order 1/2026.
What deadlines does an energy company have?
The company notifies DNSC within 30 days, and DNSC decides within 60 days for essential and 150 days for important entities. From the decision (T0) you designate the officer within 30 days and send the risk-level assessment within 60 days. Essential entities also file a remediation plan within 30 days of the self-assessment.
| What | When | Basis |
|---|---|---|
| Notification to DNSC | within 30 days of coming under the law | Art. 18(2) |
| DNSC decision (T0) | within 60 days for essential, 150 days for important entities | Art. 18(4)–(5) |
| Security officer designated | T0 + 30 days | Art. 14(3) |
| Risk-level assessment | T0 + 60 days | Art. 18(6) |
| Maturity self-assessment | 60 days after the risk-level assessment, then yearly, signed off by management | Art. 18(7), 12(4) |
| Remediation plan (essential entities only) | within 30 days of each self-assessment | Art. 12(5) |
| The officer's accredited course (essential entities) | within 12 months of designation | Art. 14(4)(e) |
| Changes to registration data | within 2 weeks or 3 months, depending on the item | Art. 18(8) |
How are OT systems treated?
The implementation guide of control PR.DS-11.1 says backup strategies should also cover OT systems: control system configurations, operational data and the settings of critical devices. In energy this means that the inventory, restore tests and continuity plan include the plant and the grid equipment, and not only the company's office systems.
- Put control systems and critical devices in the inventory.
- Keep copies of configurations on a different system, under PR.DS-11.1.
- Coordinate recovery tests with continuity and incident response; PR.DS-11.4 asks for this at Essential level.
How is an incident reported in energy?
A significant incident is reported in three steps: an early warning within 24 hours, a notification within 72 hours and a final report within one month (Art. 15). Information on cross-border impact goes out within 6 hours, which is worth preparing if your networks or customers cross Romania's borders.
| Step | Deadline | Basis |
|---|---|---|
| Early warning | 24 hours | Art. 15 |
| Incident notification | 72 hours | Art. 15 |
| Final report | one month | Art. 15 |
| Information on cross-border impact | 6 hours | Art. 15(3) |
What fines does an energy company face?
An essential entity faces 10,000 lei up to 10,000,000 EUR or 2% of worldwide turnover, and an important one 5,000 lei up to 7,000,000 EUR or 1.4%, whichever is higher (Art. 60(2)). The percentage only raises the limit above 500 million EUR of turnover.
What to do next
Frequently asked questions
Is a small energy supplier under NIS2?
As a rule no, if the company has fewer than 50 employees. The exceptions are critical entities and those identified by DNSC under the Art. 9 criteria.
Are charging points covered?
Yes. The electricity subsector includes charging points, alongside generation, distribution and supply, with the same size thresholds.
Are Modernisation Fund beneficiaries in scope?
Yes, they are listed in the energy sector by reference to GEO 60/2022. Check your exact situation with the free scope check.
Who is responsible for NIS2 in an energy company?
Management bodies approve the measures, oversee them and answer for breaches (Art. 14(1)). The security officer is designated within 30 days of the DNSC decision.
How often does the self-assessment repeat?
Yearly, signed off by management (Art. 12(4)). The official self-assessment is done with the EVAL_MMS tools until the NIS2@RO platform is operational.