Guide
NIS2 fines in Romania and management liability
NIS2 fines reach 7,000,000 EUR or 1.4% of worldwide turnover for important entities and 10,000,000 EUR or 2% for essential ones. Those are the ceilings. The law actually has five bands with minimums in lei, and for many breaches the limits are far lower.
- Important entities
- up to 7,000,000 EUR or 1.4%
- Essential entities
- up to 10,000,000 EUR or 2%
- Reduced payment
- half, within 15 days
- Limitation
- 3 years
DefinitionNIS2 fines are the administrative penalties in Art. 60 of GEO 155/2024. They apply to essential and important entities that breach the obligations in the ordinance, from security measures to registration deadlines.
What are the NIS2 fines in Romania?
Important entities can be fined 5,000 lei up to 7,000,000 EUR or 1.4% of worldwide turnover, and essential entities 10,000 lei up to 10,000,000 EUR or 2%, whichever is higher (Art. 60(2)). The band depends on which obligation was breached and on the entity class.
| Entity | Breaches | Fine | Basis |
|---|---|---|---|
| Important entity | Security measures, audit, self-assessment, management duties, incident reporting | 5,000 lei up to 7,000,000 EUR or 1.4% of worldwide turnover, whichever is higher | Art. 60(2)(a) |
| Essential entity | The same, plus letter e) of Art. 60(1) | 10,000 lei up to 10,000,000 EUR or 2% of worldwide turnover, whichever is higher | Art. 60(2)(b) |
| Important entity | Registration, risk assessment, remediation deadlines | 1,000–300,000 lei | Art. 60(2)(c) |
| Essential entity | The same | 1,500–500,000 lei | Art. 60(2)(d) |
| Any entity | Serious breaches (Art. 50(2)); the limits rise by half for repeated breaches | 3,000–600,000 lei | Art. 60(2^1) and (4) |
The table shows the five main bands. For letters u)–z), aa)–cc) and gg)–ii) of Art. 60(1), 1,000–100,000 lei applies separately (Art. 60(2)(e)).
When does the percentage of turnover matter?
The higher of the fixed amount and the percentage applies. Both 1.4% and 2% of 500 million EUR give exactly the fixed ceiling for that class, so the percentage only raises the limit above 500 million EUR of worldwide turnover. The turnover used is that of the last financial year (Art. 60(3)).
What brings the highest fines?
The highest band covers security measures, audit, self-assessment, management duties and incident reporting. Procedural breaches, such as registration, risk assessment and remediation deadlines, have limits in lei: 1,000–300,000 lei for important entities and 1,500–500,000 lei for essential entities (Art. 60(2)(c) and (d)).
- Not designating the security officer: Art. 60(1)(k).
- Management not taking the accredited training: Art. 60(1)(h).
- Serious breaches (Art. 50(2)): 3,000–600,000 lei, with the limits raised by half for repeated breaches.
What does a new company or one without turnover pay?
Newly founded companies and those with no turnover in the previous year face 1 to 50 gross minimum wages (Art. 60(5)). The rule covers the case where there is no turnover to base the fine on. Check the text of the article for the specific breach, because the limit depends on which obligation was breached.
Can only half of the fine be paid?
Yes. Half of the fine may be paid within 15 days (Art. 60(7)). Paying does not solve the underlying problem, though: the legal obligations remain, including the measures DNSC asks for and any dated remediation plans. The limitation period for applying the penalty is 3 years (Art. 61(4)).
What does management answer for?
Management bodies approve the security measures, oversee them and answer for breaches (Art. 14(1)). Their members take accredited training, and the security officer is designated within 30 days of the DNSC decision. In addition, Art. 49 provides measures such as the suspension of authorisations and a temporary ban for management.
That is why the topic cannot be left to the IT department alone: the yearly self-assessment is signed off by management (Art. 12(4)), and that sign-off has to be real and documented.
Can public bodies be fined?
Yes. GEO 155/2024 has no exemption from the Art. 60 fines for public administration: they apply to essential and important entities, including central government bodies. Only the Art. 49 measures are excluded, meaning the suspension of authorisations and the temporary ban for management (Art. 49(3)).
What to do next
Frequently asked questions
Since when do the fines apply?
The provisions on fines (Art. 60–61) apply 30 days after the ordinance was published, so from the end of January 2025 (Art. 64(4)).
Is the maximum fine the usual amount?
No. 10,000,000 EUR and 7,000,000 EUR are maximum limits. For a medium company many breaches fall in the bands in lei, and the minimums start at 5,000 lei and 10,000 lei.
What happens if I did not notify DNSC?
Registration falls in the procedural band: 1,000–300,000 lei for important entities and 1,500–500,000 lei for essential ones. If you have not notified, do it now, under the annex to DNSC Order 1/2025.
Can missing backups lead to a fine?
Backup is part of the minimum measures (Art. 13(h)), and security measures fall in the highest band. The details are in the backup guide.
Who applies the fines?
DNSC supervises entities, together with the sectoral authorities in Art. 37(1). The control rules are in DNSC Order 3/2025.
Official sources
- GEO 155/2024, Art. 60–61, consolidated text
- Law 124/2025
- DNSC Order 3/2025 (supervision and control)