URL: https://auditcybersecurity.ro/en/nis2-food-industry/
Updated: 2026-11-05. Legal texts last checked: 2026-11-05.

Sector guide

# NIS2 for food production and distribution

Food production, processing and wholesale distribution are in Annex 2 of [GEO 155/2024](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690). From 50 employees you are an important entity, even if you only distribute. [Law 124/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/299675) made that clear, and fines reach 7,000,000 EUR or 1.4%.

- **Sector**: Food, Annex 2

- **Class**: important entity

- **Threshold**: from 50 employees

- **DNSC decision**: within 150 days

**Definition**An important entity is a medium or large company in a NIS2 sector that does not meet the conditions to be essential. Medium and large companies in the Annex 2 food sector are, as a rule, important entities.

## Are food companies under NIS2 in Romania?

Yes, if they are at least medium-sized. The Annex 2 sector is called food production, processing and/or distribution, so distribution alone is enough. The annex covers wholesale distribution and industrial production and processing, not retail. CAEN codes 10, 11 and 463 are only hints, not the legal test, so check the actual activity of the company.

| Activity | In scope? |
|---|---|
| Industrial production and processing | Yes, from 50 employees |
| Wholesale distribution | Yes, from 50 employees, even if you produce nothing |
| Retail | Not covered by Annex 2 |
| Small or micro company | No, unless DNSC identifies it under the Art. 9 criteria |

Check your company

## What did Law 124/2025 change for food?

[Law 124/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/299675) worded the Annex 2 sector as food production, processing and/or distribution. Before that clarification, a distributor that produced nothing might have thought it was not covered. Now distribution alone is enough, provided the company is at least medium-sized and the activity is wholesale distribution rather than retail sale to consumers.

## What counts as a medium company?

The entry threshold is 50 employees, under [Art. 8](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) and Law 346/2004. At 250 employees a company becomes large, and the test also looks at turnover of 50 million EUR and a balance sheet of 43 million EUR. In the food sector, both sizes lead to the same class: important entity.

## What risk level does a food company have?

The standard scores in the annex to [the methodology in DNSC Order 2/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/301477) are 85 for a medium company and 127.5 for a large one. That usually means Basic level and Important level respectively. The real score comes from ENIRE@RO until [DNSC's NIS2@RO platform](https://platformanis2.ro) is operational, and decides which controls you apply.

| Size | Standard score | Range | Level |
|---|---|---|---|
| Medium | 85 | 0–99 | Basic |
| Large | 127.5 | 100–199 | Important |

The class in the law and the assurance level are two different things. A medium company can be an important entity and sit at Basic level. The details are in the [guide to DNSC Order 1/2026](https://auditcybersecurity.ro/en/dnsc-order-1-2026/).

## What deadlines does a food company have?

The company notifies DNSC within 30 days, and DNSC decides within 150 days for important entities. From the decision (T0) you designate the officer within 30 days and send the risk-level assessment within 60 days. The maturity self-assessment follows within another 60 days and repeats yearly, signed off by management ([Art. 12 and 18](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)).

| What | When | Basis |
|---|---|---|
| Notification to DNSC | within 30 days of coming under the law | [Art. 18(2)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| DNSC decision (T0) | within 60 days for essential, 150 days for important entities | [Art. 18(4)–(5)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Security officer designated | T0 + 30 days | [Art. 14(3)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Risk-level assessment | T0 + 60 days | [Art. 18(6)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Maturity self-assessment | 60 days after the risk-level assessment, then yearly, signed off by management | [Art. 18(7), 12(4)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Remediation plan (essential entities only) | within 30 days of each self-assessment | [Art. 12(5)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| The officer's accredited course (essential entities) | within 12 months of designation | [Art. 14(4)(e)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Changes to registration data | within 2 weeks or 3 months, depending on the item | [Art. 18(8)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |

Work out your deadlines

## What should a food company watch out for?

Food companies depend on production, warehouse and logistics systems, and an incident stops deliveries. Control PR.DS-11.1 asks for backups on a different system, and its guide says strategies should also cover OT systems: control configurations, operational data and the settings of critical devices. Plan for the plant, not only the office.

- Include production systems and warehouses in the inventory, not only offices.
- Check direct suppliers, as [Art. 11(8)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) asks.
- Prepare incident reporting within 24 hours and 72 hours.
- Test restores and keep a written record, with the [free templates](https://auditcybersecurity.ro/en/nis2-templates/).

## What fines does a food company face?

An important entity can be fined 5,000 lei up to 7,000,000 EUR or 1.4% of worldwide turnover for security measures, self-assessment and incident reporting ([Art. 60(2)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)). For registration, risk assessment and remediation deadlines the limits are 1,000–300,000 lei. These are maximum limits, not typical amounts.

[See all NIS2 fines](https://auditcybersecurity.ro/en/nis2-fines-romania/)

## What to do next

Check if your company is in scope
Take the self-assessment

## Frequently asked questions

### Is a grocery shop under NIS2?

Retail is not covered by the Annex 2 food sector. If the same company also runs wholesale distribution or industrial production and is at least medium-sized, check that activity with the [free scope check](https://auditcybersecurity.ro/en/nis2-scope-check/).

### Is a distributor that produces nothing in scope?

Yes, if it is at least medium-sized and does wholesale distribution. After [Law 124/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/299675), distribution alone is enough.

### Can a food company be an essential entity?

The Annex 2 sector leads, as a rule, to the important class, whether the company is medium or large. The exceptions are the special categories in [Art. 5](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690), for example a critical entity or one identified under the Art. 9 criteria.

### Must a remediation plan be filed?

Filing within 30 days of each self-assessment is an obligation of essential entities ([Art. 12(5)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)). The methodology in DNSC Order 1/2026 does, however, ask for a remediation plan when the result is below target.

### The notification deadline has passed. What now?

If the company is in scope and has not notified, do it now, under [the annex to DNSC Order 1/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/301474). If you are unsure, you can notify DNSC: DNSC decides and tells you if you are out of scope.

## Official sources

- [GEO 155/2024, Annex 2, consolidated text](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)
- [Law 124/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/299675)
- [the methodology in DNSC Order 2/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/301477)
- [the Measures approved by DNSC Order 1/2026](https://legislatie.just.ro/Public/DetaliiDocumentAfis/314360)

About this guide

Published by AuditCyberSecurity.ro. This site is informative and sells nothing. The person behind it is involved in AirVault, an offline backup service; the link is stated wherever AirVault appears on a page.

Updated: 5 November 2026 · Legal texts last checked: 5 November 2026 · Information, not legal advice; check the official text.