Sector guide
NIS2 for pharmacies and medicine distributors
Law 124/2025 added pharmacies (CAEN 4773), pharmaceutical wholesale (CAEN 4646) and holders of medicine distribution authorisations to the Annex 1 health sector. From 50 employees you are under GEO 155/2024, and large companies are essential entities.
- Sector
- Health, Annex 1
- CAEN codes
- 4773, 4646
- Large company
- essential entity
- Medium company
- important entity
DefinitionAn essential entity is a large company in an Annex 1 sector, or an entity in a special category under Art. 5. It has more obligations than an important entity, and higher maximum fines.
Are pharmacies under NIS2 in Romania?
Yes, if they are at least medium-sized. Law 124/2025 added activities CAEN 4773 (pharmacies) and 4646 (pharmaceutical wholesale) to the health sector, along with holders of medicine distribution authorisations. Large companies in this sector are essential entities and medium ones are important entities, under GEO 155/2024.
| Activity | Medium | Large |
|---|---|---|
| Pharmacy (CAEN 4773) | Important | Essential |
| Pharmaceutical wholesale (CAEN 4646) | Important | Essential |
| Holder of a distribution authorisation | Important | Essential |
| Pharmaceutical manufacturing (CAEN 21) | Important | Essential |
CAEN codes are hints, not the legal test. Check the actual activity of the company.
Is a small pharmacy under NIS2?
As a rule, no. The entry threshold is 50 employees, under Art. 8 and Law 346/2004, so a small or micro company stays outside, unless DNSC identifies it under the Art. 9 criteria. If you are unsure, you can notify DNSC: DNSC decides and tells you if you are out of scope.
What extra duties does an essential entity have?
A large company in the health sector gets the DNSC decision within 60 days, not 150 days. It files a remediation plan within 30 days of each self-assessment (Art. 12(5)). Its security officer has managerial authority, reports directly to management and obtains an accredited course within 12 months.
- Higher fine limits: up to 10,000,000 EUR or 2%.
- An officer independent of IT and OT, with the resources needed (Art. 14(4)).
- An overall self-assessment target of 3.5, if the assurance level is Essential.
What risk level does a pharmacy have?
The standard health scores in the annex to the methodology in DNSC Order 2/2025 are 145 for a medium company and 217.5 for a large one. That usually means Important level and Essential level respectively. The real score comes from ENIRE@RO until DNSC's NIS2@RO platform is operational, and decides which controls you apply.
| Size | Standard score | Range | Level |
|---|---|---|---|
| Medium | 145 | 100–199 | Important |
| Large | 217.5 | 200–1,500 | Essential |
Because both scores reach at least Important level, control PR.DS-11.2, the regular check of backups, also applies. See the guide to DNSC Order 1/2026.
What deadlines does a pharmacy or distributor have?
The company notifies DNSC within 30 days, and DNSC decides within 60 days for essential and 150 days for important entities. From the decision (T0) you designate the officer within 30 days and send the risk-level assessment within 60 days. The self-assessment follows within another 60 days, then yearly.
| What | When | Basis |
|---|---|---|
| Notification to DNSC | within 30 days of coming under the law | Art. 18(2) |
| DNSC decision (T0) | within 60 days for essential, 150 days for important entities | Art. 18(4)–(5) |
| Security officer designated | T0 + 30 days | Art. 14(3) |
| Risk-level assessment | T0 + 60 days | Art. 18(6) |
| Maturity self-assessment | 60 days after the risk-level assessment, then yearly, signed off by management | Art. 18(7), 12(4) |
| Remediation plan (essential entities only) | within 30 days of each self-assessment | Art. 12(5) |
| The officer's accredited course (essential entities) | within 12 months of designation | Art. 14(4)(e) |
| Changes to registration data | within 2 weeks or 3 months, depending on the item | Art. 18(8) |
What should a pharmacy watch out for?
Pharmacy chains and distributors depend on their management systems and IT suppliers, and an incident can stop medicines being dispensed. Art. 11(8) asks you to take into account the security practices of each direct supplier. Backups go on a different system, under control PR.DS-11.1, and are tested.
- Settle who at the software supplier answers for backups and incidents.
- Prepare incident reporting within 24 hours and 72 hours.
- Test restores and keep a written record, with the free templates.
| Step | Deadline | Basis |
|---|---|---|
| Early warning | 24 hours | Art. 15 |
| Incident notification | 72 hours | Art. 15 |
| Final report | one month | Art. 15 |
| Information on cross-border impact | 6 hours | Art. 15(3) |
What fines does a pharmacy face?
An important entity faces 5,000 lei up to 7,000,000 EUR or 1.4%, and an essential one 10,000 lei up to 10,000,000 EUR or 2% of worldwide turnover, whichever is higher (Art. 60(2)). Procedural breaches have lower limits, in lei. These are maximum limits, not typical amounts.
What to do next
Frequently asked questions
Are hospitals and clinics treated the same way?
Healthcare providers are also in the Annex 1 health sector, so the same size thresholds apply. Check the exact activity with the free scope check.
Is a small authorised distributor in scope?
As a rule no, if the company has fewer than 50 employees, unless DNSC identifies it under the Art. 9 criteria. If you are unsure, you can notify DNSC: DNSC decides and tells you if you are out of scope.
Who can be the NIS2 officer in a pharmacy?
Management designates the officer within 30 days of the DNSC decision (Art. 14(3)). In essential entities the person has managerial authority, reports directly to management, is independent of IT and OT and obtains an accredited course within 12 months.
What if I have not notified DNSC?
If the company is in scope and has not notified, do it now, under the annex to DNSC Order 1/2025. The notification is generated with the NIS2@RO tool.
Does NIS2 replace GDPR for patient data?
No. NIS2 deals with the security of networks and systems, and GDPR with personal data. They apply separately, even where some measures overlap.