URL: https://auditcybersecurity.ro/en/nis2-pharmacies/
Updated: 2026-11-05. Legal texts last checked: 2026-11-05.

Sector guide

# NIS2 for pharmacies and medicine distributors

[Law 124/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/299675) added pharmacies (CAEN 4773), pharmaceutical wholesale (CAEN 4646) and holders of medicine distribution authorisations to the Annex 1 health sector. From 50 employees you are under [GEO 155/2024](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690), and large companies are essential entities.

- **Sector**: Health, Annex 1

- **CAEN codes**: 4773, 4646

- **Large company**: essential entity

- **Medium company**: important entity

**Definition**An essential entity is a large company in an Annex 1 sector, or an entity in a special category under [Art. 5](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690). It has more obligations than an important entity, and higher maximum fines.

## Are pharmacies under NIS2 in Romania?

Yes, if they are at least medium-sized. [Law 124/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/299675) added activities CAEN 4773 (pharmacies) and 4646 (pharmaceutical wholesale) to the health sector, along with holders of medicine distribution authorisations. Large companies in this sector are essential entities and medium ones are important entities, under [GEO 155/2024](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690).

| Activity | Medium | Large |
|---|---|---|
| Pharmacy (CAEN 4773) | Important | Essential |
| Pharmaceutical wholesale (CAEN 4646) | Important | Essential |
| Holder of a distribution authorisation | Important | Essential |
| Pharmaceutical manufacturing (CAEN 21) | Important | Essential |

CAEN codes are hints, not the legal test. Check the actual activity of the company.

Check your company

## Is a small pharmacy under NIS2?

As a rule, no. The entry threshold is 50 employees, under [Art. 8](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) and Law 346/2004, so a small or micro company stays outside, unless DNSC identifies it under the [Art. 9](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) criteria. If you are unsure, you can notify DNSC: DNSC decides and tells you if you are out of scope.

## What extra duties does an essential entity have?

A large company in the health sector gets the DNSC decision within 60 days, not 150 days. It files a remediation plan within 30 days of each self-assessment ([Art. 12(5)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)). Its security officer has managerial authority, reports directly to management and obtains an accredited course within 12 months.

- Higher fine limits: up to 10,000,000 EUR or 2%.
- An officer independent of IT and OT, with the resources needed ([Art. 14(4)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)).
- An overall self-assessment target of 3.5, if the assurance level is Essential.

## What risk level does a pharmacy have?

The standard health scores in the annex to [the methodology in DNSC Order 2/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/301477) are 145 for a medium company and 217.5 for a large one. That usually means Important level and Essential level respectively. The real score comes from ENIRE@RO until [DNSC's NIS2@RO platform](https://platformanis2.ro) is operational, and decides which controls you apply.

| Size | Standard score | Range | Level |
|---|---|---|---|
| Medium | 145 | 100–199 | Important |
| Large | 217.5 | 200–1,500 | Essential |

Because both scores reach at least Important level, control PR.DS-11.2, the regular check of backups, also applies. See the [guide to DNSC Order 1/2026](https://auditcybersecurity.ro/en/dnsc-order-1-2026/).

## What deadlines does a pharmacy or distributor have?

The company notifies DNSC within 30 days, and DNSC decides within 60 days for essential and 150 days for important entities. From the decision (T0) you designate the officer within 30 days and send the risk-level assessment within 60 days. The self-assessment follows within another 60 days, then yearly.

| What | When | Basis |
|---|---|---|
| Notification to DNSC | within 30 days of coming under the law | [Art. 18(2)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| DNSC decision (T0) | within 60 days for essential, 150 days for important entities | [Art. 18(4)–(5)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Security officer designated | T0 + 30 days | [Art. 14(3)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Risk-level assessment | T0 + 60 days | [Art. 18(6)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Maturity self-assessment | 60 days after the risk-level assessment, then yearly, signed off by management | [Art. 18(7), 12(4)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Remediation plan (essential entities only) | within 30 days of each self-assessment | [Art. 12(5)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| The officer's accredited course (essential entities) | within 12 months of designation | [Art. 14(4)(e)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Changes to registration data | within 2 weeks or 3 months, depending on the item | [Art. 18(8)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |

Work out your deadlines

## What should a pharmacy watch out for?

Pharmacy chains and distributors depend on their management systems and IT suppliers, and an incident can stop medicines being dispensed. [Art. 11(8)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) asks you to take into account the security practices of each direct supplier. Backups go on a different system, under control PR.DS-11.1, and are tested.

- Settle who at the software supplier answers for backups and incidents.
- Prepare incident reporting within 24 hours and 72 hours.
- Test restores and keep a written record, with the [free templates](https://auditcybersecurity.ro/en/nis2-templates/).

| Step | Deadline | Basis |
|---|---|---|
| Early warning | 24 hours | [Art. 15](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Incident notification | 72 hours | [Art. 15](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Final report | one month | [Art. 15](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Information on cross-border impact | 6 hours | [Art. 15(3)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |

## What fines does a pharmacy face?

An important entity faces 5,000 lei up to 7,000,000 EUR or 1.4%, and an essential one 10,000 lei up to 10,000,000 EUR or 2% of worldwide turnover, whichever is higher ([Art. 60(2)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)). Procedural breaches have lower limits, in lei. These are maximum limits, not typical amounts.

[See all NIS2 fines](https://auditcybersecurity.ro/en/nis2-fines-romania/)

## What to do next

Check if your company is in scope
Take the self-assessment

## Frequently asked questions

### Are hospitals and clinics treated the same way?

Healthcare providers are also in the Annex 1 health sector, so the same size thresholds apply. Check the exact activity with the [free scope check](https://auditcybersecurity.ro/en/nis2-scope-check/).

### Is a small authorised distributor in scope?

As a rule no, if the company has fewer than 50 employees, unless DNSC identifies it under the [Art. 9](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) criteria. If you are unsure, you can notify DNSC: DNSC decides and tells you if you are out of scope.

### Who can be the NIS2 officer in a pharmacy?

Management designates the officer within 30 days of the DNSC decision ([Art. 14(3)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)). In essential entities the person has managerial authority, reports directly to management, is independent of IT and OT and obtains an accredited course within 12 months.

### What if I have not notified DNSC?

If the company is in scope and has not notified, do it now, under [the annex to DNSC Order 1/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/301474). The notification is generated with the NIS2@RO tool.

### Does NIS2 replace GDPR for patient data?

No. NIS2 deals with the security of networks and systems, and GDPR with personal data. They apply separately, even where some measures overlap.

## Official sources

- [GEO 155/2024, Annex 1, consolidated text](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)
- [Law 124/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/299675)
- [the methodology in DNSC Order 2/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/301477)
- [the Measures approved by DNSC Order 1/2026](https://legislatie.just.ro/Public/DetaliiDocumentAfis/314360)

About this guide

Published by AuditCyberSecurity.ro. This site is informative and sells nothing. The person behind it is involved in AirVault, an offline backup service; the link is stated wherever AirVault appears on a page.

Updated: 5 November 2026 · Legal texts last checked: 5 November 2026 · Information, not legal advice; check the official text.