Guide
NIS2 in Romania: GEO 155/2024 explained
What the law asks, in the order it reaches you: whether you are covered, what to notify, which measures apply, how to report incidents and what you risk. Fines reach 10,000,000 EUR or 2% of worldwide turnover.
- Sectors
- 18 (11 in Annex 1, 7 in Annex 2)
- Minimum measures
- 10, in Art. 13
- Incidents
- 24 hours, 72 hours, one month
- Authority
- DNSC
DefinitionNIS2 is Directive (EU) 2022/2555 on the security of network and information systems. In Romania it applies through GEO 155/2024, as amended, most recently by Law 123/2026. The competent authority is the National Cyber Security Directorate (DNSC).
What is GEO 155/2024?
GEO 155/2024 is the act through which Romania transposed the NIS2 directive. It was published in Official Gazette 1332 of 31 December 2024, approved with changes by Law 124/2025 and completed by Law 123/2026. It sets who is covered, the measures, incident reporting, supervision and fines.
Law 123/2026, in force since 6 July 2026, adds Art. 36(1^1) on the advisory committee for coordinated vulnerability disclosure and Art. 365^1 to the Criminal Code, which removes criminal liability for good-faith vulnerability research.
Which companies are under NIS2?
Medium and large entities in the sectors of Annexes 1 and 2, so from 50 employees. Large ones in Annex 1 are essential, the others important. Law 124/2025 added pharmacies (CAEN 4773) and pharmaceutical wholesale (CAEN 4646), and made clear that food distribution alone is enough to be covered.
| Annex | Sectors |
|---|---|
| Annex 1: high criticality | Energy, Transport, Finance, Health, Water, Digital and IT services, Space, central public administration |
| Annex 2: other critical sectors | Food, Manufacturing, Other Annex 2 sectors |
What must a company do once it is under NIS2?
The company notifies DNSC within 30 days, waits for the registration decision (T0), names the officer within 30 days of T0, sends the risk-level assessment within 60 days and the maturity self-assessment within a further 60 days. The self-assessment is repeated yearly, signed off by management, under Art. 12 and 18.
| What | When | Basis |
|---|---|---|
| Notification to DNSC | within 30 days of coming under the law | Art. 18(2) |
| DNSC decision (T0) | within 60 days for essential, 150 days for important entities | Art. 18(4)–(5) |
| Security officer designated | T0 + 30 days | Art. 14(3) |
| Risk-level assessment | T0 + 60 days | Art. 18(6) |
| Maturity self-assessment | 60 days after the risk-level assessment, then yearly, signed off by management | Art. 18(7), 12(4) |
| Remediation plan (essential entities only) | within 30 days of each self-assessment | Art. 12(5) |
| The officer's accredited course (essential entities) | within 12 months of designation | Art. 14(4)(e) |
| Changes to registration data | within 2 weeks or 3 months, depending on the item | Art. 18(8) |
The notification is sent through DNSC's NIS2@RO platform (platformanis2.ro), by email to evidenta@dnsc.ro, or on paper, under the annex to DNSC Order 1/2025. If the platform is not available when you notify, you create an account once it becomes available. The form is generated with the NIS2@RO tool. It includes your public IP ranges (Art. 18(3)). It is signed with a qualified electronic signature, or by hand on paper.
How is the risk level set?
The risk level comes from the score obtained with ENIRE@RO until the NIS2@RO platform is operational, under the methodology in DNSC Order 2/2025: 0–99 is Basic level, 100–199 Important level and 200–1,500 Essential level. That level decides which controls of DNSC Order 1/2026 apply and how often checks take place.
What are the minimum security measures?
Art. 13 lists ten measures: risk analysis, effectiveness assessment, cryptography, supply chain, security across the system life cycle, human resources and access, incidents, continuity and backup, cyber hygiene and training, and multi-factor authentication. The details are in the Measures approved by DNSC Order 1/2026.
- Risk analysis and information system security policies.
- Assessing whether the measures work.
- Cryptography and, where appropriate, encryption.
- Supply chain security.
- Secure acquisition, development, maintenance and disposal, including vulnerabilities.
- Human resources, access control, asset management.
- Incident handling.
- Business continuity, backup management, disaster recovery, crisis management.
- Cyber hygiene and training.
- Multi-factor authentication and secured communications.
Order 1/2026 organises the measures in six functions (Govern, Identify, Protect, Detect, Respond, Recover) and three assurance levels. Controls marked as key measures are dealt with first.
How do you report an incident to DNSC?
A significant incident is reported in three steps: early warning within 24 hours, notification within 72 hours and a final report within one month (Art. 15). Information on cross-border impact goes within 6 hours. Trust service providers report within 24 hours, under the same article.
| Step | Deadline | Basis |
|---|---|---|
| Early warning | 24 hours | Art. 15 |
| Incident notification | 72 hours | Art. 15 |
| Final report | one month | Art. 15 |
| Information on cross-border impact | 6 hours | Art. 15(3) |
What are the NIS2 fines?
Important entities can be fined up to 7,000,000 EUR or 1.4% of worldwide turnover, and essential entities up to 10,000,000 EUR or 2%, whichever is higher (Art. 60(2)). For procedural breaches the limits are much lower and set in lei. These are upper limits, not typical amounts.
| Entity | Breaches | Fine | Basis |
|---|---|---|---|
| Important entity | Security measures, audit, self-assessment, management duties, incident reporting | 5,000 lei up to 7,000,000 EUR or 1.4% of worldwide turnover, whichever is higher | Art. 60(2)(a) |
| Essential entity | The same, plus letter e) of Art. 60(1) | 10,000 lei up to 10,000,000 EUR or 2% of worldwide turnover, whichever is higher | Art. 60(2)(b) |
| Important entity | Registration, risk assessment, remediation deadlines | 1,000–300,000 lei | Art. 60(2)(c) |
| Essential entity | The same | 1,500–500,000 lei | Art. 60(2)(d) |
| Any entity | Serious breaches (Art. 50(2)); the limits rise by half for repeated breaches | 3,000–600,000 lei | Art. 60(2^1) and (4) |
New companies, or those with no turnover in the previous year, face 1 to 50 gross minimum wages (Art. 60(5)). Half the fine may be paid within 15 days (Art. 60(7)). The limitation period is 3 years (Art. 61(4)).
What is management responsible for?
Management bodies approve the measures, oversee them and are responsible for breaches (Art. 14(1)). Their members take accredited training, and staff are trained regularly. The security officer is named within 30 days of the DNSC decision. Failing to name one is an offence under Art. 60(1)(k), and skipping the training under Art. 60(1)(h).
Who checks companies, and what follows an inspection?
DNSC supervises, with the sector authorities. Only DNSC-certified auditors may carry out the cybersecurity audit (Art. 58(1)), and its frequency follows the risk level. Results go to DNSC within 5 days, the entity pays, and the remediation plan is due within 15 working days of the report.
After a DNSC finding note you have 3 days to respond (at most 10 days), then 15 working days for the remediation plan (Art. 47). ANCOM is the sector authority for IXPs, data centres, electronic communications and postal services, and ADR for trust services (Art. 37(1)). The control rules are in DNSC Order 3/2025.
Where are the details for your sector?
- NIS2 for food production and distribution
- NIS2 for pharmacies and medicine distributors
- NIS2 for energy companies
- DNSC Order 1/2026 explained, NIS2 fines in detail and all guides
What to do next
Frequently asked questions
The notification window has passed. What now?
The notification process in the annex to DNSC Order 1/2025 ran for 30 days from publication. If you have not notified, do it now: the duty is tied to when the company comes under the law, and failing to notify can be sanctioned.
What is ENIRE@RO?
The DNSC tool for assessing an entity's risk level. The score sets the assurance level: Basic, Important or Essential. DNSC provides it until the NIS2@RO platform is operational.
How does NIS2 differ from ISO 27001?
NIS2 is a legal duty and ISO 27001 a voluntary standard. An ISO 27001 system helps a lot, but it does not replace the notification, self-assessment or incident reporting that GEO 155/2024 requires.
Who can be the NIS2 officer?
Management names the officer within 30 days of the DNSC decision (Art. 14(3)). In essential entities, except public administration and small companies, the person has managerial authority, reports directly to management, is independent of IT and takes an accredited course within 12 months.
Must I publish how to report vulnerabilities?
Yes. Entities run a vulnerability-management process and publish on their website how to report vulnerabilities (Art. 36(7)). A security.txt file is a practical example; this site has one.
Since when do the fines apply?
The fine provisions (Art. 60–61) apply 30 days after the ordinance was published, so from the end of January 2025 (Art. 64(4)).
Official sources
- GEO 155/2024, consolidated text
- Law 124/2025
- Law 123/2026
- DNSC Order 1/2025 (notification and registration)
- DNSC Order 2/2025 (thresholds, risk level)
- DNSC Order 3/2025 (supervision and control)
- DNSC Order 1/2026 (measures and self-assessment)
- Directive (EU) 2022/2555