Free tool
Is your company under NIS2?
Answer a few questions about sector, size and special categories. You get the likely class (essential, important or out of scope), the legal basis in GEO 155/2024 and what comes next. This is not an audit under GEO 155/2024 and does not replace one.
NIS2 scope check
Enter your details to use the calculator. We email you the full result.
Which companies are under NIS2 in Romania?
Entities in the sectors of Annexes 1 and 2 of GEO 155/2024 that are at least medium-sized, so from 50 employees. Large ones in Annex 1 are essential; the others are important. Some categories, such as DNS providers, are covered at any size, under Art. 5 and 6 of the ordinance.
| Annex | Sectors |
|---|---|
| Annex 1: high criticality | Energy, Transport, Finance, Health, Water, Digital and IT services, Space, central public administration |
| Annex 2: other critical sectors | Food, Manufacturing, Other Annex 2 sectors |
How is company size worked out?
A company is large from 250 employees, or if it exceeds both 50 million EUR turnover and 43 million EUR balance-sheet total. It is medium from 50 employees, or above 10 million EUR on both. The rules come from Art. 8 of the ordinance and Law 346/2004 on small and medium enterprises.
Employees means annual work units for the last financial year. Partner and linked enterprises are added, so a group can change the class. If your company is part of a group, check with a specialist.
What do essential entity and important entity mean?
They are the two classes in the law. Both notify DNSC, apply the Art. 13 measures and report incidents. They differ in maximum fines, supervision and some duties: essential entities file a remediation plan after each self-assessment, and their officer has extra requirements. DNSC sets the final class in its decision.
Which categories are covered at any size?
Essential at any size: central public administration, critical entities, DNS providers, qualified trust service providers and TLD registries (Art. 5(1)). Important at any size, unless already essential: public electronic communications providers and trust service providers (Art. 6(2)). Medium telecoms and managed security providers are essential (Art. 5(3)–(4)).
What if the company is small?
A small or micro company in a covered sector normally stays out of scope. The exception is when DNSC identifies it under the Art. 9 criteria: sole provider of an essential service, significant impact on public safety, security or health, significant systemic risk, or national or regional criticality for the sector.
If you are unsure, you can notify DNSC; DNSC decides and tells you if you are out of scope (the annex to DNSC Order 1/2025, Art. 8(3)).
Frequently asked questions
Are pharmacies under NIS2 in Romania?
Yes, if at least medium-sized. Law 124/2025 added CAEN 4773 (pharmacies) and 4646 (pharmaceutical wholesale) to the health sector, along with holders of a medicine distribution authorisation.
Are food distributors under NIS2?
Yes, if at least medium-sized. The Annex 2 sector is now called production, processing and/or distribution of food, so distribution alone is enough. The annex covers wholesale distribution and industrial production, not retail.
Are banks under NIS2?
For banks and other entities under the DORA Regulation, only Art. 5–10 and 18 of the ordinance apply (Art. 2(3)). Their security measures come from DORA.
Are town halls under NIS2?
Local and county administration is not a NIS2 sector in Romania. A town hall comes into scope only through what it runs in another sector, such as water, heating or waste, or if DNSC identifies it under Art. 9.
Is the result final?
No. The result is an estimate from your answers. The final class comes from the DNSC identification and registration decision.
What data does the tool use?
Sector, size and special categories. The result is calculated in your browser and stored with your contact details so it can be sent to you. See the privacy notice.
Updated: 5 November 2026 · Legal texts last checked: 5 November 2026 · Information, not legal advice; check the official text.