NIS2 in Romania: Cybersecurity Obligations for Companies
21 October 2026 · ACSINTE & PARTNERS
Directive (EU) 2022/2555 ("NIS2") was transposed in Romania by Government Emergency Ordinance no. 155/2024 establishing a framework for the cybersecurity of networks and information systems in the national civil cyberspace, published in the Official Gazette no. 1332 of 31 December 2024. The ordinance was approved with amendments by Law no. 124/2025. The competent authority is the National Cyber Security Directorate (DNSC), which also acts as the national CSIRT.
Who is covered
The ordinance applies mainly to "essential" and "important" entities operating in the sectors listed in its annexes, such as energy, transport, banking and financial market infrastructure, health, water, digital infrastructure and services, postal services, waste management, chemicals, food and certain manufacturing activities. Classification depends on the sector, the size of the company (generally medium and large enterprises) and the risk profile of its services. The DNSC may also designate smaller entities where a disruption would have significant consequences. Law no. 124/2025 extended the scope to certain pharmaceutical distribution and retail activities.
Registration is done with the DNSC. Under DNSC Orders no. 1/2025 and 2/2025, which entered into force on 20 August 2025, entities already in scope had to notify the DNSC within 30 days, and entities entering the scope later must do so within the same period. The notification includes a self-assessment that supports the entity's classification.
Main obligations
- Risk management: appropriate and proportionate technical, operational and organizational measures, including incident handling, business continuity, supply-chain security and access control, followed by periodic risk-level and maturity self-assessments submitted to the DNSC.
- Incident reporting: for significant incidents, an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report no later than one month after the notification.
- Management accountability: management bodies must approve the risk-management measures, oversee their implementation and can be held responsible for non-compliance. Their members must attend cybersecurity training, and entities must also train their staff.
- Organization: appointment of a person responsible for cybersecurity within 30 days of the DNSC's notification of the entity's identification and registration.
Non-compliance may lead to warnings, binding instructions and fines, including fines calculated by reference to worldwide annual turnover, with higher amounts for repeat breaches.
Practical first steps
Companies that have not yet done so should start by checking whether any group entity falls within the annexes, taking into account the size thresholds and activities carried out in Romania. Where the answer is yes, the priorities are to confirm registration status with the DNSC, assign internal responsibility, prepare the required self-assessments and set up an incident-response procedure capable of meeting the 24- and 72-hour deadlines.
Contracts with IT and other critical suppliers should be reviewed for security requirements, incident cooperation and audit rights. Board minutes should document the approval and oversight of cybersecurity measures, since management accountability is a central feature of the new regime. Where personal data is involved, incident procedures should also be coordinated with GDPR breach notification.
ACSINTE & PARTNERS assists companies with NIS2 applicability analyses, internal procedures and supplier contracts.
This article provides general information and does not constitute legal advice.