NIS2 in Romania
Ordonanța de urgență nr. 155/2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civil
Law in force since
- Law
- OUG 155/2024
- Authority
- National Cyber Security Directorate (DNSC)
- Classes
- entitate esențială (essential), entitate importantă (important)
- Register
- DNSC notification form (NIS2_RO)
- ISO 27001
- Not named in the law
Know when Romania changes its NIS2 rules
- One email when the law, the deadlines or the portal change.
The law
The Government issued the ordinance on 2024-12-30. The Official Gazette published it on 2024-12-31 (issue 1332). The Constitution lets an emergency ordinance take effect after publication, so it applies from 2024-12-31. Law 124/2025 approved it with changes. The Official Gazette published the law on 2025-07-07 (issue 638). The Constitution says a law takes effect 3 days after publication, so on 2025-07-10.
- Name
- Ordonanța de urgență nr. 155/2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civilEmergency Ordinance 155/2024, approved by Law 124/2025
- Published
- 2024-12-31
- In force
- 2024-12-31
- Text
- Read the OUG 155/2024
Who is in scope
Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.
Where Romania differs
- Art. 5(4) OUG 155/2024 Medium-sized managed security service providers are essential entities. Under the Directive they would be important.
Registration
Notify DNSC within 30 days after the rules first apply to you. The 30 days for companies in scope at the start have passed.
- Portal
- DNSC notification form (NIS2_RO)
- Rule
- Deadline counts from the day you come into scope
- Later entrants
- 30 days after the rules first apply to you
- You need
- The NIS2_RO form in Romanian, saved as PDF and signed by the legal representative with a qualified electronic signature.
Incident reporting
- 24 hEarly warning
- 72 hIncident notification
- 1 monthFinal reportafter the notification
Send the reports to DNSC, through the national incident reporting platform (PNRISC).
Measures and proof
- Essential
- An annual maturity self-assessment, approved by management. Send a remediation plan after it. Security audits follow a DNSC order, by risk level, done by DNSC-certified auditors.
- Important
- An annual maturity self-assessment, approved by management.
Fines
The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.
| Class | Ceiling | At EUR 20m | At EUR 500m | At EUR 2bn |
|---|---|---|---|---|
| Essential | EUR 10m or 2% | EUR 10m | EUR 10m | EUR 40m |
| Important | EUR 7m or 1.4% | EUR 7m | EUR 7m | EUR 28m |
Minimum fines are RON 10,000 (essential) and RON 5,000 (important).