NIS2 obligations in Romania

Competent authority & CSIRT Legal ref: Chapter I, Section 1

• National Cyber Security Directorate. ecs-org.eu · 28 Oct 2026 · secondary source
• DNSC ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Chapter I, Section1 Annex 1, 2

• Corresponds to NIS2 ecs-org.eu · 28 Oct 2026 · secondary source
• Link: Implementing acts expected in the first quarter of 2025 ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: Implementing acts expected in the first quarter of 2025

Registration Legal ref: Chapter IV, Section 1 Art. 12, 18

• Essential and important entities were required to contact the DNSC regarding their registration within one month after the law entered into force ecs-org.eu · 28 Oct 2026 · secondary source
• Entities submitted the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
• Address of the main registered office and updated contact details. ecs-org.eu · 28 Oct 2026 · secondary source
• Addresses of the other registered offices in the EU, if applicable . ecs-org.eu · 28 Oct 2026 · secondary source
• Contact details of the person in charge of monitoring the means of contact. ecs-org.eu · 28 Oct 2026 · secondary source
• Contact details of the person designated as representative if the entity is not established in the EU. ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address. ecs-org.eu · 28 Oct 2026 · secondary source
• Proof of meeting the conditions for identification as an essential or important entity. ecs-org.eu · 28 Oct 2026 · secondary source
• Essential entities and important entities shall carry out and submit to the DNSC, on an annual basis, a self-assessment of the level of maturity of the cybersecurity risk management measures. Essential entities shall prepare and submit, within 30 days from the completion of the self-assessment, a plan of measures to remedy the identified deficiencies. ecs-org.eu · 28 Oct 2026 · secondary source
• The registration process will be conducted via the NIS2@RO self-assessment instrument and the NIS2@RO platform for submitting the registration. Alternatively, entities can submit the form via email or in person. The deadline for the registration process is 30 days after the official publication of the implementing order specifying these requirements. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 15

• Entities should notify the national CSIRT of significant incidents via the National Platform for the Reporting of Cyber Security Incidents ecs-org.eu · 28 Oct 2026 · secondary source
• Reporting requirements: ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours plus an initial assessment of the impact, if applicable . ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the national CSIRT (if necessary) . ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source
• An incident shall be considered significant if: ecs-org.eu · 28 Oct 2026 · secondary source
• It has caused or is likely to cause serious operational disruption to services or financial loss to the entity concerned. ecs-org.eu · 28 Oct 2026 · secondary source
• Has affected or may affect other natural or legal persons, causing considerable material or non-material damage. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 60

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 11

• The Romanian security framework recognises the Belgian Cyber Fundamentals. Framework based on: ISO 27001 NIST 800-53 ecs-org.eu · 28 Oct 2026 · secondary source
• Romania mandates structured, risk-based cybersecurity assessments aligned to the entity’s risk profile. Assessments must be formally documented, cover IT/OT systems, cloud services, third-party exposure, and be updated annually or after major changes. Audits are conducted by the National Directorate for Cybersecurity (DNSC). ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final Text · Draft Implementing Laws

What changed recently

No dated changes recorded.