Romania NIS2 Implementation Guide: GEO 155/2024, DNSC Registration and Reporting

Romania has moved from registering NIS2 entities to measuring them, and in September 2026 the national authority began its first sanction procedures against companies that had not registered. Government Emergency Ordinance no. 155/2024 (Ordonanța de urgență nr. 155/2024) transposes the Directive. It is dated 30 December 2024, was published in Monitorul Oficial no. 1332 of 31 December 2024 and was later approved with amendments by Parliament. The National Cybersecurity Directorate (DNSC, Directoratul Național de Securitate Cibernetică) is both the competent authority and the national CSIRT, and its orders fill in registration, risk scoring, the maturity self-assessment and supervision. This guide covers scope, the staged deadlines, the cybersecurity measures, incident reporting through DNSC, fines and what the regime means for service accounts, API keys and AI agents. It is for CISOs, compliance leads and auditors with Romanian entities. The Directive itself is covered in the NIS2 Directive Guide and cross-country status in the NIS2 Transposition Tracker.

Sources and status, checked 14 November 2026: scope, authorities, measures, reporting, audits, supervision and fines come from the published text of GEO 155/2024 as it appeared in Monitorul Oficial no. 1332. Several points rely on a single secondary source and are attributed in the text: the date and changes of the approving Law no. 124/2025 (CMS Romania), DNSC Order no. 3/2025 on supervision and sanctions (Clifford Chance Badea), DNSC Order no. 1/2026 on measures and the start of sanctions (StartupCafe.ro), and the DNSC decision on groups of companies (Alba24.ro). Article numbers below follow the original ordinance and may have shifted in the consolidated text, so confirm the current version on legislatie.just.ro before relying on any figure. This page is not legal advice.

Key takeaways

• One authority for almost everything: DNSC is the competent authority (Article 24(1)), the national CSIRT (Article 24(2)), the keeper of the register of essential and important entities and the national cyber crisis authority, with sector authorities such as ANCOM alongside it.
• A chain of deadlines, each from its own trigger: register within 30 days, appoint security officers within 30 days of DNSC's registration decision, risk-level assessment within 60 days of that decision, maturity self-assessment within 60 days after that, and for essential entities a remediation plan within 30 days.
• The maturity self-assessment is annual: management endorses it and sends it to DNSC every year (Article 12(4)), scored against the controls and five maturity stages that DNSC Order no. 1/2026 sets.
• Reporting runs 24 hours, 72 hours, one month: significant incidents go to DNSC as national CSIRT, with an early warning within 24 hours, a notification within 72 hours and a final report within one month (Article 15(7)).
• Fines follow the Directive ceilings with a low floor: up to EUR 10 million or 2% of turnover for essential entities and EUR 7 million or 1.4% for important ones, while failing to notify DNSC sits in a lower band of up to RON 500,000 or RON 300,000.

Legal framework and timeline

According to CMS Romania, Law no. 124/2025 made four changes worth noting: it added pharmaceutical distribution authorisation holders and NACE 4646 and 4773 activities (pharmaceutical wholesale and retail) to the Annex 1 sectors, required regular training for all staff, set a 30-day deadline for appointing security officers after DNSC's registration decision, and made turnover-based fines refer to annual global turnover, with a mandatory 50% increase for repeat offences.

Scope: essential, important and who supervises

The ordinance follows the Directive's sector annexes: Annex 1 for highly critical sectors and Annex 2 for other critical sectors. Size is judged with the SME criteria of Law no. 346/2004 (Article 8).

• DNSC as the centre: Article 25 gives DNSC supervision and compliance checking, CSIRT authorisation, coordinated vulnerability disclosure and the entity register.
• Sector authorities: Article 37(1) names ANCOM for digital infrastructure (internet exchange points, data centres, electronic communications) and postal and courier services, the Authority for the Digitalisation of Romania (ADR) for trust service providers, and other sector authorities designated by government decision.
• Financial sector: the National Bank of Romania (BNR) and the Financial Supervisory Authority (ASF) cooperate with DNSC on entities covered by DORA (Article 37(3)). See the DORA and NIS2 Overlap Mapping Guide.
• Classification is a DNSC decision: entities notify, DNSC may ask for clarification and then issues a formal decision classifying the entity, within 60 days for essential and 150 days for important entities (Article 18(4) and (5)).

Registration and the deadline chain

Romania's model is a sequence of filings, each running from the previous step. Treat it as a project plan, because missing a step is itself a sanctioned offence.

1. Notify DNSC within 30 days of the ordinance becoming applicable to you (Article 18(2)). Order 1/2025 sets the channels: the NIS2@RO platform once operational, an interim downloadable form sent by email, or paper filing if neither works. The form carries a self-assessment of disruption impact, critical-entity status, dependence on national-interest ICT infrastructure and sole-provider status.
2. Appoint security officers within 30 days of DNSC's registration decision. For essential entities the officer must meet set criteria, including an accredited course within 12 months (Article 14(4)).
3. Risk-level assessment within 60 days of DNSC's decision (Article 18(6)), using the Order 2/2025 methodology: attack types, threat actors, entity size and impact against probability. The score sets whether basic, important or essential level measures apply. If the platform was unavailable, CMS Romania reports a 20-day window to upload once it opens.
4. Maturity self-assessment within 60 days after the risk assessment (Article 18(7)), then annually, endorsed by management (Article 12(4)).
5. Remediation plan within 30 days of the self-assessment, for essential entities (Article 12(5)).
6. Periodic cybersecurity audit at a frequency DNSC sets by order according to risk level (Article 11(5) and (6)).

Groups of companies

According to Alba24.ro, the DNSC decision of 21 September 2026 adds no new controls but explains how existing ones apply when a group runs policies or systems centrally. Each control is classed as taken over (preluat), implemented (implementat) or shared (partajat), and in every case the Romanian entity must show the control actually operates in its own activity. A group policy alone is not evidence. The five maturity stages are Initial, Repeatable, Defined, Managed and Optimisation.

Cybersecurity measures and management duties

Article 11(1) requires proportionate technical, operational and organisational measures, and Article 13 lists the minimum content, mirroring Article 21 of the Directive. The detailed controls, target scores and maturity calculation sit in DNSC Order no. 1/2026. Where an entity is also within the scope of the EU implementing rules for digital providers, see the NIS2 Implementing Regulation 2024/2690 Guide.

• Management body accountability: management approves the risk measures, oversees them and is responsible for breaches (Article 14(1)), must apply corrective measures without unjustified delay (Article 12(3)), and allocates resources and designates security officers (Article 14(3)).
• Training: management members complete accredited training and the entity trains all staff (Article 14(2)), on a regular basis since Law no. 124/2025, according to CMS Romania. See the NIS2 Management Liability Executive Briefing.

Incident reporting to DNSC

Significant incidents are reported to DNSC as national CSIRT through its PNRISC platform (Article 15(1) and (2)).

The 6-hour cross-border rule is shorter than the Directive's baseline, so incident runbooks written from the Directive alone will miss it.

Supervision, audits and fines

• Essential entities: DNSC can supervise, inspect, order ad hoc audits, request information and access, and run scans (Article 46(1) and (5)). Control follows an annual plan or a trigger such as a significant incident (Article 46(2)).
• Important entities: supervision is limited to enforcing the measures in Article 48(2)(b) to (g) (Article 46(4)).
• Audits: the entity chooses the auditor (Article 57(4)), pays for the audit (Article 46(9)) and sends results to DNSC within 5 days of completion (Article 46(8)). Ad hoc audits can follow a significant incident, a significant system change or well-founded indications of a breach (Article 57(2)). Order no. 3/2025 details inspection and sanction procedure, according to Clifford Chance Badea.
• Management bans: for essential entities other than public administration, DNSC can ask for temporary suspension of an authorisation and a temporary ban on a person acting as executive director or legal representative (Article 49).

Turnover is taken from the last financial year (Article 60(3)); serious breaches can reach double the limits (Article 60(4)); newly founded entities face one to 50 gross minimum wages (Article 60(5)). StartupCafe.ro reported on 9 September 2026 that DNSC's first sanction procedures target companies that did not register and that the first fines would be at the low end of the scale.

What it means for AI agents and non-human identities

• Score the identities that raise your risk level: the Order 2/2025 risk score weighs attack types and impact; service accounts and API keys with broad write access into critical systems are a direct input. See the NHI Authentication Guide.
• MFA cannot cover machines, so document the alternative: Article 13 lists multi-factor authentication; for workloads, record the equivalent (short-lived tokens, workload identity federation, certificate binding) in the self-assessment rather than leaving a gap.
• Log for the 24-hour and 6-hour clocks: attributable machine identity logs make the early warning possible. See Detection Engineering for Non-Human Identities Guide.
• Agents get their own identity: give each AI agent a scoped identity rather than a shared service account. See AI Agent Identity vs Service Account.
• Group-run identity platforms need local evidence: under the groups decision, a centrally run vault or IAM platform is a taken-over or shared control, and the Romanian entity still has to show which of its machine identities it covers.
• Audit evidence: keep rotation records, access reviews and secret scanning results for the audit period. See Audit Readiness for AI Agents and NHIs.

Framework mapping

Common failure patterns

• Waiting for DNSC to find you: the duty to notify is on the entity, and non-registration is the first target of enforcement.
• Losing track of relative deadlines: each step runs from a different trigger, so diarise from the date of DNSC's decision, not from the ordinance.
• Treating the self-assessment as one-off: it is annual and management-endorsed.
• Relying on group policy alone: the groups decision requires evidence that the control operates in the Romanian entity.
• Missing the 6-hour cross-border report: runbooks copied from the Directive use 24 hours as the earliest clock.
• Leaving machine identities out of the risk score: service accounts and API keys that are not inventoried understate risk and leave MFA and access control evidence incomplete.

Practitioner checklist

• Confirm Annex 1 or 2 sector, size under Law no. 346/2004 and likely classification.
• Check that the DNSC notification was filed and a classification decision received.
• Appoint and train security officers within 30 days of that decision.
• Complete the Order 2/2025 risk-level assessment and record the resulting measure level.
• Run the Order 1/2026 maturity self-assessment, including machine identities and agents, and get management sign-off.
• For essential entities, file the remediation plan within 30 days and track it to closure.
• Test PNRISC access and drill the 6-hour, 24-hour, 72-hour and one-month clocks.
• For group companies, label each control taken over, implemented or shared and collect local evidence.

Standards and references

• Monitorul Oficial no. 1332/2024: Government Emergency Ordinance no. 155/2024 (copy hosted by Politehnica University of Timișoara)
• CMS Romania: Romania launches orders to implement the NIS2 framework
• CMS Romania: Romania expands scope of NIS2 implementation
• Wolf Theiss: Deadline approaches, NIS2 registration and risk evaluation in Romania
• Clifford Chance Badea: DNSC supervisory and sanctioning powers
• Clifford Chance Badea: NIS2 compliance obligations for Romanian companies
• StartupCafe.ro: First fines for companies breaching new cybersecurity obligations
• Alba24.ro: DNSC rules for companies in groups published in Monitorul Oficial

Related NHI Mgmt Group resources: NIS2 Directive Guide, NIS2 Transposition Tracker, Hungary NIS2 Implementation Guide, Bulgaria NIS2 Implementation Guide, NIS2 Readiness Checklist. This guide summarises Romania's NIS2 implementing law and is not legal advice.