Romania NIS2 Implementation

Comprehensive framework addressing Black Sea regional security concerns and EU digital single market integration.

JurisdictionRomania
CategoryCybersecurity
StatusActive
Latest development

Analysis

Romania has implemented the NIS2 Directive through Government Emergency Ordinance (GEO/OUG) 155/2024 and Law 124/2025, with enforcement led by the National Cybersecurity Directorate (DNSC) and additional secondary legislation (DNSC Orders 1/2025 and 2/2025). Cybersecurity: Romania transposes the NIS2 Directive. What's next? Romania expands NIS2 scope under Law No. 124/2025 NIS2 in Romania: What GEO 155/2024 and Law 124/2025

Key Requirements

Primary legal framework

Core organizational and technical requirements

Compliance Challenges

Implementation Best Practices

  • Step 3 – Establish governance, NIS2 officer, and board oversight
  • Implement clear roles and responsibilities, appoint a NIS2 officer / CISO, ensure their independence from operational IT, and set up board‑level cyber risk reporting with KPIs and documented risk‑acceptance decisions, as recommended by Romanian practitioners. [NIS2 in Romania: What GEO 155/2024

Recent developments

  • — DNSC launched a public consultation on two draft secondary-legislation acts covering cyber risk management and board-level responsibilities for essential and important entities. The drafts are meant to operationalize Romania’s NIS2 obligations under Articles 21 and 22 and mark the next implementation phase. (source)
  • — DNSC adopted two implementing orders: one on the procedure for notification and registration of entities subject to NIS2, and another on the methodology for assessing risk levels and service-disruption impact. These orders provide the detailed administrative framework for the national register and risk classification. (source)
  • — Romania’s Parliament approved GEO 155/2024 as Law No. 124/2025, formally completing transposition of NIS2 into national law. The approval law broadened scope, added sector-specific entities, strengthened training and governance obligations, and clarified fine calculations. (source)
  • — Law No. 124/2025 entered into force after publication in the Official Gazette, confirming and amending GEO 155/2024. Romania thereby finalized the national NIS2 framework after the initial emergency ordinance route. (source)
  • — Legal commentary noted that GEO 155/2024 imposes broad registration, audit, and reporting duties for essential and important entities. It also highlighted heavy sanctions, including fines up to EUR 10 million or 2% of global turnover for essential entities, and personal liability for management. (source)
  • — Industry-facing analysis emphasized that the registration deadline with DNSC had already elapsed on 2025-01-30, increasing urgency for in-scope organizations. This suggested a strong compliance push across sectors newly covered by the ordinance. (source)
  • — Copla reported that the NIS2 transposition entered into force on 2025-01-02 through OUG 155/2024, replacing Law 362/2018. The article said DNSC became the lead authority and estimated the new framework covers roughly 12,000–15,000 entities, far more than under NIS1. (source)
  • — The same update described a graduated enforcement model with warnings, corrective plans, periodic penalties, and possible domain suspension. This signaled a more aggressive enforcement posture for cybersecurity compliance in Romania. (source)
  • — Romania adopted Government Emergency Ordinance No. 155/2024 on 2024-12-30 and it entered into force on 2024-12-31. The ordinance created the core legal framework for NIS2 implementation in Romania. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates