Updates On NIS2 In Romania

August 2025 – Following up on our initial article regarding the transposition of the NIS2 Directive (EU) 2022/2555 ("NIS2") in Romania via Government Emergency Ordinance no. 155/30.12.2024 ("GEO 155"), we would like to inform you of the following relevant evolutions in this area as of today, 20 August 2025:

• The Romanian National Directorate for Cybersecurity ("DNSC") has issued the long awaited application norms for registering with DNSC as important or essential entity. DNSC Order no. 1/2025 was published in the Official Gazette of Romania on 20 August 2025. As of publication, in-scope entities have 30 days at their disposal to register with DNSC.

Registration should primarily be done using the online NIS2@RO Platform. In case the platform is unavailable, the filled out form can be submitted via e-mail or filed physically (in person or via post/currier) with DNSC at its offices.

Please note, however, to file the registration form with DNSC with enough time in advance before the deadline, because in the cases of forms filed using the online platform or e-mail, DNSC will consider the date of receipt the day when DNSC confirm receipt of the form (which can take place within 5 working days of actually filing the registration form using the platform or e-mail).

• DNSC has also issued Order no. 2/2025 approving (i) the Criteria and thresholds for determining the degree of disruption of a service and (ii) the Methodology for assessing the risk level of entities.
• As of 10 July 2025, GEO 155 was amended by Law no. 124/2025, providing more clarity on some points and expanding the scope of entities by adding in Annex 1, under Pt. 5 – Health Sector also distributors and resellers of pharma and medical products.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.