NIS2 DIRECTIVE : NOTIFICATION DEADLINE SET FOR COVERED ENTITIES

With a delay of almost six months from the initial deadline announced (31 March 2025), the implementing rules of the NIS2 Directive ¹ have been published, by means of Order no. 1/2025 approving the Requirements regarding the notification process for registration and the method of transmitting information, and Order no. 2/2025 approving the Criteria and thresholds for determining the degree of disruption of a service and the Methodology for assessing the risk level of entities, issued by the National Cyber Security Directorate (DNSC) and published in the Official Gazette no. 776 of 20 August 2025.

For more information regarding the NIS2 Directive, see our previous article published:

https://www.gruiadufaut.com/en/posts/transposition-of-the-nis2-directive-obligations-for-romanian-companies

Deadline for notification

According to the new regulations, the entities concerned by Emergency Ordinance no. 155/2024 are obliged to notify the DNSC regarding their qualification as an essential or important entity, by 19 September 2025.

Until the announced NIS2 platform becomes operational, notifications may be transmitted through the NIS2 Tool available on the DNSC website, which generates a form in PDF format, to be signed by the legal representative and sent by e-mail ². Once the platform becomes operational, each concerned entity will be required to create its own account.

The notification form is structured into six sections:

• General data: name and identification of the entity, where applicable, registration number in other national registers for entities not registered in Romania, contact details, main activity and, where applicable, authorized secondary activity (CAEN). The authorized secondary CAEN codes corresponding to the sectors and subsectors included in Annexes no. 1 and 2 to Emergency Ordinance no. 155/2024 must be indicated.
• Specific data: size of the entity (number of employees, turnover, assets), sector and subsector of activity, data concerning the person responsible for cybersecurity³  (where already appointed) and contact persons, ranges of public IP addresses, presence in other EU Member States.
• Specific situations: results of the self-assessment of the impact of service disruption, the status of critical entity (whether or not identified as such), analysis of dependence on IT&C infrastructures of national interest or of the role of sole provider of an essential service.
• Attached documents: it is mandatory to attach the documents required by legal provisions, such as documents attesting to the size of the entity (ONRC extracts, financial statements, declarations on own responsibility), results of the self-assessment and, where applicable, additional documents requested by the DNSC.
• Preliminary assessment: refers to the proposal for qualification as an essential or important entity, following the entity’s self-assessment in accordance with Emergency Ordinance no. 155/2024 and the requirements provided by Order no. 1/2025.
• Entity representation: identification details, position held and signature of the legal representative.

The notification must be signed with a qualified electronic signature. In the case of transmission via the NIS2 Tool, the use of a handwritten signature is also permitted.

Notes

1. The Directive (EU) 2022/2555, known as the NIS2 Directive, represents the new European framework on cybersecurity, adopted in 2022 and replacing the NIS Directive of 2016. It extends the categories of entities concerned (energy, transport, health, digital infrastructures, public administration, postal services, food sector, IT and others), introduces clear obligations for the implementation of security measures and for the reporting of incidents, as well as severe sanctions (fines of up to EUR 10 million or 2% of the global annual turnover). Member States must apply it through national legislation starting from 17 October 2024; in Romania it has been transposed by Emergency Ordinance no. 155/2024.
2. The e-mail address is: evidenta @ dnsc.ro
3. According to the recent amendments to Emergency Ordinance no. 155/2024, entities have 30 days from the receipt of the notification regarding their registration in the DNSC register to appoint this person.