NIS2 fines in Romania: amounts, who is liable and how to avoid them

One of the most frequent questions about NIS2 is, naturally, the one about sanctions: how large the fines can be, who is liable and what triggers them. The short answer is that the ceilings are substantial, liability reaches management, and DNSC has already started to sanction. The good news is that the risk drops significantly with concrete steps, largely free at the start.

The maximum amount of the fines

OUG 155/2024, the act that transposes Directive (EU) 2022/2555 into Romania, sets at Art. 60 different ceilings depending on the category of the entity:

The "whichever is higher" rule means that for organisations with high turnover, the percentage can exceed the ceiling expressed in euro. This is why NIS2 should not be treated as a theoretical risk, not even by large organisations.

Note also the phrase "worldwide annual turnover": the reference is not only turnover in Romania, but at global level, which can matter a great deal for entities that are part of international groups. Compared with the ceilings in other regulations, the level of NIS2 sanctions is deliberately high, so as to have a real deterrent effect, not a symbolic one. That is precisely why a "leave it for later" approach is, from a risk perspective, the most expensive of all options.

The difference between an essential and an important entity

The category you fall into influences not only the fine ceiling, but also the supervision regime. Essential entities are subject to stricter, including proactive, supervision (controls, inspections that can take place without a specific reason), whereas important entities are generally supervised reactively, that is when there are indications of non-compliance or following an incident. In practice, an essential entity has a higher likelihood of being checked ex officio, which makes the preparation of documents and evidence matter all the more.

This distinction also explains why the ceilings differ: the more critical the service provided is for society, the higher the obligations and the potential sanctions. For details on the classification criteria, see essential or important entity.

Which acts attract sanctions

Sanctions do not target only cyber attacks or serious incidents. They can be applied for failure to meet administrative and security obligations, among them:

• Failure to meet the obligation to notify and register with DNSC (Art. 18 read together with Art. 60). A late notification is a distinct act, sanctionable in itself.
• Failure to implement cyber security risk management measures, proportionate to the real risk.
• Failure to meet the obligations to report significant incidents within the legal deadlines. See incident reporting to DNSC.
• Failure to comply with the decisions, instructions or measures imposed by DNSC following controls.

For individual acts, the concrete amount is set according to severity, duration, repeated nature and other criteria provided by law, within the limits of the ceilings above. The general wording here does not replace the legal text: the exact amounts in lei for each act must be read from OUG 155/2024.

How a fine is individualised

The ceilings in Art. 60 are maximums, not fixed amounts. The concrete sanction is set taking into account a series of individualisation criteria, among them the severity of the act, the duration of the breach, its repeated nature, the harm caused or the risk created, as well as the conduct of the entity (for example whether it cooperated with the authority and took remediation measures). In short, a minor non-compliance, remedied quickly and in good faith, is not treated the same as a serious, prolonged or repeated breach.

This logic has an important practical consequence: even if you are already late, any remediation step taken now (registration, risk analysis, measures) improves your position. Passivity, by contrast, is the most costly option.

More than fines: other measures

Fines are the most visible part, but the enforcement regime does not stop there. Following controls, DNSC can also impose other corrective measures, for example binding compliance instructions, remediation deadlines or warnings. For essential entities, in serious cases, the legal framework provides for additional, more severe measures than for important ones. Failure to comply with the measures imposed by the authority can, in turn, attract sanctions.

Beyond the sanction itself, there is also a reputational cost: a non-compliance made public affects the trust of customers, partners and, in the case of institutions, citizens. This indirect cost often exceeds the value of the fine.

Management liability

A fundamental change brought by NIS2 is that cyber security is no longer solely the job of the IT department. The management body approves the risk management measures, oversees their implementation and undergoes training in the field. As a result, management can be held liable for failure to meet the obligations, and in serious cases, for essential entities, additional measures provided by law can be imposed. More in the dedicated article on management liability under NIS2.

Sanctions applied by DNSC

NIS2 sanctions have stopped being theoretical. DNSC applied the first NIS2 fine, of 50,000 lei, to an institution in central public administration, for failing to meet the notification deadline. The act was classified on the basis of the notification obligation (Art. 18(2)), read together with Art. 60(1)(o) of OUG 155/2024, and the sanction was communicated at the end of September 2026.

How to avoid fines: concrete steps

The good news is that most early sanctions are for easily preventable acts. A reasonable path looks like this:

• Check your classification and file the notification. If you have not done so yet, it is the top priority. Start with the free classification and registration tool.
• Carry out the risk analysis of networks and information systems. You can start from the free risk analysis tool.
• Perform the maturity self-assessment on the CyFun framework and identify the gaps against the required level.
• Implement the measures proportionate to the risk and document them as evidence (registers, policies, procedures). See NIS2 evidence and registers.
• Prepare the incident reporting procedure, so that the short deadlines do not catch you unprepared.

The CyFun self-assessment and the plan of measures are free in the Certudo platform. For more complex needs, we offer NIS2 consultancy and NIS2 audit performed by DNSC-attested cyber security auditors.

Conclusion

NIS2 fines can be substantial, and liability does not stop at IT, but rises to management level. However, most sanction risks, at this stage, come from delaying the administrative steps. The best way to avoid them is to start now, even if the initial notification deadline has passed.

Check your classification and prepare the notification (free)

Want an assessment of your exposure and a tailored offer? Contact the Certudo team.