OUG 155/2024 and Law 124/2025: Romania's NIS2 law, in brief

In Romania, the NIS2 framework rests on two main acts, read together: OUG 155/2024, which transposes the European directive, and Law 124/2025, which approves it with amendments. To these are added the DNSC implementing orders. This article puts them in order and explains, in brief, what each one brings.

What OUG 155/2024 regulates

OUG 155/2024 is the act by which Directive (EU) 2022/2555, known as NIS2, was transposed into Romanian law. It was published in the Official Gazette no. 1278 of 30 December 2024 and entered into force upon publication.

The ordinance establishes, among other things:

• The sectors and categories of entities covered, through annexes that list the fields of activity (energy, transport, health, digital infrastructure, public administration and others).
• The split into essential entities and important entities, with different supervision regimes.
• The basic obligations: registration and notification with DNSC, cyber security risk management measures, reporting of significant incidents.
• The role of DNSC as the competent authority at national level and the sanctions regime.

For a broader introduction to the directive and to what changes for companies, see what NIS2 is and the general NIS2 page.

From NIS1 to NIS2: why a new framework

NIS2 did not appear out of nowhere. The first NIS directive (previously transposed in Romania) covered a limited number of operators, in a few sectors, with identification rules that left room for interpretation and with large differences between member states. The experience of recent years, marked by the rise of cyber attacks and dependence on digital services, showed that this framework was insufficient.

NIS2 responds to these limits in several directions: it significantly extends the perimeter (many more sectors and organisations), clarifies the identification rules through the sector plus size combination, raises the bar on management responsibility, supply chain security and incident reporting within strict deadlines. Through OUG 155/2024, these changes became mandatory in Romania as well. For a more detailed comparison, see what NIS2 is and what changes.

Why an emergency ordinance

The transposition of NIS2 had a European deadline, and an emergency ordinance allows the framework to be put in place quickly, without waiting for the full parliamentary process. Even so, an emergency ordinance does not become final on its own: it must be submitted for the approval of Parliament, which can adopt it as such or with amendments. This mechanism explains why we have two acts, OUG 155/2024 and Law 124/2025, which together form the applicable framework. Until it was approved by law, the ordinance had already produced effects, and the obligations ran from the moment it entered into force.

What Law 124/2025 brought

An emergency ordinance must subsequently be approved by law by Parliament. This happened through Law 124/2025, which approves OUG 155/2024 with 23 amendments. The law was published in the Official Gazette on 7 July 2025 and entered into force on 10 July 2025.

Among the relevant amendments made at approval are:

• Strengthening the obligations to train management and staff, as well as consolidating the role of the NIS officer. Training of the management body and of employees becomes a more insistent requirement (Art. 14(2)-(3)).
• New categories of entities in the health sector, widening the perimeter of covered entities.
• The inclusion of pharmaceutical distribution and trade in the scope.

The practical consequence is that the two acts are read together: the applicable form of the NIS2 framework in Romania is OUG 155/2024 as amended by Law 124/2025.

The main legislative acts

For quick orientation, the table below summarises the main pieces of the NIS2 framework in Romania.

The DNSC orders complete the legal framework with detailed rules, for example on the method of notification, the classification of entities or the security requirements. For the official texts and updates, the reference source remains the DNSC website.

The role of DNSC in applying the law

OUG 155/2024 designates DNSC (the National Cyber Security Directorate) as the competent authority at national level for NIS2. In this capacity, DNSC not only issues implementing acts, but also manages the practical process of compliance and supervision:

• It operates the NIS2@RO platform, through which registration and notification are done.
• It issues the decisions classifying entities as essential or important.
• It receives incident reports and coordinates the response at national level.
• It exercises supervision, carries out controls and applies sanctions when it finds non-compliance.

For a covered organisation, DNSC is therefore both the point of contact for obligations and the authority that checks they are met. That is why the relationship with DNSC is managed proactively, not only when a problem arises.

From the law to concrete obligations

The law says what must be achieved, but does not go into technical detail. For operationalisation, DNSC adopted the CyFun (CyberFundamentals) framework as a working methodology: a structured collection of controls, with levels and a maturity scale. In this way, the general obligations in OUG 155/2024 become concrete and measurable steps. See CyFun at DNSC and the CyFun page.

In practice, the typical compliance journey looks like this:

• You check your classification and file the notification with DNSC. See the DNSC registration guide.
• You carry out the risk analysis and the CyFun maturity self-assessment.
• You implement the measures proportionate to the risk and document the evidence.
• You prepare incident reporting and, where appropriate, the audit.

Why the dates and deadlines matter

The dates of publication and entry into force are not mere details: they fix the moment from which the obligations produce effects and from which the deadlines run. Since OUG 155/2024 entered into force upon publication, and the notification deadlines were subsequently set, delays can be sanctioned. For the calendar of obligations see NIS2 deadlines, and for the sanctions regime, NIS2 fines.

Where to find the official texts

For an organisation that wants to work on the exact text of the law, a few trustworthy references help you avoid unofficial or outdated versions:

• The national legislative portal (legislatie.just.ro) for the consolidated form of OUG 155/2024 and for Law 124/2025.
• EUR-Lex for the text of Directive (EU) 2022/2555, useful when you want to understand the European intent behind a provision.
• The DNSC website for the implementing orders, guides and announcements of the authority.

A practical tip: always check the consolidated form, that is the text of OUG 155/2024 as amended by Law 124/2025, not the initial form of the ordinance, which no longer reflects all the rules in force.

Conclusion

The NIS2 framework in Romania is not a single text, but a set: OUG 155/2024, amended by Law 124/2025, plus the DNSC implementing orders. For a covered organisation, the important thing is not to get lost in legislative detail, but to move on to the concrete steps: classification, notification, risk analysis, self-assessment and measures.

Check your classification and prepare the notification (free)

For an offer tailored to your situation, contact the Certudo team.