The first NIS2 fine applied by DNSC: what happened and what you learn from it

At the end of September 2026, DNSC applied the first fine under OUG 155/2024, the law that transposes NIS2 into Romania. The sum, 50,000 lei, is not spectacular in itself, but the moment matters: it is the signal that the implementation period has passed and that the authority has started to sanction in earnest. Here, based on the facts confirmed by the specialist press, is what happened and what you learn from it.

What happened

According to press reports, DNSC applied a fine of 50,000 lei to an institution in central public administration, classified in sector 10 (public administration). The reason was not a cyber security incident, but failure to meet the obligation to notify and register on time.

From a legal standpoint, the act is classified under Art. 18(2) of OUG 155/2024, which establishes the obligation to notify and register, the sanction being provided at Art. 60(1)(o). In other words, the entity did not meet a basic administrative obligation, that of making itself known to the authority within the set deadline.

Why it matters, even though the sum seems small

At first glance, 50,000 lei seems little compared with the ceilings in the law. Under OUG 155/2024, approved by Law 124/2025, essential entities can be sanctioned with up to 10,000,000 euro or 2% of worldwide turnover (whichever is higher), and important ones with up to 7,000,000 euro or 1.4%. The difference in order of magnitude is huge.

That is precisely why the signal is important. The message is not the value of the fine, but the fact that DNSC has moved from informing and guidance to the actual application of sanctions. Until now, many organisations treated the deadlines as recommendations. The first fine shows they are not.

The fact that it targeted a public institution is also significant: NIS2 obligations apply equally to the public and the private sector. No category is exempt from the basic obligation of registration. We wrote about the specifics of public institutions in NIS2 for public institutions.

The context of the deadlines

To understand why this fine was possible, it is worth recalling the calendar. The initial notification deadline for covered entities expired around 19 September 2025. The DNSC classification decision then confirms each entity's status and starts the deadlines for the next steps (for example the initial risk analysis).

Important to keep in mind: even if the initial deadline has passed, the obligation to register remains valid. An organisation that has not registered yet does not escape the obligation once the deadline passes; on the contrary, it enters the zone where it can be sanctioned, exactly as in the case of the first fine. The full calendar is detailed in NIS2 deadlines.

What it means for your company

The practical message is direct: the enforcement stage has begun. If you have postponed until now, the risk is now concrete, not theoretical. A few useful conclusions:

• Registration is the minimum obligation, not optional. The first fine was for failure to register, the simplest of requirements. It is also the easiest to avoid.
• Sanctions do not depend on the existence of an incident. You can be sanctioned for an unmet administrative obligation, without having had any security breach.
• The ceilings for private companies are much higher. 50,000 lei was the case of a public institution; for a private essential or important entity, the legal framework allows sanctions in the order of millions of euro.
• Delay does not exempt you. The obligation remains; the longer you postpone, the more you expose yourself.

You can read about the full sanctions regime in NIS2 fines in Romania.

What you do if you have not registered yet

If your organisation is covered by NIS2 and has not registered, the steps are clear and must not be postponed:

• Check your classification. Confirm whether you fall under NIS2 and at what level, with the classification and registration tool.
• Register on the NIS2@RO platform. It is the basic obligation and, as the first fine shows, the first one the authority checks. Details in registration with DNSC.
• Start implementation. Go through the risk analysis, the CyFun maturity self-assessment and the implementation plan for free, so that you have a clear picture of the gap.
• Document what you do. A late registration, accompanied by proof that you have started implementation, is a much better position than total inaction.

A registration done now, even after the deadline, is preferable to a non-existent one. The obligation does not disappear once the deadline passes, and the first fine confirms that the authority is watching exactly this.

Why failure to register is the most avoidable mistake

It is worth dwelling on the nature of this first sanction, because its lesson is counterintuitive. Many organisations imagine that the risk under NIS2 comes from a cyber attack or a complicated breach. In reality, the first fine came from something much simpler: an entity did not announce itself to the authority within the set deadline.

Registration is, in terms of effort, among the easiest obligations in the entire NIS2 journey. It does not require the implementation of complex technical controls, nor elaborate evidence, but only notification and registration on the NIS2@RO platform. The fact that the first sanction targeted exactly this step shows that the obstacle was not difficulty, but delay.

For a company, the practical conclusion is reassuring: the authority's most likely first check is also the easiest to pass. If you make sure you are registered on time, you eliminate the category of risk that produced the first fine in Romania.

What comes after registration

Registration solves the basic obligation, but it does not end the journey. Once you are visible to the authority, the substantive part follows: the implementation of security measures at the CyFun level you fall into. The steps are the same regardless of sector:

• you go through the risk analysis and confirm the CyFun level (Basic, Important or Essential);
• you perform the maturity self-assessment on the six functions and identify the gap against the maturity target of 3 out of 5;
• you build and execute an implementation plan prioritised by risk;
• you collect the evidence as you work, not before the audit.

The earlier you start this part, the less exposed you are to a future round of checks that, predictably, will no longer stop at mere registration. The first fine targeted an administrative obligation; the next ones will increasingly concern the substance of the security measures.

Conclusion

The first NIS2 fine in Romania should not be read alarmingly, but as a clear marker: the deadlines are real and the authority applies them. For most organisations, the lesson is reassuring in its simplicity, because the most avoidable mistake, failure to register, can be corrected quickly. Start with classification and registration, then build implementation step by step.

Beyond the specific case, the contextual message is useful to any covered organisation: NIS2 has entered the phase in which compliance is no longer an intention, but a verified requirement. Those who dealt with the obligations in good time, starting with the simplest of them, are now in the most comfortable position. Those who postponed still have a clear path to recovery, provided they no longer delay. In both cases, the first step is the same and costs nothing: checking the classification and registering.

Check your classification and register

Not sure where you stand or what to do next? Contact us and we will guide you, from registration to implementation.