NIS2 deadlines for Romania: complete calendar 2025-2027

Introduction

With the final registration deadline rapidly approaching, many Romanian organizations are asking: "How much time do we have left?" This guide details all critical deadlines you must meet for NIS2 compliance.

NIS2 Calendar for Romania

Past Deadlines

January 2025 - Entry into force of OUG 155/2024

• Romanian legal framework for NIS2 is active
• Organizations must begin preparation

September 2025 - Initial registration deadline (modified)

• Initially planned for September 22, 2025
• Deadline was extended to allow adequate preparation

Critical Upcoming Deadlines

September 2026 - DNSC Registration

• Final deadline for submitting the registration form
• Includes Annex 1 (Service Impact Analysis) and Annex 2 (Risk Level Assessment)
• This deadline is non-negotiable

60 days from confirmation - Risk level assessment

• After DNSC confirms your registration, you have 60 days
• Must submit complete risk assessment

60 days after risk assessment - Maturity self-assessment

• Assessment of security measures maturity level
• Based on 140 controls from the adapted NIST CSF framework

October 2026 - Incident reporting becomes mandatory

• Initial alert: 24 hours (modified from initially proposed 6 hours)
• Complete notification: 72 hours
• Final report: 30 days

April 2027 - First annual report

• Compliance report to DNSC
• Includes progress on implemented measures

What Documents Need Preparation?

For registration (September 2026):

1. Registration Form

   • Organization identification data
   • Sectors of activity
   • Services provided
   • Security contact person

2. Annex 1 - Service Impact Analysis

   • Assessment of potential incident impact
   • Identification of critical dependencies
   • Operational and financial impact estimates

3. Annex 2 - Risk Level Assessment

   • Identification of relevant threats
   • Vulnerability assessment
   • Global risk level calculation

For ongoing compliance:

• Updated security policies
• Incident management procedures
• Business continuity plan
• Evidence of control implementation
• Audit and test reports

Penalties for Missing Deadlines

Failure to meet deadlines can result in severe penalties:

For non-registration:

• Essential entities: up to 500,000 RON
• Important entities: up to 300,000 RON

For general non-compliance:

• Essential entities: up to 10 million EUR or 2% of global turnover
• Important entities: up to 7 million EUR or 1.4% of global turnover

Additional possible measures:

• Temporary suspension of activities
• Temporary ban for management personnel
• Remediation obligations and notification of affected clients

Recommended Action Plan

Now - 3 months from now

1. Verify eligibility using our calculator
2. Form the team for NIS2 compliance
3. Conduct gap analysis - where you are vs. where you need to be

3-6 months from now

1. Implement priority controls
2. Document policies and procedures
3. Collect evidence of implementation

6-9 months from now (until September 2026)

1. Complete self-assessment on all 140 controls
2. Prepare DNSC documents - form, Annex 1, Annex 2
3. Test incident reporting processes
4. Submit registration well before the deadline

Comparison with Other EU Countries

Romania is not alone in this race. The situation in the EU:

• 16 countries have already transposed NIS2 into national legislation
• 11 countries (including Germany, until recently) were delayed
• Belgium was among the first - registration deadline passed in March 2025
• Germany adopted legislation in November 2025, with registration deadline April 2026

Romania is in the middle of the pack, with a deadline that still offers time for adequate preparation.

Conclusion

You still have time, but not much. Organizations starting preparation now will have a major advantage over those waiting until the last moment. Fines are substantial, and consequences for management can be personal.

Use NIS2 Manager to organize your compliance and meet all deadlines.

NIS2 Manager is a product by BetterQA, one of Europe's top software testing companies.