Who needs to comply with NIS2 in Romania? Complete eligibility guide

Introduction

One of the most common questions we receive from Romanian companies is: "Does my organization fall under NIS2?" The answer depends on three main factors: your sector of activity, organization size, and the nature of services provided.

NIS2 Classification Criteria

1. Sector of Activity

NIS2 regulates organizations across 18 critical sectors, divided into two categories:

Annex I - Highly Critical Sectors:

• Energy (electricity, oil, gas, hydrogen, district heating/cooling)
• Transport (air, rail, water, road)
• Banking
• Financial market infrastructure
• Healthcare
• Drinking water and wastewater
• Digital infrastructure (DNS, IXP, cloud, data centers, CDN)
• ICT service management B2B
• Public administration
• Space

Annex II - Other Critical Sectors:

• Postal and courier services
• Waste management
• Manufacturing and distribution of chemicals
• Food production and distribution
• Manufacturing of medical devices, electronic equipment, vehicles, etc.
• Digital service providers (online marketplaces, search engines, social networks)
• Research

2. Organization Size

To fall under NIS2, your organization must exceed certain thresholds:

Medium Entity:

• More than 50 employees, OR
• Annual turnover exceeding 10 million EUR, OR
• Annual balance sheet exceeding 10 million EUR

Large Entity:

• More than 250 employees, OR
• Annual turnover exceeding 50 million EUR AND balance sheet exceeding 43 million EUR

3. Exceptions and Special Conditions

Even if you don't meet the size criteria, you may still fall under NIS2 if:

• You are the sole provider of an essential service in a member state
• A disruption of your service could have cross-border impact
• You provide critical services for public safety, health, or national security
• You are explicitly designated by DNSC as an essential or important entity

Essential vs. Important Entities

Essential entities include:

• Large organizations from Annex I sectors
• DNS providers, top-level domain registries
• Qualified trust service providers
• Central public administration entities

Important entities include:

• Medium organizations from Annex I sectors
• All organizations (medium and large) from Annex II sectors

What About Belonging to a Corporate Group?

A common question: "Our company is small, but we belong to a large group. Does NIS2 affect us?"

According to OUG 155/2024:

• Group membership does not automatically trigger NIS2 applicability
• HOWEVER: if the entity operates in a regulated sector, size can be calculated at group level
• Assessment is made on a case-by-case basis

Internal IT Departments - Are They MSPs?

Another frequent question concerns internal IT departments, especially within corporate groups. OUG 155/2024 defines "managed service providers" (MSPs) in broad terms, including any entity offering active IT infrastructure management.

The legal situation is not entirely clear. In the absence of official clarifications from DNSC, we recommend a cautious approach: if your IT department provides services to other group entities operating in NIS2 sectors, you should assess compliance requirements.

Financial Sector: NIS2 vs DORA

For entities in the financial sector (banks, payment institutions, market operators), the situation is special:

• They are regulated primarily by DORA (Digital Operational Resilience Act)
• Only certain provisions from NIS2/OUG 155/2024 apply regarding cooperation and risk identification
• Registration with DNSC remains mandatory

Next Steps

1. Verify eligibility - Use our free calculator for a quick assessment
2. Analyze your sector - Identify exactly which category you fall into
3. Assess size - At entity or group level, as applicable
4. Consult specialists - For complex cases, legal opinion can clarify the situation

Conclusion

Approximately 12,000-15,000 organizations in Romania will need to comply with NIS2 - a massive increase from the approximately 1,000 regulated previously. The deadline for DNSC registration is September 2026, so preparation time is running short.

Don't leave compliance to the last minute. Start your assessment today.

NIS2 Manager is a product by BetterQA, one of Europe's top software testing companies.