Who Needs NIS2
The NIS2 Directive covers an estimated 12,000+ organizations in Romania. Check if your organization is included.
Sectors of high criticality (Annex I)
The sectors with the greatest impact on society and the economy. Large entities in these sectors are classified as essential entities; medium-sized ones as important entities.
Energy
Electricity, oil, gas, hydrogen, district heating
Transport
Air, rail, maritime, road
Banking
Credit institutions, banks
Financial Markets
Financial market infrastructures
Health
Hospitals, laboratories, pharma manufacturers, medicine distributors and pharmaceutical trade (NACE 4646/4773)
Drinking Water
Drinking water suppliers and distributors
Wastewater
Wastewater management
Digital Infrastructure
IXP, DNS, TLD, cloud, data centers, CDN
ICT Services (B2B)
MSP, MSSP
Public Administration
Central government entities
Space
Space infrastructure
Other critical sectors (Annex II)
Additional critical sectors. In-scope entities in these sectors are classified as important entities.
Postal Services
Postal and courier services
Waste Management
Collection, treatment, recycling
Chemicals
Production and distribution
Food Production
Production, processing and/or distribution of food
Manufacturing
Medical devices, electronics, machinery, vehicles
Digital Services
Marketplace, search engines, social networks
Research
Research organizations
Size thresholds and classification
You fall under NIS2 if you are at least a medium-sized enterprise:
- at least 50 employees, OR
- turnover > EUR 10M AND total balance sheet > EUR 10M
The rule (Law 346/2004, art. 4): you remain a small enterprise only if you have fewer than 50 employees and do not exceed the financial threshold. Exceeding either criterion above makes you at least medium-sized — and therefore covered by NIS2. Micro and small enterprises are generally exempt — except for the cases below.
Essential vs. important (by size and sector):
- Essential entities: large enterprises (250+ employees, or turnover > EUR 50M and balance sheet > EUR 43M) in Annex I sectors.
- Important entities: medium-sized enterprises (50–249 employees) in Annex I, plus all medium or large entities in Annex II.
Covered regardless of size:
As essential entities: DNS service providers, TLD name registries, qualified trust service providers, central public administration and critical entities (Law 294/2024).
As important entities: providers of public electronic communications networks/services and non-qualified trust service providers.
Plus any entity individually designated by DNSC (art. 9), e.g. the sole provider of an essential service. Note: cloud, data centres, CDN, MSP and digital providers (marketplaces, search engines, social networks) are not “regardless of size” — they fall in via the normal threshold.
Sanctions Regime
Essential Entities
Minimum: 10,000 RON Maximum: 10 million EUR
or 2% of global annual turnover
Important Entities
Minimum: 5,000 RON Maximum: 7 million EUR
or 1.4% of global annual turnover
Personal liability of management (board/C-level). Mandatory training for leadership.
Not sure if your organization falls under NIS2?
Request a free assessment and find out as soon as possible if you are required to comply.
Check now