Romania · RO

← Back to tracker

Status

Transposed

In force from

2025-01-01

Implementing law

Ordonanța de Urgență nr. 155/2024 (OUG 155/2024), confirmed by Law 124/2025

EU infringement procedure

None

Competent authority

Direcția Națională de Securitate Cibernetică (DNSC) Competent authority NIS2 page →

National CSIRT

CSIRT.ro / CERT-RO (within DNSC) CSIRT website →

Notable national choices

• Transposed by Emergency Ordinance (OUG 155/2024) of 31 December 2024 — a 'just-in-time' government route bypassing normal parliamentary process; subsequently ratified by Law 124/2025 (in force 10 July 2025).
• Implementing orders 1/2025 and 2/2025 published 20 August 2025; very short 30-day registration window (deadline around 19 September 2025).
• Recognises Belgium's CyFun® framework.

Sources

• https://www.kinstellar.com/news-and-insights/detail/3194/cybersecurity-romania-transposes-the-nis2-directive-whats-next
• https://dnsc.ro/pagini/legislatie-nis2
• https://cms-lawnow.com/en/ealerts/2025/09/romania-launches-orders-to-implement-the-nis2-framework-30-day-registration-deadline-in-effect

Last verified: 2026-05-27