For important entities, the fine runs from RON 5,000 to €7,000,000 or 1.4% of annual worldwide turnover. For essential entities, from RON 10,000 to €10,000,000 or 2%. The higher amount applies. Fines are imposed by DNSC, and an appeal suspends only the payment, not the obligation to implement the measures.
How much the fines are
| Entity | Fine | Legal basis |
|---|---|---|
| Important | from RON 5,000 to the RON equivalent of €7,000,000, or up to 1.4% of annual worldwide turnover, whichever is higher | OUG, art. 60 para. (2) (a) |
| Essential | from RON 10,000 to the RON equivalent of €10,000,000, or up to 2% of annual worldwide turnover, whichever is higher | OUG, art. 60 para. (2) (b) |
| Important, lesser breaches | RON 1,000–300,000 | OUG, art. 60 para. (2) (c) |
| Essential, lesser breaches | RON 1,500–500,000 | OUG, art. 60 para. (2) (d) |
The percentage is calculated on the turnover of the previous financial year. For a company with €50 million in turnover, 1.4% means €700,000. The ceilings are those of the EU directive, carried over as such into the ordinance.
What DNSC can fine you for
The offences in art. 60 cover the main obligations in the ordinance. The ones we see neglected most often:
- notifying and registering with DNSC on time, including keeping the data current;
- the risk level assessment and the annual self-assessment of the measures under DNSC Order 1/2026;
- implementing the risk management measures for your assurance level;
- notifying significant incidents within the legal deadlines;
- the cybersecurity audit by a DNSC-certified auditor and the remediation plan after the report;
- management’s obligations: training courses, designating the person responsible for network and information system security, staff training.
The first DNSC fine
On 29 September 2026, DNSC imposed its first fine under OUG 155/2024: RON 50,000, for missing the notification deadline. The signal is clear: DNSC first sanctions the formal obligations it can check from the office, before reaching the technical measures. The context is in the NIS2 in 2026 guide.
What else DNSC can order
- an ad-hoc audit, after a significant incident or a major change, at the audited entity’s cost (art. 46);
- remediation measures with deadlines: the plan of measures within 15 working days of the audit report, then evidence of implementation (art. 57);
- at essential entities, in case of persistent non-compliance, the temporary suspension of certifications or authorisations and a temporary ban on the responsible persons exercising management functions (art. 49).
Appealing the fine
The sanction decision is challenged before the Bucharest Court of Appeal within 30 days of notification (art. 61). The action suspends only the payment of the fine. The technical and organisational measures ordered still have to be implemented within the set deadlines.
How to avoid the fine: the calendar of obligations
| Obligation | Deadline | Where to start |
|---|---|---|
| Risk level assessment | under the methodology approved by DNSC Order 2/2025 | The NIS2 risk level |
| Self-assessment of the measures | annually; the first within 60 days of submitting the risk level assessment | NIS2 in Romania in 2026 |
| Remediation plan | essential entities, within 30 days of the self-assessment | The remediation plan |
| Person responsible for network and information system security | 30 days from notification of the DNSC decision | The NIS2 security officer |
| Cybersecurity audit | periodic, by risk level; results to DNSC within 5 days, plan within 15 working days | The NIS2 audit |
| Significant incidents | early warning within 24 hours, notification within 72 hours, final report within one month | SOC 24/7/365 |
If you do not know where you stand, the free NIS2 maturity calculator gives you a first picture in a few minutes.
How TRU helps
Through CIO-as-a-Service we keep the calendar above for you: the risk level assessment, the self-assessment, the remediation plan, the policies and the role of outsourced NIS2 security officer. The audit is performed by DNSC-certified auditors, TRU partners, under a direct contract.
For the technical measures: PenTest for testing evidence, SOC 24/7/365 for detection and timely incident notification, Proton Business for encryption.
Sources
OUG 155/2024, consolidated text (in Romanian), art. 46, 49, 57, 60 and 61, approved with amendments by Law no. 124/2025 (Official Gazette no. 638 of 7 July 2025) · DNSC: legislation · DNSC Order no. 1/2026.