On 9 September 2026, at the presentation of the FORT Cyber study, Gabriel Dinu, deputy director of Romania's National Cyber Security Directorate, was asked which breaches the first NIS 2 sanctions are being written for. His answer was short: the first ones are for failure to register, followed by those who missed their obligations and their document submission deadlines.
Two things in that sentence matter, and neither is the ten-million-euro figure the newspapers led with.
First, the order. Enforcement is not starting with the quality of your security controls. It is starting with whether you exist in the register. Second, DNSC said explicitly that the initial fines are "adequate to the factual situation" and begin at the minimum of the scales. That is not reassuring if you are unregistered — that is precisely the category being sanctioned first.
The two categories of exposure
Organisations mix these constantly, and the mixing produces bad decisions: money goes into technical controls while a form goes unsent.
Procedural breaches say nothing about your security. You did not send the identification notification. You did not designate a contact person for DNSC. You did not submit the risk-level evaluation or the maturity self-assessment on time. You did not update your registration details after a change. Every one of these is established from a database, in an afternoon, without anyone visiting your office.
Substantive breaches are the Article 20 and Article 21 obligations of OUG nr. 155/2024 — governance and risk-management measures: risk analysis, incident handling, business continuity, supply chain security, basic cyber hygiene, cryptography, access control, testing and auditing the effectiveness of the measures, plus the separate duty to train the management body. These require an inspection, evidence and time.
The first category exposes you now. The second exposes you at the inspection that follows.
Which amounts are confirmed
The upper ceilings are consistent across every source and with the transposed directive:
- Essential entities — fines starting at 10,000 lei, up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher.
- Important entities — fines starting at 5,000 lei, up to EUR 7 million or 1.4% of total worldwide annual turnover.
For purely procedural contraventions, the Romanian press reports much smaller lei bands — on the order of 1,000–300,000 lei and 1,000–100,000 lei depending on the category. We could not confirm those bands directly against the text of the ordinance: the legislative portal and dnsc.ro did not respond at the time of writing. Treat them as a publicly reported order of magnitude, not as the letter of the law. If you are building an internal case on the exact figure, read Article 32 and following of OUG nr. 155/2024 in the Official Gazette, not a news article — including this one.
What does not depend on the figure: the bottom of the scale is still larger than the cost of registering, and a sanction for non-registration enters the entity's record before any conversation about controls begins.
There is no national date. There is your date
This is where most time gets wasted. Several Romanian compliance sites circulate fixed deadlines — "October 2026" — after which obligations supposedly "come into force". That is not how the mechanism works.
Deadlines run from each entity's own reference points:
- The notification to DNSC is due within 30 days of the entity determining that it falls under the ordinance.
- DNSC then issues an identification decision, on different timelines for essential and important entities.
- The risk-level evaluation is due within 60 days of that identification decision.
- The maturity self-assessment is due within a further 60 days, following the methodology in DNSC Order nr. 1/2026 — six functions (governance, identify, protect, detect, respond, recover) and three assurance levels.
- Essential entities get 30 more days for a remediation plan signed off by management.
So no light switches on for everyone in October. It switches on for you, on your date — and if you never started the clock by notifying, the clock never started at all. That is exactly what is being sanctioned right now.
If you are still unregistered in October
The order of operations matters, because some of this takes a day and some of it does not.
- Determine whether you fall under the ordinance, and in which category. Sector, size and your role in the chain decide it. If the answer is "probably yes", treat it as yes until you can document otherwise.
- Send the notification. It is the cheapest action on this list and the only one that closes the category currently being sanctioned. A late notification is a materially better position than no notification.
- Name the responsible person for the DNSC relationship, with at least one deputy, in writing, and a contact route that does not depend on a single mobile phone.
- Prepare the risk evaluation before the identification decision arrives, not after. Those 60 days disappear entirely into information-gathering if you have no asset inventory.
- Do the maturity self-assessment honestly. An inflated score does not help at an inspection and actively prevents you from getting budget. The gap between the self-assessment and reality is exactly what an inspection looks for.
What you need to be able to put on the table
An inspection does not want a narrative. It wants evidence that the process existed before the incident and that it worked. Concretely:
- the asset register, with an owner and a criticality rating per entry;
- the risk analysis, dated, with the person who approved it;
- the incident response plan, plus an incident log with stable identifiers;
- proof of training, including for the management body — a distinct obligation, not an extension of staff awareness training;
- the results of an independent security test and, more importantly, the record of remediations and their closure;
- the vulnerability management procedure, with written deadlines per severity class.
The last two are what separate a self-assessment from a verifiable claim. An internally completed questionnaire says what the organisation believes about itself. A penetration test says what actually happens when someone tries, and a remediation record says whether you reacted. At an inspection, the second pair carries far more weight than the first.
A ten-minute check
Open a document and answer in writing:
- Are we registered with DNSC? What is the date and the confirmation reference?
- Who is the designated person, who is the deputy, and where is the document appointing them?
- Have we received an identification decision? When? Which deadlines started running from it?
- Have we submitted the risk evaluation and the maturity self-assessment? Where are the confirmations?
- If a document request with a five-day deadline arrived tomorrow, which item above could we not produce?
The last question is the one that matters. The rest are archive checks.
If the answer to the first question is "no" or "we don't know", that is the single item in this article that needs solving this week. For the rest, independent testing and a compliance and risk assessment produce exactly the kind of evidence an inspection accepts — but neither compensates for being absent from a register.