- Home
- Compliance
- NIS2 compliance
NIS2 compliance
NIS2: fines up to €10 million, and audits start in 2026
If you work in a covered sector and have more than 50 employees, you're probably in scope. The grace period is over. Romania transposed the directive through OUG 155/2024, amended by Law 124/2025. The authority is DNSC.
Fines reach €10 million or 2% of annual turnover. And the directive makes management personally responsible, not just IT. That's the change from NIS1 most boards haven't taken in yet.
Trusted since 2004 by the public sector, energy and heavy industry: buyers who audit their suppliers before they sign. See the case studies.
Check the current text before you rely on dates. Transposition, thresholds and deadlines change. This page explains how the rules work and isn't legal advice. We work from the text in force on the project date, and with your lawyer where interpretation is needed.
Deadlines once you're in scope
- 30 days: register with DNSC
- 60 days: gap analysis and risk treatment plan
- 90 days: policies and procedures in place
- 180 days: priority technical controls running
Reporting an incident
- 24 hours: early warning
- 72 hours: notification
- 30 days: final report
Those windows only work if you've decided in advance who makes the call.
In scope yourself, or supplying someone who is
You are in scope
Your sector and size make you an essential or important entity. You owe DNSC registration, risk management, incident reporting, business continuity, supply chain checks and management accountability.
You supply someone who is
You may be out of scope and still feel it, because your customers must assess their suppliers. It arrives as security questionnaires, new contract clauses and audit rights.
Using AI? It's in scope too
An AI agent with access to your systems isn't a separate legal category. Under NIS2 it's one more system on your attack surface, and usually one more supplier in your chain. It needs an inventory entry, a risk assessment and a place in your incident procedures.
That's why we build our agents with audit logs and system documentation from day one.
Why us, not a pure consultancy
Most NIS2 consultancies write documents. We build the systems that produce the evidence. We've built software for organisations that get audited hard: a state energy producer, a border police agency, a regional development agency.
What we don't do: we're not a law firm, we don't give legal opinions and we're not a certification body. Where interpretation is needed, we work with your lawyer.
The first question is free to answer
Most companies don't know if they're in scope. One short call settles it: your sector, headcount and turnover. We'll tell you where you stand and what it would cost to close the gap. If AI is also on your roadmap, the readiness assessment covers both in one project.
Common questions
Does NIS2 apply to my company?
It depends on sector and size. The directive covers the sectors in Annexes I and II, and each member state's transposition sets the detailed thresholds. Confirming whether you are in scope is the first step of any analysis.
What does NIS2 have to do with AI?
An AI agent with access to your systems becomes part of your attack surface and your supply chain. It has to be inventoried, risk-assessed and included in incident handling procedures, exactly like any other system.
What is the exposure if we do nothing?
The directive provides for significant administrative fines and places responsibility on management. Exact amounts and procedure come from national transposition. Check the version in force at the time of your analysis.
Find out in 30 minutes if it's worth doing.
Tell us about one process that eats your team's week. We'll tell you on the call whether an agent can take it over, roughly what it costs and what it saves. If it's not a fit, we'll say so.