NIS2 incident notification: 24 hours, 72 hours, a month

The first fine issued by DNSC under GEO no. 155/2024, on 29 September 2026, was for failing to file the registration notification, not for an incident. Part of the press conflated the two. This article is about the other one: incident notification, the obligation that triggers at any hour and carries the shortest deadlines in the whole ordinance.

The three deadlines

The basis is art. 15 of GEO no. 155/2024. For an incident with significant impact, the entity submits:

Stage	Deadline	What it is
Early warning	24 hours	the rapid flag, from the moment the entity became aware of the incident
Incident notification	72 hours	the initial assessment, with severity, impact and what is known so far
Final report	one month	from the 72 hour notification; for an incident still ongoing, one month from handling it

There is also a special rule: for trust service providers, art. 15 para. (8) sets a 24 hour deadline.

The clock does not start when the incident happened, it starts when the entity became aware of it. That moves the discussion onto detection: an organisation that learns of an incident three weeks later does not gain three weeks, it enters a different conversation, about detection capability.

What triggers the obligation

Not every incident is reported, only an incident with significant impact. The definition sits in art. 15 para. (6), whose introductory part was rewritten by Law no. 124/2025. Qualification is a decision, and somebody has to take it, quickly, against criteria written down in advance.

This is where time is lost most often. Not in drafting the notification, but on the question „is this significant?”, asked for the first time in the middle of an incident, in a meeting that keeps being postponed.

Separately, art. 16 governs voluntary reporting, for incidents, threats or near misses below the mandatory threshold. It is a useful instrument, particularly for entities that want to build a relationship with the authority before they have a real problem.

What the framework still lacks

Art. 15 para. (17) provides that the methodological rules for incident reporting are to be set by order of the DNSC director, and art. 65 para. (1) letter c) set a 120 day deadline for that from entry into force. As at the date of this article we have not identified such an order published in the Official Gazette.

In practice, that means there is no incident form approved by a normative act, as there is for registration. Reporting happens through the channels DNSC communicates. Check which channel is active for your entity and, above all, test it before you need it. An account nobody has ever opened is not a reporting channel.

What each stage contains

The structure follows the logic of Directive (EU) 2022/2555, which the ordinance transposes. In short:

At 24 hours, the early warning indicates whether the incident appears to be caused by unlawful or malicious acts and whether it may have cross border impact. It is short by design. Certainty is not awaited.
At 72 hours, the notification updates the information, provides an initial assessment including severity and impact, and, where available, indicators of compromise.
The final report describes the incident in detail, the threat type or likely root cause, the mitigation measures applied and ongoing, and, where relevant, the cross border impact.

The practical rule: the early warning is not a report. If your team tries to learn everything before sending something at 24 hours, it will miss the deadline.

Who reports and who signs

The obligation belongs to the entity. In practice the flow works if three things are settled, in writing, beforehand:

Who qualifies the incident as significant, and who stands in if they are unavailable.
Who submits, with working access to the reporting channel, verified periodically.
Who informs management, because accountability for the measures stays with the management bodies under art. 14 para. (1).

The officer responsible for the security of networks and information systems, appointed under art. 14 para. (3), is usually the right person for the first two, but the role has to be written down, not assumed.

What is penalised

Breaches of the incident reporting obligations are penalised under the letters of art. 60 para. (1) corresponding to art. 15, not under letter o), which concerns only the registration notification. Those sit in the upper fine range of art. 60 para. (2) letters a) and b): up to 7,000,000 euro or 1.4 per cent of total worldwide annual turnover for important entities, and 10,000,000 euro or 2 per cent for essential ones, whichever is higher.

The proportion is worth remembering. The first fine, for failing to register, was 50,000 lei, on the lower tier. Failing to report a major incident sits on the upper one.

Eight things to prepare in advance

Written criteria for qualifying an incident as significant, adapted to your services.
The decision maker and their deputy, with contact details that work at night.
The reporting channel, tested, with valid credentials held by more than one person.
Templates for the three stages, completable in minutes rather than hours.
The clock: who starts the 24 hour timer and where the moment of awareness is recorded.
The incident register, including non reportable ones, because the trend shows there.
The parallel flow to other authorities, where personal data or other sectoral obligations are involved.
One tabletop exercise a year, with a real timer.

The last point changes the outcome most. A procedure nobody has ever read is a procedure that does not exist.

Where we can help

If you want to know whether the flow actually works, a NIS2 compliance analysis with a remediation plan checks it on evidence rather than on an organisation chart. ProDefence is a cyber security auditor accredited by DNSC.

For organisations with nobody available at any hour, the role can be covered through an outsourced NIS2 officer. And if you are still unsure whether you are in scope, the CysNis platform walks through the scoping criteria step by step.

Sources

GEO no. 155/2024, consolidated form. Art. 14, 15, 16, 60 and 65.
Law no. 124/2025, Official Gazette no. 638 of 7 July 2025, point 5 of the single article.
Directive (EU) 2022/2555, art. 23, for the structure of the reporting stages.
DNSC, incident reporting channels.

This material is informative and does not constitute legal advice. Quotations from the Romanian acts are working translations. Reporting channels and forms may change; check dnsc.ro and the NIS2@RO platform before relying on them in a real situation.

Frequently asked questions

What are the incident reporting deadlines under GEO no. 155/2024?

An early warning within 24 hours, the incident notification within 72 hours, and a final report within one month of the 72 hour notification. For an incident still ongoing, the final report is submitted one month after it has been handled. For trust service providers, art. 15 para. (8) sets a 24 hour deadline.

When do the 24 hours start?

From the moment the entity became aware of the incident, not from the moment the incident occurred. That is why detection capability directly affects compliance with the deadline.

Which incidents must be reported?

Only those with significant impact, defined in art. 15 para. (6), whose introductory part was rewritten by Law no. 124/2025. For incidents, threats or near misses below that threshold, art. 16 provides for voluntary reporting.

Is there a DNSC form for incident notification?

Art. 15 para. (17) provides that the methodological rules for incident reporting are to be set by order of the DNSC director. As at the date of this article we have not identified such an order published in the Official Gazette. Reporting happens through the channels DNSC communicates, which should be tested before they are needed.

Was the fine of 29 September 2026 for failing to report an incident?

No. It was for failing to file the registration notification, on the basis of art. 60 para. (1) letter o), which refers to art. 18 para. (2). Breaches of the incident reporting obligations are penalised under other letters of art. 60 para. (1).

Who has to submit the incident notification?

The obligation belongs to the entity. In practice the officer responsible for the security of networks and information systems, appointed under art. 14 para. (3), is the right person to qualify the incident and to submit, but the role and the deputy must be set out in writing, with working access to the reporting channel.