On September 30, 2026, Romania's National Cyber Security Directorate (DNSC, Directoratul Național de Securitate Cibernetică) published a press release stating that on September 29, 2026 it issued a contravention finding and a penalty against a legal person that is a specialised body of the central public administration, classified in sector 10, public administration, of Annex No. 1 to Government Emergency Ordinance No. 155/2024 (OUG 155/2024). The DNSC release is the first penalty under that ordinance: a fine of 50,000 lei for failing to notify within the legal time limit in Article 18(2), the contravention in Article 60(1)(o).
Romanian essential and important entities under OUG 155/2024 in the manufacturing sector, manufacturers of connected radio, telecom and electrical equipment, Romanian importers and distributors of connected IoT and electrical equipment placed on the Romanian market, Romanian electronic communications operators and digital-infrastructure providers, and Romanian cybersecurity and product-compliance leads at equipment manufacturers must immediately confirm that the Article 18(2) registration notice to DNSC is filed and kept current, with a designated contact point and the entity data Article 18(3) requires, or face the same contravention: the issued fine was 50,000 lei, and Article 60(2) of the consolidated ordinance sets 1,000 to 300,000 lei for important entities and 1,500 to 500,000 lei for essential entities for letters (n) to (t), which include the missed Article 18(2) notice.
What did DNSC sanction on September 29, 2026?
DNSC sanctioned a missed registration notice. The release, also filed as a PDF, does not name the body. It places the addressee in sector 10 of Annex No. 1 and ties the facts to Article 18(2) and Article 60(1)(o). Article 18(2) requires entities in Annex No. 1 or Annex No. 2 to notify DNSC for the register of essential and important entities within 30 days of entry into force, or within 30 days of the ordinance becoming applicable under Articles 5 and 6. The 50,000 lei fine sits inside both Article 60(2) bands for letters (n) to (t): 1,000 to 300,000 lei for important entities and 1,500 to 500,000 lei for essential entities.
Who is exposed beyond the unnamed public body?
The sanctioned body is context. The duty in Article 18(2) attaches to entities in the annex sectors once Articles 5 and 6 classify them as essential or important, including private operators. For this industry that means Romanian manufacturers of connected radio, telecom and electrical equipment (products with digital elements), importers and distributors placing that equipment on the Romanian market, and electronic communications operators and digital-infrastructure providers that qualify as essential entities.
Article 18(3) is the content of that notice: name, seats, contacts, a permanent contact and the person who monitors it, a representative if the entity is not established in the European Union, the annex sector and subsector, and the Member States served. A separate clock, Article 15(7), covers significant incidents: an early warning within 24 hours of awareness, an incident report within 72 hours, and a final report within one month. DNSC did not cite that ladder on September 29, 2026.
What must be in place immediately?
- Confirm whether Articles 5 and 6 place the Romanian entity in Annex No. 1 or Annex No. 2 as an essential or important entity.
- Check that the Article 18(2) notice reached DNSC within 30 days of entry into force or of applicability, with the Article 18(3) contact data.
- Communicate later changes to that data under Article 18(8).
- Keep the Article 15(7) incident file separate: early warning within 24 hours, incident report within 72 hours, final report within one month.
Continuous, per-jurisdiction monitoring is what surfaces a first DNSC penalty of this kind the day the release is published.
What is the fine if the Article 18(2) notice is late?
Article 60(2)(c) and (d) set a lei band for this contravention, not the turnover caps. Important entities face 1,000 to 300,000 lei. Essential entities face 1,500 to 500,000 lei. DNSC chose 50,000 lei. The euro ceilings in Article 60(2)(a) and (b), up to 7,000,000 euro or 1.4 percent of worldwide annual turnover for important entities and up to 10,000,000 euro or 2 percent for essential entities, apply to other letters of Article 60(1). They were not the basis of this decision.
| Duty | Provision | Clock | Fine band for a breach |
|---|---|---|---|
| Registration notice to DNSC | Article 18(2), contravention Article 60(1)(o) | 30 days from entry into force or from applicability | Important: 1,000 to 300,000 lei. Essential: 1,500 to 500,000 lei. This decision: 50,000 lei |
| Significant-incident early warning | Article 15(7)(a) | Within 24 hours of awareness | Not the basis of the September 29, 2026 decision |
| Incident report | Article 15(7)(b) | Within 72 hours of awareness | Not the basis of the September 29, 2026 decision |
| Final report | Article 15(7)(d) | Within one month of the incident report | Not the basis of the September 29, 2026 decision |
Verify Annex No. 1 and Annex No. 2 classification, confirm the Article 18(2) notice and the Article 18(3) contact point, and brief the compliance and product-security leads on the 24-hour, 72-hour and one-month incident clocks so they are not confused with the registration duty DNSC has already fined. Obsidian tracks the Romanian DNSC releases and the OUG 155/2024 amendments as they are published.
