{"id":1464,"date":"2025-09-18T18:42:57","date_gmt":"2025-09-18T15:42:57","guid":{"rendered":"https:\/\/acar.aero\/?p=1464"},"modified":"2025-09-18T18:45:21","modified_gmt":"2025-09-18T15:45:21","slug":"directiva-nis2-si-implicatiile-pentru-transportul-aerian","status":"publish","type":"post","link":"https:\/\/acar.aero\/en\/directiva-nis2-si-implicatiile-pentru-transportul-aerian\/","title":{"rendered":"NIS2 Directive and its implications for air transport"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
\n

The Romanian Airline Companies Association \u201cCarpathia\u201d draws the attention of Romanian aviation operators to the new European regulations on cybersecurity and the obligations arising from the NIS2 Directive<\/strong>.<\/p>\n

What is NIS2?<\/h3>\n
    \n
  • \n

    NIS<\/strong> (Network and Information Security<\/em>) was the first European directive (2016) designed to increase the level of cybersecurity across Member States.<\/p>\n<\/li>\n

  • \n

    NIS2<\/strong> (Directive (EU) 2022\/2555), adopted in 2022, expands its scope, introduces stricter governance and reporting obligations, and provides for more severe sanctions in case of non-compliance.<\/p>\n<\/li>\n<\/ul>\n

    Implementation in Romania<\/h3>\n

    The NIS2 Directive has been transposed into national law through Emergency Ordinance no. 155\/2024<\/strong>, subsequently approved and amended by Law no. 124\/2025<\/strong>. In the air transport sector, the obligations apply to:<\/p>\n

      \n
    • \n

      certified air carriers;<\/p>\n<\/li>\n

    • \n

      aerodrome and airport operators;<\/p>\n<\/li>\n

    • \n

      air navigation service providers (ATC\/ANS);<\/p>\n<\/li>\n

    • \n

      maintenance and CAMO organizations;<\/p>\n<\/li>\n

    • \n

      air operators, ATOs, aeromedical centers;<\/p>\n<\/li>\n

    • \n

      auxiliary facility providers and simulator operators.<\/p>\n<\/li>\n<\/ul>\n

      Deadline and sanctions<\/h3>\n
        \n
      • \n

        22 September 2025<\/strong> is the deadline for registering the concerned entities with the DNSC (National Cybersecurity Directorate).<\/strong>.<\/p>\n<\/li>\n

      • \n

        Failure to register by this date may result in penalties of up to EUR 10 million or 2% of turnover<\/strong>.<\/p>\n<\/li>\n<\/ul>\n

        Operators\u2019 obligations<\/h3>\n
          \n
        1. Registration with DNSC<\/strong> in the official Registry (available online).<\/li>\n
        2. Risk and maturity assessment<\/strong> - following registration, entities must carry out a self-assessment in line with the DNSC orders issued in August 2025.<\/li>\n
        3. Incident reporting and operational continuity<\/strong> implementation of procedures and continuity\/disaster recovery plans (BCP\/DRP).<\/li>\n
        4. Governance<\/strong> - clear designation of responsibilities at management level.<\/li>\n<\/ol>\n

          Support for operators<\/h3>\n

          RACA is already in contact with cybersecurity experts and will continue to facilitate the exchange of information and best practices among its members, in order to support compliance with NIS2 requirements.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

          \n
          \n
          \n
          <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

          Asocia\u021bia Companiilor Aeriene Rom\u00e2ne\u0219ti \u201eCarpathia\u201d aduce \u00een aten\u021bia operatorilor din avia\u021bia rom\u00e2neasc\u0103 noile reglement\u0103ri europene privind securitatea cibernetic\u0103 \u0219i obliga\u021biile care decurg din Directiva NIS2. Ce este NIS2? NIS (Network and Information Security) a fost prima directiv\u0103 european\u0103 (2016) pentru cre\u0219terea nivelului de securitate cibernetic\u0103 la nivelul statelor membre. NIS2 (Directiva (UE) 2022\/2555), adoptat\u0103 \u00een […]<\/p>\n","protected":false},"author":2,"featured_media":1466,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[8,7,9],"tags":[],"class_list":["post-1464","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-biroul-de-presa","category-companii-aeriene","category-stiri"],"_links":{"self":[{"href":"https:\/\/acar.aero\/en\/wp-json\/wp\/v2\/posts\/1464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/acar.aero\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/acar.aero\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/acar.aero\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/acar.aero\/en\/wp-json\/wp\/v2\/comments?post=1464"}],"version-history":[{"count":3,"href":"https:\/\/acar.aero\/en\/wp-json\/wp\/v2\/posts\/1464\/revisions"}],"predecessor-version":[{"id":1468,"href":"https:\/\/acar.aero\/en\/wp-json\/wp\/v2\/posts\/1464\/revisions\/1468"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/acar.aero\/en\/wp-json\/wp\/v2\/media\/1466"}],"wp:attachment":[{"href":"https:\/\/acar.aero\/en\/wp-json\/wp\/v2\/media?parent=1464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/acar.aero\/en\/wp-json\/wp\/v2\/categories?post=1464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/acar.aero\/en\/wp-json\/wp\/v2\/tags?post=1464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}