This guide explains the initial path without replacing a decision by CNCS, another competent authority, or legal advice. It is not safe to decide that an entity is covered based only on its size or a broad sector label.
Start with entity registration
CNCS information identifies registration on the MyCiber platform as the starting point for self-identification under the new regime. When a company cannot determine its scope, the cautious route is to submit the facts of its specific case and wait for the competent authority's response.
- Open MyCiber through the official platform address.
- Use the legal representative or a person with authority to represent the entity.
- Submit current and consistent information.
- Keep the receipt and all platform communications.
What self-identification means
Self-identification is the electronic form containing the information needed for qualification. It is not the same as a final qualification decision. The competent authority may request additional information, notify the applicable qualification, or state that the entity falls outside the regime's scope.
- Entity name and tax identification number.
- Relevant sector, subsector, and entity type when applicable.
- Establishment, address, and current contact details.
- Employee count and, when applicable, annual turnover or balance sheet.
- EU Member States where covered services are provided, when applicable.
The list follows Article 8 of Regulation no. 756/2026. The platform form and competent authority determine what is actually required for the specific case.
Who can handle the process
The Regulation provides for entity authentication, including through a legal representative, and allows representation through legally valid means such as a mandate. If another person handles the registration, confirm in advance that the authority to represent the entity is properly documented.
What happens after submission
After the form is submitted, the platform generates a receipt confirming self-identification with the date and time of submission. The company should monitor notifications and answer any requests for additional information within the deadline stated in the communication.
- Keep the receipt accessible to management and the person handling the process.
- Assign someone to monitor notices and clarification requests.
- Do not treat self-identification as an automatic confirmation that the entity is essential or important.
- Define the measures and evidence plan only after the applicable scope is clearer.
Deadlines: do not apply a generic rule to your case
CNCS describes different deadlines for entities that started operating after the regime entered into force and entities that were already operating when the platform became available. There are also separate deadlines after qualification notification. The date that applies to your company should be confirmed in the official process and the notices received.
- CNCS describes 30 days after starting activity for new entities.
- For entities already operating, it describes 60 days after the platform becomes available.
- For applicable entities, the cybersecurity officer and permanent point of contact are communicated within 20 working days after qualification notification.
The deadlines above summarize published official information. They are not an individual decision and do not replace the platform notices.
What this guide does not decide
This content does not confirm whether a company is essential, important, or a relevant public entity, does not calculate an individual deadline, and does not replace legal advice. Its purpose is to organize the first step and make the technical conversation clearer after the official response.