Romania
Current Status: Implemented
Expected or actual implementation date or timeline
Romania adopted Law no. 294/2024 on the resilience of critical entities, which expressly transposes Directive (EU) 2022/2557. Law no. 294/2024 was published in the Official Gazette no. 1189 on November 29, 2024 and entered into force three days after publication (i.e., on December 2, 2024).
If implemented, whether a transition period applies and, if so, its duration
Yes. Under Article 6(5), Chapter III obligations regarding critical entities resilience apply to each identified critical entity 10 months after it receives its identification notice.
However, the entity's own risk assessment has a shorter, stand-alone 9-month deadline from receipt of the identification notice (rather than 10 months).
Key statutory milestones include:
- national strategy and the National Center for the Coordination of Critical Infrastructure Protection risk assessment by January 17, 2026;
- list of identified critical entities by July 17, 2026. Sectoral competent authorities are required to submit, five months prior to this deadline, data for the identification of critical entities.
Other important remarks/notes
On February 10, 2026, the draft Government Decision approving the National Strategy on the Resilience of Critical Entities was published for public consultation for 10 days on the website of the Ministry of Internal Affairs, however this has not yet been adopted.
Implementing acts adopted as of now include Prime Minister Decision no. 55/2025 (sectoral competent authorities), Prime Minister Decision no. 171/2025 (working group regulation), and Government Decision no. 1115/2025 (ECIED identification norms and Commission advisory missions).
The National Center for the Coordination of Critical Infrastructure Protection (“CNCPIC”) is the specialized central unit of the Ministry of Internal Affairs responsible for organizing and carrying out the activities necessary for the implementation of Law No. 294/2024 on the resilience of critical entities, which ensures the transposition at the national level of the provisions of Directive (EU) 2022/2557.
Key contact
© Eversheds Sutherland. All rights reserved. Eversheds Sutherland is a global provider of legal and other services operating through various separate and distinct legal entities. Eversheds Sutherland is the name and brand under which the members of Eversheds Sutherland Limited (Eversheds Sutherland (International) LLP and Eversheds Sutherland (US) LLP) and their respective controlled, managed and affiliated firms and the members of Eversheds Sutherland (Europe) Limited (each an "Eversheds Sutherland Entity" and together the "Eversheds Sutherland Entities") provide legal or other services to clients around the world. Eversheds Sutherland Entities are constituted and regulated in accordance with relevant local regulatory and legal requirements and operate in accordance with their locally registered names. The use of the name Eversheds Sutherland, is for description purposes only and does not imply that the Eversheds Sutherland Entities are in a partnership or are part of a global LLP. The responsibility for the provision of services to the client is defined in the terms of engagement between the instructed firm and the client.
Connect with us
