Current position
Overview
AI legislation has been enacted.
Key legislation & sources
EU AI Act (Regulation 2024/1689)
ANCOM (National Authority for Management and Regulation in Communications)
EU AI Act National Implementation Tracker
Council of Europe Framework Convention on AI (CETS 225)
EU AI ACT
The EU AI Act (Regulation 2024/1689) applies directly across all member states. Prohibitions on unacceptable-risk AI systems have been in force since 2 February 2025; GPAI model rules since 2 August 2025. High-risk AI obligations are due from 2 August 2026, subject to the Digital Omnibus proposal which may defer enforcement. For the full implementation timeline, governance structure, and current status, see the European Union overview.
The Ministry of Research, Innovation and Digitalization coordinates implementation. A national AI strategy was published in 2024. Market surveillance and notifying authority designation is pending.
Regulatory developments
Latest updates
Latest event import:
Updates sourced from Digital Policy Alert ↗. The latest available entries for this jurisdiction.
order
Decision on audio-visual content regulatory code including fair marketing and advertising practice requirement entered into force
Source: Digital Policy Alert · View update ↗
On 6 October 2025, the Decision No. 573 establishing an audio-visual content regulatory code, including fair marketing and advertising practice requirement, entered into force. The code applies to all television and radio broadcasters, video-on-demand platforms, and video-sharing services under Romanian jurisdiction. The code establishes advertising restrictions across multiple categories and mandates that alcohol advertising is prohibited between 6 am and 10 pm and that all alcohol advertisements must end with the warning "Excessive alcohol consumption is seriously harmful to health." The code also provides that medicine advertising requiring prescriptions is banned entirely, and permitted medicine promotion must include an audible warning to read the leaflet carefully and include additional written warnings. It also provides that endorsements of medicines, medical treatments, homoeopathic products, medical devices, and food supplements are prohibited in programs for minors. The code mandates specific awareness messages covering autism screening, vaccination, and addiction prevention.
order
National Cyber Security Directorate's order on requirements regarding registration notification process and method of submitting information for essential and important entities enters into force
Source: Digital Policy Alert · View update ↗
On 20 August 2025, the National Cyber Security Directorate (DNSC) Order No. 1/2025 for the approval of the requirements regarding the notification process for the registration of essential and important entities and the method of transmitting information entered into force. The order was adopted on the basis of Government Emergency Ordinance No. 155/2024 on establishing a framework for the cybersecurity of networks and information systems in the national civil cyberspace, approved with amendments by Law No. 124/2025, and Government Emergency Ordinance No. 104/2021 on the establishment of the National Cyber Security Directorate, approved with amendments by Law No. 11/2022, with subsequent amendments. The Government Emergency Ordinance transposes into national legislation the European Union Directive on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). The requirements proceduralise and standardise the notification process for registration in the register of entities identified as essential or important, establish the method of transmitting information, introduce the NIS2 Tool and the NIS2 Platform as mechanisms for evaluation and notification, and provide the structure of the notification form covering general data, specific data, specific situations, attached documents, preliminary assessment, and entity representation.
order
National Cyber Security Directorate order on criteria and thresholds for determining degree of service disruption and methodology for assessing risk level of entities enters into force
Source: Digital Policy Alert · View update ↗
On 20 August 2025, the National Cyber Security Directorate (DNSC) Order No. 2/2025 for the approval of the Criteria and thresholds for determining the degree of service disruption and the methodology for assessing the risk level of entities enters into force. The order was issued pursuant to Government Emergency Ordinance No. 155/2024 on establishing a framework for the cybersecurity of networks and information systems in the national civil cyberspace, as amended by Law No. 124/2025, and Government Emergency Ordinance No. 104/2021 on the establishment of the DNSC, as amended by Law No. 11/2022. The Government Emergency Ordinance transposes into national legislation the European Union Directive on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). The Order defines service disruption as interruption or impairment of confidentiality or functionality and requires entities not classified as essential or important to evaluate disruption levels across all services listed in Annexes 1 and 2 of Government Emergency Ordinance No. 155/2024. It establishes three impact categories, high, medium, and low, based on consequences for fundamental rights, the national economy, health and life, financial stability, defence, public order, national security, and trans sectoral or cross-border impact within the European Union. Thresholds include compromise of personal data affecting more than one million individuals, economic damage exceeding 0.1% of GDP, or health effects on more than 115'000 persons. The Methodology requires the calculation of a baseline risk score using sectoral values, entity size, impact and probability parameters, and typologies of cyberattacks by common- and extended-capability actors, with recalculation every three years or when disruption thresholds are exceeded.
order
National Cyber Security Directorate adopted order on requirements regarding registration notification process and method of submitting information for essential and important entities
Source: Digital Policy Alert · View update ↗
On 11 August 2025, the National Cyber Security Directorate (DNSC) adopted Order No. 1/2025 for the approval of the requirements regarding the notification process for the registration of essential and important entities and the method of transmitting information. The order was adopted on the basis of Government Emergency Ordinance No. 155/2024 on establishing a framework for the cybersecurity of networks and information systems in the national civil cyberspace, approved with amendments by Law No. 124/2025, and Government Emergency Ordinance No. 104/2021 on the establishment of the National Cyber Security Directorate, approved with amendments by Law No. 11/2022, with subsequent amendments. The Government Emergency Ordinance transposes into national legislation the European Union Directive on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). The requirements proceduralise and standardise the notification process for registration in the register of entities identified as essential or important, establish the method of transmitting information, introduce the NIS2 Tool and the NIS2 Platform as mechanisms for evaluation and notification, and provide the structure of the notification form covering general data, specific data, specific situations, attached documents, preliminary assessment, and entity representation.
order
National Cyber Security Directorate adopted order on criteria and thresholds for determining degree of service disruption and methodology for assessing risk level of entities
Source: Digital Policy Alert · View update ↗
On 11 August 2025, the National Cyber Security Directorate (DNSC) adopted Order No. 2/2025 for the approval of the Criteria and thresholds for determining the degree of service disruption and the methodology for assessing the risk level of entities. The order was issued pursuant to Government Emergency Ordinance No. 155/2024 on establishing a framework for the cybersecurity of networks and information systems in the national civil cyberspace, as amended by Law No. 124/2025, and Government Emergency Ordinance No. 104/2021 on the establishment of the DNSC, as amended by Law No. 11/2022. The Government Emergency Ordinance transposes into national legislation the European Union Directive on measures for a high common level of cybersecurity across the Union (NIS 2 Directive). The Order defines service disruption as interruption or impairment of confidentiality or functionality and requires entities not classified as essential or important to evaluate disruption levels across all services listed in Annexes 1 and 2 of Government Emergency Ordinance No. 155/2024. It establishes three impact categories, high, medium, and low, based on consequences for fundamental rights, the national economy, health and life, financial stability, defence, public order, national security, and trans sectoral or cross-border impact within the European Union. Thresholds include compromise of personal data affecting more than one million individuals, economic damage exceeding 0.1% of GDP, or health effects on more than 115'000 persons. The Methodology requires the calculation of a baseline risk score using sectoral values, entity size, impact and probability parameters, and typologies of cyberattacks by common- and extended-capability actors, with recalculation every three years or when disruption thresholds are exceeded.
Showing 5 of 9 available API entries. Dates and summaries are supplied by Digital Policy Alert.