CRA Compliance in Romania

DNSC serves as Romania's national competent authority for the CRA, with market surveillance for consumer and industrial products coordinated with the National Authority for Consumer Protection (ANPC) and the National Authority for Management and Regulation in Communications (ANCOM) for telecoms products. DNSC was established specifically to strengthen Romania's national cybersecurity governance and has been growing rapidly in both technical capacity and regulatory mandate. Romania's NIS2 transposition through Legea nr. 58/2023 provides the legislative basis for DNSC's supervisory powers over cybersecurity, which will be extended to CRA market surveillance through national implementing legislation.

Romanian manufacturers submit Article 14 notifications to DNSC through its incident reporting portal. DNSC operates incident response capability and coordinates with the EU CSIRTs network. The Article 14 obligation requires an early warning within 24 hours of detecting active exploitation and a full notification within 72 hours. DNSC's operational CSIRT function, inherited from CERT-RO, has experience coordinating cross-sector incident responses, and CRA Article 14 notifications will integrate with DNSC's existing reporting infrastructure. Manufacturers should establish a direct contact with DNSC's incident coordination team before any incident occurs.

Market surveillance for CRA products in Romania is coordinated between DNSC and ANPC, with ANCOM involved for communications products. The full CRA penalty regime applies: up to €15 million or 2.5% of global annual turnover for violations of essential cybersecurity requirements. Romania has been strengthening its market surveillance capacity under EU product safety frameworks, and ANPC conducts regular market surveillance operations. Romanian manufacturers should maintain comprehensive technical documentation as DNSC may request this as part of market surveillance procedures.

DNSC publishes cybersecurity guidance in Romanian and engages manufacturers through industry events and awareness campaigns. The Romanian National Authority for Scientific Research and Innovation (ANCSI) supports R&D including cybersecurity through national research programmes. CERT-RO's operational legacy, now absorbed into DNSC, includes a strong tradition of public-private partnership in cybersecurity. The Romanian Association of Electronic and Software Industry (ANIS) provides CRA implementation guidance for technology manufacturers. EU structural funds administered through the Ministry of Research, Innovation and Digitalization support SME cybersecurity investments including CRA compliance.