Romania: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114), transposed/enabled domestically by Government Emergency Ordinance (OUG) 10/2025 (in force 13 March 2025). Competent authorities: Autoritatea de Supraveghere Financiară (ASF) for non-bank CASPs and ART issuers; Banca Națională a României (BNR) for credit institutions and e-money token (EMT) issuers; AML/CFT under Law 129/2019. Tax administered by ANAF.

Crypto is legal in Romania and is now regulated under the EU's MiCA regulation, which became fully applicable on 30 December 2024 and was transposed via OUG 10/2025 in March 2025, designating ASF as the lead supervisor and BNR as the competent authority for banks and EMT issuers. Romania is in MiCA's transitional period: AML-registered VASPs may continue operating until 1 July 2026, by which date a MiCA CASP authorisation is required; from 1 January 2026 capital gains on crypto are taxed at 16% (raised from 10%).

Framework: EU AI Act (Regulation (EU) 2024/1689, directly applicable); National AI Strategy 2024-2027 (Government Decision HG 832/2024); Romanian Committee for Artificial Intelligence (CRIA); Authority for the Digitalisation of Romania (ADR), proposed NCA

Romania is directly bound by the EU AI Act (Regulation (EU) 2024/1689), which has been entering into force in phases since August 2024 and constitutes the primary horizontal AI framework. Romania adopted a National AI Strategy 2024-2027 (HG 832/2024) and established the advisory Romanian Committee for Artificial Intelligence (CRIA). As of mid-2026, Romania has not formally designated its national competent authority under Article 70 of the AI Act despite the August 2025 deadline, and a domestic supplementary law (PL-x 184/2025) on responsible AI use remains under parliamentary consideration.

Framework: EU GDPR (Regulation 2016/679) directly applicable; national implementation via Law no. 190/2018; ePrivacy via Law no. 506/2004; supervised by ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal)

Romania applies GDPR directly as binding EU law, supplemented by Law no. 190/2018 which provides national-level implementing measures for specific processing situations such as national identification numbers, employee monitoring, and special-category data. The supervisory authority ANSPDCP is an independent public authority established under Law no. 102/2005 and has been actively issuing fines through 2025-2026, demonstrating sustained enforcement.

Framework: Law 209/2019 (PSD2 transposition, payment services), Law 210/2019 (e-money/EMD2 transposition), BNR Regulation No. 4/2019; supervised by Banca Națională a României (BNR/NBR)

Romania has a fully operative licensing regime for digital payments and e-money, anchored in Law 209/2019 (payment services, PSD2 transposition) and Law 210/2019 (electronic money, EMD2 transposition), both in force since December 2019. The National Bank of Romania (BNR) is the sole competent authority for authorising and supervising payment institutions (PIs), electronic money institutions (EMIs), and account information service providers (AISPs), maintaining a public registry of authorised entities. Open banking is live under Berlin Group NextGenPSD2 standards, and Romania's real-time rail (Plăți Instant / TRANSFOND) has been operating since April 2019.

Framework: Law 22/2022 amending Government Emergency Ordinance no. 194/2002 on the regime of foreigners in Romania; administered by the Ministry of Foreign Affairs (MAE) and the General Inspectorate for Immigration (IGI/MAI)

Romania introduced a dedicated Digital Nomad long-stay visa (Type D) in January 2022 via Law 22/2022, available to non-EU nationals employed by or owning a company registered outside Romania who work entirely remotely via ICT. The visa is valid for up to 12 months and is renewable once for an additional 12 months. Since Romania achieved full Schengen membership in January 2025, holders gain standard Schengen 90/180-day onward travel rights.

Framework: EU Digital Services Act (Regulation 2022/2065) directly applicable since 17 February 2024; national implementation via Romania Law No. 50/2024 (Official Journal No. 232, 19 March 2024); Digital Services Coordinator: ANCOM (National Authority for Management and Regulation in Communications)

Romania gives effect to the EU Digital Services Act through Law No. 50/2024, which entered into force on 22 March 2024 and designates ANCOM as the national Digital Services Coordinator with full supervisory and enforcement powers over intermediary service providers. Beyond the DSA baseline, Romania has legislated or is actively proposing additional national measures: a 'Digital Age of Majority Law' approved by the Senate in October 2025 (pending final adoption by the Chamber of Deputies) that mandates age verification and parental consent for users under 16, and a separate draft law that would impose stricter obligations on VLOPs than the DSA requires, including a 15-minute illegal-content removal window.

Framework: Government Emergency Ordinance No. 155/2024 (GEO 155/2024), as approved and amended by Law No. 124/2025, transposing EU NIS2 Directive (2022/2555); supervised by the Directoratul Național de Securitate Cibernetică (DNSC)

Romania fully transposed the EU NIS2 Directive through GEO 155/2024 (in force 31 December 2024), formally approved by Parliament as Law 124/2025 (in force 10 July 2025). The DNSC is the competent national authority and issued implementing Orders 1 and 2 of 2025 (in force 20 August 2025) covering entity registration, incident notification procedures, and risk-level assessment methodology. The regime applies to a broad range of essential and important entities across critical sectors and carries penalties up to €10 million or 2% of global annual turnover.

Framework: Law 31/1990 on Companies (as amended), Law 239/2025 (in force 18 Dec 2025); registration authority: Oficiul Național al Registrului Comerțului (ONRC)

Romania permits 100% foreign ownership of companies with no nationality or residency restrictions on shareholders or directors. The most common vehicle is the SRL (societate cu răspundere limitată), which since 1 January 2026 requires a minimum share capital of RON 500 (~€100) under Law 239/2025. Registration is handled by ONRC and can be completed online, by email, or in person, typically within 5-10 working days.