Romania lacks a complete regulatory framework to protect critical infrastructure vital for national security. The Foundation For The Citizens Defense Of The Citizens Against State Abuses (FACIAS) has taken the Romanian Government to court for failing to adopt the necessary rules to implement Law 294/2024 on the resilience of critical entities. The case is pending before the High Court of Cassation and Justice, and the decision will be delivered on Friday, November 14, 2025.
Critical entities are those essential infrastructures and services that ensure the safe and continuous functioning of the state and the economy: electricity and gas grids, transportation systems, financial institutions, hospitals, water services and communications. Disruptions to critical entities can have devastating effects on the population and the economy.
The rules of Law No. 294/2024 on the resilience of critical entities set out the mechanisms by which the state identifies, classifies and protects critical infrastructures, including how critical entities of particular European importance (ECIEDs) are appointed, coordination between institutions and continuity plans in crisis situations.
In July 2024, the Government adopted Law No. 294/2024 on the resilience of critical entities, by which Romania transposed EU Directive 2022/2557. The Law requires the Government to adopt a Government Decision establishing the implementing rules and procedures. The legal deadline for the adoption of this Government Decision expired in December 2024. With a delay of eight months, the Ministry of Internal Affairs published a draft government decision on the identification of the ECIED in August 2025, but the document was not approved and was not published in the Official Monitor. As a consequence, it has no legal effect and Law 294/2024 remains inapplicable.
In the absence of these rules, Romania is currently without a functioning system for the identification and protection of critical infrastructures. This affects the state's ability to react quickly and effectively in major crisis situations, whether we are talking about cyber attacks on banking systems, major power outages, water supply disruptions, medical or transportation system blockages.
Through the court action, FACIAS requested that the Romanian Government should be ordered to comply with the European and national legal framework so that the country's critical infrastructures benefit from a clear, coherent and operational protection mechanism. On Friday, November 14, 2025, the judges of the High Court of Cassation and Justice are due to decide whether the Executive will be obliged to adopt the necessary decision to implement Law No. 294/2024.
FACIAS points out that critical infrastructure protection is not just a legal obligation, but a matter of national security and the protection of citizens.