In brief

  • The Government has replaced in full the list of institutions responsible for the country’s critical infrastructures. These are the networks and installations without which daily life stops: electricity, gas, water, food, hospitals, transport, communications, banks. The table has 12 sectors and 21 institutions, and against each sector it says who is responsible. Those directly concerned are the public and private operators in these sectors, because the institution listed against their sector is the one that can call them into the procedure by which a network or an installation is declared a critical infrastructure.
  • The second tier, that of European critical infrastructures, disappears. The concept left Romanian law on 2 December 2024, with Law no. 294/2024 on the resilience of critical entities. The annex to the decision kept a separate list for that tier for another 653 days, and for just as long the title went on speaking about „national and European” infrastructures. Both are cleaned up from 16 September 2026.
  • Inside the table, almost nothing moves. At 11 of the 12 positions only the names of the ministries change, following the government reorganisation of December 2024. The single substantive addition is at position 10, „space and research”, which the Ministry of Economy, Digitalisation, Entrepreneurship and Tourism joins. That ministry thus appears in 4 of the 12 sectors, more than any other institution on the list.
Act: Government Decision no. 724 of 11 September 2026 amending Government Decision no. 35/2019 designating the public authorities responsible in the field of the protection of national and European critical infrastructures
Published: Official Gazette of Romania (Monitorul Oficial) no. 788 of 16 September 2026
In force from: 16 September 2026, the date of publication

From 16 September 2026, the table stating which State institution is responsible for protecting each of the country’s vital networks looks different. The Government has replaced in full the annex to Government Decision no. 35/2019, the act that divides between ministries and services the responsibility for the 12 sectors considered critical, from energy and water through to transport, health and the financial system. The stakes are not theoretical: in August and September 2026, to keep the Cernavodă nuclear power plant from running out of cooling water, the State changed the technical solution in the bed of the Danube twice, and the institution carrying responsibility for the energy sector is precisely the one entered at the first position on this list.

The decision has a single article with two points. The first rewrites the title of the 2019 decision, removing the words „and European” from it. The second replaces the annex with a new one. The document was adopted at the Government meeting of 11 September 2026 and bears the signature of Prime Minister Ilie-Gavril Bolojan, countersigned by the Minister of Internal Affairs, through a State Secretary, by the Minister of Economy, Digitalisation, Entrepreneurship and Tourism and by the Minister of Education and Research.

The phrase „responsible public authority” has a precise meaning, given by Article 3(e) of Government Emergency Ordinance no. 98/2010. It is the public institution responsible for the activities in the fields corresponding to a critical infrastructure sector. What it does in practice: it identifies the networks and installations that could fall into the category, under Article 9 of the ordinance, then proposes to the Ministry of Internal Affairs, through the National Centre for the Coordination of Critical Infrastructure Protection, that they be designated. Designation is approved by Government decision, and the owner or the operator is notified within 10 days of the designating act entering into force.

For a company or a State-owned utility in these sectors, the list is not a formality. Article 9(6) of the same ordinance requires legal persons governed by public or private law that supply essential services of national interest to take part, at the request of the responsible authority or of the Ministry of Internal Affairs, in the identification and designation process. Who knocks at the door is written in the table replaced now.

What it changes in practice

The new list keeps the 12 sectors and their order. The energy sector stays with the General Secretariat of the Government and the Ministry of Energy. Information technology and communications goes to the Ministry of Economy, Digitalisation, Entrepreneurship and Tourism, together with the Special Telecommunications Service, the Foreign Intelligence Service and the Romanian Intelligence Service. Water, forests and the environment stay with the Ministry of Health and the Ministry of Environment, Waters and Forests. Food and agriculture go to the Ministry of Agriculture and Rural Development, to the National Sanitary Veterinary and Food Safety Authority and to the Ministry of Health. Health stays with the Ministry of Health and the Ministry of National Defence.

Further down, national security gathers nine institutions at the same position, administration stays with the Ministry of Development, Public Works and Administration, transport with the Ministry of Transport and Infrastructure, industry with the Ministry of Economy, Digitalisation, Entrepreneurship and Tourism together with the Ministry of Energy, space and research with the Romanian Space Agency, the Ministry of Education and Research and the same ministry of economy, the financial and banking sector with the Ministry of Finance and the National Bank of Romania, and culture with the Ministry of Culture.

The practical effect for an operator is the change of addressee. An electronic communications company, a data centre or a supplier of electronic public services had on the list, until 16 September 2026, the Ministry of Research, Innovation and Digitalisation, a ministry that has not existed under that name since December 2024. From now on, the counterpart written in the annex is the ministry of economy and digitalisation. In the same way, an entity in the space sector now has three institutions against its sector rather than two, because the ministry of economy has been added alongside the Romanian Space Agency and the ministry of education.

On the European tier, the decision does no more than confirm a state of affairs that is older. Law no. 294/2024, published in Official Gazette of Romania no. 1189 of 29 November 2024 and in force since 2 December 2024, repealed the definition of European critical infrastructure in Article 3(b) of Government Emergency Ordinance no. 98/2010 and removed from it the chapters concerning the European procedure. It also repealed Articles 1 to 3 and the annexes of Government Decision no. 683/2016, the act that had actually designated Romania’s European critical infrastructures. And Article 25(2) of the law provides that references to the notion of European critical infrastructure in normative acts in force are to be read as references to national critical infrastructure.

The decision creates no new obligation, lays down no deadline and no penalty. It does not ask any institution to redo the designations made so far and does not change the status of infrastructures already designated as nationally critical. No budget expenditure arises, because no structure is set up and none is wound down.

What has changed compared with the previous situation

The version in force until 16 September 2026 was the one given by Government Decision no. 656 of 16 June 2021, published in Official Gazette of Romania no. 620 of 24 June 2021, the only amendment the 2019 act underwent in seven and a half years. The comparison is therefore with that version, not with the text published on 1 February 2019.

Position by position, the changes are few. At position 2, information technology and communications, the Ministry of Research, Innovation and Digitalisation is replaced by the Ministry of Economy, Digitalisation, Entrepreneurship and Tourism. At positions 6 and 9, national security and industry, the Ministry of Economy, Entrepreneurship and Tourism becomes the same ministry of economy and digitalisation. At position 10, space and research, the ministry of research goes out, the Ministry of Education becomes the Ministry of Education and Research, and the ministry of economy and digitalisation is added. Positions 1, 3, 4, 5, 7, 8, 11 and 12 stay unchanged, letter for letter.

The first three operations are mere renamings. They come from Government Emergency Ordinance no. 153/2024, published in Official Gazette of Romania no. 1319 of 24 December 2024, under which the fields of digitalisation, innovation and communications passed from the ministry of research to the ministry of economy, and the Ministry of Education became the Ministry of Education and Research. The fourth is a real addition: the ministry of economy enters the space sector because, under Government Decision no. 189/2025 on its organisation and functioning, it acquired powers in the field, from enrolling public institutions in the European satellite systems IRIS2 and GOVSATCOM through to managing the orbital slots allocated to Romania under international conventions.

The second change, larger than all the ones above, is the deletion of point 1.2 of the annex. That was where a separate list of two positions stood for European critical infrastructures: the energy sector, under the responsibility of the General Secretariat of the Government and the Ministry of Energy, and the transport sector, under the responsibility of the Ministry of Transport and Infrastructure. With it goes the note that tied the list to Directive 2008/114/EC, the directive repealed in 2022 by Directive (EU) 2022/2557 on the resilience of critical entities.

A single note remains, the one saying that each authority designates its critical infrastructures only in the corresponding subsector. Compared with the 2021 version, it gains one extra reference, to Annex no. 1 to Government Emergency Ordinance no. 98/2010. The reference was necessary, because the subsectors have not appeared in the annex to the decision since 2021, when their column was removed. Anyone wanting to see what falls into each sector now finds them only in the ordinance, at Annex no. 1 point 1.1.

Advantages and disadvantages

What it improves

  • One table remains, not two. Anyone looking for who is responsible for a sector reads one list, not a national one and a European one that partly overlapped and in which the same institutions appeared twice.
  • The names of the ministries finally match the ministries that exist. Until 16 September 2026, the annex named two ministries that had been abolished under those names back on 24 December 2024.
  • The space sector gets the ministry that actually holds the powers. Romania’s orbital slots and the enrolment of institutions in the European satellite systems are, under Government Decision no. 189/2025, the business of the ministry of economy and digitalisation, which until now did not appear against the sector.
  • No new obligation arises for anyone, no deadline and no penalty, so the act asks operators in the 12 sectors for no adjustment and no expenditure.
  • The substance is untouched. The same institutions are responsible for the same sectors, so infrastructure designations made so far do not have to be redone and no transitional period was needed.

What remains a problem

  • The correction comes 653 days after the notion of European critical infrastructure left the law and 631 days after the ministries changed their names. For almost 21 months, an official act of the State named two non-existent ministries as responsible.
  • The single article of the 2019 decision is left untouched and goes on designating authorities „in the field of the protection of national and European critical infrastructures”, even though the title, cleaned up now, and the annex, replaced now, speak only about the national ones.
  • The note requires each authority to work only in the corresponding subsector, but neither the annex to the decision, which has had no subsector column since 2021, nor the annex to the ordinance, which links subsectors to sectors, says which institution covers which subsector.
  • No sector has a lead institution. At national security, nine institutions are listed on the same line, at information technology four, and the text does not say who opens the procedure and who answers first.
  • The preamble invokes only Article 108 of the Constitution. The 2019 decision additionally invoked Article 62(1) of Government Emergency Ordinance no. 98/2010, the provision stating that the responsible authorities are established by Government decision on a proposal from the Ministry of Internal Affairs, through its coordination centre.

Practical advice

  1. If you run a network, an installation or a system in one of the 12 sectors, look for your sector in the table. The institution beside it is the one that can call you into the identification procedure, and taking part is not optional: Article 9(6) of Government Emergency Ordinance no. 98/2010 lays it down as an obligation.
  2. If your correspondence on this subject has been going to the Ministry of Research, Innovation and Digitalisation or to the Ministry of Economy, Entrepreneurship and Tourism, the addressee written in the annex is, from 16 September 2026, the Ministry of Economy, Digitalisation, Entrepreneurship and Tourism.
  3. The subsectors are no longer in the annex to the decision. You will find them at Annex no. 1 point 1.1 to the 2010 ordinance, where the energy sector has four subsectors, information technology six, national security five and the financial and banking sector five.
  4. Do not confuse the two regimes. National critical infrastructure is designated under the 2010 ordinance, by Government decision. A critical entity is identified under Law no. 294/2024, and the list of such entities is approved by decision of the Prime Minister. They are different procedures and different lists, even if they often concern the same companies.
  5. If you hold an infrastructure designated before December 2024 as European critical, check its status. Articles 1 to 3 and the annexes of Government Decision no. 683/2016, the act that had made those designations, were repealed with effect from 2 December 2024.
  6. Do not expect a notification from the State on the basis of this decision. The 10-day period in Article 10(8) of the ordinance concerns informing the owner when an infrastructure is designated, not a change in the name of the institution responsible for the sector.

Frequently asked questions

What does critical infrastructure mean, in plain terms?
It is an element, a system or a component situated on the territory of the country, essential for maintaining the vital functions of society, people’s health, safety and well-being, and whose disruption or destruction would have a significant impact at national level. In practice: power plants and electricity grids, gas pipelines, water treatment stations, large hospitals, transport hubs, communications networks, payment systems. The definition is in Article 3(a) of Government Emergency Ordinance no. 98/2010.
What exactly does the institution listed against my sector do?
It identifies the networks and installations in the sector that meet the criteria for critical infrastructure, sets by its own order the sectoral criteria and the thresholds above which an infrastructure becomes critical, and proposes to the Ministry of Internal Affairs, through the National Centre for the Coordination of Critical Infrastructure Protection, that they be designated. Designation is then made by Government decision.
Why do European critical infrastructures disappear?
Because the European tier has been replaced by a new regime. Directive (EU) 2022/2557 on the resilience of critical entities repealed Directive 2008/114/EC, on which the category rested, and Romania transposed it through Law no. 294/2024. Since 2 December 2024, the definition of European critical infrastructure no longer exists in Romanian law, and references to it in acts in force are read as references to national critical infrastructure.
Who is responsible for the energy sector now?
The General Secretariat of the Government and the Ministry of Energy, at position 1 of the annex. The same two institutions were responsible before 16 September 2026 as well, and they also figured on the European list deleted now. The Ministry of Energy appears a second time at position 9, industry, alongside the ministry of economy.
What has changed for a company in communications or in IT services?
Only the name of the institution it deals with. The information technology and communications sector was and remains the responsibility of four institutions, three of which are the Special Telecommunications Service, the Foreign Intelligence Service and the Romanian Intelligence Service. The fourth used to be the ministry of research and digitalisation, and is now the ministry of economy and digitalisation.
Where do I find the subsectors, if the annex no longer has them?
In Annex no. 1 point 1.1 to Government Emergency Ordinance no. 98/2010. There, each of the 12 sectors is divided into subsectors, for example electricity, oil, natural gas and mineral resources for the energy sector. That column existed in the annex to the decision until June 2021, when it was taken out.
Does the decision create any new obligation or deadline for me?
No. The act amends the title of a decision and replaces an annex containing the list of responsible institutions. It imposes no new obligation on operators, sets no deadline and provides for no penalty. The obligations remain those in the 2010 ordinance and in Law no. 294/2024.

Errors and inconsistencies in the published text

  • Annex, closing note. The note says that each responsible public authority designates its national critical infrastructures „exclusiv în subsectorul corespondent, potrivit art. 9 alin. (6) și anexei nr. 1”, exclusively in the corresponding subsector, in accordance with Article 9(6) and Annex no. 1, of Government Emergency Ordinance no. 98/2010. Article 9(6) of the ordinance, however, governs something else: the obligation of legal persons governed by public or private law that supply essential services to take part, at the request of the responsible authorities or of the Ministry of Internal Affairs, in the identification and designation process. The rule on competence that the note invokes is to be found neither there nor in Annex no. 1, which arranges subsectors by sector rather than by institution; the word „exclusiv”, exclusively, appears nowhere in the ordinance. The consequence shows at position 6, national security, where the annex lists nine institutions for five subsectors: the act makes it impossible to establish which institution covers which subsector, and therefore who can propose the designation of a given infrastructure.

Editorial analysis

The problem the decision solves is real and simple to describe: until 16 September 2026, a normative act in force named as responsible for the country’s vital networks two ministries that no longer existed under those names, and kept a separate list for a legal category that had been abolished. The tidying up was needed. What deserves a look is the clock. The notion of European critical infrastructure left Romanian law on 2 December 2024, and the ministries changed their names on 24 December 2024. That makes 653 days and 631 days respectively until publication. The European deadline for transposing the directive had expired even earlier, on 17 October 2024, 699 days before. When the file did finally start moving, it moved very fast: according to opinion no. 799 of the Legislative Council, the request was registered on 10 September 2026, the favourable opinion was given the next day, and the Government adopted the decision on that same 11 September. Six days from request to publication, after almost twenty-two months of waiting.

The observation you do not get from reading the act end to end concerns what was left out. The decision amends the title of the 2019 act and replaces its annex, but does not touch its only substantive provision. The single article of Government Decision no. 35/2019 goes on saying that public authorities responsible „in the field of the protection of national and European critical infrastructures” are designated, exactly the wording this act removes from the title and from the annex. The result, after 16 September 2026, is an act on three levels that no longer say the same thing: a title about national infrastructures, an article about national and European infrastructures and an annex covering only the national ones. In law the situation resolves itself, because Article 25(2) of Law no. 294/2024 provides that references to the European notion are read as references to the national one. But that is precisely the provision invoked as the basis for cleaning up the title, which makes the omission in the article hard to explain: the same reasoning applied identically to both wordings.

The second observation comes from the preamble. The 2019 decision had been adopted on the basis of Article 108 of the Constitution and of Article 62(1) of Government Emergency Ordinance no. 98/2010, that is, of the provision stating that the responsible public authorities are established by Government decision, on a proposal from the Ministry of Internal Affairs, through the National Centre for the Coordination of Critical Infrastructure Protection. The present decision, which changes the very list of those authorities, invokes only Article 108 of the Constitution. The Ministry of Internal Affairs countersigns, through a State Secretary, but nowhere in the text does the proposal the law requires become visible. It is a difference of legislative technique between two acts doing the same thing seven years apart, and the only thing lost is the trace of the procedure.

Finally, a figure that comes out of counting the table. The 12 sectors gather 32 mentions of institutions, that is, 21 distinct institutions, an average of 2.7 per sector. The Ministry of Economy, Digitalisation, Entrepreneurship and Tourism appears at four positions, information technology, national security, industry and space and research, more than any other institution on the list. The Ministry of Health follows with three. At the other end, the Ministry of Internal Affairs, the institution that coordinates the whole system through its specialised centre and to which all designations are proposed, appears exactly once, at national security. And three sectors, administration, transport and culture, have a single responsible institution, while national security has nine, without a line in the act saying which of them leads.

What should be changed

  • Amend the single article of Government Decision no. 35/2019 as well, not only the title and the annex. A third point, one line long, would remove the words „and European” from the enacting terms. Practical effect: the reader would no longer need to know Article 25(2) of Law no. 294/2024 in order to understand that the decision no longer designates anyone for a European tier that no longer exists.
  • Correct the reference in the note to the annex. The rule under which an authority works only in its own subsector is not to be found in Article 9(6) of the 2010 ordinance, which governs the obligation of operators to take part in identification. Practical effect: the limit of competence would become verifiable, and an institution refusing to deal with an infrastructure could point to the provision it relies on.
  • Say expressly whether exclusivity is to be read at sector or at subsector level. The simplest route would be to bring back the subsector column removed in 2021. Practical effect: at national security, where nine institutions sit on the same line, it would be known who can propose the designation of a border infrastructure and who that of a prison one.
  • Designate, for each sector with several institutions, one to lead. Practical effect: in an incident in the communications sector, where four institutions are listed, there would be a single entry point for the operator and a single institution answerable for the deadlines, rather than four in parallel.
  • Invoke in the preamble Article 62(1) of Government Emergency Ordinance no. 98/2010 and mention the proposal from the Ministry of Internal Affairs. Practical effect: the published text itself would show that the special procedure laid down by law was followed, not merely the Government’s general power to issue decisions.
  • Update the list together with the reorganisation that makes it necessary, not 21 months later. Emergency Ordinance no. 153/2024 required the reorganised ministries to propose within 30 days the acts governing their own organisation. Practical effect: there would no longer be long periods in which an act in force names as responsible institutions that no longer bear that name.

Original text of the legal act

The text below is reproduced in Romanian, the official form of publication.

The full text, as published in the Official Gazette of Romania

Official Gazette of Romania no. 788 of 16 September 2026 8 pages PDF, 82 KB the act starts on page 5

Open the official PDFDownload the PDF

The viewer is not shown on small screens. Use the buttons above to open or download the file.

This article is for informational purposes only and does not constitute legal advice. For specific situations, consult a licensed attorney or tax advisor.