In brief
- The Government re-approved, on 27 August, the substantiation note of a PNRR project that has to be finished on 31 August. Four days.
- Of the 144.5 million lei the project is worth, 58.6 million were still to be spent when the note was re-approved, and three days earlier the budget had been increased by a further 36.3 million.
- The project is the Early Warning System of the Ministry of Internal Affairs, which protects the infrastructure behind the electronic identity card and the ministry’s 11 online public services.
Published: Official Gazette of Romania (Monitorul Oficial) no. 716 of 27 August 2026
In force from: 27 August 2026
A European project worth 144.5 million lei receives the approval of its substantiation note four days before the date on which it is due to be ready. Government Decision no. 663/2026, published in Official Gazette of Romania no. 716 of 27 August 2026, re-approves the substantiation note for the investment project „Sistem de alertă timpurie (SAT)” (Early Warning System), financed under the National Recovery and Resilience Plan. It is the second act of the same day to touch the security of the State’s digital infrastructure, after the catalogue of 218 cybersecurity controls.
The project belongs to the Ministry of Internal Affairs, and the beneficiary is the General Directorate for Internal Protection. It is part of component 7 of the PNRR, Digital transformation, investment 8, Electronic identity card and digital signature, milestone 174.
The substantiation note was first approved in April 2025, by Government Decision no. 361/2025. The present re-approval comes because the project has changed seven times since then: two notifications, in 2024 and 2025, four addenda and one further notification, the last addendum being signed on 24 August 2026, three days before the decision was published.
On 28 August Parliament set out by law how the PNRR is closed and who pays for the unfinished projects.
What it changes in practice
The first effect is strictly financial. The updated total value of the project rises to 144,509,562 lei, and in the table of indicators the sum appears rounded to 144,510 thousand lei, with the whole schedule placed in the second year. The last addendum added 36,300,000 lei including VAT, money intended solely for component 1.
The second effect is what that money buys. The increase introduces no new activities; it enlarges the processing infrastructure of component 1: computing and storage resources for large volumes of data, virtualisation and containerisation platforms, analytical databases, software components for semantic analysis and correlation, secure communications infrastructure, plus licences and installation and integration services, with five years of support. The reason given is the advance of artificial intelligence, with the observation that more than 65% of the new content generated in cyberspace is produced automatically.
The third effect is operational. The project has three components: automating the collection, validation and integrated assessment of multi-source data; extending the ministry’s cybersecurity system, interoperable with CERT-INT; and a back-up and disaster recovery solution. Each is quantified in the table as a single complete unit.
The fourth effect concerns the citizen directly. The system protects the infrastructure that issues the electronic identity card and the ministry’s 11 electronic public services. The note estimates that at least 10,000 citizens a year will benefit from an electronic card and from online public services with a high degree of availability.
The fifth effect is liability. Article 3 provides that the Ministry of Internal Affairs, through the General Directorate for Internal Protection, is responsible for the way the amounts set out in the annex are used.
What has changed compared with the previous situation
Three things have changed since the note approved in April 2025. The budget has grown twice: once by 1,788,576 lei, in October 2025, solely as a result of the change in the VAT rate made by Law no. 141/2025, and a second time by 36,300,000 lei, in August 2026, for the purchase of processing infrastructure.
The implementation deadline has moved twice. An addendum from June 2026 pushed it from 30 June 2026 to 25 August 2026, and another one, from the summer, as far as 31 August 2026 inclusive. The table of indicators keeps the total execution period at 24 months and 2 days, with the express mention „dar nu mai târziu de 31 august 2026” (but no later than 31 August 2026).
The third thing that has changed is the reasoning. The 2025 note spoke about the security of the electronic identity card. The present note adds a whole chapter on artificial intelligence as an attack vector: networks of inauthentic accounts created automatically, digital content altered in order to discredit public institutions, social engineering used to obtain credentials. This is the argument on which the budget increase rests.
Advantages and disadvantages
What it improves
- The increase is tied to specified categories of goods and services, it is not a general budget reserve, and the note says so expressly.
- No new activities, results or indicators are introduced, so the project is not being rewritten in its final month, only resized.
- The back-up and disaster recovery component protects the continuity of the electronic public services, not just the data.
- Interoperability with CERT-INT links the ministry’s system to the national incident response, instead of creating yet another island.
- Responsibility for the use of the amounts is placed on a named structure, not left at ministry level.
- The technical argument is properly set out, with a concrete description of what is being bought, which makes the spending verifiable later on.
What remains a problem
- The re-approval comes four days before the project’s final deadline, which leaves very little room for spending 58.6 million lei.
- The 36.3 million increase was signed on 24 August, for purchases that have to be made by 31 August.
- The implementation deadline has been extended twice in two years, a sign that the initial planning did not hold.
- The note does not say what happens if the deadline is missed, even though this is a PNRR milestone financed with non-repayable money.
- The estimate of „minimum 10.000 de cetățeni” (at least 10,000 citizens) a year is small against 144.5 million lei and comes with no explanation of the method.
- The identification of the addendum that extended the deadline contradicts itself within the text of the note. Details below.
Practical advice
- If you follow PNRR implementation, remember the figure that matters: 58,616,959.71 lei still to be spent at the date of the re-approval, out of a project worth 144,509,562 lei.
- For later comparisons, the reference point is milestone 174 of component 7, investment 8. That is where it will become visible whether the 31 August deadline was met.
- If you work in public procurement, look at the structure of the increase: it is an integrated package of hardware, software and integration services, with five years of support, not separate pieces of equipment.
- A citizen who uses the electronic identity card need do nothing: the system sits on the infrastructure side, not on the user side.
- For anyone comparing acts, the initial substantiation note is in Government Decision no. 361/2025, published in Official Gazette of Romania no. 328 of 11 April 2025. Comparing the two shows how the argument moved from the security of the document to the threats generated by artificial intelligence.
- The date of the financing contract, 29 August 2024, is useful as a zero point: the 24 months and 2 days in the table of indicators are counted from it.
Frequently asked questions
What is the Early Warning System?
How much does it cost?
Where does the money come from?
Why was a re-approval needed?
When does the project have to be finished?
What was bought with the 36.3 million increase?
Who is directly affected?
Who answers for the money?
Errors and inconsistencies in the published text
- The annex, the paragraph on the amendments to the financing contract. The same document is given two different dates a few lines apart. The list of the acts that amended the contract reads „Actul adițional nr. 3 din 18.08.2026” (Addendum no. 3 of 18 August 2026), while the detailed explanation that follows in the same paragraph reads „Actul adițional nr. 3 din 29.07.2026: modificarea perioadei de implementare a proiectului de investiții, până la data de 31.08.2026 inclusiv” (Addendum no. 3 of 29 July 2026: amendment of the implementation period of the investment project, until 31 August 2026 inclusive). The date of 29 July 2026 belongs, however, to another document, „Notificarea nr. 3 din 29.07.2026” (Notification no. 3 of 29 July 2026), which appears separately in the same list. The consequence is not a formal one: the addendum in question is precisely the one that moved the completion deadline of the project to 31 August 2026, and from the published text it is impossible to establish either which document produced the extension or from what date it runs. The two readings lead to two different chronologies of the same 144.5 million lei project, in a note whose very function is to justify the spending through the history of the amendments.
Editorial analysis
The act is well documented on the technical side, and that deserves to be said before anything else. The substantiation note does not hide behind generalities: it lists what is being bought, down to the categories of licences, states expressly that the sum is not a general budget reserve, and specifies that no new activities, results or indicators are being introduced. An auditor can check a year from now whether the money went where the text says. The argument about artificial intelligence as an attack vector is also properly set out, not decorative.
The problem is the calendar, and it leaps out of the act’s own figures. On 27 August the Government re-approves the substantiation note of a project that has to be finished on 31 August. Three days earlier, on 24 August, the budget had been increased by 36.3 million lei for hardware and software purchases which, in order to be eligible, have to be contracted, delivered, installed, configured, integrated, tested and put into service in the time left. Of the 144.5 million, 58.6 were still unspent. The note states that the indicators undertaken will be met within the implementation period, but does not explain by what mechanism, and the document’s own arithmetic does not support it.
The second weakness is that the act says nothing about what happens if the deadline is missed. Since this is a PNRR milestone, the risk is not theoretical: the non-repayable money depends on the milestone being met on time, and a substantiation note that justifies an increase four days before the due date ought to deal with that scenario explicitly. Its silence moves the whole discussion about risk outside the document that should have carried it.
What should be changed
- Correcting the date of addendum no. 3. It is a one-line rectification, but without it the chronology of the project cannot be reconstructed from the act, and the note loses its function as a verifiable justification.
- A spending schedule for the remaining sum. The 58.6 million lei unspent at the date of the re-approval should have come with a breakdown by day or by purchase, otherwise the statement that the indicators will be met remains a claim with no backing in the document.
- Explicit treatment of the risk that the milestone is missed. The note ought to say what happens to the non-repayable financing if the 31 August deadline is not met, and who bears the difference.
- Substantiating the figure of 10,000 beneficiaries a year. In a project worth 144.5 million lei, the main impact indicator ought to come with the method of calculation, not just with the value.
- Publishing a comparison between the initial note and the re-approved one. The reader would see at a glance what has changed in two years, instead of reconstructing it alone from the list of notifications and addenda.
Original text of the legal act
The text below is reproduced in Romanian, the official form of publication.
The full text, as published in the Official Gazette of Romania
Official Gazette of Romania no. 716 of 27 August 2026 16 pages PDF, 115 KB the act starts on page 9
Open the official PDFDownload the PDF
The viewer is not shown on small screens. Use the buttons above to open or download the file.
This article is for informational purposes only and does not constitute legal advice. For specific situations, consult a licensed attorney or tax advisor.