Law 354/2022 on Russia-linked antivirus software (Romania)

Summary

The law prohibits central and local public authorities and institutions from buying, installing and using antivirus-type software products and services that come directly or indirectly from the Russian Federation or from economic operators controlled by Russian persons: device and endpoint security products, antivirus detection, antimalware, web application firewalls and firewall as a service, virtual private networks (VPNs) and endpoint detection and response (EDR) systems. An operator counts as Russian-controlled when, among other things, Russian persons hold at least 25% of the voting rights or a majority of the votes, can appoint most members of its management bodies, or finance it. The named list of banned products and suppliers, set by order of the Ministry of Research, Innovation and Digitalisation, includes Kaspersky, Dr.Web, Positive Technologies, Infotecs (ViPNet) and RusBITech (Astra), among others. The products must be disconnected or uninstalled within 60 days of the entry into force of the ministerial order on the procedure, and breaches by public bodies carry fines of 50,000 to 200,000 lei. The ban applies until 31 December 2026.

Information

Jurisdiction

Romania

Issuing body

Parlamentul României (Parliament of Romania)

Type

Law

Available languages

Romanian

Topics

• Digital public administration
• Supply chain

Notes

The law was published in Monitorul Oficial No 1200 of 14 December 2022, and the Ministry of Justice's legislation portal shows no amendments. It is implemented by two orders of 21 February 2023 of the Minister of Research, Innovation and Digitalisation, Sebastian-Ioan Burduja. Order No 20.279/2023 (Monitorul Oficial No 174 of 1 March 2023, https://legislatie.just.ro/Public/DetaliiDocument/265399) approves the criteria and the named list, which the law requires to be updated every six months or whenever needed; the list has 11 entries: XSIGNAL (Wilmington, United States), Metascan (Moscow), Dr.Web (whole range), Kaspersky (Anti-Virus, Internet Security, Total Security, Security Cloud, VPN Secure Connection, Password Manager, Safe Kids and others), RusBITech (Astra), Infotecs (ViPNet range), Era Technopolis, Pasit, Neobit, Advanced System Technology and Positive Technologies. Order No 20.281/2023 (Monitorul Oficial No 167 of 27 February 2023, https://legislatie.just.ro/Public/DetaliiDocument/265364) sets the procedure, methods and tools for stopping the use of the products: public bodies had to fill in a questionnaire within 30 days, and the law also requires them to start procuring replacement products within 30 days of this order's entry into force. Bill L572/2026, which moves the end of the ban to 31 December 2035, was adopted by the Senate on 26 October 2026 under the urgent procedure (104 votes in favour, 1 against) and has been sent to the Chamber of Deputies (https://www.senat.ro/legis/lista.aspx?nr_cls=L572&an_cls=2026).

Parlamentul României (Parliament of Romania). (2022). Lege nr. 354 din 13 decembrie 2022 privind protecția sistemelor informatice ale autorităților și instituțiilor publice în contextul invaziei declanșate de Federația Rusă împotriva Ucrainei (Legea nr. 354/2022 (Monitorul Oficial nr. 1200 din 14.12.2022)). https://legislatie.just.ro/Public/DetaliiDocument/262466

Parlamentul României (Parliament of Romania). "Lege nr. 354 din 13 decembrie 2022 privind protecția sistemelor informatice ale autorităților și instituțiilor publice în contextul invaziei declanșate de Federația Rusă împotriva Ucrainei." 13 December 2022. https://legislatie.just.ro/Public/DetaliiDocument/262466.

@misc{ro_legea_354_2022_antivirus_rusia,
  author       = {{Parlamentul României (Parliament of Romania)}},
  title        = {{Lege nr. 354 din 13 decembrie 2022 privind protecția sistemelor informatice ale autorităților și instituțiilor publice în contextul invaziei declanșate de Federația Rusă împotriva Ucrainei}},
  year         = {2022},
  note         = {Legea nr. 354/2022 (Monitorul Oficial nr. 1200 din 14.12.2022)},
  url          = {https://legislatie.just.ro/Public/DetaliiDocument/262466},
  urldate      = {2026-11-02}
}