RomaniaOrdonanța de urgență nr. 141/2021, Updates and Security Updates for Digital Content and Digital Services
Ordonanța de urgență a Guvernului nr. 141/2021 privind anumite aspecte referitoare la contractele de furnizare de conținut digital și de… servicii digitale, art. 5, 7 și 21
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://legislatie.just.ro/Public/DetaliiDocumentAfis/250054In force.
A product security requirements rule binding private bodies.
- Obligation class
- Security, Disclosure
As of .
What it requires
- If you supply digital content or a digital service to a consumer in Romania, ensure that the consumer is informed that updates, including security updates, are provided and that they are actually provided, where they are needed to keep the content or service in conformity (Article 7(3)).NIST CSF 2.0PR.PS-02
- Supply those updates for the whole period in which the content or service must be supplied under the contract where the contract provides continuous supply over a set period (Article 7(3)(a)).NIST CSF 2.0PR.PS-02
- Supply those updates for the period the consumer can reasonably expect, given the type and purpose of the content or service and the circumstances and nature of the contract, where the contract provides a single act of supply or a series of individual acts of supply (Article 7(3)(b)).NIST CSF 2.0PR.PS-02
- Supply digital content and services with the functionality, compatibility, accessibility, continuity and security that are normal for content or services of the same type and that the consumer can reasonably expect (Article 7(1)(b)).NIST CSF 2.0PR.PS-06
- Tell the consumer that an update is available and what follows if it is not installed, and give installation instructions without deficiencies, to rely on the consumer's failure to install it (Article 7(4)).NIST CSF 2.0PR.PS-02
- Supply the most recent version of the content or service available when the contract is concluded, unless the parties agreed otherwise (Article 7(7)).NIST CSF 2.0PR.PS-02
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Criminal exposure note
The sanctions in Article 21 are contraventions punished by administrative fine; the ordinance creates no criminal offence.
Penalty structure
Fine for the contravention in Article 21(1)(c), which covers Article 5 (the duty to meet the requirements of Articles 6 to 8); Article 21(1)(a) and (b) set lower ranges for other provisions, and Article 21(2) sets 5,000 lei to 25,000 lei where the breach seriously and repeatedly harms consumers' economic interests.
- Rule
- Fixed only
- As of
- Minimum
- 10,000
- Currency
- RON
- Fixed cap
- 50,000
Who enforces it
Enforcement body
Autoritatea Națională pentru Protecția Consumatorilor (National Authority for Consumer Protection), whose authorized representatives find the contraventions and apply the sanctions (Article 21(3)).
Settledness
- As of
What this law does
Government Emergency Ordinance 141/2021, published in Monitorul Oficial issue 1248 of , sets the rules for contracts between a trader and a consumer for the supply of digital content or digital services and transposes Directive (EU) 2019/770. Article 25(1) brings the ordinance into force ten days after its publication in the Monitorul Oficial of Romania, Part I. That clause counts the ten days from publication and names no calendar day.
Article 7(3) requires the trader to ensure that the consumer is informed that updates, including security updates, are being supplied and that they are actually supplied, where they are needed to keep the digital content or digital service in conformity. Where the contract provides continuous supply over a set period, Article 7(3)(a) runs that duty for the period in which the digital content or service must be supplied under the contract.
Where the contract provides a single act of supply or a series of individual acts of supply, Article 7(3)(b) runs it for the period the consumer can reasonably expect, given the type and purpose of the content or service and the circumstances and nature of the contract.
Article 7(4) relieves the trader of liability for a non-conformity caused only by the lack of an update that the consumer did not install within a reasonable time, if the trader informed the consumer of the update and the consequences of not installing it and the failure was not caused by deficient installation instructions.
Article 7(1)(b) requires digital content and services to have the functionality, compatibility, accessibility, continuity and security that are normal for content or services of the same type and that the consumer can reasonably expect. Article 7(7) requires the content or service to be supplied in the most recent version available when the contract is concluded, unless the parties agreed otherwise.
Article 5 requires the trader to supply digital content or a digital service that meets the requirements of Articles 6 to 8. Article 21(1)(c) punishes non-compliance with Article 5, among other provisions, by a fine of 10,000 lei to 50,000 lei. Under Article 21(3), the authorized representatives of the National Authority for Consumer Protection (Autoritatea Națională pentru Protecția Consumatorilor) find the contraventions and apply the sanctions.
When LexLint raises it
When your app profile says your app distributes a software product or ships a mobile app.