The Bucharest Court of Appeal has recently decided to refer a preliminary question to the Court of Justice of the European Union concerning the implementation of Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (‘the NIS2 Directive’) in relation to the situation of a company with its registered office in Romania, but whose relevant IT infrastructure and decision-making and control center for cybersecurity matters are located in another EU Member State and managed by the parent company.

The question was admitted in response to a request made on behalf of its client by SCA Bondoc și Asociații in the context of an administrative dispute seeking the annulment of a decision by the national authority responsible for implementing the NIS2 Directive, which designated the Romanian company as an ‘essential entity’ strictly based on the criterion of its registered office, despite the absence of any relevant local IT infrastructure.

In particular, the question concerns the compatibility of national regulations requiring companies which are part of a group of companies to adopt extensive and costly cybersecurity measures arising from the designation of the company as an ”essential entity” by the competent national authority, in light of the principles of proportionality and cooperation between Member States enshrined in the NIS2 Directive.

“This case will serve as a key test regarding the proper implementation of the NIS2 Directive and the boundaries within which cybersecurity measures should be applied, which should not exceed what is proportionate and necessary to achieve the stated aim of increasing cyber resilience,” stated Dinu Nicolae Viorel and Monica Iancu, Partners at SCA Bondoc & Asociații.

The team managing this project also includes Alexandru Daniliuc, Managing Associate and Alina Alexandrescu, Associate, both lawyers within the IT&C/TMT practice group.