Romania Accessibility Laws: What Businesses Need to Know

What accessibility laws apply in Romania?

Two national laws set digital accessibility obligations in Romania.

OUG 112/2018, approved by Legea 90/2019

Covers websites and mobile applications belonging to public-sector bodies.

Legea 232/2022

Covers private businesses, transposing the EU's European Accessibility Act (Directive (EU) 2019/882) into Romanian law.

Why the distinction matters

The two laws point to different obligations, different enforcement bodies and different timelines.

A public university's website falls under OUG 112/2018. A private bank's mobile app falls under Legea 232/2022. A public university that also sells services commercially — paid executive-education courses through an e-commerce checkout, for instance — can answer to both laws at once, each covering a different part of its digital footprint.

One shared technical backbone

Both laws point to the EN 301 549 harmonized standard as the way to demonstrate conformance. EN 301 549 aligns closely with WCAG 2.1 AA for web content.

An organization that builds its websites and apps to WCAG 2.1 AA is already most of the way toward satisfying either law. The real differences lie in who the law applies to and what documentation it demands — not in the underlying technical bar.

How does Romania implement the European Accessibility Act?

Romania implements the EAA through Legea 232/2022, adopted on 19 July 2022 and published in the Official Gazette on 25 July 2022.

The law transposes Directive (EU) 2019/882 without adding requirements beyond what the directive itself sets out. That's not true of every EU member state — some have used national transposition to go further, for example by making built-environment accessibility mandatory rather than optional.

Transposition and entry into force are two different dates

The EU gave member states until 28 June 2022 to transpose the directive into national law. Romania met that step on schedule with Legea 232/2022's adoption.

What came next was a separate implementation period. The law only entered into force on 28 June 2025, giving businesses roughly three additional years to bring products and services into line before the obligations became enforceable.

That phased structure explains why a business could have heard about the EAA years ago and only felt its practical effect in 2025. Transposition created the legal text. Entry into force is what actually started requiring compliance. That date has now passed, so the obligations are active.

One transitional exception

Self-service terminals — ticket machines, check-in kiosks — that were already in service providing a given service before 28 June 2025 can keep operating for up to 20 years after they were put into use, rather than needing immediate replacement.

Who must comply with accessibility laws in Romania?

Compliance obligations fall on two distinct groups, matching the two laws.

Public-sector bodies

Central and local public authorities and institutions, along with bodies governed by public law as defined under Legea 98/2016.

Private businesses on the Romanian market

Any business placing covered products or providing covered services on the Romanian market — regardless of where the business itself is based.

Micro-enterprises providing services

A micro-enterprise is a business with fewer than 10 employees and annual turnover or balance sheet total not exceeding €2 million. Micro-enterprises providing services are fully exempt from the accessibility requirements. Nothing stops them from adopting the standard voluntarily, though.

Micro-enterprises working with products

The exemption applies only to services. Micro-enterprises working with products must still comply with the requirements. For them, only the documentation burden is lightened.

The role of EN 301 549

EN 301 549 isn't a mandatory test for anyone. Products and services that conform to the standard are presumed to meet the requirements. That makes building to the standard the most practical way to demonstrate compliance.

The market-based test

Legea 232/2022 applies based on the market a product or service reaches, not where the company is headquartered. A German e-commerce retailer selling to Romanian consumers is an example. If it isn't a micro-enterprise, that part of its business is subject to Romania's oversight and penalty regime. Having no physical presence doesn't change that.

Which digital products and services are covered?

Legea 232/2022 doesn't cover every digital product a business might sell. It targets a defined list carried over from the EAA's annex.

• Consumer hardware — computers and their operating systems, smartphones, e-readers, and consumer terminal equipment used for digital television.
• Self-service terminals — ATMs, ticketing machines and check-in machines, other than those built into vehicles, aircraft or vessels as integrated components.
• E-commerce — any online sales channel where a consumer buys a product or service directly.
• Banking services — consumer-facing banking, including the digital channels through which those services are delivered.
• E-books and the software needed to read them.
• Passenger transport services — specifically the digital information services around transport (real-time travel information, ticketing, check-in), rather than the physical vehicle itself.
• Electronic communications services — the digital services covered by Romania's electronic communications framework.
• Audiovisual media services — specifically the access features, like electronic program guides, tied to those services rather than broadcast content itself.

A business that doesn't sell any of these directly can still be pulled in through a supporting role. A software vendor building the e-commerce platform a retailer uses is providing a component of a covered service, even if the vendor never sells to the end consumer.

What are the requirements for websites and mobile applications?

For websites and apps, the practical requirement under both Romanian laws comes down to the same three things: build to WCAG 2.1 AA, document that conformance, and give users a way to report problems. What differs is which law demands which piece in writing.

WCAG 2.1 AA

WCAG 2.1 AA is the technical benchmark both laws point to, whether directly or through EN 301 549. It defines testable success criteria — sufficient color contrast, keyboard operability, text alternatives for non-text content, predictable navigation. They're organized so a team can check a specific page against a specific criterion, rather than debate what "accessible" means in the abstract.

For a public-sector site under OUG 112/2018, ADR's technical guidance names WCAG 2.1 AA directly as the target level. For a private business under Legea 232/2022, WCAG 2.1 AA is the practical route to satisfying EN 301 549's web-content requirements — even though the private-sector law is written in terms of functional accessibility outcomes rather than naming WCAG explicitly.

Accessibility standards

EN 301 549 is the harmonized European standard both laws lean on, and it covers more ground than WCAG alone. Where WCAG 2.1 AA addresses web content, EN 301 549 also sets requirements for hardware, non-web software and documentation. That matters for a business covered by Legea 232/2022 that sells a physical self-service terminal or a piece of consumer hardware, not just a website.

The standard functions as a presumption-of-conformity mechanism. A product or service built to EN 301 549 is presumed to meet the accessibility requirements in Romanian law. That's why it appears as the reference point in official guidance for both laws, instead of each law defining its own technical criteria from scratch.

Accessibility statements

An accessibility statement is a mandatory publication for public-sector bodies under OUG 112/2018. It has to state something specific: the current conformance level (for example, "partially conforms to WCAG 2.1 AA"), a description of any known accessibility problems, and a feedback mechanism so users can report barriers.

It's a compliance document, not a marketing page. Vague language claiming general commitment to accessibility doesn't satisfy the requirement.

Failing to publish a statement carries its own penalty, separate from — and typically smaller than — fines for the underlying accessibility failures. So an organization can be mid-remediation on genuine issues and still avoid the statement-specific fine, simply by publishing an honest statement describing where things stand.

Which industries are affected?

The industries affected map directly onto the products and services Legea 232/2022 lists, plus the entire public sector under OUG 112/2018.

• Banking and financial services — consumer banking platforms and the apps or websites through which customers manage accounts.
• E-commerce and retail — any business selling directly to consumers online.
• Transport — providers of passenger information, ticketing and check-in services, along with operators of covered self-service terminals.
• Telecommunications — providers of electronic communications services covered under Romania's communications framework.
• Broadcasting and media — audiovisual media service providers, specifically for the access features tied to their digital services.
• Publishing — e-book publishers and the reading software or platforms that deliver them.
• Consumer electronics and computing — manufacturers of computers, smartphones, e-readers and digital-television terminal equipment.
• Public administration and education — every public authority, institution and public-law body at central and local level, covered under OUG 112/2018 rather than Legea 232/2022.

An organization spanning more than one category — a telecom provider that also runs an e-commerce storefront for devices — carries obligations for each part of the business separately. A single compliance effort focused on one product line doesn't cover the whole company.

Which authorities enforce accessibility compliance?

Enforcement splits along the same public–private line as the laws themselves. Within the private sector it splits further by industry.

Public sector

The Ministry of Communications and Information Society is the designated regulatory and supervisory authority under OUG 112/2018. The Authority for the Digitalization of Romania (ADR) carries out the actual conformity monitoring against the technical requirements, and reports results to the European Commission every three years.

Private sector

No single authority owns enforcement across every sector. Market surveillance is distributed among the sectoral authorities already responsible for each covered industry — consumer protection oversight through the National Authority for Consumer Protection, electronic communications through ANCOM, and other sector-specific regulators handling banking, transport and audiovisual media within their existing remit.

Expect your existing sector regulator to be the one asking about EAA conformance, rather than a single dedicated accessibility agency.

Penalties under OUG 112/2018

Public-sector bodies face point-based fines, ranging from 1 to 10 points. Each point is set at 10% of Romania's minimum annual wage, so the fine scales with national wage levels rather than staying fixed as a flat number over time.

Failing to publish an accessibility statement carries its own penalty within that range, separate from fines tied to the underlying accessibility failures.

Penalties under Legea 232/2022

Private businesses face market-surveillance consequences beyond a fine alone. Authorities can require a non-conforming product or service to be withdrawn from the Romanian market.

In practice that can mean an app being pulled from availability, a website's access being restricted, or specific digital features being suspended until the underlying issue is fixed.

For a consumer-facing business, the market restriction is often the more consequential risk. A fine is a cost. Losing the ability to sell or operate in the Romanian market until remediation is complete is a business interruption.

How can organizations achieve EAA compliance in Romania?

Reaching compliance follows a sequence where each step depends on what the last one produced. These aren't three interchangeable tasks that can be done in any order or split across teams working in isolation.

Accessibility audit

An audit comes first because nothing else is possible without knowing where a product or service currently stands against EN 301 549 and WCAG 2.1 AA.

Its real output isn't a pass/fail verdict. It's a prioritized set of findings, separating issues that block a task entirely from ones that create friction or are purely cosmetic — which is what makes the next step possible to plan rather than guess at.

Accessibility testing

Testing is where those findings get produced. It combines automated scanning with manual checks using a keyboard alone and with actual assistive technology like a screen reader.

Automated tools catch a meaningful share of structural issues quickly — missing alt text, contrast failures. They can't evaluate whether a reading order makes sense, or whether a custom dropdown is genuinely operable without a mouse. Manual testing sits alongside the automated pass rather than replacing it.

Remediation

Remediation only makes sense once testing has identified specific, verified problems. Fixing before testing is complete usually means guessing at what's broken.

Issues that block a core task with no workaround get fixed first, ahead of a release. Friction issues with a workaround move into a scheduled sprint. Cosmetic issues can be batched for whenever that part of the product is next touched.

Once fixes ship, a follow-up test — not just the original audit — is what confirms the issue is actually resolved rather than assumed fixed.

What are the key compliance deadlines in Romania?

Public sector: already active

OUG 112/2018 has been in force since it was published in December 2018 and approved by Legea 90/2019. There is no future deadline still pending. The obligation is fully active, and ADR's monitoring and three-yearly reporting cycle to the European Commission is ongoing.

Private sector: the date has passed

Legea 232/2022 entered into force on 28 June 2025, after being adopted in July 2022 and given roughly three years to allow businesses to prepare. Covered businesses operating in Romania are expected to already be in compliance, rather than working toward a future deadline.

The one date still running

The remaining deadline is transitional, not a new obligation. Self-service terminals already in service before 28 June 2025 may continue operating for up to 20 years from when they were put into use. Some non-conforming terminals installed just before that date could legally remain in service into the mid-2040s.

Outside that narrow grandfather clause, there is no additional phase-in period left to plan around. The compliance clock for both Romanian accessibility laws has already started.