Moldova opens EU negotiating Cluster 3: what it means for companies' cybersecurity

On 13 October 2026, in Luxembourg, the Republic of Moldova and the European Union formally open negotiations on two more clusters: Cluster 2 – "Internal market" and Cluster 3 – "Competitiveness and inclusive growth". The step became possible after all 27 member states gave their approval, including Hungary, which had previously blocked it. The same clusters are being opened for Ukraine.

This brings Moldova to four of the six negotiating clusters opened: Cluster 1 – "Fundamentals" (15 June 2026), Cluster 6 – "External relations" (14 July 2026) and now Clusters 2 and 3. The stated goal of the authorities in Chișinău is to open all clusters by the end of 2026.

What Cluster 3 is

Accession negotiations cover 33 chapters, grouped into six thematic clusters. Cluster 3 brings together eight chapters related to modernising the economy:

• Chapter 10 – Digital transformation and media
• Chapter 16 – Taxation
• Chapter 17 – Economic and monetary policy
• Chapter 19 – Social policy and employment
• Chapter 20 – Enterprise and industrial policy
• Chapter 25 – Science and research
• Chapter 26 – Education and culture
• Chapter 29 – Customs union

For cybersecurity, the key chapter is Chapter 10. Here Moldova must align its legislation and practice with the EU's digital rules, above all the NIS2 Directive (EU 2022/2555) on a high common level of cybersecurity. Cybercrime falls under Cluster 1 (Chapter 24 – Justice, freedom and security), while cyber diplomacy and cyber defence fall under Cluster 6.

Moldova is not starting from scratch

In cybersecurity, the Republic of Moldova already has a legal framework built on the European model:

• Law No. 48/2023 on cybersecurity – the framework law, drafted with EU support and based on the European NIS rules.
• The Cybersecurity Agency – established by Government Decision No. 1028/2023, the authority that supervises how the law is applied.
• Government Decision No. 860/2024 – how service providers in critical sectors are identified.
• Government Decision No. 562/2025 – the concrete cybersecurity obligations of these providers, aligned with the technical requirements of NIS2.
• The package of decisions of 29 December 2025: the National Cybersecurity Programme 2026–2030 (No. 821), the State Register of Cyber Incidents (No. 822), the National Cyber Incident and Crisis Response Plan (No. 823), coordinated vulnerability disclosure (No. 824) and state supervision and control of compliance (No. 825).
• Access to the EU Cybersecurity Reserve – in May 2025, the agreement on Moldova's participation in the Digital Europe Programme was amended to give it access to EU incident response teams.

In other words, the laws are largely written. Now comes the harder part: Moldova has to show that the rules are actually applied – that providers are identified, incidents are reported, inspections take place and institutions work.

What this means for companies

Opening Cluster 3 does not create new obligations overnight. But it sends a clear signal: cybersecurity requirements will be enforced more and more strictly, and the benchmark will be the European standard. In practice:

1. Check whether the law applies to you

The law targets service providers in critical sectors – for example energy, water, transport, telecommunications, banking, health and digital infrastructure (cloud, data centres, DNS). They are divided into essential and important providers, with different obligations and deadlines.

2. Watch the deadlines

According to the Government, the rules in Government Decision No. 562/2025 (approved on 3 September 2025) apply gradually: within 12 months for essential providers and 18 months for important ones. For essential providers the deadline has practically arrived, and important providers have a few months left. Check the exact date that applies to you.

3. Risk analysis is no longer optional

Providers must analyse the risks to their networks and information systems and approve reports and treatment plans. It is the foundation for every other measure – and the first thing an inspection will ask for.

4. Get ready for incident reporting

The European NIS2 model requires an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Moldova is building its State Register of Cyber Incidents. A company without a clear process – who detects, who decides, who reports – will not be able to meet such deadlines in the middle of an attack.

5. The supply chain concerns you even if the law does not apply to you directly

Companies in critical sectors must also manage the risks coming from their suppliers. In practice this means security questionnaires, contract clauses and audits for IT suppliers, software companies and service providers. Those who cannot demonstrate a minimum level of security risk losing contracts.

6. Working with EU clients? Prepare now

Companies selling digital products or services in the EU market already face European rules, whatever the accession timeline. EU clients covered by NIS2 check their suppliers, and the Cyber Resilience Act introduces obligations for products with digital elements: reporting of actively exploited vulnerabilities applies from 11 September 2026, and most requirements from 11 December 2027.

Conclusion

Opening Cluster 3 moves the cybersecurity conversation from writing laws to applying them. For companies, the question is no longer "if" but "how soon" they will have to show that they protect their systems, data and clients. Those who start now will do it at their own pace, not under the pressure of an inspection or an incident.

Cybrx can help with the applicability assessment, risk analysis, a gap analysis against Government Decision No. 562/2025 and your incident reporting process. Book a free consultation and we'll discuss your company's situation.