Risk analysis or safety data sheet? Until May 2026, the answer for most businesses was risk analysis. Now, units are divided into two categories, with different documents and different costs. This article will help you determine which one you fall into.
If you manage a building, a hall, a hotel or a commercial space, it's worth five minutes. The wrong document costs money for nothing; the lack of the right document costs during inspection.
For the full legal text — the amended articles, deadlines, and new rules for evaluators — see the dedicated article: Government Emergency Ordinance 37/2026. Here we only deal with the distinction between the two documents.
If you want a risk analysis prepared by an evaluator registered with the RNERSF or just to find out what category you are in, see the service page risk analysis in physical security Constanta: the eligibility check is free.
The two regimes, in brief
Physical security risk analysis remains mandatory for the units whose methodological rules establish minimum security requirements — regarding security, burglar alarm systems and constructive-architectural characteristics. It is prepared exclusively by an evaluator registered in the National Register of Physical Security Risk Evaluators.
Safety data sheet is the document for other units. They implement measures according to their own needs, based on their own risk assessment, materialized in the sheet. It does not require an authorized assessor — but it does not exempt you from the obligation to think seriously about security either.
The practical difference: the first is a technical document made by a qualified third party, the second is a documented self-assessment. The confusion between the two is the most common reason why companies pay what they don't need or are left without what they need.
How do you find out which category you are in?
Here's the awkward part. I do the remote work methodological rules, which establish who has minimum security requirements. At the time of this article, they had not been published. Until they appear, existing regulations apply to the extent that they do not contradict the amended law — an area of interpretation where it is best not to improvise on your own.
What you can do concretely now:
- check whether your facility was already listed, under the previous regulation, among those with minimum security requirements — usually units that handle or store cash and valuables, commercial premises above certain thresholds, and public interest facilities;
- if you already have a valid risk analysis, keep it: contracts and analyses carried out before the change remain valid;
- If you don't have any documents, don't start by ordering an analysis — start by checking the framing.
What each document means in practice
If you enter the risk analysis: you hire an evaluator registered in the RNERSF, the document becomes the basis of the security plan and system design, and the review is done at short notice, triggered by events — the shortest is 30 days. Also pay attention to the incompatibility rule: the company that maintains your alarm system can no longer do the analysis for you, while the contract is ongoing. We have detailed the terms, conditions for the evaluator and the incompatibility in the article about GEO 37/2026.
If you enter the safety data sheet: do the assessment internally, document it and keep it updated. The format is to be established by order of the Minister of Internal Affairs. Until then, document coherently: what risks you have identified, what measures you have taken, who is responsible and when you review.
What remains valid from what you already have
- Previously performed analyses remain valid; ongoing contracts for the performance of risk analyses continue to have their effects.
- Existing licenses and certifications remain valid until expiration, with renewal to be made according to updated procedures.
- Measures already implemented It doesn't get dismantled. What changes is the document on which you justify them and the pace at which you update it.
Three things to do in the coming weeks
- Determine which category you fall into. — risk analysis or safety data sheet. Without this, any expense is a gamble.
- Check the age of the current document and whether something has happened in the meantime that triggers one of the review deadlines.
- Check if your appraiser can still work with you, in light of the incompatibility rule.
How can we help you?
GreenSoft is an IGPR licensed company and works in Constanta and Dobrogea on physical security systems. We check the scope of your site — if you need it physical security risk analysis or safety data sheet — without charging for this verification, and we tell you transparently, from the first discussion, in what capacity we can work with you without violating incompatibility rules.
If you are interested in what the document should actually contain, I have written separately about risk analysis structure, chapter by chapter.
Informative article, updated on September 11, 2026. The legislation is in a transitional period — the methodological norms and the order on the safety data sheet were not published at the time of writing. For your specific situation, request a verification of the classification.
