Is there not wider EU regulation dealing with responsible disclosure? I know for a fact that in Romania you can do that, if and only if you follow certain steps

Is there not wider EU regulation dealing with responsible disclosure? I know for a fact that in Romania you can do that, if and only if you follow certain steps (definitely not public disclosure after 3 days, obviously), and I _think_ the source is EU regulation, not local law. IANAL etc.