The Argentine, 36, shot a seven-under-par 65 to finish 17 under and win his first European Tour title for 10 years.
Bland, 44, who shared the overnight lead with Spain's Sergio Garcia, carded a three-under 69 on Sunday to finish one shot adrift of Romero.
Masters champion Garcia and Belgium's Thomas Detry also finished on 16 under at the Golfclub Munchen Eichenried.
Romero's only other European Tour win was the Players Championship of Europe in 2007, the year he finished third at The Open.
Three strokes off the lead before the final round, he made seven birdies, including one at the 18th to win.
Four players were tied for the lead at one stage, but Detry was unable to match Romero on the final hole.
Bland, who has never won on the European Tour, carded five birdies but dropped a shot on the par-five sixth and another on the 17th.
He was playing in the final pairing of the day alongside Garcia, who was competing in Europe for the first time since he won the Masters in April.
Both needed to eagle the last hole to force a play-off, but Garcia narrowly failed to chip in with his third shot before Bland's 15-foot putt slid wide.

For years the Necurs botnet has distributed junk mail and malware for many different groups of cyber-thieves.
But the amount of malicious traffic emerging from Necurs has now dwindled to almost nothing.
It is not clear what has caused the slowdown and whether traffic will return to previously high levels.
One of the first signs of the disruption was seen earlier this month when email messages spreading the Dridex banking trojan and Locky ransomware caught by security firms dried up.
Typically, millions of messages bearing these malicious programs are sent out every week,  Proofpoint said in a blogpost.
However, the flood of messages "essentially stopped" last week, it said. Investigations revealed that these messages typically travelled via the Necurs botnet which was found to have gone largely offline.
The Necurs botnet is believed to be made up of about six million compromised Windows machines, many of which were enrolled when their owners inadvertently fell victim to a form of malware known as a rootkit.
Analysis of some of the machines known to be part of Necurs shows that its core administration systems have disappeared, said Proofpoint.
"Data from a variety of sources show that Necurs bots are actively looking for a new command and control (C&C) system, but we have no evidence that the Necurs botmaster has been able to retake control of the botnet."
A botnet's C&C system helps the network keep running and co-ordinates the distribution of any spam or malware being sent out via the global collection of computers.
Security researchers who monitor botnets and the groups that operate them said the cause of the shutdown remained a mystery.
"We cannot confirm how the botnet was brought down yet," Joonho Sa, a researcher for FireEye, told tech news site Motherboard.
World number 837 Andres Romero won the BMW International as England's Richard Bland tied for second in Munich.
[NEXT_CONCEPT]
One of the biggest networks of spam-sending computers in the world has gone quiet, puzzling experts, internet security firms have said.