AI Act Compliance Landscape in Romania: obligations, risks, governance and key deadlines for companies

Are you using an AI model for recruitment, credit scoring, customer support, fraud prevention or the automation of internal workflows? The critical question is no longer whether AI delivers efficiency, but whether the way you use it complies with the EU AI Act.

In 2026, certain obligations already apply, and for other categories of systems the window for getting ready is closing fast. The real stake of AI Act compliance in Romania is operational: knowing what risk level your system falls under, what documentation must be in place, what internal governance must be implemented and what the key deadlines are for each category.

Regulation (EU) 2024/1689 of 13 June 2024 (the “AI Act”) sets out a risk-based framework for providers and users/deployers of AI. The full, legally authentic text is available on EUR-Lex, and the European Commission has confirmed the architecture and the timeline on its official platform on the AI Act.

The 4 risk levels and what they mean in practice for a company in Romania

The AI Act uses a classification by risk level. According to the European Commission's explanations, there are four categories - the official examples are set out on the dedicated AI Act page and in the AI Act Service Desk FAQ:

1. Unacceptable risk / prohibited practices. Certain forms of harmful manipulation, exploitation of vulnerabilities, social scoring, certain uses of biometric recognition, emotion recognition in the workplace and in education, and untargeted scraping for facial recognition databases. The prohibitions have applied since 2 February 2025.
2. High risk. Biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice and democratic processes. For private companies in Romania, the areas that are frequently sensitive are recruitment, credit scoring, employee assessment and certain AI components embedded in regulated products.
3. Transparency risk. Chatbots, the generation or manipulation of content, deepfakes and other systems that require the person to be informed that they are interacting with AI or that a piece of content has been artificially generated.
4. Minimal or no risk. For example, certain spam filters or AI tools with limited impact on fundamental rights.

The typical mistake is to start from the provider: “if the vendor says it is compliant, we are covered”. That is not enough. The AI Act allocates obligations between provider and deployer, and the professional user may have obligations of its own regarding oversight, training, log-keeping, impact assessment and use in accordance with the instructions - a nuance also addressed in BSA's analyses of the obligations of the HR operator under the high-risk systems regime and the right to an explanation in automated financial decisions.

Article 3 defines the provider as the entity that develops an AI system or places it on the market under its own name/trade mark, and the deployer as the entity that uses an AI system under its own authority, otherwise than in a personal non-professional context. Most Romanian companies that “merely use” an externally procured AI tool are, as a matter of law, deployeri - with obligations of their own under Article 26 (use in accordance with the instructions, human oversight by competent staff, monitoring of operation and retention of the automatically generated logs for at least six months unless the law provides otherwise).

Compared with competitors such as Țuca Zbârcea & Asociații, Mușat & Asociații, NNDKP, BMA Legal and Pavel, Mărgărit & Associates, Buju, Stanciu & Asociații stands out through a hands-on approach at the intersection of AI, GDPR, technology and how businesses actually use these systems.

Documentation and governance: what must be in place if you use an AI system

The right question is not only “what risk does the system carry?”, but also “what documentary trail can we produce tomorrow, in an audit?”. For high-risk systems, the Commission points to obligations such as: risk management, data governance, logging and traceability, technical documentation, clear information for the deployer, human oversight, accuracy, robustness and cybersecurity, plus conformity assessment - summarised in the official guidance on high-risk AI systems. For a company in Romania, we recommend at least the following elements:

• An internal register of AI systems - an inventory of all systems, setting out purpose, provider, inputs, outputs, internal users and potential impact;
• Classification by risk and by role - each system classified under the AI Act and labelled as provider, deployer, importer or distributor;
• An AI use policy and internal approval process - who may procure, test and implement; what legal, DPO, security and business sign-offs are required;
• A vendor due diligence pack - instructions for use, transparency as to data, known limitations, performance, human oversight, logging and contractual remedies;
• A combined GDPR + AI Act assessment workflow - the BSA analysis of the overlap between the AI Act and the GDPR shows that a DPIA and the AI Act obligations do not map onto each other perfectly;
• A human oversight protocol - the persons able to understand, verify, disregard or reverse the system's output;
• An AI literacy and training programme - the AI Act imposes AI literacy obligations (Article 4).

Romanian resources on the AI Act: authorities and what to keep an eye on

A common misconception is that, in the absence of a dedicated “national AI agency”, the regulation “does not yet apply” locally. That is not the case: the AI Act is an EU regulation with direct effect. That said, the designation of competent authorities determines whom companies should approach for clarifications, complaints and inspections. On 12 March 2026, the Romanian Government adopted a memorandum on the designation of the national competent authorities and of the single national point of contact, some seven months after the European deadline (2 August 2025). The proposed structure:

↔ On small screens, tables can be scrolled sideways.

A word of caution: at the time of writing, this architecture has the status of a government memorandum, not of a definitive normative act in every respect. Check the legislative status periodically directly on the ANCOM, ANSPDCP, ASF and BNR websites, not merely through the press.

Beyond the national authorities, two European reference points remain essential: the official text on EUR-Lex and the AI Act Service Desk FAQ, updated periodically.

Comparison matrix of source types for the AI Act

For a compliance file, not all sources carry the same evidential weight. We recommend the following grid:

Practical rule: every statement in a compliance document should ultimately be traceable back to EUR-Lex or to an official communication of the Commission/authority - law firm or consultancy sources serve for interpretation and context, not as normative grounding.

The application timetable and what firms should be doing now

According to the Commission's official page on AI Act, application is phased:

• 2 February 2025The prohibitions on banned AI practices (art. 5) and the AI literacy obligations (art. 4) become applicable.
• 2 August 2025Governance rules and obligations for general-purpose models (GPAI). The same date was the deadline for designating the national authorities - a deadline missed by Romania (with a proposal coming only on 12 March 2026).
• 2 August 2026Most of the remaining rules apply, including the bulk of the high-risk regime, with some exceptions.
• 2 December 2027For certain high-risk systems in biometrics, critical infrastructure, education, employment, migration and border control.
• 2 August 2028For certain high-risk systems embedded in regulated products.

The Commission has also confirmed that every Member State must have at least one national AI sandbox by 2 August 2026.

Internal AI Act compliance plan - staged template (90–180 days)

The template below can be used as an internal checklist, mapped to risk level and statutory deadline. The “Responsible” column contains suggestions; add your own “internal deadline” for each row before circulating it to management.

The common objection - “we are only a user, we do not develop models” - is precisely where the risk lies. The official FAQ makes it clear that deployers of high-risk systems must ensure human oversight, keep logs, use the system in accordance with the instructions and, in certain cases, carry out fundamental rights impact assessments.

Enforcement and supervision in Romania: what to expect

• A lack of immediate operational capacity does not mean a lack of applicability. The AI Act is directly applicable; Romania's delay does not suspend companies' obligations.
• Supervision will most likely be gradual and, initially, reactive. For high-risk systems, supervisory activity will intensify towards the end of 2026 or the beginning of 2027, driven largely by complaints rather than by broad proactive inspections.
• Sectoral overlap is a real issue. A bank using biometrics for onboarding may fall under both BNR and ANSPDCP at the same time, with parallel reporting requirements.
• The interplay with the GDPR remains the most mature enforcement channel in the short term. For AI systems processing personal data, the first investigations are likely to come through the combined AI Act-GDPR channel.
• Affected individuals have rights of their own. The Regulation introduces mechanisms allowing persons affected by AI-based decisions to lodge complaints and to request information about the use of the systems.

Key definitions under Regulation (EU) 2024/1689

We set out below the meaning (paraphrased, not quoted verbatim) of several essential concepts from art. 3, in line with the text available on EUR-Lex:

• AI system - a machine-based system designed to operate with varying levels of autonomy, which may exhibit adaptiveness and which, for explicit or implicit objectives, infers from the inputs it receives how to generate outputs (predictions, content, recommendations or decisions) capable of influencing physical or virtual environments;
• Provider - the entity that develops an AI system or a general-purpose model, or places it on the market/puts it into service under its own name or trade mark;
• Deployer - the entity using an AI system under its own authority, other than in a personal, non-professional context; the category covering most companies that acquire AI solutions from third parties;
• High-risk AI system - the systems listed in Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice, democratic processes) or the safety components of a product regulated under Annex I.

AI Act update monitoring workflow

Because the Romanian institutional architecture is still taking shape, we recommend a structured monitoring workflow rather than ad-hoc checks.

Sources to monitor

• AI Act Service Desk - FAQ and updates (European Commission);
• The Commission's page on Regulatory framework on AI;
• Monitorul Oficial (Official Gazette) and the websites of ANCOM, ANSPDCP, ASF, BNR and ADR (legislation, guidance, press releases);
• JURIDICE.ro and other legal publications, for summaries of Romanian legislation;
• Newsletters from law firms with an AI practice (as a secondary source of applied context).

Recommended frequency

• Monthly - a quick review of ANCOM/ANSPDCP/ASF/BNR announcements and of the Commission's FAQ;
• Quarterly - review of the internal register of AI systems and of the risk classification; updating of the internal plan;
• Event-driven - an ad-hoc review whenever Romanian legislation is published, a relevant EU sanctioning decision is issued or the FAQ is significantly updated.

Shortlist: Romanian players publishing AI Act updates

The list below is for information purposes and is not a ranking - it is a map of the players who regularly publish content on the AI Act, useful as a starting point for monitoring. Check the websites directly for the most recent articles.

Expert insights

The European Commission describes the AI Act as the world's first comprehensive legal framework for AI and reaffirms that the rules are risk-based and seek to protect health, safety and fundamental rights without stifling innovation. Most AI systems remain in the minimal-risk bracket, but for high-risk systems the compliance standard is substantially higher. Two official clarifications are essential for the Romanian market:

• For high-risk systems, providers must ensure compliance with the relevant articles, technical documentation, the EU declaration of conformity, CE marking and retention of the documentation for 10 years;
• AI literacy does not require a single formal certification, but operators must ensure a sufficient level of competence for the staff who use or manage AI systems.

“We only use AI” does not take you outside the AI Act. It puts you in the position of a deployer - with obligations of your own.

Prohibited practices: applicable from Feb. 2025. High-risk regime: from Aug. 2026. Start by mapping your use cases and carrying out a risk assessment, before an audit or a regulator forces a rushed response.

Call BSA now

How Buju, Stanciu & Associates handle this type of mandate

BSA approaches AI Act compliance from an angle that is essential for local companies: not merely abstract legal analysis, but compliance design applied to real business flows. The firm presents its Artificial Intelligence, practice with a focus on AI regulation, data protection, algorithmic liability, technology compliance, AI contracts and litigation; the team brings together business law, privacy and a technical layer of AI strategy through the role of Chief AI Strategy Officer (team page). In practical terms, BSA can assist with:

• AI Act applicability assessment for each use case;
• risk classification and delimitation of provider/deployer/importer/distributor roles;
• AI Act + GDPR gap analysis for systems processing personal data;
• drafting internal AI governance policies and approval flows;
• vendor contracting and due diligence for AI solutions purchased from third parties;
• DPIA / FRIA / integrated impact assessments;
• human oversight and explainability mechanisms;
• AI literacy training for management, HR, compliance and product teams;
• coordinating engagement with the competent authorities (ANCOM, ASF, BNR, ANSPDCP).

Frequently asked questions

Next steps

If your organisation already uses AI in HR, scoring, customer support, anti-fraud, analytics or internal processes, the logical step is an AI Act compliance review. We recommend starting with a mapping of use cases and a legal assessment covering risk, documentation and governance, before contractual pressure, an internal audit or a regulatory inspection forces a rushed response.

For a practical discussion, see also the articles on the AI Act and the GDPR, the obligations arising from algorithmic recruitment and the right to an explanation in automated financial decisions, and for dedicated assistance you can contact us via bsa.ro.

Methodological note: the sections on the Romanian authorities reflect the government memorandum of 12 March 2026 and subsequent public reports (June 2026). As the institutional architecture is still taking shape, we recommend checking the final legislation and the ANCOM, ANSPDCP, ASF and BNR websites directly before taking decisions with a major compliance impact.