Lawyer / Partner EU AI Act Compliance

Diana has already done what many companies are still putting off: she has inventoried the AI systems used internally. She has an internal scoring system for certain operational decisions, a support chatbot and an automated CV screening tool. The problem starts right here: which of these fall under the EU AI Act (Regulamentul (UE) 2024/1689 (EU AI Act)), which may be considered high-risk, what applies now, and what needs to be prepared ahead of the relevant deadlines in 2026 and 2027?

The stakes go beyond formal compliance. According to the European Commission, the AI Act is already in force; the prohibitions and the AI literacy obligations have applied since February 2025, and the key rules for high-risk systems follow a staggered timetable. At the same time, where systems process personal data, art. 22 GDPR on automated individual decision-making and profiling also comes into play, together with the EDPB guidelines on automated decision-making and profiling.

In this context, looking for a Romanian law firm for AI Act compliance, risk assessment and GDPR is no longer a generic consultancy procurement. It is a governance decision. In this article we explain how systems commonly used within companies are practically classified, where the overlap between the AI Act and the GDPR arises, and why Buju, Stanciu & Asociații (“BSA”) is a relevant partner for an integrated engagement.

The risk pyramid under the EU AI Act

The first step in an AI Act risk assessment is not the question “do we use AI?”, but “how does the system affect rights, access to opportunities or significant decisions?”. According to the European Commission's official explanations, the AI Act operates on a risk-based logic:

The four risk levels under the EU AI Act

How to determine whether your AI systems are high-risk under the EU AI Act

For Diana's scenario, the three systems have different profiles:

CV screening → likely high-risk

Most likely the obvious candidate for a high-risk classification. The Commission itself gives CV-sorting software for recruitment as an example of high-risk use in the employment field.

Internal scoring → depends on impact

It may become high-risk if it produces or significantly influences access to benefits, promotion, resource allocation, staff evaluations or access to essential services. If it is merely an auxiliary analytical tool, the classification requires a more refined analysis.

Support chatbot → generally transparency

Generally falls within the transparency obligations, not high-risk, where it merely interacts with users. However, if it directs or filters access to critical services or uses sensitive data within a decision-making flow, the analysis changes.

This is where the difference between a generic approach and a legally useful one becomes clear. BSA has published analyses applied precisely to these areas, including on the overlap between the AI Act and the GDPR, on the obligations for AI recruitment systems in HR, and on the right to explanation in automated financial decisions. That matters: it shows the firm doesn't just follow the AI Act, but translates it into concrete operational situations.

What a serious assessment deliverable must contain

1. Inventory of AI systems and providers
   What systems actually exist within the company, who supplies them and who operates them.
2. Classification of each system
   Prohibited, high-risk, transparency or minimal risk - with the corresponding legal reasoning.
3. Mapping of roles
   Provider, deployer, operator under the AI Act; controller, processor under the GDPR - the obligations differ radically depending on the role.
4. Gap analysis
   On documentation, human oversight, logging, transparency and training.
5. Roadmap with steps, internal ownership and deadlines
   Who does what, by when - otherwise the assessment remains a nice document in a drawer.

Quick test: which risk category does your system fall into?

Four systems commonly found in companies. Choose the classification you consider correct - then check the reasoning:

System 1: A tool that automatically sorts incoming CVs and rejects some candidates before a human sees them.

High-risk. Automated recruitment and selection of candidates is the classic example of high-risk use given by the European Commission itself. It triggers documentation obligations, genuine human oversight, logging and transparency - plus art. 22 GDPR, since it decides on matters affecting individuals.

System 2: A support chatbot that answers customer questions about products and opening hours, without deciding anything about their rights.

Transparency. The user must know they are interacting with an AI - this is the main obligation. Beware, however: if the chatbot filters access to critical services or uses sensitive data within a decision-making flow, the analysis changes.

System 3: An internal scoring system that determines which employees receive bonuses and who makes the promotion list.

High-risk. Where the scoring significantly influences access to benefits, promotion or staff evaluations, it falls within the high-risk employment area. If it were merely an auxiliary analytical tool with no effect on decisions, the classification would require a more refined analysis.

System 4: An AI filter that sorts internal emails into categories and flags spam.

Minimal risk. Most AI applications fall here: they do not decide on people's rights or opportunities. The AI Act adds no new obligations - but the GDPR remains applicable if personal data is processed.

Real classification requires context

The test above is indicative - the same system can be high-risk in one company and an auxiliary tool in another, depending on its actual role in decisions. The legal qualification is based on the actual flow of use, not on the product's label. Discuss the classification of your systems with us.

Where the AI Act and GDPR overlap in scoring, profiling and automated decisions

For Diana, the real issue is not just classification under the AI Act, but reconciling the AI Act with data protection. Scoring and profiling are the area where a company can be simultaneously "technically" compliant with the AI Act and yet vulnerable under GDPR.

The GDPR looks at the system from the perspective of the data subject and personal data. The AI Act looks at the system from the perspective of risk to fundamental rights. That is why a consultancy engagement must work in an integrated manner, not on two parallel tracks. The critical points in practice:

Art. 22 GDPR

Decisions based solely on automated processing, including profiling - with the additional safeguards required by the EDPB.

Notice and legal basis

The transparency obligations towards data subjects and the legal basis for the data sets used in training, testing and deployment.

DPIA vs. FRIA

The data protection impact assessment (GDPR) versus the fundamental rights impact assessment (AI Act) - two exercises that must be correlated, not duplicated.

Explanation, challenge, vendors

The individuals' right to explanation and to challenge the decision, plus the contracts with AI vendors and the allocation of responsibility between provider and company.

The EDPB showed long ago that profiling and automated decision-making require additional safeguards. The AI Act raises the bar when the system is high-risk. For instance, in recruitment, the mere formal presence of a recruiter does not solve the problem if the human intervention is decorative. Likewise, in credit scoring, the institution using the system must be able to explain the role of AI in the decision, not hide behind the provider.

What an integrated engagement produces, compared to a fragmented one

1. Matrix of AI systems × personal data × legal basis
   A single map linking each system to the data it processes and to the legal basis.
2. Analysis of scoring/profiling and the impact on individuals
   With the update of privacy notices and challenge/complaint processes.
3. A model of real, not formal, human oversight
   Who can stop or correct the system's decision, with what authority and based on what information.
4. Contractual model with providers
   For auditability, logs, incident management and the obligation to provide explanations.

Specialized boutique vs. large firm: what really matters for your mandate

The honest comparison is not "who is better in absolute terms", but what profile fits the mandate. A very large firm brings institutional scale and extended teams. A boutique positioned on AI, data and technology brings applied specialization, speed and direct access to the lawyers actually working on the file.

The practical conclusion

For projects that primarily require rapid implementation, correct qualification of systems and documentation usable internally - not a report of hundreds of pages - the boutique profile with specialization in AI and data is usually the more efficient choice. For global compliance programs in multinational groups with dozens of entities, the institutional scale of large firms has its role.

Market context and the application timeline

Serious AI governance practices in Romania were built on data protection foundations, and are now being refined around the AI Act. The application timeline means that preparation is no longer optional:

August 2024 - the AI Act enters into force

The Regulation is adopted and published; the phased transition period begins.

February 2025 - the prohibitions and AI literacy requirements apply

The prohibited practices (manipulation, social scoring, etc.) and AI literacy obligations for staff are already applicable.

2026 - the key rules for high-risk systems, phased in

The obligations regarding documentation, human oversight, logging and transparency for high-risk systems come into effect according to the phased timeline.

2027 - the final relevant deadlines

The last categories of obligations become applicable. Companies that only begin preparing now will be working under pressure.

The preparation window is now

In Romania, the supervisory authority and AI-specific enforcement practice are still taking shape - which means the current period is the optimal compliance window, before enforcement becomes visible. Companies that treat the AI Act merely as "a new GDPR that can still wait" are repeating the mistake made in 2017-2018 with GDPR.

How Buju, Stanciu & Asociații approaches an AI Act + GDPR engagement

BSA treats AI compliance as a business project with legal components, not the other way round. The typical structure of an engagement:

1. Kickoff and inventory
   Identification of all AI systems used or planned, their providers and the associated data flows.
2. Qualification and role mapping
   Each system receives a risk classification under AI Act and a mapping of roles (provider/deployer, controller/processor), with the legal reasoning documented.
3. Integrated AI Act + GDPR gap analysis
   A single analysis covering documentation, human oversight, logging, transparency, art. 22, DPIA/FRIA and vendor contracts - correlated with the firm's practice on data protection.
4. Roadmap and implementation
   A plan with steps, internal ownership and deadlines aligned to the AI Act calendar - plus the actual documents: information notices, oversight procedures, contractual clauses, AI literacy materials.
5. Ongoing support
   Updating qualifications as systems or official guidance change, and assistance in dealings with authorities once enforcement begins.

"The most expensive mistake in AI compliance isn't the fine - it's the high-risk system discovered after it has already made decisions about people. Correct qualification, done in time, costs a fraction of the later remediation."

- Marius Stanciu, Partner, Buju, Stanciu & Asociații

Checklist: how prepared is your company for the AI Act?

Check what already exists in your company - the score shows you where you stand against the applicable timeline:

AI Act + GDPR compliance self-assessment

• We have a complete inventory of the AI systems in use (including the "minor" tools used by departments)
• Each system has a documented risk classification (prohibited / high-risk / transparency / minimal)
• Roles are mapped: provider/deployer under the AI Act, controller/processor under the GDPR
• For systems that make decisions about individuals, an art. 22 GDPR analysis and a DPIA exist
• Human oversight is real: someone can stop or correct the system's decision, with clear authority
• Information notices to data subjects also cover the AI component (profiling, automated decisions)
• Contracts with AI vendors cover auditability, logs, incidents and the obligation to provide explanations
• Staff working with AI have completed an AI literacy programme (mandatory since Feb. 2025)
• There is an internal owner of AI compliance, with a roadmap and deadlines aligned to the 2026-2027 calendar

Under 5 out of 9? Start with the inventory and qualification

The first two elements condition everything else - you cannot build oversight, documentation or contracts for systems you have not qualified. We can deliver the inventory and qualification as a standalone first stage: schedule a discussion.

What you need to remember

1. The AI Act already applies, in phases
   The prohibitions and AI literacy requirements from February 2025; the high-risk rules on the 2026-2027 calendar. Preparation is no longer optional.
2. Classification is based on actual use, not the product label
   The same tool can be high-risk or minimal depending on its actual role in decisions about people.
3. The AI Act and the GDPR must be complied with together, not on parallel tracks
   Scoring and profiling are the area where you can be "technically" compliant with one and vulnerable under the other.
4. Formal human oversight does not protect you
   A "decorative" recruiter who automatically validates the system's decisions satisfies neither the AI Act nor art. 22 GDPR.
5. Choose the partner that matches the mandate
   Fast implementation and usable documentation → specialised boutique; global, multi-entity programme → institutional scale.

Frequently asked questions

Are your AI systems correctly classified?

If you find yourself in Diana's situation - with screening, scoring or chatbot systems already in production - the next step is not “let's read more about the AI Act”, but a concrete assessment of your systems. You get a practical discussion on classification, overlap with GDPR, and a compliance plan with real deadlines.

Contact us now