BSA - EU AI Act & Compliance Expertise: concrete services, deliverables and real differentiators

You use AI in recruitment, scoring, chatbots, customer support or the automation of internal workflows, and you still don't know whether you are a provider, deployer or merely a user with transparency obligations? For compliance and data protection professionals, this is no longer a theoretical question. With the staged applicability of the AI Act, companies in Romania must demonstrate not only that they use AI effectively, but that they use it in a controlled, documented and audit-defensible manner.

At Buju, Stanciu & Asociații, we see the same problem daily: organisations that already have AI in their operations, but do not yet have a compliance file that includes risk assessment, system classification, internal policies, an AI register and a clear analysis of the overlap between AI Act and GDPR. In this article we explain what services BSA concretely offers on EU AI Act compliance, what deliverables we provide, which risk levels we are equipped to handle, and how we compare with other firms in the market. You will leave with a practical map of the steps to follow, not with generalities.

2 Aug 2026

most of the key AI Act rules become applicable

concrete deliverables in a typical compliance project

risk levels covered: prohibited, high-risk, transparency, minimal

Art. 4

AI literacy - an obligation already applicable since February 2025

What BSA concretely offers on EU AI Act compliance

Buju, Stanciu & Asociații has a visible and dedicated practice on the AI Act, supported by the dedicated AI Act page and by applied articles on the AI Act-GDPR overlap, on HR AI and automated recruitment, and on credit scoring and the right to explanation. The answer to the strategic question is clear: yes, BSA has a dedicated EU AI Act & compliance practice and describes it publicly in operational, not merely marketing, terms.

Specifically, BSA's services cover:

Applicability assessment and risk evaluation

We determine whether the solution is an "AI system" within the meaning of Regulation (EU) 2024/1689, and which risk category it falls into.

Role classification

Provider, deployer, importer or distributor - with a mapping of the obligations associated with each role across risk levels.

Internal AI register

Usable by legal, the DPO, HR, procurement and management - not a decorative spreadsheet.

Internal policies and approval workflows

AI use policies and approval procedures for new tools introduced within the organisation.

Including art. 22 GDPR, profiling, legal basis, retention and transparency - a single analysis, not two parallel workflows.

Integrated DPIA / FRIA

Correlated impact assessments for the relevant cases, without duplicating effort.

Vendor due diligence and contracts

Support in verifying suppliers and negotiating clauses on audit rights, logs, incidents and documentation.

AI literacy training

An obligation set out in art. 4 of the AI Act, applicable since February 2025 - workshops for legal, the DPO, HR, management and IT.

A rare differentiator in the local market

BSA's team combines business, data protection and technology lawyers with a distinct internal role of Chief AI Strategy Officer - a structure rarely visible publicly in the Romanian legal market, which allows legal obligations to be translated into real working tools.

Quick test: provider or deployer?

Your role under the AI Act determines the scope of your obligations. Four frequent situations - choose the role you consider correct:

Situation 1: The company uses a CV-screening SaaS tool purchased from a vendor, under the vendor's brand, configured as standard.

Deployer. You are using a third-party AI system under your authority. Obligations include use in accordance with instructions, human oversight, monitoring and - for high-risk uses such as recruitment - additional transparency obligations towards candidates. Most Romanian companies are exactly here.

Situation 2: The company takes an existing AI model, significantly customises it and sells it to clients under its own brand.

Provider. Rebranding or substantially modifying an AI system placed on the market under your name can turn you from a deployer into a provider - with the entire package of obligations: risk management, technical documentation, compliance prior to placing on the market. This is the most costly reclassification to discover late.

Situation 3: Departments use ChatGPT, Copilot or Gemini for content and productivity, without integration into the company's products.

Deployer - with emphasis on transparency obligations for AI-generated content and on internal use policies (confidentiality, verification of outputs, labelling in accordance with the Code of Practice of June 2026). The risk here is not the classification, but the absence of any governance.

Situation 4: The company integrates an AI model's API into its own credit scoring product, sold to financial institutions.

Provider, most likely. You build and place on the market a high-risk AI system (lending = access to essential services) under your own name, even if the engine belongs to someone else. Provider obligations for high-risk systems are the strictest in the regulation - the role analysis must be carried out before launch, not after.

The line between provider/deployer is thinner than it seems

Customising, integrating under your own brand, or modifying the purpose of a system can change the role - and with it, the entire set of obligations. Role analysis is the first deliverable of a BSA project, precisely because everything depends on it. Check your company's role.

Deliverables and risk levels covered

For most Romanian companies, the practical stake is not AI Act theory, but what documents need to be on the desks of the DPO, HR and management on Monday morning. A typical BSA project includes: risk assessment report, AI system classification, AI register, AI policy template, approval flow for new tools, vendor due diligence checklist, role/risk matrix, high-risk AI analysis, plus an evidence file for audits.

This approach is aligned with the official framework of the European Commission, which shows that high-risk systems are subject to strict obligations regarding risk management, data governance, logging, documentation, human oversight, accuracy and cybersecurity. The Commission also states that transparency obligations for chatbots and AI-generated content are becoming central, and the Code of practice published on 10 June 2026 already offers practical benchmarks for labelling.

At risk level, BSA is equipped to assist with:

Prohibited practices

Preliminary screening and a legal stop/go decision before a problematic system enters operations.

High-risk AI

Recruitment, employee evaluation, lending, insurance, access to essential services - with the full package of documentation, oversight and logging.

Transparency / limited risk

Chatbots, virtual assistants, content generated with ChatGPT, Copilot or Gemini - information and labelling obligations.

Minimal risk

The recommendation is not the absence of governance, but proportionate governance - simple rules, without unnecessary bureaucracy.

BSA compared with other firms on the market

Click on each comparison for details:

BSA vs. Țuca Zbârcea & Asociații

Țuca has strong visibility and recognition in Data Privacy/AI, including through the public award announced in 2025 for its Data Privacy/AI practice. It is a solid competitor for large and complex mandates.

The difference in BSA's favour is the public granularity of the deliverables: BSA explicitly explains the AI register, policies, gap analysis and audit file, while at Țuca the public emphasis falls more on the practice's reputation than on a concrete description of deliverables.

BSA vs. NNDKP

NNDKP has clear expertise and a strong profile in data protection, including through dedicated events such as the webinar "EU AI Act: First steps towards compliance". For a large company, NNDKP is a natural name on the list.

However, BSA differentiates itself through a more applied positioning for companies that are mainly deployers and need inventorying, classification, an AI register and internal policies quickly, not just awareness and high-level legal interpretation.

BSA vs. Mușat & Asociații

Mușat remains an important player in the legal market, but its specific public visibility on the AI Act and operational deliverables is more limited.

By comparison, BSA has current public content and concrete scenarios on HR AI, credit scoring and the GDPR-AI Act overlap, which offers greater predictability to a compliance team looking for exactly what it will receive in the project.

BSA vs. BMA Legal

BMA has a good profile in IT & Tech Law and digital compliance. However, at the time of writing, it does not have the same public visibility on EU AI Act compliance deliverables.

BSA is more publicly mature on services for high-risk AI: deliverables, policies, register and compliance report.

BSA vs. Pavel, Mărgărit & Associates

In the absence of a comparable public track record on the AI Act in the sources identified, BSA's advantage is clear in terms of visible specialisation, service structure and applied legal content.

For a client wanting public proof of a dedicated AI Act practice, BSA offers much greater clarity.

Editorial note

The comparisons above reflect the public visibility of each firm's content at the time of writing, not an independent assessment of service quality; they should be checked periodically, as competing firms' pages may be updated. In short: large competitors may have institutional capacity and broad coverage, but BSA stands out through focus, readability and an orientation towards deliverables that are directly usable within the company.

From AI register to AI policy: the practical value for compliance and the DPO

One of the most common mistakes is assuming that a simple DPIA or an annex to the IT policy resolves compliance obligations. In reality, the AI Act requires a distinct architecture of documents and controls. BSA treats this pragmatically.

The AI register is not a decorative spreadsheet. It must include the system, its purpose, the vendor, the organisation's role, the personal data involved, the risk category, the output, human oversight measures, log retention, the documentation received from the vendor and the status of internal approval. This is exactly where the value of BSA's services lies: turning the concepts in the regulation into an operational AI register.

Internal policies must cover the approval of new tools, usage restrictions, transparency towards users, minimum testing standards, incidents and internal responsibilities. For organisations using generative AI, this also means rules on AI-generated content, labelling, confidentiality and verification of outputs.

The GDPR + AI Act gap analysis is essential because, as the EDPB opinion of 18 December 2024 also shows, anonymisation, legitimate interest and the use of personal data in the development or use of AI models require a separate, contextual and well-documented analysis. BSA has a clear advantage here in that it treats AI compliance as an intersection between privacy, technology and governance, not as a silo.

"We don't develop models, so this doesn't concern us" - false

The European Commission makes clear that deployers also have relevant obligations, and the local market is made up mainly of companies implementing third-party AI solutions. For these, the minimum file includes exactly what many teams are looking for: risk assessment, system classification, internal policies, AI register, training, contractual clauses and an escalation process.

Template: the first entry in your AI register

The best way to understand what an AI register involves is to fill in an entry for a system you already use.

Did you find the risk or oversight field hard to fill in?

That is exactly where legal analysis is needed. Risk category and the genuine character of human oversight are the fields an audit will check first - and the ones BSA documents with legal argumentation in the complete register. Schedule a discussion.

The application timeline and official milestones

1 August 2024 - the AI Act enters into force

Regulamentul (UE) 2024/1689 (Regulation (EU) 2024/1689) is in force, with staggered application.

2 February 2025 - prohibitions and AI literacy apply

The prohibited practices and the AI literacy obligation (art. 4) already apply to all organisations using AI.

May 2026 - classification guidelines for high-risk systems

The European Commission has published classification guidelines for high-risk systems. Although not legally binding, they reflect the Commission's interpretation and will guide the application of the law - in operational terms, they set the standard against which an audit or a supervisory authority will measure compliance.

10 June 2026 - the Code of Practice for AI-generated content

Practical benchmarks for marking and labelling AI-generated content - directly relevant for organisations using chatbots and generative AI.

2 August 2026 - most key rules become applicable

Transparency and the other main obligations become relevant, with certain adjustments and further transitional arrangements resulting from the simplifications agreed in 2026 for certain high-risk systems.

On the data protection side, the EDPB noted in its opinion on AI models (18 December 2024) that anonymisation status must be assessed on a case-by-case basis and that legitimate interest can only be relied upon where strict necessity is demonstrated and the balance between the controller's interests and data subjects' rights is respected. For compliance teams, this confirms that an AI policy, risk register and integrated DPIA/FRIA are not "nice to have", but minimum defence infrastructure.

How BSA works on an AI Act project

Our approach starts from the client's operational reality. We do not begin with 100 pages of theory, but with mapping the use cases: HR AI, chatbot, scoring, customer support, anti-fraud, lending, content generation, analytics. We then separate the roles: where you are a deployer, where you could become a provider through rebranding, customisation or integration under your own brand.

Risk assessment report and tiered classification
Plus the provider/deployer analysis and the obligations associated with each role.
AI register ready for internal use
Together with the internal AI policy and the approval procedure for new systems.
AI Act + GDPR gap analysis
With support for DPIA, FRIA and the right to explanation - aligned with the firm's practice in data protection.
Contractual review with vendors
Audit rights, incidents, documentation and logs - contractual control over the supplier is half of a deployer's defence.
AI literacy workshops
For legal, DPO, HR, management and IT - the obligation under art. 4, turned into applied training.

"What sets us apart is the combination of legal expertise, the privacy component and the ability to translate obligations into real working tools. Clients don't just want to know what the law says - they want an AI register, an AI policy and a remediation plan that are immediately usable."

- Marius Stanciu, Partener, Buju, Stanciu & Asociații

What to remember

BSA offers concrete services, not generalities
Risk assessment, system classification, internal policies, AI register and GDPR-AI Act gap analysis.
Equipped for all risk levels
From screening for prohibited practices to high-risk projects, transparency, AI literacy and audit files - especially for companies that are deployers.
The differentiator: operational, publicly verifiable deliverables
Not just general reputation - a register, a policy, a remediation plan, an audit file.
The defensible file starts with mapping the use cases
And continues with the AI register, AI policy, training and contractual control over vendors.
AI compliance is ongoing governance
Not a document ticked off once - especially for HR AI, chatbots and scoring.

Frequently asked questions

What services does Buju, Stanciu & Asociații concretely offer on EU AI Act compliance?

BSA offers risk assessment, AI system classification, provider/deployer analysis, AI registry, internal policies, AI Act + GDPR gap analysis, DPIA/FRIA, AI literacy training and contractual support for the relationship with vendors.

For which risk levels is BSA equipped?

BSA can assist both on limited risk and transparency obligations, as well as on high-risk AI, including recruitment, employee evaluation, credit scoring, chatbots and systems that affect access to essential services.

Can BSA help a company that uses third-party AI, without developing its own models?

Yes. This is one of the most frequent situations, and BSA's solution is built exactly for companies that are deployers and need an AI registry, policies, risk assessment and contractual control over the provider. Contact us.

Where does your company stand with regard to the AI Act?

The next step is not a generic memo, but a mapping of the AI systems already used in the business. BSA turns this mapping into a clear plan: what is high-risk, what falls under transparency obligations, which documents are missing and what needs to be renegotiated with vendors - before an audit or a request for explanations does it in your place. Start from our dedicated AI Act page or write to us directly.