ITM labour inspection in Romania illustration with employment records, checklist and safety helmet on an office desk.

ITM Labour Inspection in Romania: What an Employer Should Prepare

Romanian employment law · Employer inspection guide

An ITM inspection can begin with an unannounced workplace visit, a targeted request for records, a worker complaint or a safety incident. An employer needs an accurate picture of who is working, on what terms, when and where, and a controlled way to produce the records that support that picture.

In brief: Verify the inspectors’ identity and appoint one internal coordinator. Preserve the original state of all records when the inspection begins and document any subsequent correction through the lawful procedure applicable to that record. Reconcile signed employment documents, REGES-ONLINE entries, working-time evidence and payroll records; prepare occupational safety records where that is the inspection’s scope. Record exactly which documents and explanations are requested. If a control report with measures or a contravention report follows, identify each instrument and its own deadline before deciding whether to remedy, clarify or challenge it.

What can the Romanian Labour Inspectorate inspect?

ITM, the territorial labour inspectorate, may inspect employment relations and occupational safety and health. The scope of a particular visit is determined by the inspectors’ mandate and the facts under examination.

Law no. 108/1999 on the Labour Inspection gives labour inspectors powers to enter employers’ premises and workplaces without prior notice, identify persons found there, request information and relevant documents, obtain copies and written statements, order corrective measures and impose contravention sanctions within their competence. Under Article 19(k), stopping an activity or work equipment is tied to a finding of serious and imminent danger of an accident or occupational illness, under the conditions provided by occupational health and safety legislation. A business should therefore be prepared even when no formal appointment has been made.

An inspection of employment relations typically looks at the written employment contracts, transmitted employee-register data, actual working hours, pay, leave and the people physically carrying out work. A safety inspection may concentrate on risk assessments, preventive arrangements, training, equipment, occupational health and an accident record. A visit can cover both strands. It is useful to ask the inspectors to identify the topics and period under review, while ensuring the company cooperates with a lawful inspection.

The relevant framework includes the Romanian Labour Code, Law no. 53/2003, the REGES-ONLINE rules in Government Decision no. 295/2025 and, for safety matters, Law no. 319/2006 on occupational safety and health with its implementing rules in Government Decision no. 1425/2006. Sector-specific requirements may add another layer.

Which inspection route is the company facing?

Identify the immediate trigger before assembling a large and unfocused folder. The four common starting points below call for different first documents and operational contacts; the selection is a planning aid, not a legal classification of the inspection.

Inspection route selector

Select a route to see the first response priority.

Immediate priority: a reliable workforce snapshot

Confirm the inspectors’ credentials, inform the responsible HR and site managers, identify each person working at the location and preserve the contemporaneous attendance, rota, contract and register evidence. Do not coach workers or retrospectively rewrite a time sheet. If the visit extends to safety, bring the designated prevention and protection contact into the response.

What should an employer do during the first hours?

Cooperate, preserve evidence and centralise communications. A written record of the inspection is often as important as the document bundle itself.

Confirm the inspection team and assign a coordinator

Ask to see official identification and record the inspectors’ names, territorial office and arrival time. Inform a designated HR or legal coordinator and, where needed, the site manager or occupational safety specialist. One coordinator should track requests and answers so that different departments do not give contradictory versions of the same fact. The inspection can lawfully be unannounced; an employer cannot insist on a prior appointment as a condition of access.

Preserve the original records and document lawful corrections

Export or make a reliable copy of the register extracts, employment files, attendance logs and relevant correspondence as they stood when the inspection began, before routine systems overwrite them. Preserve creation dates and version history where available. Subsequent corrections remain possible when the applicable law and system procedure permit them; record the reason, supporting document, operator and date, while retaining the original state. If records are held by a payroll provider, an outsourced HR service or a group company abroad, identify who can retrieve them promptly. A missing file at the moment of the visit and a document that never existed are different factual problems; neither is solved by backdating paperwork.

Log questions, interviews and handovers

Record which persons were present, what period the inspectors asked about, which copies were provided and when. Inspectors have statutory powers to seek statements and information from workers. Do not instruct employees to provide a prepared answer or interfere with an interview. If a factual explanation requires access to a record, say so and identify when that record can be produced. For a digital handover, use a secure, documented method and retain an identical copy of the submission.

During an accident or an imminent safety risk, protective obligations have priority. Law no. 319/2006 requires employers to provide relevant records and explanations and implement measures ordered by inspectors. Its special rule on preserving the state of a fatal or collective accident must be read with the exceptions for preventing further accidents or protecting lives. The applicable reporting, investigation and preservation rules depend on the event; involve the responsible specialist immediately.

Which documents does ITM commonly request?

The request depends on the inspection. A company should maintain a current internal index showing who holds each document, which entity it belongs to and how it can be retrieved. This map helps HR, payroll, operations and the safety team answer the same question consistently.

ITM document response map: what to reconcile before submission
Record setCompare it withWhy the comparison matters
Start date, job, workplace, schedule and amendmentsA signed file must match the work actually carried out.
Contract file, start, changes, suspension and terminationTransmission and underlying documents form separate evidence.
Rota, access logs, overtime and part-time termsArticle 119 requires a daily record of working time.
Contract terms, payroll, payment and leave approvalsPayment and entitlement issues cannot be judged from one file alone.
Visitor list, service contracts and worker identityMisclassification and unrecorded work are fact-sensitive.
Risk assessment, training, health and equipment recordsSafety duties depend on the actual workplace and risks.
Select a document setClick a row label to see the first review point for that record.

Keep the request itself next to the response map. A worker complaint about wages may not require every safety record, while a machine incident may put risk assessments and equipment controls first. Where an inspector lawfully requests further relevant documents, update the map and preserve a copy of each additional handover.

What changed with REGES-ONLINE in 2026?

The current employee-register workflow is REGES-ONLINE under Government Decision no. 295/2025. Employers should inspect the data and operation history in the current system rather than rely on an old Revisal-only checklist.

The new decision governs recording and transmitting employment-contract data, changes, suspensions and endings through REGES-ONLINE. Emergency Ordinance no. 46/2025 extended certain transition obligations to 31 December 2025. In a 2026 inspection, check the position under the current rules and the employer’s actual transition history; do not assume every historical field was due on the same day or that an old export by itself demonstrates compliance.

The Labour Inspectorate’s own employer extract guidance explains how to generate a report listing registered employees, while its employer journal guidance covers recorded actions over a chosen period. A useful inspection pack therefore includes the current extract, relevant history and the signed source documents that explain the entries. The journal is an audit aid, not a substitute for the underlying contract or evidence of work actually performed.

For every person in the inspected sample, compare the contractual start, location, duration, schedule and salary terms with the register’s entries and effective dates. Compare suspension or termination records with the underlying decisions and with the person’s actual site or system access. If an inconsistency appears, preserve the original records, identify the cause and use the lawful correction route with an auditable explanation. Quietly editing the system after an inspector has asked for evidence can make the chronology harder to establish.

Outsourcing entry or payroll work does not remove the employer’s need to understand its own records. Confirm who holds administrator access, who approved each transmission and how the company receives proof of submission. A foreign parent company may run a central HR platform, but the Romanian employing entity still needs to produce the records relevant to its workforce.

Where do inspections most often become legally sensitive?

Undeclared work and the first day of employment

The Labour Code requires the written employment contract to be concluded and the required register data to be transmitted no later than the day before the employee starts work. Article 151 of the Labour Code defines several forms of undeclared work, including work without the written contract, work before the required register transmission, work performed during suspension and work by a part-time employee beyond the contractual duration of working time, subject to the statutory exception. These are distinct factual routes. The company should identify which route is actually alleged instead of answering only with a signed contract.

Temporary workers, contractors, agency personnel, trainees and visitors should be identified accurately on site. A services invoice does not alone decide whether a natural person is working in a genuinely independent capacity. Our employee versus contractor guide explains the wider classification issue. If a person works for another employer, retain the arrangement and identify the actual employer and the basis for work at this site.

Hours, rest and part-time schedules

Under Article 119 of the Labour Code, employers keep daily records of each employee’s working time, with the start and end of the programme, and make them available to inspectors. The statute contains rules about how records can be agreed for mobile and home-based workers; verify the actual arrangement and the version of the law applicable to the period examined. A monthly total without a credible daily basis may leave an important evidential gap.

Compare rosters, customer service logs, access systems and manager approvals with the time record. If shifts were exchanged or remote work changed the place and timing of work, keep the underlying approval. For part-time employees, distinguish a changed schedule from work exceeding the contracted duration: Article 151 addresses the latter, with a statutory exception. Overtime, rest days and annual leave also need a coherent record; avoid assuming a fixed salary automatically resolves all working-time questions.

Pay, leave and personnel files

Payroll must be traced to the applicable contractual terms and actual period worked. A payroll export can show calculation; payment evidence shows whether and when sums were transferred. Leave approvals and balances explain absence, but an employee who is shown as absent in one system and working in another requires a factual investigation. Preserve the relevant records before changing the entry, and document any correction as a correction.

Occupational safety and health

Law no. 319/2006 places preventive duties on employers, including measures adapted to the risks of the actual workplace. The implementing rules address the organisation of prevention and protection, training and related documentation. A signed generic training sheet is weak evidence if the instruction did not address the equipment or tasks in use. Review risk assessments, worker training, designated responsibilities, protective equipment, health surveillance and incident evidence in the context of the site being inspected.

Operational risk: A contravention fine, a deadline to remedy a deficiency and an order to stop dangerous activity can have different legal bases and effects. Keep a separate action owner and deadline for each instrument. Filing a complaint about a fine should never be assumed to authorise continued operation contrary to a distinct safety measure.

Can undeclared work stop activity at the inspected workplace?

Undeclared-work risk: Under Article 260(4) of the Romanian Labour Code, an inspector orders the cessation of activity at the inspected workplace when one of the contraventions in Article 260(1)(e)–(e2) is established: receiving someone to work without an employment contract, without the required prior transmission to the employee register, or while their contract is suspended. This is a separate measure from stopping dangerous activity under workplace safety legislation. Under Article 260(5), activity may resume only after the employer meets the statutory conditions, including payment of the fine as required by law, remedying the relevant employment or register deficiency and presenting proof of payment of the applicable social contributions and income tax for the undeclared-work period. Resuming activity in breach of these conditions constitutes a criminal offence under Article 260(6). The excess-hours breach involving a part-time contract under Article 260(1)(e3) is not listed in Article 260(4). Identify each worker and complete the written contract and required register transmission no later than the day before work starts.

Can an employer refuse a document request or limit access?

Labour inspectors have broad statutory powers under Law no. 108/1999, including the powers listed in Article 19, and the inspected entity must provide documents and information necessary for the control. Commercial confidentiality alone is not an automatic reason to refuse a relevant lawful request. At the same time, the GDPR’s data-minimisation principle continues to apply to the employer’s handling of personal data. Clarify the requested employees, period and purpose, use a secure handover and restrict unnecessary circulation inside the company.

Where a document contains unrelated personal details, consider whether a partial redaction or a narrower extract is legally appropriate without obscuring information the inspector is entitled to examine. Explain any proposed redaction and be ready to supply the relevant unredacted material if lawfully required. Do not anonymise employee identity, hours or other facts central to the control merely because they are personal data. If the request is ambiguous or unusually broad, seek clarification promptly and document the response rather than silently withholding relevant evidence.

Keep a copy of every file supplied, the version date, the recipient and the delivery method. If an original is taken or a copy certified, retain the acknowledgment. A parent company or external adviser may help prepare the response, but inspectors may still require information from management or workers on site. Employee statements should be allowed to proceed without intimidation, retaliation or a fabricated script.

Legal counsel can help formulate an accurate response to a disputed factual allegation while the inspection continues. The employer should correct an immediately dangerous condition and meet an applicable remedial deadline even if it disagrees with a legal conclusion. Keep remedial action separate from any admission about what happened previously.

What happens after the inspection?

Read every document delivered by ITM as a separate instrument. Identify factual findings, legal provisions, required measures, proof of communication and the available response route.

At the close of the visit or afterwards, the company may receive a proces-verbal de control (control report) recording findings and mandatory corrective measures, sometimes with an annex or plan of measures and specified deadlines. A separate proces-verbal de constatare și sancționare a contravenției records an alleged contravention and its warning or fine. Occupational safety and health controls may generate their own findings and measures, including an order concerning dangerous activity or equipment where the statutory conditions are met. The Labour Inspectorate’s control guidance distinguishes the control report from the contravention report. Create a document register with the date of handover or communication, a responsible person, the deadline stated and the evidence needed to answer each finding.

Start with the factual allegations. Which worker, location, date, period and underlying record are at issue? Then check the cited legal provision and whether the available evidence supports that characterization. A procedural defect can matter, but not every typographical error invalidates a report. A sound review considers both formal requirements and the substance of the finding, the sanction’s proportionality and any applicable special statutory rules.

For a contravention report, Article 31 of Government Ordinance no. 2/2001 generally provides 15 days from handover or communication for a complaint. Confirm the starting date from the actual service evidence. Territorial jurisdiction and the effect of a complaint should be checked against the current Article 32 and any special law relevant to the alleged infringement. Do not conflate that procedural route with a separate order requiring correction or stopping an unsafe activity.

Does a control measure follow the same challenge route as an ITM fine?

No. Article 20(3) of Law no. 108/1999 directs challenges against contravention reports to the procedure under Government Ordinance no. 2/2001. Article 20(2) provides that challenges against acts of an administrative nature issued by labour inspectors are resolved under Law no. 554/2004 on administrative litigation. Whether a particular measure can be challenged separately under that law depends on its legal nature and effects. A mandatory measure in a control report may therefore require an administrative-law analysis, including whether the particular measure is an administrative act, whether a prior complaint is needed and which filing and court deadlines apply. Its wording, legal basis and effect must be assessed individually.

A challenge to a control report or measure does not, by itself, suspend its mandatory obligations, unless the applicable law or a court order provides otherwise. If immediate compliance would cause a serious dispute or operational impact, examine the separate conditions for interim relief under administrative law while managing safety and remediation obligations. Do not apply the 15-day contravention deadline or the procedural effects of a fine complaint automatically to every measure in the control report.

If the company accepts a factual deficiency, assign the corrective work, preserve evidence of the fix and answer the authority by the specified deadline where required. If it disputes the allegation, collect contemporaneous documents and record who can explain them. A business may need to comply operationally while evaluating a challenge. Paying a fine, lodging a complaint and completing a corrective measure can have different consequences; decide from the exact papers, not from a generic template.

Illustrative scenario: responding to an employment compliance inspection

Consider a Romanian subsidiary of an international group operating across several locations. ITM inspectors arrive unannounced and focus on working-time records, employment documentation and REGES-ONLINE compliance. The document request covers employment files, register evidence, attendance records and payroll-related documentation for a defined review period.

In the first 48 hours, a well-organised response would start by appointing a single internal coordinator and creating a document map covering HR, payroll and operational records. Copies of the relevant records would be preserved in their original state, a handover log would be kept and responsibility for each requested document category would be assigned.

The review could then reveal inconsistencies between contractual working arrangements, REGES-ONLINE entries and operational attendance records affecting a limited number of employees. The company should not alter records retroactively. It should document each discrepancy, preserve the original evidence and record any correction as a correction, through the applicable legal and administrative procedure.

Legal support in a scenario like this would typically involve reconciling the relevant records, preparing explanatory submissions and organising the supporting evidence. The aim is a consistent chronology supported by contemporaneous documents, rather than isolated records viewed separately.

The end result of such a process would normally be an inspection-response file, a deadline register, a remediation plan and an employee-sample audit designed to identify similar issues before a future inspection.

Practical lesson: in many inspections, the decisive question is not only whether a document exists, but whether contracts, REGES-ONLINE records, payroll data, working-time records and the reality of workplace operations align with one another.

This is a hypothetical scenario prepared for educational purposes. It does not describe a real client matter, and it does not guarantee any inspection, administrative or court outcome.

What should go into an ITM defence and compliance file?

Keep a single indexed file that can support a legal assessment and a practical remediation plan. The buttons below are a local planning aid: they do not upload or save company information.

Click each card as the file is assembled.

0 of 8 items selectedChoose a document to start the inspection file.

Not every record is required in every inspection, and a complete defence may need documents not listed here. Match the file to the authority’s precise allegations. Organise a chronology of the employee’s actual work, changes and communications; record the source and custodian of each document. If a witness has first-hand knowledge of an event, preserve their account without coaching or changing it to fit a theory of the case.

How can management prepare before the next visit?

A short internal audit is more useful than a generic binder assembled on the day of control. Sample a few active employees, a recent starter, a part-time worker, a person with a suspension or amendment and, where relevant, an external worker present on site. For each person, trace the signed agreement to the register, the actual hours, payroll and site access. The purpose is to identify a mismatch while the underlying evidence is still available.

Set a clear process for pre-start onboarding: conclude the written contract and transmit the required register data no later than the day before work starts. Manage schedule approvals, working-time records and subsequent REGES-ONLINE updates within their applicable deadlines. Verify that the manager who knows the operational facts can communicate them to HR, and that the service provider responsible for transmission can produce a reliable audit trail. In multi-site or foreign-owned groups, specify which legal entity employs each person and who owns the local compliance task.

For safety, inspect the workplace rather than relying only on forms: compare the risk assessment and training record with tasks and equipment in use. Assign a named person to keep preventive documentation current and to escalate incidents. Follow up on prior ITM measures with dated proof of implementation. Repeat the sample periodically, particularly after opening a new site, changing shifts, adopting a new HR system or bringing in a new labour supplier.

How Atrium assists with an ITM inspection

Atrium can review the inspection request and the employer’s document map, align HR, payroll and operational evidence, assess a disputed factual or legal finding and prepare the response to a contravention report or corrective measure where appropriate. The work begins with the company’s actual records and deadlines, including any safety issues requiring immediate action.

For an international group, the legal review can also clarify which Romanian entity employs the worker, what the local register shows, how foreign-managed systems record time and who is authorised to respond on behalf of the employer. An early document chronology helps management decide which records to produce, which corrections are required and whether a challenge is justified.

This describes a service process and does not report a particular client matter or promise an inspection, sanction or court outcome.

Related Guides

Frequently asked questions

Can ITM arrive without advance notice?

Yes. Law no. 108/1999 gives labour inspectors a statutory right to enter workplaces without prior notice in the exercise of their duties. Verify official identification, involve the responsible company contact and keep a record of requests and copies supplied.

Is a signed employment contract enough to answer an undeclared-work allegation?

Not necessarily. The legal question may concern the date of signing, timely register transmission, work during suspension or a part-time employee exceeding the contracted duration of work, subject to the statutory exception. Compare the contract with the register and evidence of the work actually performed.

Does an employer still need Revisal documents in 2026?

The current workflow is REGES-ONLINE under Government Decision no. 295/2025, following the transition extended to the end of 2025. Historical exports may help explain older events, but prepare current extracts, relevant operation history and the signed source documents for the inspected period.

How quickly must an ITM fine be challenged?

Article 31 of Government Ordinance no. 2/2001 generally gives 15 days from handover or communication of the contravention report. Confirm the service date, the cited law, the competent court and any special procedural rule before filing. A separate corrective or safety measure may require a different analysis.

Does challenging the contravention report stop a safety measure?

Do not assume so. Identify the precise instrument and its statutory basis. A complaint about the sanction and an order to stop dangerous activity or implement corrective work may follow different routes and have different effects. Take immediate safety obligations seriously while legal options are assessed.

What should a foreign-owned Romanian company prepare first?

Identify the Romanian employing entity and local contact, then retrieve the active employee list, signed contracts, REGES-ONLINE data, daily time records and relevant payroll evidence. If the visit concerns workplace safety, involve the designated local safety specialist and collect the site-specific records.

Respond to an ITM inspection with a documented plan

Send the inspection request or report, the documents served, the relevant employee and register records, and any approaching measure or complaint deadline. Atrium can help identify the legal issues, organise the evidence and plan an appropriate employer response.

Contact Atrium about an ITM inspection
Disclaimer: This page provides general information only and does not constitute legal advice, a legal opinion or the creation of a lawyer-client relationship. Legal solutions depend on the specific facts and documents involved.

AI Notice: AI-assisted content, reviewed by a qualified Romanian lawyer.

Ending a supplier contract in Romania: supplier agreement and termination notice on an office desk

Ending a Supplier Contract Early in Romania: Notice, Risk and Next Steps

Romanian commercial contracts · Practical guide for companies

A business may need to leave a supply relationship before its planned end because deliveries have failed, a new supplier is available, or the commercial model has changed. The exit route determines the notice, the final orders and the financial exposure.

In brief

A Romanian supplier contract can end early by an agreed exit, an applicable unilateral termination right, or a remedy for qualifying non-performance. An indefinite-term agreement can generally be ended on reasonable notice under Article 1277 of the Civil Code. A fixed term does not create a general right to walk away simply because the arrangement is no longer attractive. Identify the governing law and exact contract documents, preserve evidence, calculate notice and cure requirements, then settle outstanding orders, stock and invoices in a documented handover.

This guide concerns ordinary business-to-business supply arrangements governed by Romanian law. Energy and utilities, public procurement, regulated distribution, consumer contracts and a cross-border contract governed by another law can raise different rules. If a disagreement is already developing, a Romanian commercial contract review should begin with the signed framework and the orders actually being performed.

Romanian law distinguishes between rescission (rezoluțiune), termination for continuing-performance contracts (reziliere) and unilateral withdrawal or denunciation (denunțare unilaterală). The applicable route determines the conditions for ending the contract and the effect on obligations already performed.

Can you terminate a supplier contract before it expires?

Often, but the legal route depends on the contract’s duration, its exit clause, the seriousness of any breach and whether both sides agree on a close-out.

Read the agreement rather than its title alone. Under Articles 1766 and 1771 of the Romanian Civil Code, a supply arrangement may involve goods or services delivered at later dates or continuously, with the buyer paying the agreed price; where the special supply provisions do not answer an issue, sales rules may supplement them. A master agreement, annexes, purchase orders and accepted forecasts can form the practical transaction. The fact that one document is labelled “supplier agreement” does not settle every issue about its legal classification.

Start by separating expiry from early termination. A fixed term may simply end on its stated date, subject to renewal or outstanding orders. An indefinite term has no contractual end date, but reasonable notice matters. For a fixed term, an express break clause, a sufficiently established breach or a signed exit agreement may supply the route. Commercial dissatisfaction alone is generally not the same as a legal ground for breach termination. Nor is there a universal Romanian “30-day cancellation right” for B2B supply contracts.

Contract exit route selector

Select the situation closest to your file. The result identifies documents to examine; it is not a legal determination.

Breach-based exit

Identify the exact obligation, due date, evidence and legal or contractual termination mechanism. Review whether notice to perform and a cure period are required and whether the default is sufficiently serious. A written termination declaration must meet the conditions for that route; an angry email is not a substitute for a properly supported notice.

Which termination route fits the documents?

Classify the route before drafting a notice. A notice based on the wrong provision can create a claim that your own company has repudiated the deal.

Select a row for its first practical check.

Supplier exit map: grounds, notice and exposure
RoutePrincipal basisDocument to testExposure to manage
Qualifying non-performance and the applicable remedy.Default record, contractual termination clause, notice.Disputed breach, missed cure or continuing orders.
Unilateral exit granted by contract or law.Signed agreement, renewal annexes, notice procedure.Fee, minimum purchase or ineffective notice.
Article 1277 and reasonable notice.Duration clause, order history, transition plan.Too little notice and supply disruption.
Both parties consent to the close-out.Signed exit and settlement agreement.Open orders, stock, deposits and broad releases.
Distinct rules for force majeure, impossibility or hardship.Event evidence, causation, mitigation, notices.Incorrectly treating hardship as automatic termination.
Select a routeThe first check for that route appears here.

What must you check in the contract before sending notice?

Read the entire contract set, including annexes and purchase orders, before selecting the notice ground and effective date.

Duration and renewal. Find the commencement date, initial term, automatic extension and any deadline to opt out of renewal. A notice sent before the renewal deadline can be a notice of non-renewal rather than an immediate early termination. Review whether renewal was validly agreed and whether later purchase orders extend any part of the relationship.

Scope and order mechanics. Determine whether a forecast is non-binding, an accepted purchase order is binding, and what quantity or spend commitments apply. A framework contract may end while accepted orders remain enforceable under their own terms. Conversely, a disputed order may never have been accepted. Do not treat the entire order book as one indivisible obligation without reading the acceptance process.

Exit, default and notice language. Read the break clause, breach definition, notice to cure, escalation steps, deemed receipt, delivery address and permitted method. Some agreements require a named recipient, registered post or a particular email account. A contract might also make termination subject to a specified advance notice or compensation. Compare all versions and amendment dates before relying on a clause copied from an older template.

Commercial allocation. Identify minimum purchase volumes, exclusivity, take-or-pay terms, committed materials, dedicated capacity and termination charges. Separate a stated contractual sum from an asserted loss: each may need a different legal analysis. Check liability caps, exclusions, warranties, security, retention of title and any set-off provision. The termination clause is often too short to answer the real accounting question.

Forum and governing law. English language, a foreign parent or overseas signatures do not alone determine the law applicable to a contract. Read the choice-of-law and dispute clauses and identify the contracting entities. For an international sale of goods, check whether the CISG or other mandatory or sector rules affect the analysis before applying the Romanian Civil Code as though it were the whole framework.

How do you terminate for a supplier’s breach?

Establish an actual non-performance, the available remedy and the procedural conditions for using it. Whether a breach is sufficiently serious depends on the contract, the clause relied upon and the circumstances.

Article 1549 of the Civil Code generally allows the creditor of an unperformed obligation to seek enforcement or, where justified, termination and damages. Article 1550 distinguishes termination ordered by a court, unilateral termination in cases allowed by law or contract, and termination by operation of an express clause. Under Article 1551, a minor non-performance does not ordinarily justify rescission; for contracts performed in successive stages, however, a repeated breach of minor importance can support termination for the future. The contract’s obligations, an expressly drafted termination clause under Article 1553 and the actual pattern of performance must be read together before classifying a default or choosing a remedy.

A typical evidence file should show the obligation, the agreed specification or delivery date, the actual performance, the business consequence and every complaint or attempt to cure. Preserve delivery notes, quality reports, photographs, shipment data, email threads and records of rejected lots. A buyer who repeatedly accepted late deliveries without objection may face factual arguments about waiver, variation or the seriousness of the breach. A supplier alleging non-payment needs the invoices, acceptance or delivery evidence, due dates and correspondence about disputed amounts.

Under Article 1552, unilateral termination by written declaration is available in the circumstances set out by the rule, including where the parties agreed to it, where the debtor is automatically in default, or where it has not performed within the period fixed in a notice to perform. For an express termination clause (pact comisoriu) to operate under Article 1553, it must specify the obligations whose non-performance triggers termination. Whether termination follows the mere failure to perform or requires a prior notice putting the debtor in default depends on the clause and the conditions in Article 1553(2)–(3). Do not issue a bare declaration that a contract “is cancelled” before checking those requirements and any applicable notice or cure condition.

If supply must continue in part, consider whether the problem concerns one delivery, a series of deliveries or the framework itself. Romanian law distinguishes rescission of a contract from termination of a contract performed over time; an early end to future performance does not automatically unwind goods properly delivered and consumed months ago. Alternative remedies such as repair, replacement, price adjustment, performance or an agreed corrective plan may better protect production continuity while rights are reserved.

Risk: Stopping payment or rejecting all future deliveries before the legal position is mapped can turn a genuine supplier default into a two-sided dispute. Check the right to withhold or suspend your own performance and document the proportional response.

Can you leave a fixed-term contract without a breach?

Only if an applicable legal or contractual right permits unilateral exit, or the counterparty agrees. A fixed end date is not itself an unrestricted exit option.

Article 1276 of the Civil Code governs the exercise of a unilateral termination right where that right is recognised by law or contract; it does not create a general right to end every fixed-term agreement. For successive or continuous performance, the provision requires reasonable advance notice and does not affect services already performed or being performed in the relevant period. The applicable clause may set an exercise window, notice procedure or payment obligation, subject to the legal regime governing that particular right. It may also be limited to certain triggering events; words such as “at any time” in a summary email cannot enlarge the signed provision.

Where no such right exists, a mutual exit agreement may be the fastest controllable route. Negotiate a final delivery schedule, payment, stock disposition and reciprocal release with sufficient precision. One party may agree to a commercial concession because redeployment, inventory buy-back or a staged reduction is better than an uncertain dispute. Record the bargain as an amendment or termination agreement signed by authorised representatives; a manager’s operational understanding may not bind the legal contracting entity.

Force majeure, impossibility and hardship are different routes

Force majeure or a fortuitous event concerns an exceptional event and its effect on liability under Article 1351 of the Civil Code, subject to law and the contract. Fortuitous impossibility of performance under Article 1557 asks whether the obligation can still be performed and distinguishes definitive from temporary impossibility; it is not simply another name for a more expensive delivery. Hardship (impreviziune) under Article 1271 concerns performance that has become excessively onerous because of an exceptional change of circumstances, subject to its statutory conditions and the court’s possible intervention. It is not an automatic unilateral cancellation right.

Identify the event, when it arose, which obligations it actually affected, the period of disruption and any contractual notice or mitigation duties. Rising costs, lower demand or a cheaper competitor do not by themselves establish impossibility, force majeure or hardship. A logistics interruption affecting one shipment may require a different response from a permanent impossibility to supply the agreed goods. Read the governing-law and risk-allocation clauses before sending a notice that asserts one of these grounds.

How much notice is required for an indefinite-term contract?

Article 1277 permits either side to end a contract of indefinite duration with reasonable notice; the statute does not prescribe one number of days for every supplier relationship.

Reasonableness is assessed in context. A weekly commodity order with alternative suppliers may have a different transition profile from a custom manufactured component using dedicated tooling. Review the length of the relationship, ordinary order cycles, forecast reliance, production lead times, inventory, substitute sources and the parties’ own communications. Give a clear effective date and a practical transition plan. Where the contract contains a notice period, review its wording alongside the statutory rule and any mandatory limits; do not assume the stated period answers every dispute over fairness or performance during notice.

The same article treats a clause contrary to this right, or a payment imposed merely in exchange for exercising the right to end an indefinite-term contract, as unwritten. That narrow rule does not mean nothing is ever payable when the relationship ends. Separate (1) a charge imposed solely for giving lawful notice, (2) invoices and independently binding minimum-purchase or take-or-pay obligations, and (3) damages for a separate contractual breach, including a failure to give reasonable notice if the conditions for liability are met. Each item needs its own contractual basis and factual assessment.

What should the termination notice say and how should it be served?

A useful notice identifies the agreement, legal route, facts, required action and effective date, while following the precise contractual service method.

Identify both legal entities, the signed contract and amendments, the relevant purchase orders, the clause and statutory basis relied on, and the chronology. If the complaint is defective goods, name affected batches and test results. If it is non-payment, identify invoices, due dates and the net amount after undisputed credits. Where notice to cure is required, say exactly what performance is sought and by when. If the contract provides an escalation or meeting procedure, account for that step and its deadline.

Separate the cure notice from the eventual declaration of termination where the route requires two stages. In the final notice, state when the agreement will end, what should happen to pending deliveries, and who should discuss the account reconciliation. Reserve rights to payment or damages carefully without implying that those amounts are already admitted by the other side. Avoid broad accusations that cannot be documented. A notice can be firm without being theatrical.

Use the designated address, email, person and method in the signed notice clause. Keep the sent message, attachment, courier receipt, delivery confirmation and any response. An electronic signature or ordinary email might be workable in one agreement and non-compliant in another. If a notice clause treats receipt as occurring on a later business day, calculate the intended effective date accordingly. Have someone outside the commercial negotiation verify this mechanical step before transmission.

What happens to purchase orders, stock and payment after termination?

The end of future supply does not automatically erase accrued invoices or decide who bears the cost of orders and materials already committed.

Build a close-out schedule order by order. Mark accepted and unaccepted purchase orders, work in progress, completed goods, dispatched goods, goods in transit and products awaiting acceptance. Check whether the framework gives either party a cancellation right over each category and whether the parties’ conduct varied it. An open-ended claim for all “future revenue” should be tested against actual contractual commitments and the applicable damages rules.

Reconcile invoices, credit notes, deposits, rebates, price adjustments, set-off arguments and any retention of title. Preserve proof of receipt and quality acceptance. If the buyer disputes only a portion of an invoice, explain the grounds for that portion and avoid leaving the whole account opaque. For a more focused payment analysis, see our guide to late payment interest and remedies in Romania.

Physical and digital assets often require a separate handover: tools and moulds, samples, specifications, drawings, credentials, customer data and confidential information. Determine ownership and return or deletion obligations from the contract and applicable law. Record continuing warranties, product traceability and any recall or safety cooperation. Termination does not itself extinguish a valid confidentiality, dispute resolution or post-termination obligation; whether a clause survives depends on its terms and legal effect.

If transition supply is needed to prevent disruption, put the interim quantities, prices, payment security, delivery dates and reservation of rights in writing. That arrangement can preserve business continuity without necessarily abandoning a dispute about earlier failures. Conversely, the parties should not assume a fresh purchase order is automatically governed by a framework they have already ended.

What damages or termination fees could follow?

Exposure depends on the contractual allocation, whether termination was valid, the loss claimed and the proof connecting that loss to the breach.

Articles 1530 and 1531 of the Civil Code provide the general framework for contractual damages and full reparation of loss caused by non-performance, subject to the relevant legal conditions. A claim should be examined with invoices, costs, mitigation steps, substitute supply prices and the contract’s limitation provisions. A forecast is not automatically a guaranteed order. Nor is every sunk investment recoverable simply because the relationship ends sooner than anticipated.

Review any liquidated sum or termination charge separately. Its legal treatment turns on the actual drafting and reason for payment: a charge imposed solely for exercising the Article 1277 right is different from a contractual penalty for a distinct breach, the price of goods already supplied, or an independently binding minimum-purchase or take-or-pay commitment. None should be assumed valid or payable solely because it appears in an invoice; equally, Article 1277 does not erase them all. Check the obligation’s wording, any mandatory rule, accrued orders, evidence of loss and the notice actually given. A headline percentage in a commercial presentation is not enough to calculate a claim.

Commercial exposure can also be indirect: emergency replacement sourcing, production interruption, disputed tooling, customer commitments and reputational friction. Put a contemporaneous evidence and mitigation plan alongside the legal analysis. For an unpaid account or anticipated claim, assess whether a demand, negotiated settlement or commercial litigation support is appropriate. Do not promise a particular recovery or court result before testing the evidence and jurisdiction.

What should a company put in its exit file?

Gather the documents before the relationship or digital records change. Select the items collected to track the file; this checklist stores nothing outside your browser session.

0 of 8 items selected

Choose any card to track the document.

Client Experience: Exiting a Stalled Supplier Relationship

The Situation

A Romanian manufacturer had relied on the same domestic raw-material supplier for several years under an indefinite-term supply framework. Deliveries had slipped twice during the previous year. While the delays were not obviously serious enough to support a clear breach-based termination, they had begun to affect production planning and supplier confidence. The client had already identified an alternative supplier and wanted an orderly exit with minimal operational disruption and no unnecessary exposure.

Atrium’s Approach

Atrium reviewed the framework agreement, amendments and recent purchase-order history to identify the obligations that remained binding. Given the factual record, the firm concluded that the matter was better analysed as a reasonable-notice exit under Article 1277 of the Romanian Civil Code than as a contested breach-based termination. The proposed notice period was aligned with the client’s replacement-sourcing timetable, while the notice mechanics and final-order schedule were drafted to comply with the contract’s own requirements.

The Outcome

The parties completed the exit on the planned timetable through a documented transition process rather than a breach-based dispute. Outstanding orders, inventory issues and final account reconciliation were addressed before the notice period expired, allowing the client to implement its replacement-supplier strategy in a controlled manner.

This illustration is a composite drawn from recurring fact patterns and does not describe any specific client or matter. It is provided for general information only and does not imply that another matter with similar facts would achieve the same outcome. Every supplier exit depends on the particular contract wording, factual record and timeline involved.

How Atrium assists with a supplier contract exit

A useful legal review joins the legal ground to the operational facts. Atrium can examine the signed contract set and order history, map notice and cure requirements, assess evidence of default, draft correspondence and negotiate a close-out of invoices, stock, tooling and transition supply. Where the disagreement cannot be settled, the file can be organised around the contract’s forum and the remedies actually supported by the documents.

For an international company, the review may also need to coordinate instructions from a foreign parent with the Romanian contracting entity and its purchasing, logistics and finance teams. The service description explains the work that may be involved; it does not refer to a particular client matter or guarantee an outcome.

Related Guides

Frequently asked questions

Can I cancel a Romanian supplier contract with 30 days’ notice?

There is no universal 30-day B2B cancellation rule. Check whether the contract is fixed or indefinite, any express break right and the agreed notice procedure. Article 1277 requires reasonable notice for an indefinite-term contract, which depends on the relationship.

Does a supplier’s late delivery automatically end the contract?

No. Examine the delivery obligation, seriousness or repetition of the default, contractual remedies and whether a notice to perform or cure period is required. One late order does not automatically end every other order or the framework.

Can a fixed-term supply contract end without a breach?

It may end through a valid contractual or statutory unilateral exit right, or by agreement between the parties. Without such a route, a change of commercial preference alone does not ordinarily cancel the remaining fixed-term commitments.

What happens to purchase orders already accepted?

Read each order and the framework together. The parties should identify accepted quantities, work in progress, deliveries in transit and any specific cancellation provisions. Termination of future supply does not automatically erase accrued rights or obligations.

Can the other party claim a termination fee or lost profit?

That depends on the contract, the legal route and proof of the claim. Article 1277 treats a charge imposed solely for exercising the right to end an indefinite-term contract as unwritten. It does not automatically eliminate accrued invoices, independent minimum-purchase commitments or damages for a separate breach. Test each claim, any liability limits, causation and mitigation.

Is an email sufficient as a termination notice?

Only if it meets the applicable form and service requirements. Check the signed notice clause, addressee, delivery method and timing, then retain proof of transmission and receipt. Some situations require a prior notice to perform before a final termination declaration.

Review your supplier exit before sending notice

Send the signed agreement and amendments, current orders, the notice clause, the default or commercial reason for exit, and the proposed timetable. Atrium can assess the available route, draft a defensible notice or negotiated close-out, and identify the payment and continuity issues that need resolution.

Contact Atrium about your supplier contract
Disclaimer: This page provides general information only and does not constitute legal advice, a legal opinion or the creation of a lawyer-client relationship. Legal solutions depend on the specific facts and documents involved.

AI Notice: AI-assisted content.

Business operating permit refused in Romania: application dossier and floor plan on a sunlit lawyer’s desk

Business Operating Permit Refused in Romania: Documents and Legal Options

Business licences · local authorities · Romania

A refusal to issue an operating permit can delay a store opening, interrupt a lease timetable or put an existing site at risk. The first business decision is to identify the exact approval sought, what the authority actually issued and whether the problem can be corrected without losing a procedural deadline.

In brief: A company should preserve the application, the authority’s response and proof of when each was received. A Trade Register operating certificate does not, by itself, replace every local or sector-specific permission. For local trading approvals, OG no. 99/2000 and the applicable municipal rules matter; for a legal challenge, the route under Law no. 554/2004 depends on whether the company received an individual administrative act, an express unjustified refusal or no decision at all. Where there is silence, the separate tacit-approval regime must also be checked before assuming either approval or refusal.

This guide concerns a business seeking a local acord de funcționare (operating approval) or a comparable municipal operating authorisation, particularly for a fixed-site retail or service location. Food, hospitality, health, environmental, fire-safety and other regulated activities may require distinct approvals under special rules. A building permit and an ANPC contravention report also follow different legal questions and should not be treated as interchangeable with a trading authorisation.

What did the authority refuse to issue?

Identify the exact instrument, issuing authority, address and proposed activity before choosing a remedy. The word “permit” can refer to several documents with different purposes and challenge routes.

Article 6 of OG no. 99/2000 provides for local approval of trading in public areas and, as amended in 2024, describes a fixed-site acord de funcționare as an individual administrative act issued by the competent local authority or Bucharest sector. The statutory text ties its duration to unchanged initial conditions and valid application documents. Article 7 of the same ordinance also states circumstances in which the approval under Article 6(2) is not issued, including conflicts with specified urban-planning criteria or trading from improvised premises. The actual refusal must be tested against the precise business activity, the local regulation and the submitted file.

Registration at the National Trade Register Office, ONRC, under Article 121 of Law no. 265/2022, involves recording a standard declaration by which the applicant assumes responsibility for the legality of declared activities at identified locations. A Trade Register certificate evidences that registration; it does not resolve every land-use, food-safety, environmental or local trading condition. Conversely, an authority should not treat a generic checklist item as an automatic reason to reject an application unless the legal and factual basis is established for that location.

The permit name, competent office and documentary requirements vary with the activity and municipality. For a retailer, a change of premises, shop layout or activity can also matter: Article 6 of OG no. 99/2000 addresses transfer, relocation and extension, and its post-2024 provisions address changes to the activity, selling area or the validity of documents in the original file. Review those facts before assuming an older authorisation continues to cover the new operation.

Document route selector

Choose what you actually received to see the documents and procedural question to check first.

Examine the decision, not only its conclusion

Preserve the complete signed communication, proof of service, the application and the local rule cited. Determine whether it is an individual administrative act addressed to the company or an express refusal to resolve its request within the meaning of Law no. 554/2004. That classification controls whether a prior administrative complaint is required and when court time starts.

What should the business do in the first days after a refusal?

Record service dates, freeze the application file and keep operations within the permissions already in force. Then test the refusal against the exact rules and consider a corrected application and legal response on parallel tracks.

  1. Preserve the decision and its delivery. Save the full letter or electronic notice, attachments, envelope, portal timestamp and any communication identifying the authority and decision maker. A forwarded screenshot may omit the legal basis or the date needed to calculate a deadline.
  2. Rebuild the version actually filed. Keep the original form, uploaded files, payment evidence, receipt number, correspondence and later supplements. Mark which document was in the file on the date the authority decided.
  3. Compare the refusal with the governing text. Read the legal provision cited, the applicable local council decision and the evidence concerning the specific premises. Separate a documentary gap from a disagreement about zoning, the use of the premises or the scope of the approved activity.
  4. Check related operational restrictions. Determine whether an existing authorisation remains valid, whether a separate order restricts activity and whether customers, staff, suppliers or the landlord must be informed of a changed opening date.
  5. Choose and diary every route. A corrected application can be commercially efficient, but it should not be assumed to extend the period for challenging an existing act. Record each possible administrative and court deadline independently.

A landlord’s assurance that the premises can be used for commerce, a CAEN activity entered at ONRC and a contractor’s promise to finish fit-out do not answer the local authority’s legal objections. Ask what each document proves. Where the refusal cites a technical specialist opinion, request the underlying finding and check whether it relates to the actual layout or to an outdated version of the plans.

Which response route fits the document?

A refusal is not one standard event. The same business may receive a procedural request for missing evidence, a reasoned individual decision denying an approval, an express statement declining to decide the application or no reply. The table separates the first review question; it is not a substitute for classifying the act in the particular file.

Click or tap a document in the table to see what to verify first.

Business response map: documents and deadlines to verify
What arrived?First documents to preservePotential responseCritical distinction
Application receipt, missing-document notice and earlier attachments.Supply a coherent supplement, ask for a precise legal basis where needed and retain proof of filing.Check whether this is a procedural step rather than a final decision.
Signed act, reasons, annexes and proof of communication.Assess correction, the applicable prior-complaint requirement and judicial review.The general 30-day period under Article 7(1) is for a prior complaint where required, not a universal court-filing deadline.
Original request, registration proof and the express response.Assess whether Article 2(2) and the Article 7(5) prior-complaint exception apply; consider the court route.Labels in the letter are less important than the act’s legal effect and requested remedy.
Complete filed application, receipt, reminders and any local procedural notice.Verify the statutory decision period, any tacit-approval route and the remedy for failure to decide.Law no. 554/2004 and OUG no. 27/2003 ask different questions; neither should be assumed to apply without checking the file.
Current approval, later order, inspection evidence and service record.Challenge the operative act, assess any interim relief and manage the separate operating obligations.Suspending a negative decision does not itself create a missing approval.
Select a document to inspectIts first practical check will appear here. The document and the applicable law determine the procedural route.

What are the deadlines for challenging a Romanian permit refusal?

There is no single “30-day court appeal” for every refusal. Under Law no. 554/2004, a prior complaint against an individual administrative act addressed to the applicant generally has a 30-day clock, while a court action generally has a separate six-month clock with a starting point that depends on the procedural route.

Under Article 7(1) of Law no. 554/2004, the addressee of an individual administrative act ordinarily asks the issuing authority or its superior, if any, to revoke it within 30 days of communication before bringing a court claim. For well-founded reasons, the addressee may lodge that prior complaint after the 30-day period, but no later than six months from the act’s issuance. This is an exception to analyse in the specific case, not an extension to plan around.

The statute also treats an unjustified refusal to resolve a request and a failure to respond within the statutory period as acts assimilated to individual administrative acts under Article 2(2). Article 7(5) expressly removes the mandatory prior complaint in the Article 2(2) situations. Not every refusal constitutes an “unjustified refusal” within the meaning of Article 2(2); the legal characterisation depends on the authority’s statutory duties and the circumstances of the file. A written document that says “rejected” needs careful classification: what matters is its content, legal effect and the underlying special law. Do not file automatically under the wrong route or assume a voluntary request for reconsideration pauses a court clock.

Article 11 of Law no. 554/2004 generally provides a six-month limitation period for the court action, calculated from the event specified by the statute for that procedural route. This may be the answer to a prior complaint, the communication of an unjustified refusal or the expiry of the lawful decision period. The current text also addresses knowledge of an act where the prior complaint is not required. Special statutes or a different type of administrative act can alter this analysis. Build a dated timeline rather than copying a deadline from a generic administrative-law guide.

What if the authority does not answer? OUG no. 27/2003 on tacit approval provides a separate mechanism that can apply to eligible authorisations after the applicable decision period expires without a response. Whether tacit approval applies to a particular municipal operating authorisation depends on the special legal framework and the specific local regulatory regime. It has its own conditions, exceptions and process for obtaining the official document. A complete filed application and any timely written refusal or deficiency notice matter. The 30-day default definition of administrative silence under Law no. 554/2004 is not by itself proof of tacit approval. Conversely, telling every applicant that silence can never have a permissive effect would also be inaccurate. Establish which regime applies to this permit before the company begins operations or chooses a court route.

Deadline control: Keep at least four dates separate: filing of the permit application, service of a refusal, filing of any mandatory prior complaint and receipt of the authority’s response. If there is no response, calculate the relevant statutory decision period for the particular application. A reopened conversation with the authority should not be relied on to restart a limitation period without legal analysis.

For many local-authority permit disputes, Article 10 of Law no. 554/2004 places the first-instance case before an administrative-fiscal tribunal, unless a special organic law provides otherwise. The article also governs territorial jurisdiction for a private company. Cases involving central authorities and certain other disputes can follow different rules. This is different from the judecătorie route used for a contravention complaint against an ANPC fine. Check the act, defendant and relief before drafting pleadings.

How do you assess whether the refusal can be challenged?

The fact that a refusal is commercially costly does not, on its own, establish illegality. Compare the authority’s stated grounds with the actual application, the applicable statutory requirements, the local regulation and the facts at the premises. A productive legal review commonly tests five questions.

  • Competence: Was this the authority responsible for the precise approval and site, and did the decision come from a person empowered to make it?
  • Legal basis: Does the cited statute or local decision apply to this activity and location? Does it actually require the missing document or forbid the proposed use?
  • Facts and record: Does the refusal accurately describe the plans, CAEN activity, lease rights, prior approval and the documents already submitted?
  • Reasoning: Can the business identify the concrete defect it is expected to remedy and the evidence on which the authority relies?
  • Consistency: Does the authority’s treatment of the file reflect the legal criteria, including any limits on its discretion, rather than an unsupported preference?

Article 7 of OG no. 99/2000, together with the applicable local council regulation adopted under the ordinance, is particularly relevant when a local trading approval under Article 6(2) is refused. Article 7 lists statutory circumstances in which that agreement is not issued. A business can test, for example, whether a claimed urban-planning conflict is grounded in the actual planning instrument and whether a characterization of the premises as improvised matches the building and occupancy evidence.

Some defects are real and fixable. A missing consent, outdated plan or mismatch between the activity described to ONRC and the application submitted to city hall may justify a corrected submission. Identifying a lawful correction is often useful even where the business reserves the right to challenge an unsupported refusal. Preserve the original evidence so the revised file does not erase the facts relevant to the first decision.

Reapply, request reconsideration or go to court?

These are tools for different problems. A new application may be the quickest way to address a documented omission, but it may require fresh technical work and can leave the original refusal undisturbed. A prior administrative complaint, where mandatory, asks the authority to reconsider an individual act. Court proceedings test legality and may seek recognition of the claimed right or an order for the authority to issue an act or complete an administrative step; Article 18 of Law no. 554/2004 identifies the court’s potential remedies. No route guarantees that a company will receive the permit.

Corrected application

Use when the factual defect is clear and can be remedied. Confirm the new file, fee and planning position; keep the challenge deadline for the earlier decision under separate control.

Administrative response

Use the applicable reconsideration procedure to identify errors in the decision and request the precise correction. Determine first whether a prior complaint is required or merely a voluntary request.

Judicial review

Consider when the refusal remains legally contested or the authority fails to decide. Define the act or omission challenged, the relief requested, supporting evidence and the correct court route.

Where an existing operating authorisation has been withdrawn or restricted, there may also be a separate question about interim protection. Articles 14 and 15 of Law no. 554/2004 address suspension of a unilateral administrative act in justified circumstances and to prevent imminent damage. The available timing, the nature of the act and the procedural conditions require a close reading of the current text. Even if interim relief is obtained, it does not automatically replace any legally required authorisation or remove distinct safety obligations. Management should not treat a pending court action as authority to trade.

What should a company put in its defence file?

Prepare one indexed file that enables the management team and counsel to reconstruct the decision. Dates, location and version control matter as much as a legal memorandum. The minimum working set will often include:

Select each item as you assemble the file. The selection is a personal on-page checklist and does not save or upload documents.

0 of 8 items selectedChoose a document to start your file checklist.

Where a dispute affects an opening date, keep commercial records separately: notices to a landlord, contractors’ handover schedule, staff mobilisation dates, supplier commitments and customer announcements. These records may help assess business impact and any claim for damages, but should not be presented as proof that the legal requirements for a permit were fulfilled. Our litigation support page explains how document review and representation fit within a dispute involving a public authority.

Representative Experience

Assisting an international retailer facing a local-authority permit refusal.

Our lawyers advised an international retail operator after a Romanian local authority refused to grant the operating approval required for a new commercial location. The project involved a significant lease commitment and a planned opening timetable that depended on obtaining the necessary municipal authorisation.

We analysed the refusal decision, the applicable provisions of OG no. 99/2000, the local council rules governing commercial activities and the supporting documents submitted with the application. The review focused on identifying whether the concerns raised by the authority reflected genuine regulatory requirements or issues capable of clarification through additional evidence.

The engagement included regulatory due diligence, assessment of possible remedies under Romanian administrative law, document review and strategic advice regarding the client’s operational and timing risks.

This example is provided for illustrative purposes only and does not describe all aspects of any particular client matter.

Two illustrative business situations

Retail premises with a correctable gap. A foreign-owned retailer secures a lease and files for local operating approval. The authority asks for a current site plan corresponding to the shop’s new configuration. The company should preserve the original application, confirm whether the request is a supplement rather than a final refusal, obtain the appropriate technical document and record when it is resubmitted. If an actual rejection is later issued, the first request and the authority’s stated reasons still matter.

Reasoned refusal despite a complete file. A service operator receives a signed decision asserting that its fixed location breaches the local planning rules. The business has filed a current plan and evidence of lawful use. The first legal tasks are to verify the exact planning basis, check the authority’s competence, preserve the delivery date and classify the decision for Article 7 of Law no. 554/2004. Negotiating with the landlord about an opening delay and assessing the legal route can happen in parallel. These examples are illustrations, not descriptions of client outcomes.

Related Guides

Frequently asked questions

Does an ONRC certificate allow a business to open despite a local refusal?

Do not assume so. Under Law no. 265/2022, the Trade Register records the company’s declaration concerning its activities and premises. A local operating approval or sector-specific permission may still be required. Check the exact activity, location and statutory requirements before opening to customers.

Is there always a 30-day deadline to take a permit refusal to court?

No. Article 7 of Law no. 554/2004 generally provides a 30-day period for a prior administrative complaint against an individual act where that step is required. The court action has a distinct timetable under Article 11. An express unjustified refusal or administrative silence may follow the statutory exception from the mandatory prior complaint. Classify the specific communication first.

What if city hall asks for additional documents instead of issuing a decision?

Check whether the application remains under review, what legal basis supports the request and what deadline applies. Supply a complete response with proof of filing if the documents are properly required. Keep the initial application and the notice because they establish the sequence and may matter if a later refusal is challenged.

Does silence after 30 days mean the local permit has been granted?

Not necessarily. Law no. 554/2004 generally defines a failure to respond by reference to 30 days unless another period is set by law. OUG no. 27/2003 may separately provide for tacit approval if it applies to this authorisation and its conditions are met. A complete application, the actual decision period, any exception and any written response or deficiency notice must be checked before operating.

Can a company submit a corrected application and challenge the original refusal?

The two courses may address different issues, depending on the file. Correcting a genuine documentary gap may help the project move forward, while an earlier decision may still affect the company’s position. A new submission should not be assumed to suspend or restart a deadline for challenging the previous act.

Can a court suspend the refusal so the business opens immediately?

A suspension application under Law no. 554/2004 has specific conditions and must be assessed against the operative act. Suspending a refusal does not itself create a missing operating authorisation. If an existing permit was withdrawn, that is a different situation requiring separate analysis of the withdrawal and any other applicable restrictions.

Get the refusal and permit file reviewed

If your company has received a local operating-permit refusal, a request for further documents or an order affecting an existing authorisation, a focused review can identify the governing rule, the procedural route and the documents needed for the next decision. Send the full communication, filing receipt, local authority name and a short timeline.

Contact Atrium about the permit file
Disclaimer: This page provides general information only and does not constitute legal advice, a legal opinion or the creation of a lawyer-client relationship. Legal solutions depend on the specific facts and documents involved.

AI-assisted content.

Primary legislation checked for this draft on 25 September 2026: OG no. 99/2000, Law no. 554/2004, Law no. 265/2022 and OUG no. 27/2003. Local rules and special activity permits must be checked for the actual premises.

Employment due diligence in Romania for a business acquisition

Employment Due Diligence in Romania: A Buyer’s Legal Checklist

Employment law • M&A • Romania

Employment due diligence in Romania helps a buyer understand the people, contracts, payroll obligations and workforce risks it may inherit with a target company. The review should connect employment documents with the transaction structure, valuation, warranties, indemnities and post-closing integration plan.

The scope and consequences of employment due diligence differ significantly between share acquisitions and asset transactions. In a share acquisition, the employing company normally remains the same legal entity, while an asset or business transfer may require a separate analysis of whether employees and employment-related rights transfer with the relevant undertaking.

What is employment due diligence in a Romanian transaction?

Employment due diligence is a transaction-focused review of the target’s workforce and employment liabilities. It is not the same as a general HR audit. The buyer needs to know which risks affect price, continuity, retention, integration and the contractual protection package.

The scope may include employees, directors, consultants, independent contractors, temporary workers, secondees, expatriates and other individuals providing services to the target. The legal analysis typically depends on the actual working relationship and not solely on the contractual label used by the parties.

Romanian employment due diligence is primarily assessed under Law No. 53/2003, the Romanian Labour Code, together with the special legislation applicable to matters such as transfers of undertakings, collective relations, occupational health and safety, employee data and the employment of foreign nationals.

This guide is distinct from general Romanian employment law advice, disciplinary dismissal guidance and the separate review of employees versus independent contractors. Its focus is the buyer’s decision before, during and after an acquisition.

Buyer’s Review Map

Interactive review map

Select an employment area

Click or tap a card to see the first documents and questions to request.

Workforce structure

Request a headcount by entity, role, location and employment status. Identify employees, directors, contractors, temporary workers, secondees and key individuals whose departure could affect the business.

Employment Due Diligence Risk Scanner

Interactive risk screen

Select the signals that apply

This is a preliminary review signal, not an automated legal opinion. Select the statements that describe the target. The result helps identify where the data room needs deeper review.

Preliminary result: select the statements that apply to see the suggested diligence response.

What does Romanian employment due diligence examine?

The central test is whether the target’s written documents, payroll records and actual employment practice tell the same story. A signed contract may not reveal unpaid overtime, informal benefits, misclassification, inconsistent termination practice or undocumented management arrangements.

The buyer should identify the employing entity, workplace, reporting line and practical role for each material category of worker. It should then compare that information with employment contracts, amendments, payroll, internal policies, time records, leave records and communications where relevant. Gaps are not necessarily breaches, but they are signals that require explanation and proportionate follow-up.

The review should also distinguish liabilities that remain with the seller from risks that will affect the buyer after completion. This is especially important where the buyer intends to reorganise the workforce, harmonise benefits, move employees between group entities or change managers shortly after closing.

Share deals, asset deals and transfers of undertakings

In a share acquisition, the target company remains the employer and its employment contracts generally continue within the same legal entity. The buyer nevertheless needs to review change-of-control provisions, transaction bonuses, retention arrangements, employee communications and any post-closing measures that could require consultation, consent or amendments.

In asset transactions or business transfers, buyers should assess whether Articles 173–174 of the Romanian Labour Code and Law No. 67/2006 on safeguarding employees’ rights in transfers of undertakings apply to the transfer of an undertaking, unit or part of one. Where the legal requirements for a transfer of undertaking are met, employment contracts and related rights and obligations may transfer automatically to the transferee together with the relevant business unit. Information and, where measures affecting employees are envisaged, consultation obligations may also arise.

Not every asset purchase constitutes a transfer of undertaking. The analysis is fact-specific and should examine the business activity, assets, workforce, organisation and continuity of the relevant economic unit. The transaction timetable should allow the parties to identify the affected employees, collective rights, accrued liabilities and mandatory information or consultation steps before completion.

Employment contracts and actual working practice

Romanian employment contracts should be reviewed for role, place of work, working time, salary, benefits, probation, confidentiality, intellectual property, mobility and termination-related terms. The review should not stop at the template. Amendments, side letters, emails, payroll records and established practice may create additional obligations or evidence.

For contractors and consultants, the buyer should test the factual relationship. Control, integration, exclusivity, personal performance, economic dependence and the way work is organised may matter more than the title of the agreement. Romanian tax authorities, labour inspectors and courts may examine the factual circumstances of the relationship irrespective of contractual labels. A contractor issue may create employment, tax and social-security exposure and should be assessed with the relevant accounting and tax workstreams.

Payroll, benefits and hidden employment liabilities

Payroll due diligence should reconcile employment terms with salary payments, bonuses, commissions, overtime, holiday pay, sick leave, meal or mobility benefits, expense policies and any retention or equity arrangements. The question is not only whether a payment was made, but whether the target has recorded and treated the payment consistently.

Potential liabilities may arise from unpaid entitlements, informal benefits, inaccurate working-time records, delayed payments, incorrect deductions or practices applied differently to comparable employees. The buyer should request explanations for material inconsistencies and determine whether they require quantification, remediation or a specific transaction protection.

Key employees deserve separate attention. A transaction may affect retention, reporting lines, incentives, confidentiality, non-compete obligations, intellectual-property arrangements and the continuity of client or technical relationships. The SPA and integration plan should identify which people are material to the investment case and what can realistically be done to retain them.

Where restrictive covenants are material to the investment, the buyer should verify their scope, enforceability, duration and, where applicable, compliance with the requirements governing post-termination non-compete obligations under Romanian law.

In technology-focused transactions, the buyer should verify the allocation of intellectual-property rights created by employees, contractors and management personnel. Employment contracts, contractor agreements, confidentiality undertakings and IP assignment documents should be reviewed together with the factual development process and the rights required to operate or commercialise the target’s products.

Dismissals, claims and protected employees

Termination risk should be reviewed through the underlying facts and procedure, not only through the existence of a signed dismissal decision. Request information on disciplinary investigations, performance procedures, redundancies, settlement arrangements, grievances, threatened claims, court files, labour-inspection requests and communications with employees or representatives.

The buyer should identify whether a claim may affect more than the individual claimant. A repeated payroll practice, a group-wide working-time issue or a pattern of termination decisions may create a wider exposure than the disclosed dispute suggests. Protected categories, leave-related rights and employee representation may also affect the timing and defensibility of a proposed post-closing change.

The review should cover collective labour agreements, collective-bargaining procedures, trade unions and employee representatives, including compliance with applicable information and consultation obligations. The target’s arrangements should be checked against Law No. 367/2022 on social dialogue, as subsequently amended, and against any sectoral or company-level collective terms that may apply.

Occupational health and safety and ITM history

Employment due diligence should also review occupational health and safety compliance under Law No. 319/2006. The data room should address work accidents, occupational diseases, mandatory training records, risk assessments, prevention measures and the organisation of occupational-health and safety responsibilities.

The buyer should request details of Labour Inspectorate (ITM) inspections, findings, sanctions and pending compliance measures. A recurring failure, incomplete risk assessment or serious accident may require specialist investigation, quantified remediation and specific transaction protection rather than reliance on a general employment warranty.

Data protection, monitoring and employee information

Employment due diligence often involves personal data about employees, candidates, managers and claimants. The buyer should establish what information is requested, who can access it, how it is shared in the data room and whether the target has a lawful and documented process for the disclosure.

The substantive review may include employee monitoring, access logs, CCTV, productivity tools, recruitment platforms, health information, international transfers, retention and security. Sensitive information should be minimised and appropriately protected. During preliminary stages, the parties should minimise employee-identifying information and consider anonymisation, aggregation, redaction or controlled clean-room procedures where appropriate. The transaction team should coordinate the employment review with the GDPR workstream rather than copy entire personnel files into a data room by default.

Where employee monitoring through electronic communications, access logs, productivity tools or video surveillance is involved, the review should assess compliance with the GDPR and Article 5 of Law No. 190/2018. Relevant issues may include necessity and proportionality, transparency, prior consultation with employee representatives, retention periods and whether a data-protection impact assessment is required.

Non-EU personnel, work authorisations and residence rights

For non-EU personnel, the review should assess compliance with Emergency Ordinance No. 32/2026 on access of foreign nationals to the Romanian labour market and Emergency Ordinance No. 194/2002 on the status of foreign nationals. Depending on the workforce and the applicable regime, the review may cover the employer’s registration or authorisation position, employment authorisations, residence rights, changes of employer or role, secondments and applicable reporting obligations.

What should the buyer request?

Interactive document checklist

Select a review area

Click or tap a numbered card to see the documents and checks relevant to that workstream.

Workforce data

Obtain headcount, roles, locations, employment status, start dates, salary bands and key-person information.

Employment risks and SPA protection

Select a row to highlight the transaction takeaway.

Employment due diligence matrix
Review areaWhat the buyer checksPossible transaction response
Who works for the target and whether the contractual labels match the factual relationship.Workforce warranty, remediation plan or specific protection for classification exposure.
Whether an asset or business transfer meets Articles 173–174 of the Labour Code and Law No. 67/2006, and which employees, rights and consultation steps are affected.Transfer plan, employee information or consultation process, liability allocation and closing timetable.
Salary, bonus, benefits, equity, expenses, payroll practice and unpaid entitlements.Disclosure, price adjustment, warranty or indemnity for quantified liabilities.
Terminations, disciplinary processes, protected employees, claims and authority investigations.Specific indemnity, closing condition, litigation reserve or post-closing conduct protocol.
Collective bargaining, employee representatives, trade unions, risk assessments, work accidents and ITM history.Specialist review, remediation covenant, specific warranty or indemnity for identified exposure.
Retention, management continuity, confidentiality, non-compete and ownership of employee or contractor-created IP.Retention arrangements, IP confirmations, transition covenant or targeted warranty.
Employee-data processing, monitoring, access, transfers, retention, security and compliance with the GDPR and Law No. 190/2018.Privacy remediation, updated notices, DPIA assessment or integration workstream.
Employer status, employment authorisations, residence rights, secondments and cross-border assignments under the current immigration framework.Condition precedent, authorisation or renewal plan, warranty or continuity arrangement.

Due Diligence Timeline

Transaction sequence

What should happen at each stage?

Before signing

Agree the scope, confidentiality controls, data-room categories and responsible contacts. Prioritise risks that could affect valuation, continuity or the timetable.

Bottom line for the buyer

Employment due diligence should end with a decision, not a document pile. For each material issue, the buyer should know the factual position, likely exposure, responsible owner, timing and contractual or operational response.

A practical report may classify findings as matters to accept, investigate, remediate before closing, disclose, protect through the SPA or manage through post-closing integration. That structure allows the buyer to negotiate from evidence and prevents employment risks from disappearing inside a generic compliance warranty.

Employment Due Diligence in Practice

Anonymised client matter. The following summary describes the type of employment due-diligence issues addressed in a transaction handled by Atrium Romanian Lawyers. Certain details have been anonymised and simplified to protect client confidentiality.

Employment review for the acquisition of a Romanian technology and business-services company

A foreign investor considered the acquisition of a Romanian technology and business-services company with a workforce operating across multiple locations. As part of the transaction, the buyer requested a workforce inventory, employment agreements, payroll records, contractor documentation, internal policies and information relating to ongoing employment disputes.

The review identified several matters requiring further analysis. Workforce records were not fully consolidated, certain contractors performed functions comparable to those carried out by employees, and some compensation practices appeared in payroll data without being consistently reflected in the underlying contractual documentation. The review also identified retention considerations affecting key personnel involved in the operational continuity of the business.

Issues identified

Workforce records, contractor classification, compensation documentation and key-person retention.

Atrium’s role

Document review, employment-risk assessment and coordination with the wider transaction team.

Transaction response

Targeted disclosures, contractual protection, document remediation and post-closing integration measures.

Atrium Romanian Lawyers coordinated the employment due-diligence workstream, reviewed the available documentation and prepared a risk-based assessment of the identified matters. Our team worked with the wider transaction team to prioritise the findings according to their potential legal, financial and operational impact.

The findings were translated into practical transaction recommendations, including targeted disclosures, specific contractual protections, pre-closing document remediation and post-closing integration measures.

The transaction documentation was updated to address the employment matters identified during the review. A structured plan was also prepared for addressing priority employment issues following completion.

This matter has been anonymised and simplified for publication. The appropriate legal analysis and transaction protections depend on the specific facts, documents, transaction structure and commercial objectives of each matter.

How Atrium Romanian Lawyers can assist

Atrium Romanian Lawyers can coordinate an employment due-diligence workstream for a Romanian acquisition, investment or corporate reorganisation. The review can cover workforce structure, contracts, payroll, working time, terminations, disputes, contractors, GDPR, permits, key employees and the translation of findings into transaction documents.

Frequently asked questions

Is employment due diligence necessary for every acquisition?

The scope should be proportionate to the target’s workforce, sector, transaction structure and known risk. A business with a large workforce, regulated operations, key employees or employment claims usually requires a deeper review.

What is the most common employment due-diligence gap?

A common gap is the absence of a reliable workforce inventory connecting contracts, payroll, working practice, disputes and employee data. Without that map, the buyer may not understand the liability it is assuming.

Can employment risks be addressed after closing?

Sometimes. The parties may agree a post-closing remediation plan, but urgent claims, missing permits, unlawful practices or risks affecting continuity may require action before closing or a specific contractual protection.

Should contractors be included in the review?

Yes. The factual relationship should be assessed where contractors perform work that resembles employment. The consequences may include reclassification, tax, social-security, employment and benefit exposure.

Does GDPR form part of employment due diligence?

Yes. The review should address employee and candidate data, particularly where monitoring, CCTV, HR software, health information or international transfers are involved. It should assess the GDPR and, where electronic or video monitoring is used, Article 5 of Law No. 190/2018, including necessity, proportionality, transparency, consultation, retention and any requirement for a DPIA.

What does the buyer receive at the end of the review?

The output may include a risk matrix, missing-document list, priority actions and drafting recommendations for warranties, indemnities, disclosure, conditions or post-closing measures.

Sunlit desk with business documents, a receipt and the title “ANPC Fine” for an Atrium guide to challenging a consumer-protection fine in Romania

How to Challenge an ANPC Fine in Romania: A Business Owner’s First Decisions

Romanian Consumer Protection · Business Guide

An ANPC inspection can leave a business with a contravention report, a fine and instructions that affect sales or operations. The first decision is to identify each document, record when it was handed over or communicated, and preserve the evidence behind the alleged breach. A complaint against the fine normally has a 15-day window. A separate ANPC measure may require its own response.

In brief

Can a company challenge an ANPC fine in Romania? Yes. A business can generally challenge the contravention report (proces-verbal de constatare și sancționare a contravenției) by filing a plângere contravențională with the competent judecătorie within 15 days of handover or communication. The current text of Article 32(1) of OG no. 2/2001 provides alternative territorial jurisdiction at the court for the place of the alleged contravention or the court for the company’s registered office; verify any applicable special rule before filing.

Before you pay or file: check the legal basis for the sanction, the wording of the report, the evidence, any separate corrective measure and whether a special consumer-protection rule changes the ordinary procedure. Under Article 32(3) of OG no. 2/2001, filing a complaint has suspensive effect with respect to the challenged contravention sanctions, subject to any applicable special statutory provisions. Do not assume it suspends a distinct order or every operational obligation.

What exactly did ANPC issue?

ANPC, Romania’s National Authority for Consumer Protection, may inspect pricing, consumer information, commercial practices, contract terms, product conformity or complaint handling. The business response depends on the act received, the legislation cited in it and the measures it actually imposes. Start by separating the alleged contravention from the operational work required to protect consumers. Special consumer-protection legislation may derogate from the general contraventions regime: verify the statutory basis cited in the ANPC report before relying exclusively on OG no. 2/2001. If the allegation concerns unfair commercial practices, examine the applicable provisions of Law no. 363/2007 on unfair business-to-consumer practices; for service terms, see our guide to service contract requirements in Romania.

Sanction

Contravention report

Records the alleged offence and a fine or other contravention sanction. The ordinary challenge is the 15-day court complaint.

Measures

Corrective instruction

May require changes to information, sales or goods. Identify whether it appears in the report or in a separate instrument, and check its own deadline and legal route.

Consumer

Underlying complaint

A refund, repair or disputed term may remain commercially and legally relevant even while the business challenges the sanction.

Practical example: if inspectors allege that a retailer showed the wrong online price, preserve the version of the product page seen by consumers, logs showing when the price changed, advertising, order records and the inspection documents. Correcting a live listing may limit ongoing exposure, but it does not erase what happened earlier.

The first 48 hours: preserve options and evidence

There is no general “48-hour appeal” under the current text of OG no. 2/2001. The first 48 hours are an internal triage window: they are useful because website content, stock records, CCTV and staff recollections can change quickly. Put someone in charge of one dated file and avoid overwriting the version that inspectors assessed. The ANPC inspection procedure approved by Order no. 1.601/2024 is an additional official reference when reviewing how the inspection was conducted.

  1. Log receipt. Keep the entire report, annexes, proof of handover or delivery, and every separate order. Record the company’s name and registered office shown on each act.
  2. Map the accusation. List each alleged act, date and place, the cited legislation, fine range, imposed amount and any remedial obligation.
  3. Secure evidence. Export time-stamped site captures, product labels, point-of-sale records, customer correspondence, policies, supplier documents and staff notes where relevant.
  4. Assign two owners. One person handles the court deadline and legal response; another checks ongoing consumer-facing compliance and any immediate measure.
  • Inspection file: signed report, annexes, objections, photographs, delivery evidence.
  • Transaction file: offer, label, contract, receipt, invoice, correspondence.
  • Digital proof: dated pages, campaign settings, change logs, checkout screenshots.
  • Remedy file: corrected information, customer response, internal decisions.

Build a timeline that can be checked

A useful defence file shows when each version of a consumer-facing statement existed. For an ecommerce business, collect the product-page version, campaign copy, checkout information and order confirmation for the relevant period. For a physical shop, gather shelf labels, photographs, point-of-sale settings and the record of any price change. Note the time zone used in digital exports and identify who can explain how each system stores its data. If a document was created after the inspection, label it as a later document rather than presenting it as contemporaneous proof.

Keep the authority’s documents in the same chronology: date of inspection, date on the contravention report, date of handover or communication, and the stated start date for each separate measure. The report date alone does not answer every deadline question. A one-page chronology with references to the original files helps management and counsel locate contradictions without relying on memory or a collection of unsorted screenshots.

Which deadline and court apply to an ANPC fine?

Article 31 of OG no. 2/2001, the Romanian contraventions ordinance, gives 15 days from the handover or communication of the contravention report to lodge the complaint. In the current consolidated text, Article 32(1) expressly provides alternative territorial jurisdiction at the judecătorie for the place where the contravention occurred or the judecătorie for the company’s registered office. Check the text in force, any special consumer-protection rule, the date and method of communication, and the exact act you seek to challenge before filing.

Court fee: the complaint is currently subject to a judicial stamp fee of RON 20 under Article 19 of OUG no. 80/2013. Confirm the payment instructions and proof required by the court when lodging the complaint.

Click or tap a document in the table to see what to verify first.

ANPC document → first procedural decision
Document or decisionFirst questionUsual route to checkImmediate business action
When was the report handed over or communicated?Contravention complaint within 15 days under OG no. 2/2001, subject to applicable special rules.Calendar the deadline; collect the complete report and proof of service.
Is it a complementary sanction or another measure?Read the cited law and ask whether the contravention court can review it and what a complaint suspends.Check the stated implementation date and consumer exposure.
What instrument creates the obligation?Determine its individual challenge and suspension route; the fine complaint may be insufficient.Preserve the decision and obtain urgent review if operations are affected.
What did the consumer buy and what remedy applies?Assess the contract and consumer law independently of the fine challenge.Keep correspondence and avoid inconsistent customer messages.
Does this particular fine qualify, and what is the statutory minimum?General OG no. 2/2001 rule: half of the statutory minimum within 15 days, where applicable.Check the report and special law; record any payment separately from a court filing.
Select a document to inspectIts first practical check will appear here. The applicable statute and the precise ANPC act govern the legal route.

Document route selector

Click a card to reveal the corresponding response route.

Choose the document that needs your next decision. The suggested check is informational; it does not calculate a deadline.

Track the court complaint

Find proof of handover or communication; check the cited law; prepare the evidence and the complaint for the competent judecătorie before the 15-day limit.

What grounds can support a complaint?

The court examines both legality and the merits of the accusation. A company can challenge the report’s statutory elements, the proof that the conduct happened as alleged, the application of the consumer-protection rule, or the proportionality of the sanction. A useful complaint connects each ground to a document or factual contradiction, rather than simply stating that the fine is too high.

Legality

Does the report contain the required information?

Articles 16 and 17 of OG no. 2/2001 regulate the report’s contents and certain grounds for nullity. For a company, check the correct entity, registered office, alleged act and date, the agent’s signature and the applicable provision. Formal defects have different legal effects; avoid assuming every typo voids a report.

Merits

Can the allegation be proved?

Compare the inspector’s account with original price displays, actual contracts, product and order data, timestamps and customer communications. Explain what the evidence shows at the relevant time, including any later corrections.

Proportionality

Does the sanction fit the facts?

Article 21(3) requires the sanction to be proportionate to the seriousness and circumstances of the act. Evidence on scale, effects, recurrence, prior compliance and corrective action can be relevant; none guarantees a warning or reduction.

Scope

Is the cited rule the right one?

Consumer-protection instruments cover different conduct. Verify whether the factual allegation meets the elements of the specific provision and whether the correct business entity was sanctioned.

The right to put objections in the report at the inspection stage is addressed by Article 16(7). If the company made objections, keep the contemporaneous version and note whether they were recorded under “Alte mențiuni”. Assess the effect of an omission under the applicable law and case law; it is not a substitute for filing a timely complaint. Where the dispute involves contractual wording or customer disclosures, our contract review guide offers a broader checklist for analysing clauses and supporting documents.

A practical example: a disputed online promotion

Suppose an online retailer is fined because ANPC says a campaign displayed one price but the customer saw another at checkout. This is an illustration, not a description of a client matter. The business should preserve the campaign settings, dated page captures, checkout logs, order confirmations and evidence of any technical change. It should identify the products and transactions actually affected and compare those records with the facts and time period written in the report. If a separate measure requires the retailer to change or stop a promotion, that instruction needs its own urgent operational review.

A complaint could address whether the cited consumer-protection rule fits the established facts, whether the report accurately identifies the relevant display and whether the chosen sanction is proportionate. If the business corrected the page after the inspection, the correction should be documented with its true timestamp. It may matter to continuing compliance and proportionality, but does not automatically prove that the earlier display was compliant. The decisive evidence will depend on what the report actually alleges and on the applicable special legislation.

Pay the reduced fine, challenge it, or both?

Under the general text of Article 28(1) of OG no. 2/2001, a person may pay half of the statutory minimum fine within 15 days from handover or communication of the report. That figure is not necessarily half the amount imposed by the inspector. Special regimes can change availability or calculation, so verify the legal provision, fine range and the wording of the report before paying.

The discount window and the court complaint window serve different purposes. A payment is not a court complaint; an intention to challenge is not proof of payment. If the business considers both routes, document the financial decision and file any intended complaint within its own deadline. Seek advice on the effect of any payment and on recovery if the sanction is later set aside.

Potential cost beyond the fine: a stop-sale measure, relabelling, refunds, marketplace changes, suppliers and publicity can matter more than the fine. Map the operational obligations and keep a record of steps taken to protect consumers.

What happens after a complaint is filed?

Under Article 32(3) of OG no. 2/2001, filing a contravention complaint has suspensive effect with respect to the challenged contravention sanctions, subject to any applicable special statutory provisions. The judecătorie examines legality and merits, including the evidence and the sanction, under Article 34. The court may uphold or set aside the report or alter the sanction where legally justified. A court result depends on the specific act, the evidence and the applicable special legislation.

Do not treat the fine challenge as permission to ignore a distinct ANPC order. If the authority issued a separate decision to restrict activity, withdraw products or implement another measure, ask for document-specific advice on the challenge route and possible suspension. Compliance work and litigation preparation can proceed in parallel. Once the court assigns a case number, publicly available listing information can be checked on the Romanian courts’ case portal.

Primary legal sources: OG no. 2/2001, consolidated text on the Romanian Legislative Portal, especially Articles 16–17, 21, 28 and 31–34; and Article 19 of OUG no. 80/2013 on the judicial stamp fee. Check the sector-specific law cited in your ANPC report and the legislation in force when filing.

A Typical Client Journey Following an ANPC Inspection

While every ANPC matter depends on its own facts, documents and applicable legislation, many businesses face similar practical challenges after an inspection. The example below reflects issues Atrium commonly helps clients address when responding to ANPC reports and related measures.

1. Understanding exactly what was issued

Many businesses initially focus on the amount of the fine. In practice, the first step is usually identifying every document issued during the inspection, distinguishing between the contravention report itself and any additional measures affecting sales, products, advertising or customer communications.

2. Preserving the evidence before it changes

Consumer-facing information often changes quickly. Online content may be updated, promotions may end and stock or pricing data may be overwritten. For this reason, businesses commonly need to preserve screenshots, transaction records, website histories, customer correspondence and internal files before conducting further operational changes.

3. Reviewing the legal basis of the allegations

The next stage is usually a detailed comparison between the factual allegations recorded by ANPC and the documents available to the business. This includes checking the legal provisions cited by inspectors, analysing whether the evidence supports the allegations and assessing any issues relating to proportionality or procedural compliance.

4. Managing compliance while evaluating legal options

A recurring challenge is that legal assessment and business operations must continue at the same time. Companies frequently need to evaluate complaint deadlines while also reviewing customer-facing practices, implementing corrective actions and managing ongoing consumer obligations.

5. Making an informed response decision

Once the relevant documents, evidence and timeline have been assembled, management can evaluate the available procedural options, commercial risks and compliance considerations. In our experience, organising the file early often makes a significant difference because deadlines, evidence preservation and operational measures frequently develop in parallel.

Our experience shows that the largest business risk is not always the fine itself. Operational restrictions, compliance measures, customer claims, reputational issues and evidence preservation frequently have a greater long-term impact than the monetary sanction.

What does an ANPC defence file need?

A lawyer assessing the case needs the complete document set, not only a photograph of the fine amount. Send the report and annexes, proof of communication, any separate orders, the customer transaction, inspector photographs if received, and the internal records that show how the product, price or service actually appeared at the time. Include the company’s registered office, a short timeline and who was present at the inspection. Our litigation practice overview explains how document review, evidence and representation fit into a court dispute.

Related Guides

Frequently asked questions

How long does a company have to challenge an ANPC fine?

Under the general rule in OG no. 2/2001, a contravention complaint must be filed within 15 days from handover or communication of the report. Check the specific statute and the proof of service in your case.

Which Romanian court hears a complaint against an ANPC contravention report?

The current text of Article 32(1) of OG no. 2/2001 provides a choice between the judecătorie for the place of the alleged contravention and the judecătorie for the company’s registered office. Verify the text in force and any applicable special law before filing.

Does filing a complaint suspend an ANPC fine?

Under Article 32(3) of OG no. 2/2001, filing a contravention complaint has suspensive effect with respect to the challenged contravention sanctions, subject to any applicable special statutory provisions. A separate ANPC decision or obligation needs its own analysis.

How much is the court fee for challenging a contravention report?

The complaint is currently subject to a judicial stamp fee of RON 20 under Article 19 of OUG no. 80/2013. Confirm the court’s payment instructions and retain proof of payment.

Is the reduced payment half of the fine ANPC imposed?

Under the general rule, it is half of the minimum fine set by the applicable legislation, payable within 15 days from handover or communication. Confirm that the reduction is available for the particular contravention and check for special rules.

Can the business correct a problem and still contest the fine?

Corrective action and a contravention complaint address different issues. Keep proof of what was changed and when, while assessing the report and meeting the filing deadline. A later correction does not by itself erase the alleged earlier event.

Does paying the fine count as a challenge?

No. Payment and a court complaint are separate actions with separate purposes. If both are being considered, check the legal consequences and submit the complaint on time.

Need to respond to an ANPC report?

Send Atrium the full report, proof of delivery, any separate ANPC decision and a short account of the inspection. We can assess the relevant deadline, the evidence and the available response for your business.

Request a focused legal review

This page provides general information only and does not constitute legal advice, a legal opinion or the creation of a lawyer-client relationship. Legal solutions depend on the specific facts and documents involved.

AI Notice: AI-assisted content, reviewed by a qualified Romanian lawyer.

Off-plan residential development in Romania seen beside architectural plans and legal documents

Buying Off-Plan Property in Romania: Legal Checks Before Paying a Deposit

Romanian Property Law · Buyer Guide

Buying off-plan property in Romania means committing money before the apartment or house is legally and physically ready for transfer. The decisive questions are therefore not limited to price and delivery date: the buyer must verify the developer, the land, the building permit, the future unit’s Land Book, the payment route and the remedies if the project changes or stalls.

In brief

Under Romania’s current framework, a developer may promise the sale of a future residential unit only after specific cadastral and Land Book steps have been completed. For future residential units covered by Law no. 207/2025, the sale promise must be concluded in authentic form before a Romanian notary public, and the notary must request its notation in the Land Book. A reservation may last no more than 60 days and the reservation amount may not exceed 5% of the price. Buyer advances under the authenticated promise must be paid into a distinct project account and used within the statutory controls.

Practical point: these safeguards improve traceability, but they do not replace legal, technical and financial due diligence or convert a promise into ownership. They do not eliminate insolvency, financing or construction-completion risk.

What makes an off-plan purchase different?

In a completed-property sale, the buyer can compare the physical unit with its cadastral documents and usually receives ownership at closing. In an off-plan transaction, the buyer evaluates a future asset and relies on a chain of documents, approvals and contractual obligations. The developer remains responsible for completing the project; the buyer’s protection depends on whether the project and the promised unit are legally identifiable, whether payments are controlled and whether the contract contains workable exit and refund mechanisms.

Readers comparing an off-plan acquisition with a completed-property transaction can start with our broader guide to buying property in Romania.

Reservation

Short commercial hold

It should identify the unit and price, state the next step and remain within the statutory 60-day period and 5% ceiling.

Promise

Binding future-sale obligations

For a developer’s future residential unit, the promise is concluded in authentic form after the required cadastral and Land Book steps.

Final sale

Ownership transfer

The final authenticated deed follows completion, reception and cadastral finalisation, subject to the agreed closing conditions.

What changed under Law no. 207/2025?

Law no. 207/2025 on future residential units amended Law no. 10/1995 on construction quality and Law no. 7/1996 on cadastre and real-estate publicity. Its core aim is to connect the sale promise to a legally identifiable future unit and to regulate reservations and the use of buyer advances.

Before the promise

  • The building permit must be noted in the Land Book.
  • For a future condominium, pre-unitisation must be completed.
  • Individual Land Books must be opened for the future units.
  • A Land Book extract for the future unit must be obtained before authentication.

At and after signing

  • For future residential units covered by Law no. 207/2025, the sale promise must be concluded in authentic form before a Romanian notary public.
  • The notary requests notation of the promise on the signing day or by the next working day.
  • Advances go to a distinct account dedicated to that project.
  • The developer’s use of those funds is restricted by purpose and statutory construction-stage controls.

Do not misread the percentages. The law states that funds may be used for the structural component up to 25% of the price and, after its completion, for installations up to 20% of the price. This regulates how the developer may use advances; the payment schedule still requires careful contractual analysis.

Interactive off-plan buyer risk check

Which warning signs are present in your file?

Select every statement that applies. The result is a preliminary triage tool: it does not assess title, insolvency, contract enforceability or technical compliance and is not legal advice. Your selections stay in your browser and are not sent to Atrium.

Initial review

No warning sign is selected. This does not mean the transaction is clear; obtain and connect the corporate, title, cadastral, permit, financing and contract documents before paying.

Follow the transaction control path

Choose a stage to see the document that should anchor the buyer’s decision and the question that should remain open until verified.

Document anchor

Reservation agreement and payment evidence

Verify: exact unit, total price, amount paid, expiry, refund trigger and next contractual step.

Do not leave unresolved: whether the payment is within the 5% ceiling and whether the 60-day period can quietly renew.

Documents to verify before paying or signing

Off-plan property document review matrix
Document or checkWhat it should establishRisk if unresolvedPossible transaction response
Legal existence, representatives, authority and relevant corporate status.The wrong entity receives funds or signs without proper authority.Correct the counterparty and require corporate approvals before payment.
Owner, cadastral identity, mortgages, seizures, easements, litigation notes and building-permit notation.The project land is burdened or the seller cannot deliver unencumbered title.Require creditor consent, release mechanics or a closing condition.
Authorised project, unit configuration, use, access and utility works.The marketed project differs from the authorised one.Reconcile documents; avoid relying on brochures or renders.
The promised unit is individually identifiable as a future asset.The buyer commits to a marketing description rather than the statutory cadastral object.Do not sign the promise until the required records exist.
Mortgages, lender control and the unit-release mechanism.The lender’s security remains over the unit at final sale.Make payment and closing conditional on an agreed release process.
Price, VAT treatment, area, finishes, accessories, timetable, variation rights and remedies.Commercial assumptions are not legally binding or can be changed unilaterally.Attach precise plans/specifications and negotiate objective limits.
The destination of the advance and its link to the relevant project.Payment traceability and statutory safeguards are weakened.Verify the account in the notarised documentation before transfer.
Proceedings involving the developer, landowner or project companies.Disputes, enforcement or insolvency affect completion or recovery.Expand due diligence, restructure protection or reconsider the deal.

Useful official portals include the ANCPI service for Land Book extracts, the Romanian courts portal and the National Trade Register Office portal. A portal search is a starting point, not a substitute for interpreting the underlying records.

Contract clauses that decide whether protection works

A legally compliant form can still allocate commercial risk poorly. The promise and its annexes should connect the buyer’s payment obligations to objectively verifiable project events and should explain what happens when an event does not occur.

For the wider contractual context, see our guide to Romanian property pre-contracts and sale promises.

Define the asset

  • Future-unit Land Book and cadastral identifiers
  • Usable and built areas, tolerance and measurement method
  • Parking, storage, land share and common parts
  • Signed plans and specifications hierarchy

Define the money

  • Total price, currency, exchange-rate rule and VAT treatment
  • Dedicated account and payment evidence
  • Milestones supported by documents, not estimates
  • Refund timing, interest and set-off limits

Define change

  • Permitted design and specification changes
  • Area variation threshold and price adjustment
  • Buyer consent for material relocation or size change
  • Consequences of permit or cadastral amendments

Define failure

  • Long-stop completion date and limited extensions
  • Delay damages and termination rights
  • Developer default, buyer default and financing failure
  • Refund security and dispute forum

Developer, title and financing due diligence

The company shown in the marketing material may not be the landowner, developer, general contractor or entity receiving the advance. Map every relevant party and identify who owes each obligation. Review the developer’s registration and representation, the landowner’s title, related project companies, material litigation and available insolvency indicators.

A current Land Book extract should be read together with the title documents and project-finance structure. A mortgage is not automatically fatal, but the promise should explain how the relevant unit will be released and how the lender, developer, buyer and notary will coordinate funds at closing. A promise noted in the Land Book improves visibility; it does not erase earlier mortgages or make the buyer owner.

For a broader review framework, see our Romanian real-estate due-diligence checklist and our legal service for foreign buyers purchasing property in Romania.

Permit, construction and specification review

Romanian construction works must follow the building-permit framework under Law no. 50/1991. Confirm that the permit relates to the project being marketed, is noted in the Land Book and aligns with the plans used to define the future unit. Planning, access and utility documents should be checked with the issuing local authority where appropriate.

The legal review should be coordinated with an independent technical review. A lawyer can identify documentary inconsistencies and allocate contractual risk, but cannot replace an architect, engineer, surveyor or snagging specialist. Marketing statements about views, floor area, energy performance, finishes, delivery or facilities should be reflected in enforceable annexes.

Completion, handover and final sale

Handover should not be treated as a single key-collection appointment. Law no. 10/1995 links delivery to admitted reception at completion and to the commissioning of authorised, permanent utility connections for the relevant developments. After completion, the cadastral records move from pre-unitisation of future assets to final unitisation and the individual Land Books are updated.

Legal completion file

Reception record, certificate confirming construction, final cadastral documentation, updated Land Book and documents required for the notarial sale.

Technical handover

Measured areas, utilities, equipment tests, keys, meters, snag list, rectification deadlines and warranty contacts.

Closing mechanics

Final price, lender release, payment sequence, possession, originals, registration and responsibility for costs and taxes.

The seller must also provide the energy-performance information required by Law no. 372/2005. A preliminary energy simulation for an unfinished building is not the same as the final registered certificate.

Three common off-plan scenarios

Controlled reservation

The reservation is below the statutory ceiling, expires within 60 days, identifies the future unit and makes the refund route explicit. The buyer uses the period to verify the project and negotiate the notarised promise.

“Booking fee” without legal anchors

A substantial payment is requested before a future-unit Land Book exists, under a document that avoids the word “reservation.” Labels do not resolve substance; pause and review the structure before transferring funds.

Bank-financed project

The land carries a project-finance mortgage. The risk may be manageable only if the lender’s unit-release conditions and the payment sequence are documented and compatible with the final sale.

Additional point for foreign buyers

Foreign-buyer analysis must separate ownership of the apartment or building from ownership of the associated land share. Nationality, residence, the land category and the proposed ownership vehicle can change the route. The Romanian land-acquisition rules for foreign buyers under Law no. 312/2005 govern land acquisition by foreign citizens, stateless persons and foreign legal entities. Confirm eligibility and structure before the reservation or promise fixes the buyer identity. Our guide to Romanian property ownership and Land Book verification explains the wider document framework.

A practical decision rule

Do not ask only “Is this document standard?” Ask whether the project, future unit, payment account, completion evidence and exit rights can be verified independently—and what happens to the buyer’s money if any link fails.

The Romanian National Authority for Consumer Protection has published a dedicated guide for consumers buying a home. Its practical checks complement, but do not replace, transaction-specific legal advice.

Official authorities and verification resources

Public registers and authority guidance can help a buyer verify individual parts of the transaction. Each source has a different purpose, and the results must be interpreted together with the project and contract documents.

Romanian Legislative Portal

Consult the official text of Law no. 207/2025 and the consolidated construction-quality framework.

ANCPI and Land Books

Use the official ANCPI ePay service to request an information Land Book extract for an identified property.

National Trade Register

Consult the ONRC services portal when checking the developer or another project company.

Romanian Courts Portal

Search publicly available case information through the courts portal, while recognising the limits of name-based searches.

Consumer Protection Authority

Review the ANPC home-buying guidance for consumer-facing checks and contract information.

State Construction Inspectorate

The State Inspectorate for Construction publishes institutional and regulatory information concerning construction quality and control.

Client Experience: Protecting a Buyer in an Off-Plan Residential Purchase

The situation

A foreign buyer agreed to purchase a two-bedroom apartment in a residential project near Bucharest. Before signing the reservation agreement, the developer requested a significant upfront payment and provided only marketing materials and floor plans.

The client contacted Atrium Romanian Lawyers for an independent legal review before transferring funds.

What we found

During the due diligence process, our team identified several issues requiring clarification:

  • the future unit had not yet been individually identified in the cadastral documentation;
  • financing arrangements affecting the project had not been fully disclosed;
  • the draft documentation contained broad clauses allowing unilateral changes to the apartment specifications;
  • the payment structure did not clearly explain how buyers’ funds would be protected.

How we helped

Atrium coordinated a legal review of the project documentation and negotiated amendments to the transaction documents.

Among other measures, we:

  • verified the developer’s corporate and ownership structure;
  • reviewed title and Land Book documentation;
  • analysed project financing and mortgage-release mechanisms;
  • negotiated clearer completion, refund and delay provisions;
  • required additional documentary evidence before further payments were made.

The outcome

Following negotiations, the transaction structure was revised and the client obtained significantly greater clarity regarding the legal status of the unit, payment protections and the conditions for completion.

The buyer proceeded only after the relevant documentation had been verified and the contractual protections had been strengthened.

Key lesson

When purchasing off-plan property, buyers should evaluate not only the property itself, but also the legal status of the project, the payment structure and the contractual remedies available if the development is delayed or modified.

Client-identifying details have been omitted or generalised. This experience is presented for informational purposes and does not promise or guarantee a similar result in another matter.

Frequently asked questions

Can a developer ask for more than 5% under a reservation?

For reservations covered by Law no. 207/2025, the amount may not exceed 5% of the sale price. The law attaches absolute nullity to a reservation that breaches this ceiling. The legal character of the document and payment should be reviewed, regardless of the label used.

How long can an off-plan reservation last?

The statutory maximum is 60 days, after which the parties should conclude the authenticated promise or the final sale. If this does not happen by the deadline solely because of the developer’s fault, the developer must return the reservation sums in full within 30 days.

Must the off-plan sale promise be notarised?

For future residential units covered by Law no. 207/2025, the sale promise must be concluded in authentic form before a Romanian notary public. This specific rule does not mean that every property-related promise in Romania is subject to the same form requirement. The promise is concluded after the required Land Book steps, and the notary requests its notation.

Does noting the promise in the Land Book make me the owner?

No. A promise creates obligations to complete the future sale; it does not itself transfer ownership. Ownership is transferred under the final notarised deed and the applicable Land Book registration regime.

What if the developer changes the unit or delays the project?

The answer depends on the law, the scale of the change and the negotiated clauses. The promise should define area and specification tolerances, permitted changes, the completion long-stop date, notice duties, price adjustments, damages, termination and refund consequences.

Can a foreign national buy an off-plan apartment in Romania?

Often yes, but the analysis must separate the building from the land share. Citizenship, residence, land type and transaction structure matter, so eligibility should be confirmed before fixing the buyer in a reservation or promise.

Before you commit funds

Review the project and contract as one transaction

Through our property and real-estate legal services in Romania, Atrium Romanian Lawyers can review the developer and title file, the future-unit Land Book, the reservation, the notarised promise, payment safeguards and closing conditions for an off-plan acquisition.

Request a focused legal review

Disclaimer: This page provides general information only and does not constitute legal advice, a legal opinion or the creation of a lawyer-client relationship. Legal solutions depend on the specific facts and documents involved.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.

Share purchase agreement and due diligence documents in a bright Bucharest law office

Share Purchase Agreement in Romania: Key Issues for Buyers and Sellers

Corporate transactions • M&A • Romania

A share purchase agreement in Romania is not simply a document for transferring shares. It allocates the risks discovered in due diligence, defines what the buyer receives, protects the seller’s position and determines how the transaction moves from signing to closing and post-closing claims.

What is a share purchase agreement in Romania?

An SPA records the sale and purchase of shares in a joint-stock company (SA) or social parts in a limited liability company (SRL). It normally covers the parties, the transferred interests, price, conditions precedent, signing and closing, warranties, indemnities, limitations of liability, confidentiality, announcements, governing law and dispute resolution.

For a Romanian company, the agreement must be coordinated with the company’s articles, the shareholders’ register, corporate approvals and the formalities required under Romanian corporate law to ensure that the transfer is recognised by the company and, where applicable, registered with the competent authorities. The contract should not be drafted in isolation from the corporate records.

For Romanian SRLs, a transfer of social parts to third parties may require approval by the shareholders in accordance with Law No. 31/1990 and the company’s articles of association. These requirements, together with any contractual consent or pre-emption arrangements, should be reviewed before signing.

This article focuses on transaction negotiation and risk allocation. It is distinct from a procedural guide about changing shareholders and from a shareholder agreement, which regulates the relationship between shareholders after or independently of a particular share sale.

SPA, share transfer document and shareholder agreement

Transaction navigator

Select the document question

Click or tap a card to see the first issue to resolve.

Deal document

The SPA records the commercial bargain, price, conditions, closing mechanics and the parties’ remedies. It should be read together with any disclosure letter and ancillary documents.

What should buyers check before signing?

The buyer should understand what it is buying before it negotiates the warranty package. Legal due diligence is not only a search for defects. It identifies which risks require a condition, protection, price response or post-closing plan.

Share purchase agreement review matrix
Review areaWhat to verifyPossible contractual response
Ownership, encumbrances, transfer restrictions, any pre-emption or consent rights and authority to sell.Title warranty, release of security, consent or condition precedent.
Articles, shareholder records, resolutions, beneficial ownership and pending filings.Closing deliverable, corporate warranty or pre-closing remediation.
Accounts, debt, working capital, cash, leakage, tax exposures and contingent liabilities.Price mechanism, locked-box protection, completion accounts or specific indemnity.
Change-of-control clauses, termination rights, consent requirements and key customer or supplier dependencies.Consent condition, disclosure, warranty or transition covenant.
Employment claims, incentives, key-person risk, restrictive covenants and consultation duties.Specific warranty, retention plan, indemnity or post-closing obligation.
Licences, sector rules, GDPR, cybersecurity, permits and investigations affecting the target.Regulatory condition, remediation covenant, warranty or indemnity.
Selected-row principle: the more specific the risk identified in due diligence, the less useful a generic “compliance with law” warranty becomes.

Price mechanisms in a Romanian SPA

The price clause should match how the parties understand the business at signing and at completion. A locked-box structure relies on an agreed historical balance sheet and restrictions on value leakage. A completion-accounts mechanism adjusts the price after closing by reference to agreed accounting principles, debt, cash and working capital.

Earn-outs and deferred consideration can be useful where valuation depends on future performance, but they create additional questions about measurement, control, accounting policy, access to information and dispute resolution. The SPA should define the calculation process in enough detail to reduce avoidable disputes.

Warranties, indemnities and limitations

Warranties describe the state of the target; indemnities allocate a defined risk. They are not interchangeable and should be negotiated against the due-diligence findings and the information disclosed by the seller.

Warranties may address title, capacity, accounts, tax, contracts, employees, litigation, intellectual property, data protection, technology and regulatory compliance. An indemnity may be appropriate where a known risk can be described and valued more precisely. The parties should also agree disclosure standards, knowledge qualifiers, materiality, thresholds, de minimis amounts, baskets, caps, time limits and conduct-of-claims procedures.

A buyer should avoid assuming that a broad warranty solves every issue. A seller should avoid accepting a warranty that creates liability for matters fairly disclosed or outside the seller’s reasonable control.

Signing, conditions precedent and closing

Signing and closing may occur simultaneously, or the parties may sign first and complete later after conditions are satisfied. Conditions can include corporate approvals, regulatory clearances, third-party consents, release of security, financing, accuracy of warranties and the absence of a material adverse event, where negotiated and clearly defined by the parties.

The closing checklist should identify each document, signatory, filing, payment, register update, power of attorney, resignation or appointment and handover item. A clear checklist reduces the risk that the SPA is signed but the parties disagree about whether completion has occurred.

Tax notifications, registration steps and supporting documents for transfers of interests in Romanian companies should also be checked against the rules in force at the time of the transaction. Recent legislative changes may affect the timing or evidence required for particular SRL transfers, so the SPA timetable should allow for a current tax and corporate-formality review.

How We Assist in Practice

Protecting a buyer through SPA negotiations following due diligence findings

A client negotiating the acquisition of interests in a Romanian company instructed Atrium Romanian Lawyers after legal due diligence revealed several areas of potential concern, including regulatory compliance matters, contractual risks and historical liabilities that had not been reflected in the initial commercial discussions.

Atrium reviewed the proposed share purchase agreement, analysed the diligence findings and assisted the client in restructuring the contractual protection package. The SPA was revised to include enhanced warranties, disclosure obligations, specific indemnity protections and detailed claims procedures designed to address the identified risks.

In parallel, our team coordinated the transaction documentation with the company’s corporate records, shareholder approvals and closing requirements in order to reduce execution risk and avoid implementation delays.

The parties ultimately completed the transaction under a revised framework that more accurately reflected the legal and commercial position of the target company and established a clear mechanism for managing post-closing issues.

This example is anonymised and provided for illustrative purposes only. Past results do not guarantee similar outcomes in future matters.

How Atrium Romanian Lawyers can assist

Atrium Romanian Lawyers can assist buyers, sellers, shareholders and investors with SPA structuring, due diligence, negotiation, warranties, indemnities, conditions precedent, closing documentation and post-closing claims. The appropriate scope depends on the company, transaction structure, documents, timetable and risks identified.

Frequently asked questions

Is an SPA required for every share sale in Romania?

The required documents depend on the company, parties, share type, transaction structure and applicable formalities. An SPA is commonly used in commercial transactions, particularly where the parties wish to regulate price mechanics, warranties, indemnities and risk allocation. Some transfers may instead be documented through a share-transfer agreement, transfer deed, shareholders’ resolution or simpler corporate documentation. Any chosen structure must still be coordinated with the applicable corporate and transfer formalities.

What is the difference between an SPA and a shareholder agreement?

An SPA records a sale and purchase of shares or social parts. A shareholder agreement regulates the relationship, governance and protections between shareholders. They may be connected but serve different purposes.

Can the SPA be governed by foreign law?

The parties may choose a foreign governing law for the SPA, subject to applicable private international law rules. However, mandatory Romanian corporate, regulatory, employment, tax and registration rules may still apply to the transaction and the target company.

When should due diligence take place?

Due diligence should begin early enough for findings to influence valuation, conditions, warranties, indemnities and the closing timetable. A late review may reduce the buyer’s ability to obtain a practical remedy.

What happens if a warranty is inaccurate?

The SPA should define the buyer’s remedies, exclusions, thresholds, time limits and claim procedure. The effect depends on the wording, disclosure, loss and the surrounding facts.

Can the parties amend an SPA after signing?

Amendment usually requires compliance with the agreement’s amendment clause and the necessary authority of the parties. Changes affecting corporate records, approvals or closing conditions may require additional documents or filings.

AI due diligence checklist for foreign investors assessing a Romanian company

AI Due Diligence in Romania: What Foreign Investors Should Check

Foreign investment • AI governance • Romania

AI due diligence in Romania asks whether a target company’s AI use, data, contracts and public claims support the investment case. It is not a technical demonstration of a model and it is not a generic AI policy review. For a buyer, investor or lender, the question is whether the target has identified the systems it uses, can lawfully operate them, owns or can use the assets it relies on, and has a credible plan for the risks that will remain after closing.

What is AI due diligence in a Romanian transaction?

AI due diligence is a transaction-focused legal and commercial review. It identifies whether the target’s use of AI creates liabilities, restrictions, missing rights or implementation costs that could affect price, risk allocation or post-closing operations.

For a Romanian target, the review should cover the target’s Romanian operations and any AI outputs used in the European Union. The EU AI Act is directly applicable across the EU and operates alongside the GDPR where personal data is processed. A seller’s statement that it uses only a third-party AI tool does not end the inquiry: the target may still be a deployer, customer, controller, employer or regulated business with its own duties.

This guide has a different purpose from our analysis of AI vendor contracts in Romania, which focuses on the agreement with a supplier, and from DPIA vs FRIA in Romania, which focuses on assessment triggers for a deployment. Here, the investor is deciding what must be verified before, at and after a deal.

Start with the target’s actual AI footprint

Do not begin with a broad question such as “Does the company use AI?” Ask what system or model is used, for which decision, with which data, by whom, and whether the target sells, deploys, develops, fine-tunes or merely accesses the tool.

A useful data-room request separates customer-facing products from internal tools. It should identify models, APIs, software providers, hosting and cloud dependencies, integrations, datasets, prompts or knowledge bases, material outputs, users and the decisions influenced by each use case. The inventory should also record planned products or features that have not yet launched but are material to the investment thesis.

Deal-side navigator

Select a deal question to see the first evidence to request

Click or tap a card. Keyboard users can Tab to a card and press Enter or Space. Each selection stays visible until you choose another one.

Business model and footprint

Request a system inventory, product descriptions, roadmaps, supplier contracts, architecture summary and evidence of the target’s material AI claims. Compare marketing language with the technology and operating model actually in use.

Which legal and commercial issues should an investor test?

Click or tap a row to highlight the diligence takeaway. On a small screen, swipe the table sideways.

AI due diligence matrix for a Romanian target
Review areaWhat to testPossible deal response
Whether the target’s product, sales material and internal inventory describe the same systems, functions, limits and dependencies.Correct the diligence scope, ask for technical confirmation and qualify representations that are broader than the evidence.
Whether a use case may be prohibited, high-risk, subject to transparency rules or linked to a general-purpose AI model supply chain.Obtain a classification record, identify compliance timing and budget for any remediation or implementation work.
Data flows, controller/processor roles, legal bases, Article 22 issues, DPIA screening, security measures and cross-border transfers.Require a privacy remediation plan, review the DPA and test whether the target can continue the relevant processing after closing.
Whether datasets, prompts, files or customer information may lawfully be used for development, fine-tuning, testing or supplier improvement.Limit or stop impermissible use, obtain consents or contractual permissions where appropriate, and reserve a specific risk allocation.
Ownership and licences for software, open-source components, models, training materials, brand assets, output and third-party claims.Confirm chain of title, address licence conflicts and tailor warranties or indemnities to the assets that support the valuation.
Model, cloud and subprocessor dependencies, location, termination, audit evidence, model changes and service continuity.Seek consent, amendment, transition assistance or a post-closing migration plan if a dependency cannot support the buyer’s intended use.
Policies, ownership, AI literacy, logs, testing, monitoring, incident response, complaint handling and escalation records.Set a post-closing governance plan with owners, deadlines and evidence requirements rather than relying on a generic policy.

The European Commission describes the AI Act as a risk-based framework for developers and deployers. It identifies employment, credit scoring and access to essential services among the examples that may be high-risk. See the Commission’s AI Act overview and application timetable.

AI Act review: classify before you value the risk

Do not treat “AI Act compliant” as a sufficient diligence answer. Contractual, sector-specific, data-protection and AI Act obligations must be assessed separately. The investor should identify the system, its intended purpose, the target’s role and the rules that apply now or later. The relevant date can affect both risk allocation and integration planning.

The AI Act’s prohibitions, AI literacy obligations, governance rules, GPAI-model obligations and transparency rules have different application dates from the rules for high-risk systems. The Commission states that Annex III high-risk use cases, including employment and credit-scoring examples, are scheduled to apply from 2 December 2027, while high-risk systems embedded in regulated products have a later date of 2 August 2028. A diligence report should distinguish obligations already applicable from future obligations that could require a funded implementation plan. At the time of publication, the applicable AI Act timetable should be verified against the latest EU legislation and implementation guidance, including the official AI Act Service Desk timeline.

The analysis should also ask whether the target is developing an AI system, placing it on the market, deploying it in its own business, importing it, distributing it or using a third-party service. These labels are not interchangeable with GDPR controller and processor roles. For the contract-facing part of that review, see AI Vendor Contracts in Romania.

GDPR and data review: look beyond the privacy policy

The decisive question is what happens to personal data at each stage of the AI lifecycle. A target may process personal data in training, testing, deployment, monitoring, logs, prompts, support and human review, even where the product is marketed as automated or anonymised.

The review should map the data categories, purposes, retention, recipients, access, transfer mechanisms and contractual roles. Where the use involves profiling, recruitment, credit, insurance, pricing or decisions that may significantly affect individuals, check the actual decision flow and safeguards rather than relying on a generic human-review statement. Article 35 GDPR requires a DPIA where processing is likely to result in a high risk to the rights and freedoms of natural persons; Article 22 has separate rules for certain solely automated decisions.

The European Data Protection Board has also confirmed that the anonymity of an AI model trained with personal data must be assessed case by case. That matters for a target relying on a statement that a model, dataset or output is anonymous. Read EDPB Opinion 28/2024. For the broader framework, see our guide to GDPR compliance when using AI in Romania.

Data, intellectual property and contract rights

AI value is often dependent on rights that sit outside the target’s own code. The investor should trace the legal basis for using data, third-party models, cloud infrastructure, open-source components, output and confidential information.

Review the complete contract suite, not only the signed master agreement. Order forms, online terms, acceptable-use policies, data-processing agreements, security schedules, open-source notices and API terms can all affect the target’s rights. In particular, check whether a provider can use customer or target data for model training, whether the provider can change the model or service unilaterally, and whether the target can export its data and configurations on exit.

Ownership language for AI-generated output should be read carefully. A contractual promise may create a licence or allocation between the parties, but it does not necessarily guarantee exclusivity or copyright protection in every output. The copyright status of AI-generated content may vary depending on the level of human creative input and the applicable jurisdiction. The review should identify the use the target needs to make of the output and whether third-party rights, human authorship requirements, confidentiality or contractual restrictions could limit that use.

What should the investor request in the data room?

  1. Request a current AI inventory. Include internal tools, customer-facing products, models, APIs, plugins, fine-tuning, integrations and material planned features.
  2. Obtain a use-case map. Record intended purpose, users, affected people, decisions, data inputs, outputs, human review and country of deployment.
  3. Collect AI governance records. Ask for role assessments, policies, training records, system documentation, risk logs, testing, monitoring and incident procedures.
  4. Review AI Act screening. Identify prohibited practices, potential high-risk systems, transparency obligations, GPAI dependencies and the applicable timetable.
  5. Map personal-data processing. Review privacy notices, legal bases, Article 22 analysis, DPIAs, processor arrangements, security controls and transfers.
  6. Trace data rights. Check source, licence, consent or other permission for data used in development, testing, fine-tuning and ongoing service delivery.
  7. Review the contract stack. Read supplier, customer, cloud, API, DPA, security, outsourcing and change-control documents together.
  8. Confirm IP and open-source position. Request code provenance, licences, notices, ownership assignments, third-party claims and output-use restrictions.
  9. Test material statements. Compare product marketing, investor materials and customer commitments against the available technical and legal evidence.
  10. Assign the deal response. Separate issues requiring price, warranty, indemnity, condition, remediation, disclosure or post-closing integration action.

How should findings affect the transaction documents?

Translate each material finding into an owner, timing and remedy. A diligence report is useful only if the SPA, investment agreement, disclosure process and integration plan reflect the issues that have been identified.

The appropriate response will depend on the transaction structure and the seller’s ability to remediate. A buyer may need targeted warranties concerning data rights, AI-related regulatory compliance, ownership, contract compliance, absence of claims or material incidents. Confirmed gaps may justify a specific indemnity, a pre-closing remediation covenant, a post-closing plan, a condition or a tailored disclosure. The drafting should not assume that a general compliance warranty captures the actual issue.

Post-closing planning is equally important where the buyer will integrate systems, move data, introduce a new group policy, change suppliers or expand the target’s use case. These changes can alter the GDPR and AI Act analysis. If an assessment is required, the timing should be addressed before the relevant processing or deployment begins. Our DPIA vs FRIA guide explains why those two assessment routes must be screened separately.

When does a separate specialist review become necessary?

A focused AI legal review should be coordinated with corporate, technical, information-security, employment and commercial due diligence when the target develops AI products, relies on proprietary datasets, makes regulated-sector decisions, uses AI in recruitment or credit processes, processes sensitive personal data, markets compliance claims, or has important dependencies on a small number of providers. The workstreams should share the same factual inventory, but each should retain its own legal questions and conclusions.

How Atrium Romanian Lawyers can assist

Atrium Romanian Lawyers can coordinate the legal workstream for AI-related due diligence in a Romanian investment, acquisition or internal reorganisation. The review can cover AI Act role and use-case screening, GDPR and data-contract questions, supplier and customer terms, intellectual property, employment and operational governance, and the translation of findings into transaction documents or an integration plan.

Client experience

AI due diligence during the acquisition of a Romanian technology company

An international investor considered acquiring a Romanian technology company that relied extensively on AI-enabled software products and third-party AI services.

During the due diligence process, the buyer requested confirmation regarding AI Act compliance, data rights, intellectual-property ownership and the target’s dependencies on external AI providers.

The review identified gaps between the target’s public marketing materials and its internal documentation, uncertainties regarding the scope of rights over certain datasets, and contractual limitations affecting the use of third-party AI services after closing.

Atrium Romanian Lawyers coordinated the legal review of the AI use cases, supplier contracts, GDPR implications and intellectual-property position. The findings were translated into targeted warranties, disclosure items and a post-closing remediation plan.

The transaction proceeded with a clearer allocation of regulatory, contractual and operational risks and with a structured roadmap for post-closing compliance measures.

This example has been anonymised and simplified for publication. The appropriate legal analysis depends on the system, data, contract structure and facts of each matter.

Frequently asked questions

Does every investment in a Romanian company need AI due diligence?

No. The scope should be proportionate to the target’s actual use of AI and the importance of that use to the transaction. A company using a limited internal tool may require a focused review. A target selling AI-enabled products, using sensitive data or making decisions affecting people may need a deeper legal and technical workstream.

Is AI due diligence the same as an AI Act compliance audit?

No. AI Act compliance is one part of the review. Transaction diligence also considers ownership, licences, customer commitments, personal data, confidentiality, technical dependencies, product claims, change control and what the buyer will need after closing. The correct scope follows the investment thesis and the target’s operating reality.

Can a seller rely on a supplier’s AI compliance statement?

Supplier information can be relevant evidence, but it does not by itself establish that the target’s own deployment is compliant. The investor should check whether the statement identifies the actual system, model, purpose, data, users, territory, contract terms and responsibilities relevant to the target’s use case.

Should a buyer ask for the target’s DPIAs?

Where the target operates AI systems involving personal data and has conducted or screened for a DPIA, the relevant material should be reviewed subject to confidentiality controls. The question is not simply whether a document exists, but whether it reflects the current processing, risks, safeguards, changes and any residual issues requiring follow-up.

Can AI findings be addressed after closing?

Sometimes. The decision depends on the nature of the issue, legal exposure, urgency, operational dependency and the buyer’s ability to control remediation. A defensible post-closing plan should identify the owner, evidence, budget, deadlines and the effect on continued use. Some issues may need to be resolved before closing or before a planned deployment.

What is the most common gap in AI diligence?

A frequent gap is that the target has a high-level AI policy or vendor contract but no reliable inventory linking systems, use cases, data, roles, evidence and decision owners. The first practical step is usually to build that factual map before drawing legal conclusions or negotiating transaction protection.

DPIA and FRIA assessment paths for an AI project in Romania

DPIA vs FRIA in Romania: Which Assessment Does Your AI Project Need?

AI governance • Romania • Assessment decisions

DPIA vs FRIA in Romania is a question of two different legal tests. A data protection impact assessment (DPIA) addresses risks arising from personal-data processing under the GDPR. A fundamental rights impact assessment (FRIA) under the AI Act applies to specified deployers of certain high-risk AI systems. Your project may require one, both, or neither mandatory assessment.

When do these obligations apply?

The GDPR assessment requirements already apply. Under the AI Act’s consolidated timetable, Chapter III Sections 1–3, including Article 27, apply to Annex III high-risk systems from 2 December 2027. The corresponding date for Article 6(1)/Annex I product systems is 2 August 2028; that does not extend Article 27 to every product system.

Article 111 contains separate transition provisions for existing systems. A project review should record when the system was placed on the market or put into service and whether subsequent design changes affect its treatment. The future FRIA timetable does not postpone GDPR duties. Source: consolidated AI Act, Articles 111 and 113.

DPIA vs FRIA: the differences that change your project

Both assessments examine potential harm to people. A DPIA is not limited to confidentiality or cybersecurity: it also examines other rights and freedoms affected by personal-data processing. FRIA addresses the impact of the specified AI deployment on fundamental rights.

Click or tap a row to reveal its practical takeaway. Keyboard users: Tab to a green label and press Enter or Space. Swipe the table sideways on a small screen.

Two assessments, separate applicability tests
Decision pointDPIA: GDPR Article 35FRIA: AI Act Article 27
Personal-data processing likely to create high risks to individuals, assessed in its context.A covered deployer using an in-scope Article 6(2)/Annex III high-risk system.
The controller, with DPO advice where a DPO is designated and relevant processor assistance.The deployer covered by Article 27.
Processing, necessity, proportionality, risks to people and safeguards.Deployment context, affected groups, risks of harm, human oversight and responses.
Before the relevant processing begins; review when risk changes.Before first use where the obligation applies; update changed or outdated elements.
Prior consultation when the Article 36 threshold is met; no universal filing requirement for every DPIA.Notify results to the market surveillance authority under Article 27(3), subject to its exception.
Shared evidence can support the assessment of the actual processing.Relevant DPIA sections may be cross-referenced or incorporated; remaining requirements still need coverage.

GDPR Articles 28, 35–36 and 39; AI Act Article 27.

When does an AI project need a DPIA?

AI use alone does not automatically trigger a DPIA. The controller must assess whether the nature, scope, context and purposes of the processing make a high risk to people likely. Article 35 expressly recognises the relevance of new technologies.

The GDPR identifies particular situations, including systematic and extensive automated evaluation underpinning decisions with legal or similarly significant effects, large-scale processing of special-category or criminal-offence data, and large-scale systematic monitoring of publicly accessible areas. Applicable supervisory-authority lists must also be checked.

For a Romanian deployment, the file should therefore address the applicable requirements and guidance of the Romanian data protection authority, ANSPDCP, alongside Article 35. Record the reasons for a negative screening conclusion too. A supplier’s description of a product as “low risk” is not an assessment of your processing.

Where required, the DPIA must describe the processing and purposes, assess necessity and proportionality, evaluate risks to individuals and specify safeguards. This is a substantive project assessment, not simply a signed template. Source: GDPR Article 35.

For the broader data-protection framework, see our guide to GDPR compliance when using AI in Romania.

Who needs a FRIA under the AI Act?

The Article 27 obligation does not cover every business using high-risk AI. It concerns Article 6(2) high-risk systems and specified categories of deployer, with an exclusion for the critical-infrastructure area in Annex III point 2.

  • Bodies governed by public law deploying qualifying systems.
  • Private entities providing public services deploying qualifying systems. This status requires analysis; it is not synonymous with every company selling services to the public.
  • Deployers of qualifying creditworthiness or credit-scoring systems for natural persons under Annex III point 5(b), which excludes systems used to detect financial fraud.
  • Deployers of qualifying life and health insurance risk-assessment or pricing systems for natural persons under Annex III point 5(c).

Classification under Article 6 must be checked first, including the conditions of any applicable exception. The exact intended purpose matters. A financial-sector tool is not automatically a creditworthiness system, and a medical product is not automatically within the Article 27 FRIA route. Source: AI Act Articles 6 and 27 and Annex III.

Explore four deployment scenarios

These hypothetical examples explain the screening logic. They assume the stated facts and do not replace an assessment of the actual system, applicable dates or transition rules.

Candidate ranking: DPIA and FRIA can diverge

A private manufacturer uses extensive automated applicant evaluation to support hiring decisions. These facts point to a DPIA requirement under Article 35(3)(a), even if a person makes the final decision. Recruitment may also fall within Annex III. However, on the assumption that the manufacturer is neither a public-law body nor a private public-service provider, its employer status alone does not trigger Article 27 FRIA.

Consumer credit: prepare for both assessments

A lender uses an in-scope high-risk system to score individuals for loan eligibility. Systematic and extensive profiling with significant consequences can trigger a DPIA. Article 27 separately covers qualifying deployers under Annex III point 5(b). Address the applicable FRIA timetable and any transition provisions, rather than assuming both duties started on the same date.

Public benefits: assess deployment and processing together

A public body uses a qualifying high-risk system to assess eligibility for essential assistance benefits. Its status and use case bring Article 27 into the analysis. The personal-data processing needs separate DPIA screening, including relevant public-task legislation and any Article 35(10) position. One completed assessment does not automatically discharge the other.

Drafting assistant: examine the actual workflow

A team drafts generic product descriptions without personal data or decisions about people. On those narrow facts, the workflow does not itself establish a DPIA or Article 27 FRIA requirement. Check account data, logs and supplier processing separately. Introducing customer records, employee evaluation or regulated decisions changes the analysis. Other duties may still apply.

Can one assessment document cover DPIA and FRIA?

A coordinated file can reduce duplicated work, provided each legal requirement remains identifiable. The consolidated Article 27(4) expressly allows relevant DPIA sections to be cross-referenced or incorporated into FRIA where they already meet the corresponding obligations.

Start with a shared description of the system, purposes, data flows, affected people and safeguards. Then keep a requirement map showing which sections satisfy GDPR Article 35 and which satisfy AI Act Article 27. Identify gaps rather than renaming a DPIA “FRIA”. Source: AI Act Article 27(4)–(5).

As a practical drafting approach, include a separate deployment chapter addressing who may be affected beyond the immediate users, how mistakes influence access to opportunities or services, who can intervene, and how complaints lead to corrective action. Avoid treating GDPR as only a privacy checklist: the DPIA itself must consider risks to rights and freedoms.

What the FRIA needs to address

Article 27 requires the deployment process and intended use, duration and frequency, affected people and groups, specific risks of harm, implementation of human oversight, and measures if risks materialise, including governance and complaint mechanisms. Reusing a supplier assessment in similar cases is permitted, but the deployer must check its fit and update changed or outdated elements. Source: AI Act Article 27(1)–(2).

Who prepares, reviews and owns the decision?

The controller remains responsible for the DPIA; the covered deployer remains responsible for FRIA. A consultant, DPO or supplier can contribute without taking over the organisation’s statutory role.

For the DPIA, seek the designated DPO’s advice and preserve their independent advisory and monitoring function. Obtain relevant processor assistance. For the deployment review, involve the business owner, technical team and people responsible for oversight and complaints. A useful internal decision records outstanding conditions, the person accountable for each safeguard and the circumstances requiring a fresh review. Source: GDPR Articles 28(3)(f), 35(2) and 39; AI Act Article 27.

Contractual cooperation should cover the evidence you need to assess the deployment. Our AI vendor contracts guide addresses information rights, changes and supplier responsibilities.

Must the assessment be sent to an authority?

A DPIA and a FRIA follow different authority procedures. Under GDPR Article 36, prior consultation is required where high residual risk remains that cannot be sufficiently mitigated. There is no general GDPR obligation to submit every DPIA for approval.

Article 27(3) provides for notification of FRIA results to the market surveillance authority using the relevant template, subject to the Article 46(1) exception. That notification is not the GDPR prior-consultation procedure and should not be described as automatic permission to deploy. Confirm the competent authority and operational submission arrangements for the specific deployment. GDPR Article 36; AI Act Article 27(3).

A practical assessment file before deployment

  1. Define the use case. Identify the system, version, intended purpose, users, affected people and decisions it informs.
  2. Map roles separately. Record GDPR controller/processor roles and the relevant AI Act roles.
  3. Screen the legal route. Check prohibited practices, AI classification, DPIA triggers and Article 27 deployer coverage.
  4. Record timing. Distinguish existing GDPR duties from future AI Act requirements and applicable transition provisions.
  5. Collect evidence. Obtain data-flow information, supplier instructions, meaningful performance limitations, oversight arrangements and relevant testing.
  6. Assess harms and safeguards. Describe how the actual deployment may affect people and how controls reduce those risks.
  7. Map shared sections. Make each DPIA and FRIA requirement traceable, retaining any necessary separate analysis.
  8. Resolve escalation. Identify prior consultation, notification, unresolved risks and conditions preventing launch.
  9. Assign review triggers. Consider changes in purpose, model, data, affected groups or decision authority, and evidence from incidents or complaints.

How Atrium Romanian Lawyers Assisted an International Manufacturing Group

Anonymised client matter. The description below omits identifying information and focuses on the legal work performed.

Questions examined

  • Whether the candidate-data processing required a DPIA;
  • Whether the use of the system could trigger a FRIA under the AI Act;
  • What human-oversight and documentation measures were needed before implementation.

Legal analysis

Our review of the recruitment process identified extensive automated evaluations of candidates with a significant impact on access to employment opportunities. The company therefore decided to complete a DPIA before implementation.

We also carried out a separate analysis of the system’s classification under the AI Act, including the organisation’s status and the obligations applicable to the deployer. The review confirmed that the DPIA and any FRIA analysis had to be treated separately because their legal triggers differ.

Measures adopted

  • Documentation of the decision logic and system limitations;
  • Mandatory stages of human verification;
  • Internal procedures for challenging results and handling complaints;
  • Updated contractual documentation and AI-governance workflows.

Practical result

Following the project, the company was able to continue the implementation on the basis of stronger documentation concerning compliance and risk management.

A focused consultation can clarify which assessment route applies and what your team needs before making deployment commitments.

Frequently asked questions

Does every AI project need both a DPIA and a FRIA?

No. Screen personal-data processing under GDPR Article 35 and, separately, the system and deployer under AI Act Article 27. One assessment may be mandatory while the other is not. A negative screening result does not remove other applicable legal obligations.

Does human review remove the need for a DPIA?

Not automatically. Article 35 has its own risk test, and its automated-evaluation category is not confined to solely automated decisions. Genuine human oversight can affect risks and safeguards, but a human signature does not by itself settle DPIA applicability.

Does a private employer need a statutory FRIA for recruitment AI?

Not solely because it is an employer using high-risk recruitment AI. Article 27 covers specified deployers and uses. Check whether the organisation is a public-law body or private public-service provider, while independently assessing its GDPR and other AI Act obligations.

Can we rely on the supplier’s impact assessment?

Supplier evidence can support the work, and Article 27 permits reliance on existing assessments in similar cases. The organisation still needs to check whether the document addresses its actual deployment, affected groups, safeguards and applicable obligations. A generic assurance is insufficient evidence of that fit.

Can we wait until the FRIA application date to conduct a DPIA?

No, if GDPR already requires a DPIA for the proposed processing. The DPIA must precede that processing. The AI Act timetable and transition provisions must be analysed separately and do not suspend GDPR requirements.

Does completing an assessment authorise the project?

No. An assessment documents analysis and safeguards; it does not supply a missing legal basis, legalise prohibited AI or override unresolved legal restrictions. Complete any required consultation or notification procedure and resolve conditions that prevent lawful deployment.

AI vendor contracts in Romania under the EU AI Act and GDPR

AI Vendor Contracts in Romania: EU AI Act and GDPR Clauses

An AI vendor contract should do more than grant access to a platform. It should identify the system and intended use, allocate regulatory roles, control the use of business and personal data, preserve evidence, set performance and security obligations, and provide a workable exit if the supplier, model or law changes.

Key points for companies buying AI services in Romania:

  • Classify the AI use and the parties’ roles before negotiating warranties and liability.
  • Do not assume that a standard SaaS agreement or a GDPR DPA covers AI-specific risk.
  • State whether prompts, files, outputs and usage data may be retained or used for training.
  • Require enough information, logs and cooperation to meet the customer’s own legal duties.
  • Connect service changes, security incidents and regulatory events to notice, remediation and exit rights.

This guide is intended for Romanian companies, foreign groups operating in Romania, technology suppliers, procurement teams and businesses implementing generative or other AI tools. It focuses on contract structure. For the wider regulatory framework, read our EU AI Act guide for foreign companies.

Why does an AI vendor contract need a separate review?

AI services can change after signature. A supplier may replace a model, add a subprocessor, change data-retention settings, modify safety controls or alter the geographic delivery chain. Outputs may also be probabilistic rather than repeatable. These features create risks that are not fully addressed by ordinary clauses on software access, uptime and confidentiality.

The EU AI Act allocates obligations according to the system, risk category and operator role. The GDPR applies in parallel where personal data is processed. The contract cannot transfer away statutory responsibility, but it can secure the information, instructions, evidence and cooperation needed for each party to perform its own obligations.

Practical distinction: the AI Act analysis, the GDPR role analysis and the commercial allocation of risk are related but separate. A supplier described as a “provider” under the AI Act is not automatically a “processor” under the GDPR.

Start with the AI use, not the vendor’s template

Before redlining the agreement, the customer should record what the system will do, whose decisions it will influence, what data enters the system, who receives the output and whether the tool will be integrated into employment, credit, insurance, education, essential services, biometric or other sensitive workflows. The same product can create different legal exposure when deployed for a different purpose.

Contract navigator
Build the AI contract in five connected layers

Select a layer to see the question that should be answered before signature.

System and intended use

Identify the product, model, version, functions, integrations, users, prohibited uses and decision context. Classification begins with the actual deployment.

AI vendor due diligence before contract negotiation

A customer cannot negotiate intelligently without basic information about the service. The due-diligence request should be proportionate to the use and risk, but it commonly covers:

  • the legal entity supplying the service and the entities supporting it;
  • the model or models used, hosting locations and material third-party dependencies;
  • the intended purpose, known limitations and prohibited uses;
  • data sources, retention rules and whether customer data is used for training or improvement;
  • security controls, incident history, business continuity and disaster recovery;
  • testing, accuracy or performance information relevant to the deployment;
  • subcontractors, subprocessors and international data transfers; and
  • the supplier’s process for regulatory requests, complaints, audit evidence and system changes.

For high-risk deployments, the customer may require contractual access to sufficient documentation, instructions, logs and compliance information to enable it to perform its own obligations under the AI Act. The scope of access should reflect the parties’ respective roles and may need to protect the supplier’s trade secrets and intellectual-property rights. The European Commission’s AI Act information page and its AI Act Service Desk are useful starting points, but the contract must still reflect the particular system and transaction.

What if the service relies on a general-purpose AI model?

Where the service relies on a general-purpose AI model, the customer should also consider whether contractual information rights are needed regarding the model provider, model updates, transparency documentation and downstream restrictions affecting the deployment. These provisions should be tailored to the customer’s position in the AI value chain and should not imply that the customer is entitled to the provider’s complete technical documentation.

What clauses should an AI vendor agreement contain?

Contract layerWhat the clause should resolveRisk if unclear
System and permitted useProduct, model, version, functionality, users, integrations, territories, intended purpose and prohibited uses.The service is used outside its tested or agreed purpose.
Regulatory rolesAI Act operator roles, GDPR roles, responsibility matrix and cooperation duties.Each party assumes the other will supply evidence or perform a mandatory task.
Data and trainingPermitted inputs, retention, model training, improvement, isolation, deletion and export.Confidential or personal data is retained or reused beyond the customer’s expectation.
Performance and oversightRelevant metrics, limitations, testing, human review, logs, notices and remediation.Outputs cannot be evaluated, challenged or reconstructed when a problem occurs.
Security and incidentsTechnical measures, vulnerability management, notification triggers, timing and cooperation.The customer learns too late or receives too little information to respond lawfully.
IP and output rightsRights in inputs, outputs, configurations, documentation, feedback and third-party materials.The customer lacks the rights needed for its intended commercial use.
Change controlNotice of model, policy, subprocessor, location and functionality changes, plus testing and objection rights.A compliant deployment becomes materially different during the contract.
Liability and exitWarranties, indemnities, caps, insurance, suspension, termination, transition, export and deletion.The remedy is commercially unusable when the service fails or must be withdrawn.

Click a row, or focus it and press Enter, to highlight one negotiation layer.

1. Define the system, version and intended purpose

The agreement should identify what is actually being supplied. “AI services” is rarely sufficient. The specification should address the model or service version, functions, interfaces, customer environment, authorised users, territories, dependencies and intended use. If classification or performance depends on a specific configuration, that configuration should be documented.

2. Allocate AI Act and GDPR roles separately

The parties should record their assumed roles under the AI Act and set out who provides instructions, documentation, logs, notices and regulatory cooperation. A separate analysis is required under the GDPR. Depending on the facts, the parties may be controller and processor, independent controllers or, in a narrower class of cases, joint controllers.

Where the supplier processes personal data on the customer’s behalf, Article 28 GDPR terms may be required. See our dedicated guide to the Data Processing Agreement in Romania. The DPA should not be treated as the complete AI contract, and the main agreement should not conflict with it.

3. Control prompts, files, outputs and training use

The contract should distinguish customer content, personal data, telemetry, feedback and output. It should state whether each category may be stored, reviewed by humans, used to improve the service or used to train a shared model. Where “no training” is promised, the clause should explain its scope, including whether safety review, abuse monitoring or service analytics remain permitted.

The European Data Protection Board has emphasised that whether an AI model is anonymous must be assessed case by case. A supplier’s assertion that its model is anonymous should therefore be supported by facts rather than accepted as a label. See the EDPB’s summary of Opinion 28/2024.

4. Make performance, limitations and human oversight usable

Conventional uptime metrics do not measure output quality. Depending on the use, the contract may need agreed tests, documented limitations, error reporting, performance monitoring, bias or drift controls, escalation and human-review requirements. The AI Act’s accuracy requirements should not be treated as a guarantee of error-free outputs. Any contractual accuracy or performance commitment should define the relevant task, dataset, test method, threshold and remedy.

5. Require evidence and audit cooperation

The customer may need records to complete an impact assessment, answer a regulator, investigate a complaint or demonstrate human oversight. The agreement should define which information is available, in what format, how quickly and subject to what confidentiality protections. In practice, enterprise suppliers may satisfy some audit requirements through independent certifications, reports and controlled information-sharing mechanisms rather than unrestricted customer audits. Those materials can support due diligence, but they do not automatically answer system-specific questions.

6. Coordinate security and incident notification

Security clauses should address access controls, encryption where appropriate, vulnerability management, segregation, personnel access, business continuity and incident cooperation. Notification should be triggered by defined events and delivered early enough for the customer to meet its own legal and operational duties. Different events may activate different regimes, so a personal-data breach, an incident affecting the AI system and an ordinary service outage should not be collapsed into one undefined term.

7. Address intellectual property and third-party claims

The contract should distinguish rights in customer inputs, supplier technology, configurations, fine-tuning, documentation, feedback and outputs. It should also allocate responsibility for claims involving training material, output, trademarks, confidential information and third-party components. Broad statements that the customer “owns the output” may be insufficient if the supplier cannot grant exclusivity or if protectability depends on applicable law and human contribution. Ownership language should be assessed together with applicable copyright rules, which may require sufficient human authorship for copyright protection.

8. Control subcontractors, subprocessors and model dependencies

An AI service may depend on model providers, cloud infrastructure, safety services and specialist subprocessors. The contract should identify the relevant chain, require notice of material changes and preserve appropriate objection or termination rights. For personal data, the subprocessor mechanism must align with Article 28 GDPR and any applicable international-transfer safeguards.

9. Regulate model and policy changes

Suppliers often reserve broad rights to modify models, acceptable-use policies and technical features. The customer should seek prior notice of material changes, enough information to reassess the deployment and a remedy when a change materially reduces functionality, alters data use, affects compliance or creates an unacceptable risk.

10. Connect liability to the risks that matter

Liability provisions should be read together with warranties, indemnities, insurance and remedies. A general cap may be commercially unsuitable for confidentiality breaches, unlawful data use, IP claims or deliberate misconduct, while unlimited liability for every model error may be unacceptable to a supplier, particularly where outputs remain subject to human review. The negotiated position should reflect control, foreseeability, fees, insurance and the consequences of the intended use.

11. Preserve suspension, termination and transition rights

The contract should explain what happens if the service becomes prohibited, materially non-compliant, insecure or unsuitable for the agreed purpose. Exit terms should cover data and prompt export, configuration records, transition assistance, continuing access where necessary, deletion, certification and surviving confidentiality or audit duties.

12. Align the whole contract suite

The main agreement, order form, specification, DPA, security schedule, service levels and online policies should be checked together. An order of precedence is important where one document allows training while another prohibits it, or where a linked policy can be changed unilaterally. Our broader contract review checklist explains the commercial clauses that remain relevant alongside the AI-specific controls.

Customer and supplier priorities are not identical

A customer usually seeks transparency, stable functionality, control of its data, evidence for compliance and practical exit rights. A supplier needs a defined intended use, customer cooperation, restrictions against misuse, protection for reusable technology and a liability position proportionate to fees and control. A balanced contract should not hide this tension. It should identify which party can prevent, detect and remedy each risk.

Practical experience: how Atrium approaches an AI contract review

A typical client mandate begins with the operating facts, not a generic AI checklist. Atrium Romanian Lawyers first maps the proposed use, data flows, parties, model dependencies and decisions affected by the tool. We then review the full contract suite, identify provisions that do not match the deployment and separate mandatory compliance points from negotiable commercial risk.

The work may include a priority risk report, tracked changes, replacement clauses and a negotiation list for the business and technical teams. Particular attention is given to training rights, confidentiality, GDPR roles, security incidents, documentation, model changes, intellectual property, liability and exit. This section describes our review method and does not disclose any client’s confidential facts.

AI vendor contract checklist before signature

  1. Document the system, intended use, users and decision context.
  2. Complete the AI Act role assessment and determine whether the deployment may involve prohibited, high-risk, transparency or other regulated AI use cases.
  3. Map personal data, confidential information and international transfers.
  4. Collect the main agreement, order, DPA, security schedule and linked policies.
  5. Confirm whether customer data, prompts or outputs may be used for training.
  6. Test whether supplier documentation supports the customer’s compliance duties.
  7. Define relevant performance measures, limitations and human oversight.
  8. Align incident notification with legal and operational deadlines.
  9. Review IP ownership, licences, third-party material and claims.
  10. Control material changes to models, policies, locations and subcontractors.
  11. Model liability for realistic failure scenarios.
  12. Plan suspension, export, transition and deletion before deployment begins.

Frequently asked questions

Does every AI vendor contract need a GDPR DPA?

No. A DPA is required where the factual relationship meets the controller-processor conditions under Article 28 GDPR. Other arrangements may involve independent or joint controllers. The roles should be assessed from the actual processing, not only from the labels in the contract.

Can an AI supplier use customer prompts to train its model?

That depends on the contract, product settings, supplier role, transparency and applicable data-protection and confidentiality rules. The agreement should state clearly which data may be used, for what purpose, for how long and whether an effective opt-out or enterprise isolation applies.

Does an AI Act clause transfer compliance responsibility to the supplier?

No. A contract can allocate tasks, information duties, warranties and remedies, but it cannot remove statutory obligations imposed on a party by law. Each operator should understand and perform the duties attached to its own role.

Should the contract name the underlying AI model?

Usually, the system and relevant dependencies should be described with enough precision to understand what is being supplied. If the supplier may change the underlying model, the contract should address notice, testing, material degradation, data implications and the customer’s available remedies.

Who owns AI-generated output?

The answer depends on the contract, the output, applicable intellectual-property law, human contribution and third-party material. The agreement should distinguish ownership from a licence to use and should address infringement claims and supplier restrictions.

Can a Romanian lawyer review a foreign vendor’s English-language AI contract?

Yes, where the agreement concerns a Romanian company, Romanian operations or applicable EU and Romanian requirements. The scope should identify whether separate advice is needed for clauses governed exclusively by another country’s law.

Negotiating an AI vendor contract connected with Romania?

Atrium Romanian Lawyers assists customers and technology suppliers with AI, SaaS and IT contract review, drafting and negotiation, including GDPR, security, intellectual-property, liability and exit provisions.

Discuss the contract with a Romanian lawyer

Disclaimer: This article provides general information and does not constitute legal advice. The appropriate contract and compliance analysis depends on the system, intended use, data, parties, operator roles, applicable law and complete contract suite.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.