Classical city buildings behind the title “Dividend Distribution by a Romanian SRL: Approval Documents Before Payment”.

Dividend Distribution by a Romanian SRL: Approval Documents Before Payment

Corporate decisions · Romanian SRLs · Dividend payments

The owners have agreed that the Romanian company should pay a dividend.

Before the bank transfer, the company needs a decision supported by the right accounts, adopted by the right shareholders and aligned with the payment and tax record.

In brief: A profitable year or a positive bank balance does not, by itself, authorise a dividend payment by a Romanian limited liability company (SRL).

The accountant should confirm the distributable amount and accounting treatment, while legal counsel reviews the corporate approvals, constitutive documents and distribution mechanics.

The recipient-specific tax position requires its own assessment before payment.

A focused legal review can identify the missing approval or constraint before a payment is released.

This article is for founders, foreign parent companies, investors and directors preparing a specific SRL distribution.

It explains when legal support is useful and what the review covers, without offering a substitute for the company’s accounting and tax advice.

Can a Romanian SRL pay dividends once it has cash?

Cash is not the legal test.

A distribution needs profit determined according to law and an appropriate corporate decision, with losses, reserves and net assets checked against the current accounts.

Article 67 of Companies Law no. 31/1990 on the Romanian Legislative Portal provides that dividends may be distributed only from profit determined according to law.

The same article provides for annual distribution and, optionally, quarterly distribution based on interim financial statements, subject to annual reconciliation.

A bank statement therefore cannot answer whether the amount proposed for payment is distributable.

Liquidity matters to the business, but the legal distribution decision depends on the financial basis and a valid shareholder approval.

The director and accountant should distinguish accounting profit, cash available for operations and an amount that shareholders have lawfully approved for distribution.

A company may have collected a large customer invoice yet carry prior losses, required reserves or other constraints that change the distributable figure.

Conversely, an approved dividend may remain unpaid because cash is needed for working capital; the legal entitlement and payment planning are related but different questions.

The review should start with the latest approved accounts and the actual period from which the dividend is proposed to come.

Atrium’s corporate and commercial lawyers in Romania can review the company documents and proposed decision alongside the financial analysis supplied by the accountant.

Which documents should be reviewed before the dividend decision?

Start with the financial basis, the company’s current constitutional documents and a draft resolution that identifies the amount and recipients.

The exact pack depends on whether the proposed distribution is annual or interim, whether there is one shareholder or several, and whether any owner is abroad.

The financial statements establish the starting figures, while the company’s articles of association (constitutive act) determine whether the default allocation and voting arrangements have been changed.

Article 67 generally allocates dividends in proportion to paid-up capital participation unless the company’s articles of association provide otherwise.

For an annual decision, Article 194(1)(a) gives the SRL shareholders’ general meeting the task of approving the annual financial statements and determining the allocation of net profit.

A sole shareholder exercises those meeting powers and records the decision without delay in writing under Article 196¹.

Where there are several owners, the meeting, notice, representation and voting route must be checked against the law and current articles.

A foreign parent’s internal approval does not by itself replace the Romanian subsidiary’s decision.

Our guide to signing Romanian shareholder resolutions from abroad explains why the voting authority, decision record and signing method should be treated separately.

The bank instruction should then match the adopted resolution, recipient identities and payment schedule.

What decision is the company preparing?

Select the closest situation to see the first documents a focused review would compare.

Annual distribution review

Compare the approved annual financial statements, carried-forward losses, reserves, ownership record and draft profit-allocation resolution.

Confirm that the payment instruction reflects the amount and recipients actually approved.

Interim distribution review

Obtain the interim financial statements, proposed quarterly decision and record of any earlier interim dividends.

Plan the annual reconciliation and assess whether a later repayment of excess interim dividends could arise.

Foreign-parent payment review

Check the Romanian company’s decision and the foreign shareholder’s identity and signing authority.

Coordinate the recipient’s residence and any claimed treaty or domestic exemption with the tax adviser before determining withholding and payment mechanics.

The selector identifies review areas; it does not confirm that a distribution is lawful or tax-exempt.

What can prevent a profitable SRL from making the proposed distribution?

Prior losses, required reserves and net-asset deterioration can change the answer even when the current year shows profit.

These checks should be made before the shareholders approve a number, not after the bank transfer is scheduled.

Articles 69 and 69¹ of Companies Law no. 31/1990 address losses, reserves and restrictions on distributions where net assets have fallen.

Where a loss of net assets has been established, Article 69 requires the subscribed share capital to be restored or reduced before profit can be allocated or distributed.

Article 69¹ adds specific checks for carried-forward accounting losses and net-asset deterioration.

Its first paragraph conditions distribution from the current year’s profit where carried-forward accounting losses exist on legal reserves, coverage of those losses and reserves required by the constitutive act.

Where approved annual accounts show net assets below half the subscribed share capital, its second paragraph permits distribution from the current year’s profit only after net assets have been restored to the statutory minimum.

Its third paragraph applies a corresponding restriction to interim dividends on the basis of approved interim accounts.

These are distinct questions from whether the business can afford a transfer in the coming month.

The accountant should confirm the figures and applicable financial-statement treatment; counsel can test the proposed resolution and payment against the corporate restrictions.

If the SRL also owes money to a shareholder, the dividend and loan repayment should not be merged into one undefined “owner payment.”

Article 67(2³) restricts loans by companies distributing interim dividends until the annual differences are reconciled, while Article 67(2⁴) restricts repayment of certain shareholder or affiliate loans where approved annual accounts show net assets below the statutory threshold.

Article 67(2⁵)–(2⁶) also provides for liability and administrative sanctions in the circumstances specified by law, so a proposed owner payment should be reviewed against the current text.

Our guide to shareholder loans in Romania addresses the separate funding and repayment questions.

Does an interim dividend follow the same document route as an annual dividend?

No.

A quarterly distribution requires interim financial statements and later regularisation through the annual statements; it should not be treated as an informal advance against anticipated profit.

Article 28(8¹) of the Accounting Law no. 82/1991 requires interim financial statements where a company chooses quarterly dividend allocation.

Article 67(2¹) of the Companies Law requires the annual statements to show the dividends allocated during the year and to reconcile the resulting differences.

If reconciliation shows that shareholders received more than they were entitled to, Article 67(2²) requires repayment within 60 days after approval of the annual financial statements and provides for late-payment interest after that period.

The company should therefore know what it has already distributed in the same year, not review the latest quarter in isolation.

A later downturn, a corrected accounting entry or a financial-statement adjustment can make an apparently convenient interim payment more complicated.

Where an international group expects a recurring cash sweep, its treasury calendar should accommodate the Romanian accounting and approval process rather than assume every transfer can be labelled a dividend after the fact.

A targeted review can keep the interim decision, accounts, recipient schedule and later annual reconciliation in one coherent record.

How should the resolution describe the payment?

The decision should clearly identify the accounts and profit being allocated, the approved dividend amount, the beneficiaries and the intended payment terms.

It should match the articles, ownership record and accounting treatment.

A generic instruction that “profit will be paid to the parent” can leave material questions unanswered.

Which financial year or interim period is involved, which amount is distributed and what portion remains in the company?

Who held the relevant participation, and does the articles-of-association allocation rule differ from the statutory default?

Has the sole shareholder decided in writing, or did a multi-shareholder SRL adopt a valid meeting decision?

The answers can matter where a shareholder has recently joined or exited, ownership is disputed or a minority investor has negotiated consent rights.

A separate shareholder deadlock review may be needed if a distribution cannot obtain the necessary vote.

Do not assume that a private shareholder agreement changes the company’s articles or cures an incorrectly adopted resolution.

When the owner is a foreign company, confirm who may represent it and what authority evidence is available before circulating the decision for signature.

Atrium can prepare or review the proposed decision and identify any linked corporate action, while the accountant confirms the underlying profit and accounting entries.

What needs to be checked before the bank pays a foreign shareholder?

The Romanian approval and the recipient’s tax treatment should be checked as separate workstreams that meet at payment.

A foreign address or EU incorporation alone does not establish a withholding exemption.

The company should identify the legal recipient, current participation, payment account and documentation supporting any proposed treaty or domestic-law treatment.

The Romanian Fiscal Code on the official Legislative Portal contains different dividend rules depending on the recipient and any conditions for relief.

The applicable tax position may depend on residence, shareholding history, beneficial ownership, supporting certificates, distribution date and payment date.

For a cross-border payment, the tax adviser should verify any applicable double-tax treaty and whether domestic relief implementing the EU Parent–Subsidiary Directive is available.

Tax treatment can change with legislation and should be confirmed for the specific distribution and payment dates.

Where treaty or EU relief is claimed, the foreign recipient’s tax-residence certificate and other supporting evidence should be assessed before payment.

A tax adviser should confirm the withholding, declaration and payment obligations for the actual recipient rather than assume that the domestic headline rate is the amount due in every case.

That analysis should be completed before the net payment is calculated and the bank instruction issued.

For a group that recently acquired its Romanian company, the ownership documents and the dividend resolution should tell the same story.

Our guide to changing shareholders in a Romanian company discusses the separate registration and ownership record.

What if a distribution has already been approved or paid incorrectly?

Preserve the resolution, accounts and payment trail, then assess the actual defect before adopting a corrective step.

A new resolution, accounting correction, repayment or tax amendment may address different problems and should not be treated as interchangeable.

Article 67(4) of the Companies Law deals with repayment of dividends paid contrary to specified distribution rules where the company proves that the recipients knew or should have known of the irregularity.

Article 67(5) states a three-year limitation period from distribution for the restitution action concerning dividends paid contrary to paragraphs (2) and (3); other claims require their own timing analysis.

The separate annual reconciliation mechanism for interim dividends may also create a repayment obligation.

These rules do not imply that every documentary error makes every dividend automatically repayable on identical terms.

There may also be governance, creditor, insolvency or tax consequences depending on the company’s condition and the payment history.

If the issue is discovered before transfer, pause the payment instruction while the relevant legal, accounting and tax questions are resolved.

If payment has occurred, establish the date, amount, recipient and accounting entry before altering the company record.

The same care matters when one owner received money described as a loan repayment, management fee or advance while another expected a dividend.

Labels cannot substitute for the legal basis of each payment.

What can Atrium review before your SRL pays?

A focused instruction can produce a clear answer on the corporate approval, an improved resolution and a list of issues for the accountant or tax adviser before the transfer.

The scope depends on the company, ownership structure and documents already available.

For a straightforward sole-shareholder annual distribution, the work may focus on the approved accounts, written decision, signatory authority and payment wording.

For several shareholders, the review may include notice, majority, unequal allocation provisions, reserved matters or an existing dispute.

For an interim distribution, the company may need its prior payment history and a reconciliation plan considered alongside the interim accounts.

For a foreign parent, we can coordinate Romanian corporate documentation with the tax and banking questions identified by the relevant advisers.

We do not present a legal review as an audit of the accounts or a guarantee that a particular dividend can be paid.

Send the current articles, shareholder details, latest approved annual statements, any interim statements, proposed amount, draft decision and intended recipients.

If prior losses, owner loans or earlier interim dividends exist, include that history at the outset.

The firm can then define a proportionate scope and fee for the decision in front of you.

Request a Romanian dividend decision review

Frequently asked questions

Can the sole shareholder approve a dividend without a meeting?

Yes, the sole shareholder exercises the general meeting’s powers and must record the decision without delay in writing under Article 196¹ of Companies Law no. 31/1990.

The financial basis and distribution restrictions still apply.

A foreign corporate shareholder must also act through an appropriately authorised representative.

Can an SRL distribute dividends every quarter?

Romanian law permits optional quarterly distributions based on interim financial statements, followed by reconciliation in the annual statements.

Before approving an interim amount, check prior distributions, losses and the relevant net-asset position.

The accountant should confirm the accounts and any required reporting for the specific period.

Is an available bank balance enough to approve the payment?

No.

Cash availability does not establish distributable profit or replace the accounts and shareholder decision.

Prior losses, reserves and the statutory net-asset rules can affect the amount available even when cash is present.

Can dividends be paid if prior-year losses exist?

Not automatically.

Current company law requires the relevant carried-forward accounting loss and reserve position to be addressed before distributing profit from the current year.

The accountant should confirm the financial figures, and counsel should review the proposed distribution against Article 69¹ and the company’s constitutive act.

Does a foreign parent automatically receive dividends without Romanian withholding tax?

No.

The recipient’s tax status and any exemption or treaty relief must be checked against the applicable conditions and supporting documents.

The Romanian company’s corporate approval and the tax position should be aligned before the net amount is paid.

What if the SRL also owes its owner a shareholder loan?

A loan repayment and a dividend have distinct legal bases and restrictions.

Review the loan agreement, approved accounts, net assets and any interim-dividend history before selecting the payment route.

Do not use a dividend resolution as a generic authority for repaying debt.

Related corporate guidance

AI-assisted content.

Architectural plans and a model building on a legal office desk beneath the words “Building Permit Refused”.

Building Permit Refused in Romania: A Decision Checklist for Developers

Romanian property law · Developer decision guide

A refused building permit can put a land acquisition, financing drawdown, contractor appointment and launch date at risk. The useful first question is precise: did the authority reject a complete permit application, request missing material, withhold an upstream approval or simply fail to decide?

In brief: Preserve the refusal and proof of communication. Compare its reasons with the urbanism certificate, approved planning rules, land rights, technical documentation and endorsements in the submitted file. Classify the authority’s response before choosing a correction, a new submission or an administrative-law challenge. Keep the project’s commercial deadlines in a separate register. A planning certificate and silence alone do not authorise construction.

Building permit refused in Romania: what can Atrium review?

If a Romanian project has a live refusal or an approaching land, loan or contractor deadline, the first useful engagement is a defined review of the actual file. The scope and fee are agreed for the matter.

One project, one urgent decision

We can review the authority’s letter, service date, urbanism certificate, submitted plans and endorsements, then identify the legal issue, available response routes and deadlines. The resulting advice can help management decide whether to complete, revise, reapply or assess a challenge.

Request a permit-file review →

Several projects or recurring legal work

Where permits sit alongside repeated land, lease, contractor, supplier and authority matters, we can discuss an ongoing Romanian-law mandate. The covered entities, workstreams, hours and any separate project or court work are agreed in advance.

Explore monthly legal support →

To start a focused discussion, send the refusal or latest authority response, the urbanism certificate, the filed-document index and the next commercial deadline. Avoid sending a large unindexed archive at first contact.

What exactly was refused?

Identify the document and the stage of the procedure. A negative urbanism certificate, an objection from an endorsing body, an incompleteness notice and a final refusal to issue a building permit present different legal and practical questions.

Under Law no. 50/1991 on the authorisation of construction works, the urbanism certificate (certificat de urbanism) informs the applicant about the legal, economic and technical regime of the plot, applicable urban-planning requirements and the endorsements or agreements needed for authorisation. It does not itself confer a right to build. The building permit (autorizație de construire) is the act that authorises the works described in the approved documentation. An investor who has a favourable certificate has taken an important step but has not cleared every subsequent condition.

Start with the full correspondence rather than the subject line of the last email. The authority might have asked for a revised drawing, identified an expired endorsement, rejected the proposed use under a local planning regulation, or signed a reasoned refusal. For the developer, all four can stop a project. For legal analysis, the distinction determines whether the response is a request to complete a file, an administrative operation, an individual act or potentially an unjustified refusal within the meaning of Law no. 554/2004 on administrative litigation. The actual wording, legal effect and relevant special rules control that characterisation.

Ask for the official document, not a verbal summary. Record its number, issue and communication dates, signatory, legal grounds, factual objections and any invitation to submit further material. Keep the original electronic message, registry receipt and envelope where relevant. Those records can become as important as the design file when calculating a procedural deadline.

Document route selector: where is the block?

The four cards help the project team choose the first file to review. They are a planning aid; the legal classification of any actual document still requires reading it.

Select the document you received

Click a card to see the immediate review route.

Express refusal

Preserve proof of communication; map each stated reason to the legal rule and the exact document submitted. Assess whether the communication constitutes an individual administrative act, a lawful refusal, an allegedly unlawful refusal, or an unjustified refusal within the meaning of Article 2(2) of Law no. 554/2004. Its wording and legal effect determine the procedural route.

What should the application file contain?

The file must evidence the legal right or legal basis required by Law no. 50/1991 for obtaining the building permit and carrying out the proposed works, alongside a technical proposal that fits the planning framework. Article 7 of Law no. 50/1991 lists the core components for an ordinary building-permit application, including the urbanism certificate, proof of title or other qualifying right over the property, the technical documentation for authorisation, the endorsements and agreements required by the certificate and evidence of the relevant fees. The precise documents depend on the work, the land, the authority and the special regulatory regime. A project in a protected area, for example, calls for a different approval analysis from a routine industrial fit-out.

The architect should compare the actual submitted version of the drawings with the urbanism certificate, applicable urban plans and local planning regulations. Site coverage, floor-area ratio, height, setbacks, use, access, parking and utility solutions can each become a point of disagreement. The legal review should also compare cadastral identifiers and plot boundaries with the land register, the site plan and the rights relied on in the application. A technically elegant proposal does not cure a missing legal right, while a sound title does not cure a scheme that breaches binding urban-planning rules.

Keep an indexed copy of the file as filed: forms, signed design documents, plan revisions, cover letters, registry number, fee receipts, opinions and written clarifications. A later version prepared to answer the authority should be clearly marked as a later version. If litigation follows, the review must establish what the authority actually had when it made the decision. Developers often have multiple CAD files and revised PDFs; the version history can determine whether an alleged defect existed at the relevant time.

Article 7(1) of Law no. 50/1991 states a general 30-day period from submission of the building-authorisation documentation, subject to any applicable special procedure. Under Article 7(3), an incomplete file or a need for technical clarification or modification is notified in writing within five working days of registration. Article 7(32) provides that, from the notification, the issuance period is extended by the number of days the applicant needs to prepare, submit and register the requested changes or additions, provided they are submitted within three months of receiving the notice. Check the registered application, the content and timing of a lawful notification, and the actual completion date; do not treat every informal request as a fresh 30-day period. The deadlines for endorsements and the urbanism certificate are separate.

Business response map: documents and deadlines to verify

Use this comparison with the project schedule. Select a row to see what the decision memo should answer. The table is a triage tool, not a calculation of the deadline in a particular case.

Connect the authority’s document to the project decision
IssueEvidence to pullImmediate decisionTiming to verify
Signed refusal, service record, submitted dossier and local regulation.Correct the scheme, assess a statutory prior complaint or consider litigation.Classify the act before applying Law no. 554/2004.
Notice, filing index, stamped submission and design version history.Supply a documented completion or dispute a demand outside the rules.Check the Law no. 50/1991 notice rule and the actual filing chronology.
Certificate, application purpose, PUG/PUZ/PUD, local regulation and maps.Clarify the planning position or assess a targeted challenge.Apply the route for the actual document and its legal effect.
Certificate list, endorsement request, proof of filing and replies.Obtain, correct or legally assess the upstream approval.Check the specific issuer and exceptions in current Law no. 50/1991.
Registry receipt, complete-file proof, all correspondence and diary.Seek a decision and assess the failure-to-decide route.Verify the lawful decision period and Article 11 starting event.
SPA, financing, lease, construction contract and condition precedents.Preserve extension or notice rights and update the project forecast.Record private-contract deadlines separately from public-law periods.
Written permit refusalSeparate a reasoned final decision from an informal letter. Check service, cited rule, submitted file and the applicable prior-complaint route.

How do you test the refusal against planning law?

A strong review has two layers. First, does the authority cite a rule that applies to this plot and project? Second, do the facts and drawings in the filed dossier actually breach it? The relevant framework may include Law no. 50/1991, Law no. 350/2001 on territorial planning and urbanism, the approved general or zonal urban plan, the local urban-planning regulation and a special protection regime. The current approved version of the plan matters, as do its maps and written regulations. Ask the architect and urban planner to prepare a short matrix pairing each objection with the relevant drawing and regulation.

A refusal saying only that a project is “inappropriate” should prompt a request to identify the legal and factual basis. That does not mean every broadly worded letter is unlawful: its complete text and the administrative file must be evaluated. Conversely, a detailed explanation is not automatically valid merely because it names a law. The question is whether the cited requirement applies and whether the authority applied it consistently to the proposal actually submitted.

Planning changes are especially sensitive when the investment was priced on an earlier certificate or zoning assumption. Confirm which plan was in force at each relevant date, how the certificate described the regime and whether any applicable transitional provision affects the file. A land-purchase agreement may allocate the risk of obtaining authorisation to one party even though the public-law test is determined elsewhere. These are related decisions, but they have different evidence and remedies.

Check also whether the rejection really arises from a third-party endorsement or from the authority’s own assessment. Emergency Ordinance no. 31/2025 introduced a special mechanism for certain endorsements and agreements in the construction authorisation process, subject to its categories, exceptions and procedural conditions and subsequent amendments; Law no. 50/1991 contains those amended rules. Identify the issuer, the request, any clarification, the statutory timeline and any excluded category. In particular, Article 5(111)–(115) contains important exceptions and conditions, including for national defence, public order and national security bodies. The possibility of tacit endorsement must not be presented as tacit issue of the building permit itself. A developer should not commence works simply because an endorsing body or the permit authority has missed a period.

Where the specific conditions of Article 5(110) are met, endorsements issued after the beneficiary invokes tacit approval do not produce legal effects under that provision. Preserve the filing and invocation record. Article 5(114) also requires the beneficiary, designers and builders to comply with applicable construction, urbanism, heritage and related rules when a permit is based on tacit endorsements. The resulting permit may still face a legally grounded third-party challenge; tacit endorsement does not cure substantive design or land-right defects.

For an endorsement governed by Article 5, paragraph (17), of Law no. 50/1991, as amended by Government Ordinance no. 7/2026 (OG no. 7/2026), a beneficiary who receives a request for corrections or additions must respond within 60 days of receiving it, either with revised documentation, clarifications or a legally and technically grounded explanation for not adopting the comments. Failure to respond can close that endorsement procedure, requiring a fresh application. This is a deadline in the endorsement process; verify that Article 5 applies to the particular document and do not confuse it with the separate building-permit application.

For documentation still undergoing endorsement when OG no. 7/2026 entered into force on 2 February 2026 and for which an endorsement or agreement had not yet been obtained, Article VII provides that the relevant procedural periods amended by Emergency Ordinance no. 31/2025 run from that commencement date. This transitional rule concerns the qualifying pending endorsement files, not a universal reset of building-permit application periods.

Can a developer challenge the refusal?

Potentially, but the route depends on the legal nature of the document. Law no. 554/2004 treats an unjustified refusal to resolve a request concerning a right or legitimate interest, and failure to answer within the legal period, as equivalent to unilateral administrative acts for judicial-review purposes.

Do not label every negative answer “unjustified”. An authority may have a lawful reason to refuse a project that lacks a required right or breaches an applicable plan. A challenge should identify the precise legal error, disputed fact or procedural defect and support it with the filed documents. Ask whether a revised plan and fresh application could fix a real problem more efficiently. The decision is both legal and commercial: litigation costs time, while a redesign may affect lettable area, construction cost and commitments to tenants or lenders.

For an individual administrative act addressed to the applicant, Article 7(1) of Law no. 554/2004 generally requires a prior complaint asking the issuing authority, or a hierarchical superior where one exists, to revoke the act within 30 days of communication. For well-founded reasons, a later complaint may be possible within the statutory six-month outer limit described in that provision. Article 7(5) says a prior complaint is not compulsory in the Article 2(2) cases concerning unjustified refusal or failure to answer. An express, reasoned refusal is not automatically an Article 2(2) unjustified refusal; its legal character and the authority’s statutory duties must be assessed. Where that classification is genuinely uncertain, counsel should consider whether to file a timely prior complaint expressly requesting revocation, while independently calculating any potentially applicable judicial deadline. The prior complaint should not be treated as automatically preserving, extending or replacing every other procedural route. Do not use a single “30-day appeal” rule for every kind of permit blockage.

Article 11(1) generally sets a six-month period for bringing the relevant administrative action, calculated from the event specified for that procedural route: for example, the answer to a prior complaint, communication of an unjustified refusal, or expiry of the legally applicable response period. Article 11(2) may allow an action concerning an individual administrative act after the ordinary period for well-founded reasons, but subject to the statutory one-year limit and the specific starting event prescribed by law; this is an exception, not a routine extra six months. The competent court and territorial venue also need to be checked under Article 10 and any special legislation. In many local-authority permit cases the administrative and fiscal section of the tribunal hears the matter at first instance, but the subject, the parties and any special rule determine the correct court. Put all possible dates in a written timeline before communicating strategy to the project team.

Under Article 18, the court may, where the legal conditions are met, annul an unlawful act or order an authority to issue an act or perform an administrative operation. The requested remedy should fit the file and the relief the court can give. A claim for damages may require separate proof of loss and causation. Filing proceedings does not itself give the developer a permit or authorise construction. Interim suspension under Articles 14–15 addresses the execution of an administrative act under defined conditions; it does not automatically transform a refusal into a building permit.

How should the project team manage the commercial timetable?

Build two linked but separate timelines. The public-law timeline records the urbanism certificate, each endorsement, permit application, completion notice, refusal, service date and procedural step. The commercial timeline records the land option, conditions precedent, loan availability, lease long-stop date, mobilisation payment, contractor price validity, pre-sales and any construction milestone. A deadline in one agreement does not pause because an administrative complaint is being drafted.

Review who bears permitting risk under the acquisition and financing documents. Does the buyer have an option to extend closing? Is the building permit a condition precedent to first drawdown? Must a tenant receive a notice by a certain date? Is there a performance bond or non-refundable reservation payment? Legal counsel can coordinate those decisions, while the design team measures whether a redesign is feasible. Management needs a decision memo showing likely options and dependencies, not only an opinion that the authority’s letter is poorly reasoned.

If the proposal must change, document the cost and ask whether the modification would trigger a fresh certificate, new endorsements or a new permit file. If the project continues through a challenge, preserve correspondence with third parties about extensions and mitigation. Avoid promising a revised opening date before the planning position and the technical programme are aligned.

When does a permit problem justify monthly legal support?

A single disputed building permit usually calls for a defined project mandate. A monthly arrangement makes more sense when the same company regularly needs Romanian-law decisions across several developments or operating sites. Typical recurring work could include reviewing land and lease commitments, negotiating contractor and supplier terms, responding to authority correspondence and coordinating the legal parts of project changes. The company should be able to name its expected monthly workload before choosing a plan.

Atrium’s legal subscriptions for companies provide different monthly allocations and service mixes. A development business may need a tailored scope rather than assuming that a standard plan covers a complex permit dispute, technical design work or litigation. An initial conversation can separate the urgent file review from recurring advisory needs, define the companies and projects covered and identify any work requiring a separate mandate.

What a focused permit-file review can deliver

The first work product should answer management’s immediate choice. A legal review can classify the authority’s communication, identify which filing and service dates matter, and separate a curable documentation issue from a disputed planning interpretation. It should use the exact version of the drawings and documents that reached the authority.

A reason-to-evidence matrix pairs each ground in the authority’s letter with the applicable law, local plan or regulation, the relevant drawing and any endorsement. The architect or urban planner addresses technical design questions; legal counsel tests whether the authority relied on the correct rule and followed the applicable procedure. An issue without supporting evidence should be flagged for further fact gathering.

A procedural timetable records the registered permit application, requests to complete the file, endorsements, communication of any refusal and the possible administrative or court dates. It distinguishes a prior complaint against an individual administrative act from an unjustified-refusal or failure-to-answer claim, subject to the legal character of the document and any special rule.

A management decision note compares completion, clarification, redesign, a new application and a legal challenge against the land, financing, lease and contractor deadlines. It can identify where further technical advice or extensions are needed. The scope of each review depends on the available file, and no route guarantees a permit or a particular court outcome.

What belongs in the developer’s response file?

Build one controlled set of documents for the architect, management and lawyers. Use the interactive checklist locally while assembling it; selections are not stored or sent anywhere.

Click a card when its document group has been located.

0 of 8 items selectedChoose a document group to start the response file.

Give every document a date, source and version. A table that merely says “approval pending” hides whether the issuing body received a complete request, asked for clarification or rejected it. Legal arguments should refer to the filed plan and actual correspondence; commercial projections should use the same factual chronology. If a new document is supplied, preserve the earlier one and explain the change rather than silently replacing history.

When is legal advice most useful?

Seek a focused review as soon as the negative document is communicated or a statutory decision period may have passed. Early legal work can classify the instrument, preserve the relevant clock, test the authority’s legal basis and help the project team choose between completion, redesign, renewed application and litigation. The lawyer needs to work with the architect or urban planner on technical planning points, and with the commercial team on transaction deadlines.

Atrium’s real estate and construction counsel can review the permit record, identify the administrative-law route, coordinate the evidence with project advisers and advise on the affected deal documentation. If court proceedings are justified, the firm’s litigation practice can assess the pleadings and requested relief. This describes the work that may be undertaken; each mandate is scoped to the actual project and documents.

Related Guides

Frequently asked questions

Does an urbanism certificate allow construction to begin?

No. Article 6 of Law no. 50/1991 describes it as an information document setting out the planning framework and required endorsements; it does not grant the right to execute building works. Check whether the planned works require a building permit and obtain the lawful authorisation before commencing.

Is a request for missing documents the same as a permit refusal?

Usually it is a different step. Examine the written notice, its legal basis and its actual effect. Preserve the filed version and document a lawful completion. An authority cannot be assessed fairly from an informal description of the notice alone.

Is a building permit issued automatically after 30 days?

Do not assume that. Law no. 50/1991 sets a general issuance period in relation to the authorisation documentation, but completeness and special rules matter. A failure to decide can raise an administrative-law remedy; it is not, by itself, permission to build. The amended tacit-endorsement rules concern qualifying endorsements and have their own conditions and exceptions.

Must the developer file a prior complaint?

It depends on the document’s legal character. Article 7(1) of Law no. 554/2004 ordinarily requires a prior complaint for an individual administrative act addressed to the applicant, generally within 30 days of communication. Article 7(5) removes that obligation in the Article 2(2) refusal and failure-to-answer cases. An express refusal does not automatically fit the latter category. Where classification is uncertain, consider both procedural routes with counsel and calculate each deadline independently.

What is the court filing deadline?

Article 11(1) of Law no. 554/2004 generally provides six months from the event specified for the relevant route, such as the answer to a prior complaint, an unjustified refusal or expiry of the legal response period. Article 11(2) may allow a later claim concerning an individual administrative act for well-founded reasons, subject to its one-year limit and the starting event specified by law. That exception is not an automatic extension. Check any special rule and the actual chronology.

Can a court order the authority to issue the permit?

Article 18 permits appropriate orders against the authority, including an order to issue an administrative act, when the legal conditions are met. The evidence and remedy must be assessed case by case. Neither a filed claim nor interim relief automatically supplies the building permit.

Get a decision on the permit file

Tell us which authority responded, what document you received and your next project deadline. Send the letter and proof of communication, urbanism certificate and index of the filed documents. Atrium can discuss a defined review of the refusal and, if your company has recurring Romanian legal work, a separately scoped monthly arrangement.

Disclaimer: This page provides general information only and does not constitute legal advice, a legal opinion or the creation of a lawyer-client relationship. Legal solutions depend on the specific facts and documents involved.

AI Notice: AI-assisted content.

Sunlit Romanian corporate law office with governance papers and the headline “Changing an SRL Administrator”.

Changing an SRL Administrator in Romania: Shareholder Decisions, ONRC Documents and Handover

Romanian corporate law · Practical guide for shareholders

Changing an SRL administrator in Romania involves more than signing a shareholder decision. A company must identify who has authority to decide, record the appointment and departure correctly, prepare the Trade Register file, and hand over the practical controls that keep the business running.

In brief: For a Romanian limited liability company (SRL), the shareholders’ meeting exercises the power to appoint and revoke administrators under Article 194 of Law no. 31/1990, while Article 197 governs SRL administration. The constitutive act and voting rules matter. ONRC requires a registration application and the competent body’s decision, with identity documents and further items according to the case. Where the change involves an amending instrument, the general filing rule is 15 days, unless another legal rule applies. Bank access, signatures and contract notices should be planned separately.

What does changing an SRL administrator in Romania mean?

In Romanian company law, the office relevant here is the administrator of an SRL. International shareholders sometimes use “company director” as an English shorthand, but “director” may describe a different corporate or employment role in Romanian law, especially in an SA. The SRL administrator’s legal powers, term and method of representation are set by statute and the company’s constitutive act (act constitutiv). A general manager, an employee whose job title contains “director,” and an SRL administrator are not necessarily the same person. Identify the office that is changing before preparing the documents.

Article 194(1)(b) of Law no. 31/1990 gives the shareholders’ meeting the power to appoint and revoke SRL administrators. Article 197(1) governs SRL administration: one or more administrators may serve, and they may be shareholders or persons from outside the ownership group. In a single-shareholder SRL, the sole shareholder exercises the powers of the general meeting and records decisions in writing under Article 1961.

A change of administrator does not by itself transfer shares or necessarily change the beneficial owner. Examine who ultimately owns or controls the company and whether the registered beneficial-owner information has changed. The change also does not automatically terminate a separate employment agreement, settle an outgoing administrator’s mandate-related claims, or transfer personal access to a bank account. Those questions deserve a separate document review. For the wider risk landscape, see our guide to Romanian company director liability.

Which administrator-change route fits the company?

Start with the event that creates the vacancy or change of powers. The same ONRC category can cover several materially different governance situations.

Administrator-change route selector

Select the event to reveal the first documents to check.

Who can appoint or remove the administrator?

For an SRL with several shareholders, Article 192(1) of Law no. 31/1990 sets the ordinary rule of an absolute majority of both shareholders and share capital, unless the constitutive act provides otherwise. In practical terms, more than 50% of all shareholders must vote for the decision, and those shareholders must together hold more than 50% of the share capital. For example, in an SRL with five shareholders, three voting in favour still need to hold over half the share capital between them. Do not use an old template demanding unanimous consent for every amendment: Article 192(2), which previously addressed amendments, was repealed in 2022. Equally, do not assume a bare majority works where the company’s own act provides a different threshold or the meeting was called incorrectly.

Review the notice clause and the proposed agenda before circulating a decision. Article 195(3) refers first to the form in the constitutive act; without a special provision, it provides for registered-letter notice at least ten days before the meeting, stating the agenda. The court’s interpretation of when that period starts may matter where an attendee contests service. The current Article 1951 of Law no. 31/1990 permits remote participation where the constitutive act provides for it, the shareholders decide by the Article 192 majority, or all shareholders agree in writing. The means used must allow identification, effective participation, continuous transmission of deliberations and verification of votes; the adopted resolutions are signed by hand or electronically in accordance with the law. A foreign parent company’s wish to sign remotely is therefore a document and procedure question, not a reason to skip formalities.

Where one administrator is removed and another appointed, draft the decision around both acts. Make the precise change to any named administrators in the constitutive act, state the new term and method of representation, and confirm who may implement the filing. A decision that says merely “appoint our new administrator” can leave registrable facts uncertain. If shareholders disagree over the process, consider whether the meeting, vote and grounds for any challenge need legal review before a filing is attempted.

Which documents go into the ONRC filing?

The ONRC guidance on changes to management bodies lists the registration application, the competent corporate body’s decision, identity documents for incoming members, and an updated constitutive act for an SRL where applicable. Its additional items are explicitly conditional. Use the current checklist and the facts of your case, including the identity and tax status of a foreign appointee.

Select a row to see the practical filing check.

Administrator change response map: decision, documents and action
StepCore documentPractical actionRisk to check
Constitutive act; current ONRC record; shareholder details.Confirm convening, votes, office, term and representation.Wrong body, wrong majority or an outdated shareholder list.
Meeting resolution or written sole-shareholder decision.Record removal or cessation and appointment with precise dates and powers.Ambiguous effective dates or missing authority of a foreign signer.
Incoming person’s identity copy; updated act if applicable; conditional statements.Match the current ONRC checklist to the person and company.Treating every optional document as mandatory or overlooking a required one.
Signed application, decision, annexes and any payable publication proof.Choose the appropriate ONRC submission route and retain the receipt.Late or incomplete filing and assuming a filing number equals approval.
Updated Trade Register evidence; board pack; operational handover log.Update bank, payroll, contracts and access on a controlled timetable.Former signatories retaining practical access or a new administrator lacking it.
Select a stepIts first filing or operational check will appear here.

The ONRC page says applicable fiscal-record information is obtained by the office from ANAF ex officio. Depending on the case, ONRC also lists a foreign individual’s declaration where the individual is not registered for Romanian tax purposes, a signature specimen, a declaration that the new administrator meets legal conditions, evidence for a legal-entity office holder, required sector authorisations and an attorney’s authority. A beneficial-owner declaration is listed if applicable. Replacing an administrator does not necessarily change beneficial ownership, but the company must assess the actual ownership and control structure, any change to registered beneficial-owner data and the ONRC requirements for a beneficial-owner declaration applicable when it files. A person’s management role should not be treated as a universal answer to who ultimately controls the company.

What should the shareholder resolution actually say?

Clear drafting reduces both registration questions and disputes about who may act for the company. Identify the Romanian company by its full legal name, registration number and registered office. Identify the decision-maker, how the meeting was convened or the sole shareholder’s authority, the date, attendees and vote. Then state the outgoing administrator’s name and reason or legal mechanism for cessation without implying that a dispute is resolved merely by using a label.

Set out the incoming person’s full identifying details, the appointment, its effective date and duration, and whether the administrator represents the company alone or together with another named office holder. If a specific approval is needed for certain transactions, distinguish internal authorisation from the registered external representation rule. Decide whether discharge of management activity is on the agenda; appointment and discharge are related but distinct shareholder decisions under Article 194.

Where the constitutive act names the administrator or states the representation method, attach an updated full text reflecting the amendment, consistent with Article 204(4) of Law no. 31/1990 and the ONRC checklist. Ask counsel to check whether the particular appointment requires an act amendment; not every change presents an identical filing set. Keep signing authority, dates and spelling the same throughout the decision, constitutive act, identity copy and application.

How soon must the change be filed, and how is it submitted?

ONRC’s current guidance states the general rule that an application for a legal entity’s registration is filed within 15 days from conclusion of the constitutive or amending act, unless the law provides otherwise. Determine what instrument actually changes this company and whether a special provision applies. Put the decision date, signature date, proposed start of office and filing date on a single timetable. Do not treat fifteen days as a promise that a bank or counterparty will update its records within the same period.

ONRC lists physical submission, postal or courier submission and electronic transmission among the available routes. It states that electronic submissions require a qualified electronic signature in the relevant format; paper and electronic requirements should not be conflated. The same guidance notes that filings can be made at any Trade Register office under Article 85 of Law no. 265/2022. A representative filing on a company’s behalf needs the appropriate authority document. For a broader overview of digital company filings, see our guide to online company registration and electronic signatures.

The guidance describes a one-working-day decision period for the registrar calculated from registration of the application, with power to request further documentary evidence. That is a procedural decision standard, not a guarantee that the entire corporate change, publication, banking update and business handover will be complete the next day. Check the actual case status and retrieve the updated registration evidence before presenting a new signatory to counterparties.

How do foreign shareholders or foreign administrators sign?

International groups commonly have a Romanian SRL owned by a foreign company and want its parent-level officers to approve an administrator change without travelling. The corporate decision still has to be made by the correct Romanian company’s decision-maker, represented by someone authorised to act for the foreign shareholder. Review the foreign parent’s current registry evidence, internal powers and any power of attorney before settling the Romanian resolution. A job title alone does not always prove authority to sign.

Document language, certification, translation and any apostille or legalisation question depend on where the document originates and how it will be used. ONRC states that documents submitted for registration must be typed in Romanian and legible; foreign source documents may require additional formalities under the relevant rules. Do not assume every foreign document requires an apostille or that an electronic signature substitutes for all underlying evidence of authority. Clarify the exact package before circulating originals internationally.

If the proposed administrator is a foreign individual, compare the ONRC conditions for identity, fiscal status, declarations and specimen of signature with the individual’s actual situation. Appointment as administrator is a company-law question; the person’s immigration, work, residency and tax position may create additional questions that are outside the registry filing itself. Build time for those checks if the administrator will manage operations from Romania.

Does a resignation or contested removal require a different approach?

A voluntary resignation and a shareholder revocation may lead to the same need to update registered management, but the underlying evidence and possible private claims differ. Preserve the resignation communication, proof of receipt, mandate or service agreement and relevant shareholder decision. Check whether the company will still have a person who can represent it during transition. If the former administrator is also a shareholder or employee, treat those capacities separately.

If shareholders are divided, meeting procedure, voting rights, access to records and the accuracy of the existing register become central. Article 196 of Law no. 31/1990 addresses challenge of an SRL general-meeting decision, applying rules from joint-stock companies and a specific knowledge-based starting point for the fifteen-day period stated there. A dispute over the decision calls for case-specific litigation analysis; a Trade Register filing should not be portrayed as settling all private-law disputes.

Revoking an administrator does not automatically extinguish liability for conduct during an earlier mandate, just as a disagreement over performance does not itself invalidate every corporate decision. Conversely, the outgoing administrator may have contractual claims even where the shareholder resolution is valid. Keep evidence of the handover, account access and communications in a controlled file, particularly when control of financial information or customer contracts is disputed.

What should the company put in its handover file?

A registry update is one part of continuity. The incoming administrator may need to approve payroll, tax submissions, supplier payments, litigation instructions or an imminent lease. Create an indexed file and assign a named person to confirm each handover. The following checklist is interactive for planning only; selecting an item does not save or upload company information.

Click each card as you assemble the file.

0 of 8 items selectedChoose a document to start the handover checklist.

The checklist does not imply that all eight documents must be submitted to ONRC. Bank forms, contract notices and IT credentials belong to an operational workstream. The registry workstream has its own legally required papers. Separating the two prevents a common problem: the new administrator appears in the public record but still cannot release a payment, or the former administrator retains access after their authority has changed.

How should the handover be sequenced with the bank and counterparties?

Before the shareholder decision, identify urgent transactions and who can sign them. Then align the effective date in the decision with any necessary acceptance, the outgoing administrator’s access changes and the planned ONRC submission. After the registrar has decided and the public record is updated, obtain the extract the bank needs and follow its own mandate process. Banks and contract partners may require additional identity or corporate documents under their own procedures.

Review loan agreements, leases, licences, supplier frameworks and insurance policies for named signatories, notification duties or key-person conditions. An administrator change is not automatically a change of share ownership, but a contractual notice clause may still respond to a management or control event as defined in that contract. Record notices and acknowledgments. In regulated sectors, check whether an authority’s approval or notification must precede the registration or a person beginning their functions; the ONRC checklist itself flags prior sector authorisations where the law requires them.

Give the incoming administrator a concise briefing on pending payment runs, deadlines, tax correspondence, pending claims and employment decisions. Where a departure is contentious, a neutral inventory of company assets and records protects the integrity of the transition. Avoid copying personal material unrelated to company duties; the point is a complete business record that another authorised person can actually use.

How Atrium assists with an SRL administrator change

A cross-border change works best when the legal decision, filing papers and operating handover are built from the same verified facts. Our corporate-law work can include reading the current constitutive act and registry extract, mapping the shareholder approval route, drafting the decision and updated act where required, reviewing documents signed abroad, and coordinating the ONRC application with the company’s implementation timetable.

That review can also identify a separate question that should not be buried in the filing: the departing administrator’s mandate or employment terms, a disputed shareholder vote, a bank access problem, or a regulated activity that needs its own approval. The aim is to give management a usable decision pack and a clear record of what has been filed and what still requires action.

The description above outlines a service process. It is not a report of a particular client matter or a promise of registration or dispute outcome.

Two illustrative administrator-change situations

A foreign parent replaces its Romanian subsidiary’s sole administrator. The parent wants the new appointee to begin signing contracts next week. Counsel first checks its authority to sign the sole-shareholder decision, the Romanian constitutive act and the proposed representation date. The filing pack includes the decision, the incoming person’s identification and any additional ONRC documents triggered by the facts. The bank’s mandate timetable is checked separately so a legal appointment is not mistaken for immediate payment access.

Two shareholders disagree after an administrator resigns. The company has a time-sensitive supplier payment and conflicting views on who can call the meeting. The team preserves the resignation, the current articles, notices, voting evidence and bank-authority records. It then decides what valid corporate action can fill the vacancy, whether a challenge risk arises and how the Trade Register and temporary operational controls should be managed. These scenarios are illustrations, not claims about actual clients or guaranteed outcomes.

Related Guides

Frequently asked questions

Can a foreign national be an administrator of a Romanian SRL?

Law no. 31/1990 allows an SRL administrator to be a non-shareholder. ONRC’s checklist expressly contemplates documents for foreign individuals in relevant cases. The person’s eligibility, tax-status declarations and any separate immigration or regulated-sector requirements need checking.

Must every shareholder agree to remove or appoint an administrator?

Not necessarily. Article 192(1) generally requires votes from more than 50% of shareholders who together hold more than 50% of share capital, unless the constitutive act provides otherwise. Check the company’s own voting and meeting provisions; the old Article 192(2) amendment rule has been repealed.

Is an updated constitutive act always required?

ONRC lists an updated act for an SRL where applicable. If the change amends the company’s act, Article 204(4) requires filing the amending instrument and consolidated text. Review the actual document and the nature of the change rather than assuming a single universal filing set.

How long does the company have to file the change with ONRC?

ONRC states the general 15-day rule from conclusion of the constitutive or amending instrument for legal entities unless the law provides otherwise. Confirm the instrument, its date and any special rule for the specific filing.

Does appointing a new administrator automatically change beneficial ownership?

No. The appointment alone does not necessarily change who ultimately owns or controls the company. Check the actual ownership and control arrangements, whether registered beneficial-owner data changed, and the ONRC declaration requirements applicable at the time of filing.

Can the new administrator immediately access the company’s bank account?

Do not assume so. Corporate appointment, registration and the bank’s own mandate and verification process can occur on different timetables. Arrange the bank documents and existing signatory controls before urgent payments fall due.

Plan an SRL administrator change in Romania

Send the current constitutive act, latest Trade Register extract, shareholder structure, proposed effective date and any resignation or dispute correspondence. Atrium can review the approval route, prepare a coherent corporate document set and identify the ONRC and operational handover steps for your company.

Contact Atrium about your administrator change
Disclaimer: This page provides general information only and does not constitute legal advice, a legal opinion or the creation of a lawyer-client relationship. Legal solutions depend on the specific facts and documents involved.

AI Notice: AI-assisted content, reviewed by a qualified Romanian lawyer.

Ending a supplier contract in Romania: supplier agreement and termination notice on an office desk

Ending a Supplier Contract Early in Romania: Notice, Risk and Next Steps

Romanian commercial contracts · Practical guide for companies

A business may need to leave a supply relationship before its planned end because deliveries have failed, a new supplier is available, or the commercial model has changed. The exit route determines the notice, the final orders and the financial exposure.

In brief

A Romanian supplier contract can end early by an agreed exit, an applicable unilateral termination right, or a remedy for qualifying non-performance. An indefinite-term agreement can generally be ended on reasonable notice under Article 1277 of the Civil Code. A fixed term does not create a general right to walk away simply because the arrangement is no longer attractive. Identify the governing law and exact contract documents, preserve evidence, calculate notice and cure requirements, then settle outstanding orders, stock and invoices in a documented handover.

This guide concerns ordinary business-to-business supply arrangements governed by Romanian law. Energy and utilities, public procurement, regulated distribution, consumer contracts and a cross-border contract governed by another law can raise different rules. If a disagreement is already developing, a Romanian commercial contract review should begin with the signed framework and the orders actually being performed.

Romanian law distinguishes between rescission (rezoluțiune), termination for continuing-performance contracts (reziliere) and unilateral withdrawal or denunciation (denunțare unilaterală). The applicable route determines the conditions for ending the contract and the effect on obligations already performed.

Can you terminate a supplier contract before it expires?

Often, but the legal route depends on the contract’s duration, its exit clause, the seriousness of any breach and whether both sides agree on a close-out.

Read the agreement rather than its title alone. Under Articles 1766 and 1771 of the Romanian Civil Code, a supply arrangement may involve goods or services delivered at later dates or continuously, with the buyer paying the agreed price; where the special supply provisions do not answer an issue, sales rules may supplement them. A master agreement, annexes, purchase orders and accepted forecasts can form the practical transaction. The fact that one document is labelled “supplier agreement” does not settle every issue about its legal classification.

Start by separating expiry from early termination. A fixed term may simply end on its stated date, subject to renewal or outstanding orders. An indefinite term has no contractual end date, but reasonable notice matters. For a fixed term, an express break clause, a sufficiently established breach or a signed exit agreement may supply the route. Commercial dissatisfaction alone is generally not the same as a legal ground for breach termination. Nor is there a universal Romanian “30-day cancellation right” for B2B supply contracts.

Contract exit route selector

Select the situation closest to your file. The result identifies documents to examine; it is not a legal determination.

Breach-based exit

Identify the exact obligation, due date, evidence and legal or contractual termination mechanism. Review whether notice to perform and a cure period are required and whether the default is sufficiently serious. A written termination declaration must meet the conditions for that route; an angry email is not a substitute for a properly supported notice.

Which termination route fits the documents?

Classify the route before drafting a notice. A notice based on the wrong provision can create a claim that your own company has repudiated the deal.

Select a row for its first practical check.

Supplier exit map: grounds, notice and exposure
RoutePrincipal basisDocument to testExposure to manage
Qualifying non-performance and the applicable remedy.Default record, contractual termination clause, notice.Disputed breach, missed cure or continuing orders.
Unilateral exit granted by contract or law.Signed agreement, renewal annexes, notice procedure.Fee, minimum purchase or ineffective notice.
Article 1277 and reasonable notice.Duration clause, order history, transition plan.Too little notice and supply disruption.
Both parties consent to the close-out.Signed exit and settlement agreement.Open orders, stock, deposits and broad releases.
Distinct rules for force majeure, impossibility or hardship.Event evidence, causation, mitigation, notices.Incorrectly treating hardship as automatic termination.
Select a routeThe first check for that route appears here.

What must you check in the contract before sending notice?

Read the entire contract set, including annexes and purchase orders, before selecting the notice ground and effective date.

Duration and renewal. Find the commencement date, initial term, automatic extension and any deadline to opt out of renewal. A notice sent before the renewal deadline can be a notice of non-renewal rather than an immediate early termination. Review whether renewal was validly agreed and whether later purchase orders extend any part of the relationship.

Scope and order mechanics. Determine whether a forecast is non-binding, an accepted purchase order is binding, and what quantity or spend commitments apply. A framework contract may end while accepted orders remain enforceable under their own terms. Conversely, a disputed order may never have been accepted. Do not treat the entire order book as one indivisible obligation without reading the acceptance process.

Exit, default and notice language. Read the break clause, breach definition, notice to cure, escalation steps, deemed receipt, delivery address and permitted method. Some agreements require a named recipient, registered post or a particular email account. A contract might also make termination subject to a specified advance notice or compensation. Compare all versions and amendment dates before relying on a clause copied from an older template.

Commercial allocation. Identify minimum purchase volumes, exclusivity, take-or-pay terms, committed materials, dedicated capacity and termination charges. Separate a stated contractual sum from an asserted loss: each may need a different legal analysis. Check liability caps, exclusions, warranties, security, retention of title and any set-off provision. The termination clause is often too short to answer the real accounting question.

Forum and governing law. English language, a foreign parent or overseas signatures do not alone determine the law applicable to a contract. Read the choice-of-law and dispute clauses and identify the contracting entities. For an international sale of goods, check whether the CISG or other mandatory or sector rules affect the analysis before applying the Romanian Civil Code as though it were the whole framework.

How do you terminate for a supplier’s breach?

Establish an actual non-performance, the available remedy and the procedural conditions for using it. Whether a breach is sufficiently serious depends on the contract, the clause relied upon and the circumstances.

Article 1549 of the Civil Code generally allows the creditor of an unperformed obligation to seek enforcement or, where justified, termination and damages. Article 1550 distinguishes termination ordered by a court, unilateral termination in cases allowed by law or contract, and termination by operation of an express clause. Under Article 1551, a minor non-performance does not ordinarily justify rescission; for contracts performed in successive stages, however, a repeated breach of minor importance can support termination for the future. The contract’s obligations, an expressly drafted termination clause under Article 1553 and the actual pattern of performance must be read together before classifying a default or choosing a remedy.

A typical evidence file should show the obligation, the agreed specification or delivery date, the actual performance, the business consequence and every complaint or attempt to cure. Preserve delivery notes, quality reports, photographs, shipment data, email threads and records of rejected lots. A buyer who repeatedly accepted late deliveries without objection may face factual arguments about waiver, variation or the seriousness of the breach. A supplier alleging non-payment needs the invoices, acceptance or delivery evidence, due dates and correspondence about disputed amounts.

Under Article 1552, unilateral termination by written declaration is available in the circumstances set out by the rule, including where the parties agreed to it, where the debtor is automatically in default, or where it has not performed within the period fixed in a notice to perform. For an express termination clause (pact comisoriu) to operate under Article 1553, it must specify the obligations whose non-performance triggers termination. Whether termination follows the mere failure to perform or requires a prior notice putting the debtor in default depends on the clause and the conditions in Article 1553(2)–(3). Do not issue a bare declaration that a contract “is cancelled” before checking those requirements and any applicable notice or cure condition.

If supply must continue in part, consider whether the problem concerns one delivery, a series of deliveries or the framework itself. Romanian law distinguishes rescission of a contract from termination of a contract performed over time; an early end to future performance does not automatically unwind goods properly delivered and consumed months ago. Alternative remedies such as repair, replacement, price adjustment, performance or an agreed corrective plan may better protect production continuity while rights are reserved.

Risk: Stopping payment or rejecting all future deliveries before the legal position is mapped can turn a genuine supplier default into a two-sided dispute. Check the right to withhold or suspend your own performance and document the proportional response.

Can you leave a fixed-term contract without a breach?

Only if an applicable legal or contractual right permits unilateral exit, or the counterparty agrees. A fixed end date is not itself an unrestricted exit option.

Article 1276 of the Civil Code governs the exercise of a unilateral termination right where that right is recognised by law or contract; it does not create a general right to end every fixed-term agreement. For successive or continuous performance, the provision requires reasonable advance notice and does not affect services already performed or being performed in the relevant period. The applicable clause may set an exercise window, notice procedure or payment obligation, subject to the legal regime governing that particular right. It may also be limited to certain triggering events; words such as “at any time” in a summary email cannot enlarge the signed provision.

Where no such right exists, a mutual exit agreement may be the fastest controllable route. Negotiate a final delivery schedule, payment, stock disposition and reciprocal release with sufficient precision. One party may agree to a commercial concession because redeployment, inventory buy-back or a staged reduction is better than an uncertain dispute. Record the bargain as an amendment or termination agreement signed by authorised representatives; a manager’s operational understanding may not bind the legal contracting entity.

Force majeure, impossibility and hardship are different routes

Force majeure or a fortuitous event concerns an exceptional event and its effect on liability under Article 1351 of the Civil Code, subject to law and the contract. Fortuitous impossibility of performance under Article 1557 asks whether the obligation can still be performed and distinguishes definitive from temporary impossibility; it is not simply another name for a more expensive delivery. Hardship (impreviziune) under Article 1271 concerns performance that has become excessively onerous because of an exceptional change of circumstances, subject to its statutory conditions and the court’s possible intervention. It is not an automatic unilateral cancellation right.

Identify the event, when it arose, which obligations it actually affected, the period of disruption and any contractual notice or mitigation duties. Rising costs, lower demand or a cheaper competitor do not by themselves establish impossibility, force majeure or hardship. A logistics interruption affecting one shipment may require a different response from a permanent impossibility to supply the agreed goods. Read the governing-law and risk-allocation clauses before sending a notice that asserts one of these grounds.

How much notice is required for an indefinite-term contract?

Article 1277 permits either side to end a contract of indefinite duration with reasonable notice; the statute does not prescribe one number of days for every supplier relationship.

Reasonableness is assessed in context. A weekly commodity order with alternative suppliers may have a different transition profile from a custom manufactured component using dedicated tooling. Review the length of the relationship, ordinary order cycles, forecast reliance, production lead times, inventory, substitute sources and the parties’ own communications. Give a clear effective date and a practical transition plan. Where the contract contains a notice period, review its wording alongside the statutory rule and any mandatory limits; do not assume the stated period answers every dispute over fairness or performance during notice.

The same article treats a clause contrary to this right, or a payment imposed merely in exchange for exercising the right to end an indefinite-term contract, as unwritten. That narrow rule does not mean nothing is ever payable when the relationship ends. Separate (1) a charge imposed solely for giving lawful notice, (2) invoices and independently binding minimum-purchase or take-or-pay obligations, and (3) damages for a separate contractual breach, including a failure to give reasonable notice if the conditions for liability are met. Each item needs its own contractual basis and factual assessment.

What should the termination notice say and how should it be served?

A useful notice identifies the agreement, legal route, facts, required action and effective date, while following the precise contractual service method.

Identify both legal entities, the signed contract and amendments, the relevant purchase orders, the clause and statutory basis relied on, and the chronology. If the complaint is defective goods, name affected batches and test results. If it is non-payment, identify invoices, due dates and the net amount after undisputed credits. Where notice to cure is required, say exactly what performance is sought and by when. If the contract provides an escalation or meeting procedure, account for that step and its deadline.

Separate the cure notice from the eventual declaration of termination where the route requires two stages. In the final notice, state when the agreement will end, what should happen to pending deliveries, and who should discuss the account reconciliation. Reserve rights to payment or damages carefully without implying that those amounts are already admitted by the other side. Avoid broad accusations that cannot be documented. A notice can be firm without being theatrical.

Use the designated address, email, person and method in the signed notice clause. Keep the sent message, attachment, courier receipt, delivery confirmation and any response. An electronic signature or ordinary email might be workable in one agreement and non-compliant in another. If a notice clause treats receipt as occurring on a later business day, calculate the intended effective date accordingly. Have someone outside the commercial negotiation verify this mechanical step before transmission.

What happens to purchase orders, stock and payment after termination?

The end of future supply does not automatically erase accrued invoices or decide who bears the cost of orders and materials already committed.

Build a close-out schedule order by order. Mark accepted and unaccepted purchase orders, work in progress, completed goods, dispatched goods, goods in transit and products awaiting acceptance. Check whether the framework gives either party a cancellation right over each category and whether the parties’ conduct varied it. An open-ended claim for all “future revenue” should be tested against actual contractual commitments and the applicable damages rules.

Reconcile invoices, credit notes, deposits, rebates, price adjustments, set-off arguments and any retention of title. Preserve proof of receipt and quality acceptance. If the buyer disputes only a portion of an invoice, explain the grounds for that portion and avoid leaving the whole account opaque. For a more focused payment analysis, see our guide to late payment interest and remedies in Romania.

Physical and digital assets often require a separate handover: tools and moulds, samples, specifications, drawings, credentials, customer data and confidential information. Determine ownership and return or deletion obligations from the contract and applicable law. Record continuing warranties, product traceability and any recall or safety cooperation. Termination does not itself extinguish a valid confidentiality, dispute resolution or post-termination obligation; whether a clause survives depends on its terms and legal effect.

If transition supply is needed to prevent disruption, put the interim quantities, prices, payment security, delivery dates and reservation of rights in writing. That arrangement can preserve business continuity without necessarily abandoning a dispute about earlier failures. Conversely, the parties should not assume a fresh purchase order is automatically governed by a framework they have already ended.

What damages or termination fees could follow?

Exposure depends on the contractual allocation, whether termination was valid, the loss claimed and the proof connecting that loss to the breach.

Articles 1530 and 1531 of the Civil Code provide the general framework for contractual damages and full reparation of loss caused by non-performance, subject to the relevant legal conditions. A claim should be examined with invoices, costs, mitigation steps, substitute supply prices and the contract’s limitation provisions. A forecast is not automatically a guaranteed order. Nor is every sunk investment recoverable simply because the relationship ends sooner than anticipated.

Review any liquidated sum or termination charge separately. Its legal treatment turns on the actual drafting and reason for payment: a charge imposed solely for exercising the Article 1277 right is different from a contractual penalty for a distinct breach, the price of goods already supplied, or an independently binding minimum-purchase or take-or-pay commitment. None should be assumed valid or payable solely because it appears in an invoice; equally, Article 1277 does not erase them all. Check the obligation’s wording, any mandatory rule, accrued orders, evidence of loss and the notice actually given. A headline percentage in a commercial presentation is not enough to calculate a claim.

Commercial exposure can also be indirect: emergency replacement sourcing, production interruption, disputed tooling, customer commitments and reputational friction. Put a contemporaneous evidence and mitigation plan alongside the legal analysis. For an unpaid account or anticipated claim, assess whether a demand, negotiated settlement or commercial litigation support is appropriate. Do not promise a particular recovery or court result before testing the evidence and jurisdiction.

What should a company put in its exit file?

Gather the documents before the relationship or digital records change. Select the items collected to track the file; this checklist stores nothing outside your browser session.

0 of 8 items selected

Choose any card to track the document.

Client Experience: Exiting a Stalled Supplier Relationship

The Situation

A Romanian manufacturer had relied on the same domestic raw-material supplier for several years under an indefinite-term supply framework. Deliveries had slipped twice during the previous year. While the delays were not obviously serious enough to support a clear breach-based termination, they had begun to affect production planning and supplier confidence. The client had already identified an alternative supplier and wanted an orderly exit with minimal operational disruption and no unnecessary exposure.

Atrium’s Approach

Atrium reviewed the framework agreement, amendments and recent purchase-order history to identify the obligations that remained binding. Given the factual record, the firm concluded that the matter was better analysed as a reasonable-notice exit under Article 1277 of the Romanian Civil Code than as a contested breach-based termination. The proposed notice period was aligned with the client’s replacement-sourcing timetable, while the notice mechanics and final-order schedule were drafted to comply with the contract’s own requirements.

The Outcome

The parties completed the exit on the planned timetable through a documented transition process rather than a breach-based dispute. Outstanding orders, inventory issues and final account reconciliation were addressed before the notice period expired, allowing the client to implement its replacement-supplier strategy in a controlled manner.

This illustration is a composite drawn from recurring fact patterns and does not describe any specific client or matter. It is provided for general information only and does not imply that another matter with similar facts would achieve the same outcome. Every supplier exit depends on the particular contract wording, factual record and timeline involved.

How Atrium assists with a supplier contract exit

A useful legal review joins the legal ground to the operational facts. Atrium can examine the signed contract set and order history, map notice and cure requirements, assess evidence of default, draft correspondence and negotiate a close-out of invoices, stock, tooling and transition supply. Where the disagreement cannot be settled, the file can be organised around the contract’s forum and the remedies actually supported by the documents.

For an international company, the review may also need to coordinate instructions from a foreign parent with the Romanian contracting entity and its purchasing, logistics and finance teams. The service description explains the work that may be involved; it does not refer to a particular client matter or guarantee an outcome.

Related Guides

Frequently asked questions

Can I cancel a Romanian supplier contract with 30 days’ notice?

There is no universal 30-day B2B cancellation rule. Check whether the contract is fixed or indefinite, any express break right and the agreed notice procedure. Article 1277 requires reasonable notice for an indefinite-term contract, which depends on the relationship.

Does a supplier’s late delivery automatically end the contract?

No. Examine the delivery obligation, seriousness or repetition of the default, contractual remedies and whether a notice to perform or cure period is required. One late order does not automatically end every other order or the framework.

Can a fixed-term supply contract end without a breach?

It may end through a valid contractual or statutory unilateral exit right, or by agreement between the parties. Without such a route, a change of commercial preference alone does not ordinarily cancel the remaining fixed-term commitments.

What happens to purchase orders already accepted?

Read each order and the framework together. The parties should identify accepted quantities, work in progress, deliveries in transit and any specific cancellation provisions. Termination of future supply does not automatically erase accrued rights or obligations.

Can the other party claim a termination fee or lost profit?

That depends on the contract, the legal route and proof of the claim. Article 1277 treats a charge imposed solely for exercising the right to end an indefinite-term contract as unwritten. It does not automatically eliminate accrued invoices, independent minimum-purchase commitments or damages for a separate breach. Test each claim, any liability limits, causation and mitigation.

Is an email sufficient as a termination notice?

Only if it meets the applicable form and service requirements. Check the signed notice clause, addressee, delivery method and timing, then retain proof of transmission and receipt. Some situations require a prior notice to perform before a final termination declaration.

Review your supplier exit before sending notice

Send the signed agreement and amendments, current orders, the notice clause, the default or commercial reason for exit, and the proposed timetable. Atrium can assess the available route, draft a defensible notice or negotiated close-out, and identify the payment and continuity issues that need resolution.

Contact Atrium about your supplier contract
Disclaimer: This page provides general information only and does not constitute legal advice, a legal opinion or the creation of a lawyer-client relationship. Legal solutions depend on the specific facts and documents involved.

AI Notice: AI-assisted content.

Employment due diligence in Romania for a business acquisition

Employment Due Diligence in Romania: A Buyer’s Legal Checklist

Employment law • M&A • Romania

Employment due diligence in Romania helps a buyer understand the people, contracts, payroll obligations and workforce risks it may inherit with a target company. The review should connect employment documents with the transaction structure, valuation, warranties, indemnities and post-closing integration plan.

The scope and consequences of employment due diligence differ significantly between share acquisitions and asset transactions. In a share acquisition, the employing company normally remains the same legal entity, while an asset or business transfer may require a separate analysis of whether employees and employment-related rights transfer with the relevant undertaking.

What is employment due diligence in a Romanian transaction?

Employment due diligence is a transaction-focused review of the target’s workforce and employment liabilities. It is not the same as a general HR audit. The buyer needs to know which risks affect price, continuity, retention, integration and the contractual protection package.

The scope may include employees, directors, consultants, independent contractors, temporary workers, secondees, expatriates and other individuals providing services to the target. The legal analysis typically depends on the actual working relationship and not solely on the contractual label used by the parties.

Romanian employment due diligence is primarily assessed under Law No. 53/2003, the Romanian Labour Code, together with the special legislation applicable to matters such as transfers of undertakings, collective relations, occupational health and safety, employee data and the employment of foreign nationals.

This guide is distinct from general Romanian employment law advice, disciplinary dismissal guidance and the separate review of employees versus independent contractors. Its focus is the buyer’s decision before, during and after an acquisition.

Buyer’s Review Map

Interactive review map

Select an employment area

Click or tap a card to see the first documents and questions to request.

Workforce structure

Request a headcount by entity, role, location and employment status. Identify employees, directors, contractors, temporary workers, secondees and key individuals whose departure could affect the business.

Employment Due Diligence Risk Scanner

Interactive risk screen

Select the signals that apply

This is a preliminary review signal, not an automated legal opinion. Select the statements that describe the target. The result helps identify where the data room needs deeper review.

Preliminary result: select the statements that apply to see the suggested diligence response.

What does Romanian employment due diligence examine?

The central test is whether the target’s written documents, payroll records and actual employment practice tell the same story. A signed contract may not reveal unpaid overtime, informal benefits, misclassification, inconsistent termination practice or undocumented management arrangements.

The buyer should identify the employing entity, workplace, reporting line and practical role for each material category of worker. It should then compare that information with employment contracts, amendments, payroll, internal policies, time records, leave records and communications where relevant. Gaps are not necessarily breaches, but they are signals that require explanation and proportionate follow-up.

The review should also distinguish liabilities that remain with the seller from risks that will affect the buyer after completion. This is especially important where the buyer intends to reorganise the workforce, harmonise benefits, move employees between group entities or change managers shortly after closing.

Share deals, asset deals and transfers of undertakings

In a share acquisition, the target company remains the employer and its employment contracts generally continue within the same legal entity. The buyer nevertheless needs to review change-of-control provisions, transaction bonuses, retention arrangements, employee communications and any post-closing measures that could require consultation, consent or amendments.

In asset transactions or business transfers, buyers should assess whether Articles 173–174 of the Romanian Labour Code and Law No. 67/2006 on safeguarding employees’ rights in transfers of undertakings apply to the transfer of an undertaking, unit or part of one. Where the legal requirements for a transfer of undertaking are met, employment contracts and related rights and obligations may transfer automatically to the transferee together with the relevant business unit. Information and, where measures affecting employees are envisaged, consultation obligations may also arise.

Not every asset purchase constitutes a transfer of undertaking. The analysis is fact-specific and should examine the business activity, assets, workforce, organisation and continuity of the relevant economic unit. The transaction timetable should allow the parties to identify the affected employees, collective rights, accrued liabilities and mandatory information or consultation steps before completion.

Employment contracts and actual working practice

Romanian employment contracts should be reviewed for role, place of work, working time, salary, benefits, probation, confidentiality, intellectual property, mobility and termination-related terms. The review should not stop at the template. Amendments, side letters, emails, payroll records and established practice may create additional obligations or evidence.

For contractors and consultants, the buyer should test the factual relationship. Control, integration, exclusivity, personal performance, economic dependence and the way work is organised may matter more than the title of the agreement. Romanian tax authorities, labour inspectors and courts may examine the factual circumstances of the relationship irrespective of contractual labels. A contractor issue may create employment, tax and social-security exposure and should be assessed with the relevant accounting and tax workstreams.

Payroll, benefits and hidden employment liabilities

Payroll due diligence should reconcile employment terms with salary payments, bonuses, commissions, overtime, holiday pay, sick leave, meal or mobility benefits, expense policies and any retention or equity arrangements. The question is not only whether a payment was made, but whether the target has recorded and treated the payment consistently.

Potential liabilities may arise from unpaid entitlements, informal benefits, inaccurate working-time records, delayed payments, incorrect deductions or practices applied differently to comparable employees. The buyer should request explanations for material inconsistencies and determine whether they require quantification, remediation or a specific transaction protection.

Key employees deserve separate attention. A transaction may affect retention, reporting lines, incentives, confidentiality, non-compete obligations, intellectual-property arrangements and the continuity of client or technical relationships. The SPA and integration plan should identify which people are material to the investment case and what can realistically be done to retain them.

Where restrictive covenants are material to the investment, the buyer should verify their scope, enforceability, duration and, where applicable, compliance with the requirements governing post-termination non-compete obligations under Romanian law.

In technology-focused transactions, the buyer should verify the allocation of intellectual-property rights created by employees, contractors and management personnel. Employment contracts, contractor agreements, confidentiality undertakings and IP assignment documents should be reviewed together with the factual development process and the rights required to operate or commercialise the target’s products.

Dismissals, claims and protected employees

Termination risk should be reviewed through the underlying facts and procedure, not only through the existence of a signed dismissal decision. Request information on disciplinary investigations, performance procedures, redundancies, settlement arrangements, grievances, threatened claims, court files, labour-inspection requests and communications with employees or representatives.

The buyer should identify whether a claim may affect more than the individual claimant. A repeated payroll practice, a group-wide working-time issue or a pattern of termination decisions may create a wider exposure than the disclosed dispute suggests. Protected categories, leave-related rights and employee representation may also affect the timing and defensibility of a proposed post-closing change.

The review should cover collective labour agreements, collective-bargaining procedures, trade unions and employee representatives, including compliance with applicable information and consultation obligations. The target’s arrangements should be checked against Law No. 367/2022 on social dialogue, as subsequently amended, and against any sectoral or company-level collective terms that may apply.

Occupational health and safety and ITM history

Employment due diligence should also review occupational health and safety compliance under Law No. 319/2006. The data room should address work accidents, occupational diseases, mandatory training records, risk assessments, prevention measures and the organisation of occupational-health and safety responsibilities.

The buyer should request details of Labour Inspectorate (ITM) inspections, findings, sanctions and pending compliance measures. A recurring failure, incomplete risk assessment or serious accident may require specialist investigation, quantified remediation and specific transaction protection rather than reliance on a general employment warranty.

Data protection, monitoring and employee information

Employment due diligence often involves personal data about employees, candidates, managers and claimants. The buyer should establish what information is requested, who can access it, how it is shared in the data room and whether the target has a lawful and documented process for the disclosure.

The substantive review may include employee monitoring, access logs, CCTV, productivity tools, recruitment platforms, health information, international transfers, retention and security. Sensitive information should be minimised and appropriately protected. During preliminary stages, the parties should minimise employee-identifying information and consider anonymisation, aggregation, redaction or controlled clean-room procedures where appropriate. The transaction team should coordinate the employment review with the GDPR workstream rather than copy entire personnel files into a data room by default.

Where employee monitoring through electronic communications, access logs, productivity tools or video surveillance is involved, the review should assess compliance with the GDPR and Article 5 of Law No. 190/2018. Relevant issues may include necessity and proportionality, transparency, prior consultation with employee representatives, retention periods and whether a data-protection impact assessment is required.

Non-EU personnel, work authorisations and residence rights

For non-EU personnel, the review should assess compliance with Emergency Ordinance No. 32/2026 on access of foreign nationals to the Romanian labour market and Emergency Ordinance No. 194/2002 on the status of foreign nationals. Depending on the workforce and the applicable regime, the review may cover the employer’s registration or authorisation position, employment authorisations, residence rights, changes of employer or role, secondments and applicable reporting obligations.

What should the buyer request?

Interactive document checklist

Select a review area

Click or tap a numbered card to see the documents and checks relevant to that workstream.

Workforce data

Obtain headcount, roles, locations, employment status, start dates, salary bands and key-person information.

Employment risks and SPA protection

Select a row to highlight the transaction takeaway.

Employment due diligence matrix
Review areaWhat the buyer checksPossible transaction response
Who works for the target and whether the contractual labels match the factual relationship.Workforce warranty, remediation plan or specific protection for classification exposure.
Whether an asset or business transfer meets Articles 173–174 of the Labour Code and Law No. 67/2006, and which employees, rights and consultation steps are affected.Transfer plan, employee information or consultation process, liability allocation and closing timetable.
Salary, bonus, benefits, equity, expenses, payroll practice and unpaid entitlements.Disclosure, price adjustment, warranty or indemnity for quantified liabilities.
Terminations, disciplinary processes, protected employees, claims and authority investigations.Specific indemnity, closing condition, litigation reserve or post-closing conduct protocol.
Collective bargaining, employee representatives, trade unions, risk assessments, work accidents and ITM history.Specialist review, remediation covenant, specific warranty or indemnity for identified exposure.
Retention, management continuity, confidentiality, non-compete and ownership of employee or contractor-created IP.Retention arrangements, IP confirmations, transition covenant or targeted warranty.
Employee-data processing, monitoring, access, transfers, retention, security and compliance with the GDPR and Law No. 190/2018.Privacy remediation, updated notices, DPIA assessment or integration workstream.
Employer status, employment authorisations, residence rights, secondments and cross-border assignments under the current immigration framework.Condition precedent, authorisation or renewal plan, warranty or continuity arrangement.

Due Diligence Timeline

Transaction sequence

What should happen at each stage?

Before signing

Agree the scope, confidentiality controls, data-room categories and responsible contacts. Prioritise risks that could affect valuation, continuity or the timetable.

Bottom line for the buyer

Employment due diligence should end with a decision, not a document pile. For each material issue, the buyer should know the factual position, likely exposure, responsible owner, timing and contractual or operational response.

A practical report may classify findings as matters to accept, investigate, remediate before closing, disclose, protect through the SPA or manage through post-closing integration. That structure allows the buyer to negotiate from evidence and prevents employment risks from disappearing inside a generic compliance warranty.

Employment Due Diligence in Practice

Anonymised client matter. The following summary describes the type of employment due-diligence issues addressed in a transaction handled by Atrium Romanian Lawyers. Certain details have been anonymised and simplified to protect client confidentiality.

Employment review for the acquisition of a Romanian technology and business-services company

A foreign investor considered the acquisition of a Romanian technology and business-services company with a workforce operating across multiple locations. As part of the transaction, the buyer requested a workforce inventory, employment agreements, payroll records, contractor documentation, internal policies and information relating to ongoing employment disputes.

The review identified several matters requiring further analysis. Workforce records were not fully consolidated, certain contractors performed functions comparable to those carried out by employees, and some compensation practices appeared in payroll data without being consistently reflected in the underlying contractual documentation. The review also identified retention considerations affecting key personnel involved in the operational continuity of the business.

Issues identified

Workforce records, contractor classification, compensation documentation and key-person retention.

Atrium’s role

Document review, employment-risk assessment and coordination with the wider transaction team.

Transaction response

Targeted disclosures, contractual protection, document remediation and post-closing integration measures.

Atrium Romanian Lawyers coordinated the employment due-diligence workstream, reviewed the available documentation and prepared a risk-based assessment of the identified matters. Our team worked with the wider transaction team to prioritise the findings according to their potential legal, financial and operational impact.

The findings were translated into practical transaction recommendations, including targeted disclosures, specific contractual protections, pre-closing document remediation and post-closing integration measures.

The transaction documentation was updated to address the employment matters identified during the review. A structured plan was also prepared for addressing priority employment issues following completion.

This matter has been anonymised and simplified for publication. The appropriate legal analysis and transaction protections depend on the specific facts, documents, transaction structure and commercial objectives of each matter.

How Atrium Romanian Lawyers can assist

Atrium Romanian Lawyers can coordinate an employment due-diligence workstream for a Romanian acquisition, investment or corporate reorganisation. The review can cover workforce structure, contracts, payroll, working time, terminations, disputes, contractors, GDPR, permits, key employees and the translation of findings into transaction documents.

Frequently asked questions

Is employment due diligence necessary for every acquisition?

The scope should be proportionate to the target’s workforce, sector, transaction structure and known risk. A business with a large workforce, regulated operations, key employees or employment claims usually requires a deeper review.

What is the most common employment due-diligence gap?

A common gap is the absence of a reliable workforce inventory connecting contracts, payroll, working practice, disputes and employee data. Without that map, the buyer may not understand the liability it is assuming.

Can employment risks be addressed after closing?

Sometimes. The parties may agree a post-closing remediation plan, but urgent claims, missing permits, unlawful practices or risks affecting continuity may require action before closing or a specific contractual protection.

Should contractors be included in the review?

Yes. The factual relationship should be assessed where contractors perform work that resembles employment. The consequences may include reclassification, tax, social-security, employment and benefit exposure.

Does GDPR form part of employment due diligence?

Yes. The review should address employee and candidate data, particularly where monitoring, CCTV, HR software, health information or international transfers are involved. It should assess the GDPR and, where electronic or video monitoring is used, Article 5 of Law No. 190/2018, including necessity, proportionality, transparency, consultation, retention and any requirement for a DPIA.

What does the buyer receive at the end of the review?

The output may include a risk matrix, missing-document list, priority actions and drafting recommendations for warranties, indemnities, disclosure, conditions or post-closing measures.

Share purchase agreement and due diligence documents in a bright Bucharest law office

Share Purchase Agreement in Romania: Key Issues for Buyers and Sellers

Corporate transactions • M&A • Romania

A share purchase agreement in Romania is not simply a document for transferring shares. It allocates the risks discovered in due diligence, defines what the buyer receives, protects the seller’s position and determines how the transaction moves from signing to closing and post-closing claims.

What is a share purchase agreement in Romania?

An SPA records the sale and purchase of shares in a joint-stock company (SA) or social parts in a limited liability company (SRL). It normally covers the parties, the transferred interests, price, conditions precedent, signing and closing, warranties, indemnities, limitations of liability, confidentiality, announcements, governing law and dispute resolution.

For a Romanian company, the agreement must be coordinated with the company’s articles, the shareholders’ register, corporate approvals and the formalities required under Romanian corporate law to ensure that the transfer is recognised by the company and, where applicable, registered with the competent authorities. The contract should not be drafted in isolation from the corporate records.

For Romanian SRLs, a transfer of social parts to third parties may require approval by the shareholders in accordance with Law No. 31/1990 and the company’s articles of association. These requirements, together with any contractual consent or pre-emption arrangements, should be reviewed before signing.

This article focuses on transaction negotiation and risk allocation. It is distinct from a procedural guide about changing shareholders and from a shareholder agreement, which regulates the relationship between shareholders after or independently of a particular share sale.

SPA, share transfer document and shareholder agreement

Transaction navigator

Select the document question

Click or tap a card to see the first issue to resolve.

Deal document

The SPA records the commercial bargain, price, conditions, closing mechanics and the parties’ remedies. It should be read together with any disclosure letter and ancillary documents.

What should buyers check before signing?

The buyer should understand what it is buying before it negotiates the warranty package. Legal due diligence is not only a search for defects. It identifies which risks require a condition, protection, price response or post-closing plan.

Share purchase agreement review matrix
Review areaWhat to verifyPossible contractual response
Ownership, encumbrances, transfer restrictions, any pre-emption or consent rights and authority to sell.Title warranty, release of security, consent or condition precedent.
Articles, shareholder records, resolutions, beneficial ownership and pending filings.Closing deliverable, corporate warranty or pre-closing remediation.
Accounts, debt, working capital, cash, leakage, tax exposures and contingent liabilities.Price mechanism, locked-box protection, completion accounts or specific indemnity.
Change-of-control clauses, termination rights, consent requirements and key customer or supplier dependencies.Consent condition, disclosure, warranty or transition covenant.
Employment claims, incentives, key-person risk, restrictive covenants and consultation duties.Specific warranty, retention plan, indemnity or post-closing obligation.
Licences, sector rules, GDPR, cybersecurity, permits and investigations affecting the target.Regulatory condition, remediation covenant, warranty or indemnity.
Selected-row principle: the more specific the risk identified in due diligence, the less useful a generic “compliance with law” warranty becomes.

Price mechanisms in a Romanian SPA

The price clause should match how the parties understand the business at signing and at completion. A locked-box structure relies on an agreed historical balance sheet and restrictions on value leakage. A completion-accounts mechanism adjusts the price after closing by reference to agreed accounting principles, debt, cash and working capital.

Earn-outs and deferred consideration can be useful where valuation depends on future performance, but they create additional questions about measurement, control, accounting policy, access to information and dispute resolution. The SPA should define the calculation process in enough detail to reduce avoidable disputes.

Warranties, indemnities and limitations

Warranties describe the state of the target; indemnities allocate a defined risk. They are not interchangeable and should be negotiated against the due-diligence findings and the information disclosed by the seller.

Warranties may address title, capacity, accounts, tax, contracts, employees, litigation, intellectual property, data protection, technology and regulatory compliance. An indemnity may be appropriate where a known risk can be described and valued more precisely. The parties should also agree disclosure standards, knowledge qualifiers, materiality, thresholds, de minimis amounts, baskets, caps, time limits and conduct-of-claims procedures.

A buyer should avoid assuming that a broad warranty solves every issue. A seller should avoid accepting a warranty that creates liability for matters fairly disclosed or outside the seller’s reasonable control.

Signing, conditions precedent and closing

Signing and closing may occur simultaneously, or the parties may sign first and complete later after conditions are satisfied. Conditions can include corporate approvals, regulatory clearances, third-party consents, release of security, financing, accuracy of warranties and the absence of a material adverse event, where negotiated and clearly defined by the parties.

The closing checklist should identify each document, signatory, filing, payment, register update, power of attorney, resignation or appointment and handover item. A clear checklist reduces the risk that the SPA is signed but the parties disagree about whether completion has occurred.

Tax notifications, registration steps and supporting documents for transfers of interests in Romanian companies should also be checked against the rules in force at the time of the transaction. Recent legislative changes may affect the timing or evidence required for particular SRL transfers, so the SPA timetable should allow for a current tax and corporate-formality review.

How We Assist in Practice

Protecting a buyer through SPA negotiations following due diligence findings

A client negotiating the acquisition of interests in a Romanian company instructed Atrium Romanian Lawyers after legal due diligence revealed several areas of potential concern, including regulatory compliance matters, contractual risks and historical liabilities that had not been reflected in the initial commercial discussions.

Atrium reviewed the proposed share purchase agreement, analysed the diligence findings and assisted the client in restructuring the contractual protection package. The SPA was revised to include enhanced warranties, disclosure obligations, specific indemnity protections and detailed claims procedures designed to address the identified risks.

In parallel, our team coordinated the transaction documentation with the company’s corporate records, shareholder approvals and closing requirements in order to reduce execution risk and avoid implementation delays.

The parties ultimately completed the transaction under a revised framework that more accurately reflected the legal and commercial position of the target company and established a clear mechanism for managing post-closing issues.

This example is anonymised and provided for illustrative purposes only. Past results do not guarantee similar outcomes in future matters.

How Atrium Romanian Lawyers can assist

Atrium Romanian Lawyers can assist buyers, sellers, shareholders and investors with SPA structuring, due diligence, negotiation, warranties, indemnities, conditions precedent, closing documentation and post-closing claims. The appropriate scope depends on the company, transaction structure, documents, timetable and risks identified.

Frequently asked questions

Is an SPA required for every share sale in Romania?

The required documents depend on the company, parties, share type, transaction structure and applicable formalities. An SPA is commonly used in commercial transactions, particularly where the parties wish to regulate price mechanics, warranties, indemnities and risk allocation. Some transfers may instead be documented through a share-transfer agreement, transfer deed, shareholders’ resolution or simpler corporate documentation. Any chosen structure must still be coordinated with the applicable corporate and transfer formalities.

What is the difference between an SPA and a shareholder agreement?

An SPA records a sale and purchase of shares or social parts. A shareholder agreement regulates the relationship, governance and protections between shareholders. They may be connected but serve different purposes.

Can the SPA be governed by foreign law?

The parties may choose a foreign governing law for the SPA, subject to applicable private international law rules. However, mandatory Romanian corporate, regulatory, employment, tax and registration rules may still apply to the transaction and the target company.

When should due diligence take place?

Due diligence should begin early enough for findings to influence valuation, conditions, warranties, indemnities and the closing timetable. A late review may reduce the buyer’s ability to obtain a practical remedy.

What happens if a warranty is inaccurate?

The SPA should define the buyer’s remedies, exclusions, thresholds, time limits and claim procedure. The effect depends on the wording, disclosure, loss and the surrounding facts.

Can the parties amend an SPA after signing?

Amendment usually requires compliance with the agreement’s amendment clause and the necessary authority of the parties. Changes affecting corporate records, approvals or closing conditions may require additional documents or filings.

AI due diligence checklist for foreign investors assessing a Romanian company

AI Due Diligence in Romania: What Foreign Investors Should Check

Foreign investment • AI governance • Romania

AI due diligence in Romania asks whether a target company’s AI use, data, contracts and public claims support the investment case. It is not a technical demonstration of a model and it is not a generic AI policy review. For a buyer, investor or lender, the question is whether the target has identified the systems it uses, can lawfully operate them, owns or can use the assets it relies on, and has a credible plan for the risks that will remain after closing.

What is AI due diligence in a Romanian transaction?

AI due diligence is a transaction-focused legal and commercial review. It identifies whether the target’s use of AI creates liabilities, restrictions, missing rights or implementation costs that could affect price, risk allocation or post-closing operations.

For a Romanian target, the review should cover the target’s Romanian operations and any AI outputs used in the European Union. The EU AI Act is directly applicable across the EU and operates alongside the GDPR where personal data is processed. A seller’s statement that it uses only a third-party AI tool does not end the inquiry: the target may still be a deployer, customer, controller, employer or regulated business with its own duties.

This guide has a different purpose from our analysis of AI vendor contracts in Romania, which focuses on the agreement with a supplier, and from DPIA vs FRIA in Romania, which focuses on assessment triggers for a deployment. Here, the investor is deciding what must be verified before, at and after a deal.

Start with the target’s actual AI footprint

Do not begin with a broad question such as “Does the company use AI?” Ask what system or model is used, for which decision, with which data, by whom, and whether the target sells, deploys, develops, fine-tunes or merely accesses the tool.

A useful data-room request separates customer-facing products from internal tools. It should identify models, APIs, software providers, hosting and cloud dependencies, integrations, datasets, prompts or knowledge bases, material outputs, users and the decisions influenced by each use case. The inventory should also record planned products or features that have not yet launched but are material to the investment thesis.

Deal-side navigator

Select a deal question to see the first evidence to request

Click or tap a card. Keyboard users can Tab to a card and press Enter or Space. Each selection stays visible until you choose another one.

Business model and footprint

Request a system inventory, product descriptions, roadmaps, supplier contracts, architecture summary and evidence of the target’s material AI claims. Compare marketing language with the technology and operating model actually in use.

Which legal and commercial issues should an investor test?

Click or tap a row to highlight the diligence takeaway. On a small screen, swipe the table sideways.

AI due diligence matrix for a Romanian target
Review areaWhat to testPossible deal response
Whether the target’s product, sales material and internal inventory describe the same systems, functions, limits and dependencies.Correct the diligence scope, ask for technical confirmation and qualify representations that are broader than the evidence.
Whether a use case may be prohibited, high-risk, subject to transparency rules or linked to a general-purpose AI model supply chain.Obtain a classification record, identify compliance timing and budget for any remediation or implementation work.
Data flows, controller/processor roles, legal bases, Article 22 issues, DPIA screening, security measures and cross-border transfers.Require a privacy remediation plan, review the DPA and test whether the target can continue the relevant processing after closing.
Whether datasets, prompts, files or customer information may lawfully be used for development, fine-tuning, testing or supplier improvement.Limit or stop impermissible use, obtain consents or contractual permissions where appropriate, and reserve a specific risk allocation.
Ownership and licences for software, open-source components, models, training materials, brand assets, output and third-party claims.Confirm chain of title, address licence conflicts and tailor warranties or indemnities to the assets that support the valuation.
Model, cloud and subprocessor dependencies, location, termination, audit evidence, model changes and service continuity.Seek consent, amendment, transition assistance or a post-closing migration plan if a dependency cannot support the buyer’s intended use.
Policies, ownership, AI literacy, logs, testing, monitoring, incident response, complaint handling and escalation records.Set a post-closing governance plan with owners, deadlines and evidence requirements rather than relying on a generic policy.

The European Commission describes the AI Act as a risk-based framework for developers and deployers. It identifies employment, credit scoring and access to essential services among the examples that may be high-risk. See the Commission’s AI Act overview and application timetable.

AI Act review: classify before you value the risk

Do not treat “AI Act compliant” as a sufficient diligence answer. Contractual, sector-specific, data-protection and AI Act obligations must be assessed separately. The investor should identify the system, its intended purpose, the target’s role and the rules that apply now or later. The relevant date can affect both risk allocation and integration planning.

The AI Act’s prohibitions, AI literacy obligations, governance rules, GPAI-model obligations and transparency rules have different application dates from the rules for high-risk systems. The Commission states that Annex III high-risk use cases, including employment and credit-scoring examples, are scheduled to apply from 2 December 2027, while high-risk systems embedded in regulated products have a later date of 2 August 2028. A diligence report should distinguish obligations already applicable from future obligations that could require a funded implementation plan. At the time of publication, the applicable AI Act timetable should be verified against the latest EU legislation and implementation guidance, including the official AI Act Service Desk timeline.

The analysis should also ask whether the target is developing an AI system, placing it on the market, deploying it in its own business, importing it, distributing it or using a third-party service. These labels are not interchangeable with GDPR controller and processor roles. For the contract-facing part of that review, see AI Vendor Contracts in Romania.

GDPR and data review: look beyond the privacy policy

The decisive question is what happens to personal data at each stage of the AI lifecycle. A target may process personal data in training, testing, deployment, monitoring, logs, prompts, support and human review, even where the product is marketed as automated or anonymised.

The review should map the data categories, purposes, retention, recipients, access, transfer mechanisms and contractual roles. Where the use involves profiling, recruitment, credit, insurance, pricing or decisions that may significantly affect individuals, check the actual decision flow and safeguards rather than relying on a generic human-review statement. Article 35 GDPR requires a DPIA where processing is likely to result in a high risk to the rights and freedoms of natural persons; Article 22 has separate rules for certain solely automated decisions.

The European Data Protection Board has also confirmed that the anonymity of an AI model trained with personal data must be assessed case by case. That matters for a target relying on a statement that a model, dataset or output is anonymous. Read EDPB Opinion 28/2024. For the broader framework, see our guide to GDPR compliance when using AI in Romania.

Data, intellectual property and contract rights

AI value is often dependent on rights that sit outside the target’s own code. The investor should trace the legal basis for using data, third-party models, cloud infrastructure, open-source components, output and confidential information.

Review the complete contract suite, not only the signed master agreement. Order forms, online terms, acceptable-use policies, data-processing agreements, security schedules, open-source notices and API terms can all affect the target’s rights. In particular, check whether a provider can use customer or target data for model training, whether the provider can change the model or service unilaterally, and whether the target can export its data and configurations on exit.

Ownership language for AI-generated output should be read carefully. A contractual promise may create a licence or allocation between the parties, but it does not necessarily guarantee exclusivity or copyright protection in every output. The copyright status of AI-generated content may vary depending on the level of human creative input and the applicable jurisdiction. The review should identify the use the target needs to make of the output and whether third-party rights, human authorship requirements, confidentiality or contractual restrictions could limit that use.

What should the investor request in the data room?

  1. Request a current AI inventory. Include internal tools, customer-facing products, models, APIs, plugins, fine-tuning, integrations and material planned features.
  2. Obtain a use-case map. Record intended purpose, users, affected people, decisions, data inputs, outputs, human review and country of deployment.
  3. Collect AI governance records. Ask for role assessments, policies, training records, system documentation, risk logs, testing, monitoring and incident procedures.
  4. Review AI Act screening. Identify prohibited practices, potential high-risk systems, transparency obligations, GPAI dependencies and the applicable timetable.
  5. Map personal-data processing. Review privacy notices, legal bases, Article 22 analysis, DPIAs, processor arrangements, security controls and transfers.
  6. Trace data rights. Check source, licence, consent or other permission for data used in development, testing, fine-tuning and ongoing service delivery.
  7. Review the contract stack. Read supplier, customer, cloud, API, DPA, security, outsourcing and change-control documents together.
  8. Confirm IP and open-source position. Request code provenance, licences, notices, ownership assignments, third-party claims and output-use restrictions.
  9. Test material statements. Compare product marketing, investor materials and customer commitments against the available technical and legal evidence.
  10. Assign the deal response. Separate issues requiring price, warranty, indemnity, condition, remediation, disclosure or post-closing integration action.

How should findings affect the transaction documents?

Translate each material finding into an owner, timing and remedy. A diligence report is useful only if the SPA, investment agreement, disclosure process and integration plan reflect the issues that have been identified.

The appropriate response will depend on the transaction structure and the seller’s ability to remediate. A buyer may need targeted warranties concerning data rights, AI-related regulatory compliance, ownership, contract compliance, absence of claims or material incidents. Confirmed gaps may justify a specific indemnity, a pre-closing remediation covenant, a post-closing plan, a condition or a tailored disclosure. The drafting should not assume that a general compliance warranty captures the actual issue.

Post-closing planning is equally important where the buyer will integrate systems, move data, introduce a new group policy, change suppliers or expand the target’s use case. These changes can alter the GDPR and AI Act analysis. If an assessment is required, the timing should be addressed before the relevant processing or deployment begins. Our DPIA vs FRIA guide explains why those two assessment routes must be screened separately.

When does a separate specialist review become necessary?

A focused AI legal review should be coordinated with corporate, technical, information-security, employment and commercial due diligence when the target develops AI products, relies on proprietary datasets, makes regulated-sector decisions, uses AI in recruitment or credit processes, processes sensitive personal data, markets compliance claims, or has important dependencies on a small number of providers. The workstreams should share the same factual inventory, but each should retain its own legal questions and conclusions.

How Atrium Romanian Lawyers can assist

Atrium Romanian Lawyers can coordinate the legal workstream for AI-related due diligence in a Romanian investment, acquisition or internal reorganisation. The review can cover AI Act role and use-case screening, GDPR and data-contract questions, supplier and customer terms, intellectual property, employment and operational governance, and the translation of findings into transaction documents or an integration plan.

Client experience

AI due diligence during the acquisition of a Romanian technology company

An international investor considered acquiring a Romanian technology company that relied extensively on AI-enabled software products and third-party AI services.

During the due diligence process, the buyer requested confirmation regarding AI Act compliance, data rights, intellectual-property ownership and the target’s dependencies on external AI providers.

The review identified gaps between the target’s public marketing materials and its internal documentation, uncertainties regarding the scope of rights over certain datasets, and contractual limitations affecting the use of third-party AI services after closing.

Atrium Romanian Lawyers coordinated the legal review of the AI use cases, supplier contracts, GDPR implications and intellectual-property position. The findings were translated into targeted warranties, disclosure items and a post-closing remediation plan.

The transaction proceeded with a clearer allocation of regulatory, contractual and operational risks and with a structured roadmap for post-closing compliance measures.

This example has been anonymised and simplified for publication. The appropriate legal analysis depends on the system, data, contract structure and facts of each matter.

Frequently asked questions

Does every investment in a Romanian company need AI due diligence?

No. The scope should be proportionate to the target’s actual use of AI and the importance of that use to the transaction. A company using a limited internal tool may require a focused review. A target selling AI-enabled products, using sensitive data or making decisions affecting people may need a deeper legal and technical workstream.

Is AI due diligence the same as an AI Act compliance audit?

No. AI Act compliance is one part of the review. Transaction diligence also considers ownership, licences, customer commitments, personal data, confidentiality, technical dependencies, product claims, change control and what the buyer will need after closing. The correct scope follows the investment thesis and the target’s operating reality.

Can a seller rely on a supplier’s AI compliance statement?

Supplier information can be relevant evidence, but it does not by itself establish that the target’s own deployment is compliant. The investor should check whether the statement identifies the actual system, model, purpose, data, users, territory, contract terms and responsibilities relevant to the target’s use case.

Should a buyer ask for the target’s DPIAs?

Where the target operates AI systems involving personal data and has conducted or screened for a DPIA, the relevant material should be reviewed subject to confidentiality controls. The question is not simply whether a document exists, but whether it reflects the current processing, risks, safeguards, changes and any residual issues requiring follow-up.

Can AI findings be addressed after closing?

Sometimes. The decision depends on the nature of the issue, legal exposure, urgency, operational dependency and the buyer’s ability to control remediation. A defensible post-closing plan should identify the owner, evidence, budget, deadlines and the effect on continued use. Some issues may need to be resolved before closing or before a planned deployment.

What is the most common gap in AI diligence?

A frequent gap is that the target has a high-level AI policy or vendor contract but no reliable inventory linking systems, use cases, data, roles, evidence and decision owners. The first practical step is usually to build that factual map before drawing legal conclusions or negotiating transaction protection.

AI vendor contracts in Romania under the EU AI Act and GDPR

AI Vendor Contracts in Romania: EU AI Act and GDPR Clauses

An AI vendor contract should do more than grant access to a platform. It should identify the system and intended use, allocate regulatory roles, control the use of business and personal data, preserve evidence, set performance and security obligations, and provide a workable exit if the supplier, model or law changes.

Key points for companies buying AI services in Romania:

  • Classify the AI use and the parties’ roles before negotiating warranties and liability.
  • Do not assume that a standard SaaS agreement or a GDPR DPA covers AI-specific risk.
  • State whether prompts, files, outputs and usage data may be retained or used for training.
  • Require enough information, logs and cooperation to meet the customer’s own legal duties.
  • Connect service changes, security incidents and regulatory events to notice, remediation and exit rights.

This guide is intended for Romanian companies, foreign groups operating in Romania, technology suppliers, procurement teams and businesses implementing generative or other AI tools. It focuses on contract structure. For the wider regulatory framework, read our EU AI Act guide for foreign companies.

Why does an AI vendor contract need a separate review?

AI services can change after signature. A supplier may replace a model, add a subprocessor, change data-retention settings, modify safety controls or alter the geographic delivery chain. Outputs may also be probabilistic rather than repeatable. These features create risks that are not fully addressed by ordinary clauses on software access, uptime and confidentiality.

The EU AI Act allocates obligations according to the system, risk category and operator role. The GDPR applies in parallel where personal data is processed. The contract cannot transfer away statutory responsibility, but it can secure the information, instructions, evidence and cooperation needed for each party to perform its own obligations.

Practical distinction: the AI Act analysis, the GDPR role analysis and the commercial allocation of risk are related but separate. A supplier described as a “provider” under the AI Act is not automatically a “processor” under the GDPR.

Start with the AI use, not the vendor’s template

Before redlining the agreement, the customer should record what the system will do, whose decisions it will influence, what data enters the system, who receives the output and whether the tool will be integrated into employment, credit, insurance, education, essential services, biometric or other sensitive workflows. The same product can create different legal exposure when deployed for a different purpose.

Contract navigator
Build the AI contract in five connected layers

Select a layer to see the question that should be answered before signature.

System and intended use

Identify the product, model, version, functions, integrations, users, prohibited uses and decision context. Classification begins with the actual deployment.

AI vendor due diligence before contract negotiation

A customer cannot negotiate intelligently without basic information about the service. The due-diligence request should be proportionate to the use and risk, but it commonly covers:

  • the legal entity supplying the service and the entities supporting it;
  • the model or models used, hosting locations and material third-party dependencies;
  • the intended purpose, known limitations and prohibited uses;
  • data sources, retention rules and whether customer data is used for training or improvement;
  • security controls, incident history, business continuity and disaster recovery;
  • testing, accuracy or performance information relevant to the deployment;
  • subcontractors, subprocessors and international data transfers; and
  • the supplier’s process for regulatory requests, complaints, audit evidence and system changes.

For high-risk deployments, the customer may require contractual access to sufficient documentation, instructions, logs and compliance information to enable it to perform its own obligations under the AI Act. The scope of access should reflect the parties’ respective roles and may need to protect the supplier’s trade secrets and intellectual-property rights. The European Commission’s AI Act information page and its AI Act Service Desk are useful starting points, but the contract must still reflect the particular system and transaction.

What if the service relies on a general-purpose AI model?

Where the service relies on a general-purpose AI model, the customer should also consider whether contractual information rights are needed regarding the model provider, model updates, transparency documentation and downstream restrictions affecting the deployment. These provisions should be tailored to the customer’s position in the AI value chain and should not imply that the customer is entitled to the provider’s complete technical documentation.

What clauses should an AI vendor agreement contain?

Contract layerWhat the clause should resolveRisk if unclear
System and permitted useProduct, model, version, functionality, users, integrations, territories, intended purpose and prohibited uses.The service is used outside its tested or agreed purpose.
Regulatory rolesAI Act operator roles, GDPR roles, responsibility matrix and cooperation duties.Each party assumes the other will supply evidence or perform a mandatory task.
Data and trainingPermitted inputs, retention, model training, improvement, isolation, deletion and export.Confidential or personal data is retained or reused beyond the customer’s expectation.
Performance and oversightRelevant metrics, limitations, testing, human review, logs, notices and remediation.Outputs cannot be evaluated, challenged or reconstructed when a problem occurs.
Security and incidentsTechnical measures, vulnerability management, notification triggers, timing and cooperation.The customer learns too late or receives too little information to respond lawfully.
IP and output rightsRights in inputs, outputs, configurations, documentation, feedback and third-party materials.The customer lacks the rights needed for its intended commercial use.
Change controlNotice of model, policy, subprocessor, location and functionality changes, plus testing and objection rights.A compliant deployment becomes materially different during the contract.
Liability and exitWarranties, indemnities, caps, insurance, suspension, termination, transition, export and deletion.The remedy is commercially unusable when the service fails or must be withdrawn.

Click a row, or focus it and press Enter, to highlight one negotiation layer.

1. Define the system, version and intended purpose

The agreement should identify what is actually being supplied. “AI services” is rarely sufficient. The specification should address the model or service version, functions, interfaces, customer environment, authorised users, territories, dependencies and intended use. If classification or performance depends on a specific configuration, that configuration should be documented.

2. Allocate AI Act and GDPR roles separately

The parties should record their assumed roles under the AI Act and set out who provides instructions, documentation, logs, notices and regulatory cooperation. A separate analysis is required under the GDPR. Depending on the facts, the parties may be controller and processor, independent controllers or, in a narrower class of cases, joint controllers.

Where the supplier processes personal data on the customer’s behalf, Article 28 GDPR terms may be required. See our dedicated guide to the Data Processing Agreement in Romania. The DPA should not be treated as the complete AI contract, and the main agreement should not conflict with it.

3. Control prompts, files, outputs and training use

The contract should distinguish customer content, personal data, telemetry, feedback and output. It should state whether each category may be stored, reviewed by humans, used to improve the service or used to train a shared model. Where “no training” is promised, the clause should explain its scope, including whether safety review, abuse monitoring or service analytics remain permitted.

The European Data Protection Board has emphasised that whether an AI model is anonymous must be assessed case by case. A supplier’s assertion that its model is anonymous should therefore be supported by facts rather than accepted as a label. See the EDPB’s summary of Opinion 28/2024.

4. Make performance, limitations and human oversight usable

Conventional uptime metrics do not measure output quality. Depending on the use, the contract may need agreed tests, documented limitations, error reporting, performance monitoring, bias or drift controls, escalation and human-review requirements. The AI Act’s accuracy requirements should not be treated as a guarantee of error-free outputs. Any contractual accuracy or performance commitment should define the relevant task, dataset, test method, threshold and remedy.

5. Require evidence and audit cooperation

The customer may need records to complete an impact assessment, answer a regulator, investigate a complaint or demonstrate human oversight. The agreement should define which information is available, in what format, how quickly and subject to what confidentiality protections. In practice, enterprise suppliers may satisfy some audit requirements through independent certifications, reports and controlled information-sharing mechanisms rather than unrestricted customer audits. Those materials can support due diligence, but they do not automatically answer system-specific questions.

6. Coordinate security and incident notification

Security clauses should address access controls, encryption where appropriate, vulnerability management, segregation, personnel access, business continuity and incident cooperation. Notification should be triggered by defined events and delivered early enough for the customer to meet its own legal and operational duties. Different events may activate different regimes, so a personal-data breach, an incident affecting the AI system and an ordinary service outage should not be collapsed into one undefined term.

7. Address intellectual property and third-party claims

The contract should distinguish rights in customer inputs, supplier technology, configurations, fine-tuning, documentation, feedback and outputs. It should also allocate responsibility for claims involving training material, output, trademarks, confidential information and third-party components. Broad statements that the customer “owns the output” may be insufficient if the supplier cannot grant exclusivity or if protectability depends on applicable law and human contribution. Ownership language should be assessed together with applicable copyright rules, which may require sufficient human authorship for copyright protection.

8. Control subcontractors, subprocessors and model dependencies

An AI service may depend on model providers, cloud infrastructure, safety services and specialist subprocessors. The contract should identify the relevant chain, require notice of material changes and preserve appropriate objection or termination rights. For personal data, the subprocessor mechanism must align with Article 28 GDPR and any applicable international-transfer safeguards.

9. Regulate model and policy changes

Suppliers often reserve broad rights to modify models, acceptable-use policies and technical features. The customer should seek prior notice of material changes, enough information to reassess the deployment and a remedy when a change materially reduces functionality, alters data use, affects compliance or creates an unacceptable risk.

10. Connect liability to the risks that matter

Liability provisions should be read together with warranties, indemnities, insurance and remedies. A general cap may be commercially unsuitable for confidentiality breaches, unlawful data use, IP claims or deliberate misconduct, while unlimited liability for every model error may be unacceptable to a supplier, particularly where outputs remain subject to human review. The negotiated position should reflect control, foreseeability, fees, insurance and the consequences of the intended use.

11. Preserve suspension, termination and transition rights

The contract should explain what happens if the service becomes prohibited, materially non-compliant, insecure or unsuitable for the agreed purpose. Exit terms should cover data and prompt export, configuration records, transition assistance, continuing access where necessary, deletion, certification and surviving confidentiality or audit duties.

12. Align the whole contract suite

The main agreement, order form, specification, DPA, security schedule, service levels and online policies should be checked together. An order of precedence is important where one document allows training while another prohibits it, or where a linked policy can be changed unilaterally. Our broader contract review checklist explains the commercial clauses that remain relevant alongside the AI-specific controls.

Customer and supplier priorities are not identical

A customer usually seeks transparency, stable functionality, control of its data, evidence for compliance and practical exit rights. A supplier needs a defined intended use, customer cooperation, restrictions against misuse, protection for reusable technology and a liability position proportionate to fees and control. A balanced contract should not hide this tension. It should identify which party can prevent, detect and remedy each risk.

Practical experience: how Atrium approaches an AI contract review

A typical client mandate begins with the operating facts, not a generic AI checklist. Atrium Romanian Lawyers first maps the proposed use, data flows, parties, model dependencies and decisions affected by the tool. We then review the full contract suite, identify provisions that do not match the deployment and separate mandatory compliance points from negotiable commercial risk.

The work may include a priority risk report, tracked changes, replacement clauses and a negotiation list for the business and technical teams. Particular attention is given to training rights, confidentiality, GDPR roles, security incidents, documentation, model changes, intellectual property, liability and exit. This section describes our review method and does not disclose any client’s confidential facts.

AI vendor contract checklist before signature

  1. Document the system, intended use, users and decision context.
  2. Complete the AI Act role assessment and determine whether the deployment may involve prohibited, high-risk, transparency or other regulated AI use cases.
  3. Map personal data, confidential information and international transfers.
  4. Collect the main agreement, order, DPA, security schedule and linked policies.
  5. Confirm whether customer data, prompts or outputs may be used for training.
  6. Test whether supplier documentation supports the customer’s compliance duties.
  7. Define relevant performance measures, limitations and human oversight.
  8. Align incident notification with legal and operational deadlines.
  9. Review IP ownership, licences, third-party material and claims.
  10. Control material changes to models, policies, locations and subcontractors.
  11. Model liability for realistic failure scenarios.
  12. Plan suspension, export, transition and deletion before deployment begins.

Frequently asked questions

Does every AI vendor contract need a GDPR DPA?

No. A DPA is required where the factual relationship meets the controller-processor conditions under Article 28 GDPR. Other arrangements may involve independent or joint controllers. The roles should be assessed from the actual processing, not only from the labels in the contract.

Can an AI supplier use customer prompts to train its model?

That depends on the contract, product settings, supplier role, transparency and applicable data-protection and confidentiality rules. The agreement should state clearly which data may be used, for what purpose, for how long and whether an effective opt-out or enterprise isolation applies.

Does an AI Act clause transfer compliance responsibility to the supplier?

No. A contract can allocate tasks, information duties, warranties and remedies, but it cannot remove statutory obligations imposed on a party by law. Each operator should understand and perform the duties attached to its own role.

Should the contract name the underlying AI model?

Usually, the system and relevant dependencies should be described with enough precision to understand what is being supplied. If the supplier may change the underlying model, the contract should address notice, testing, material degradation, data implications and the customer’s available remedies.

Who owns AI-generated output?

The answer depends on the contract, the output, applicable intellectual-property law, human contribution and third-party material. The agreement should distinguish ownership from a licence to use and should address infringement claims and supplier restrictions.

Can a Romanian lawyer review a foreign vendor’s English-language AI contract?

Yes, where the agreement concerns a Romanian company, Romanian operations or applicable EU and Romanian requirements. The scope should identify whether separate advice is needed for clauses governed exclusively by another country’s law.

Negotiating an AI vendor contract connected with Romania?

Atrium Romanian Lawyers assists customers and technology suppliers with AI, SaaS and IT contract review, drafting and negotiation, including GDPR, security, intellectual-property, liability and exit provisions.

Discuss the contract with a Romanian lawyer

Disclaimer: This article provides general information and does not constitute legal advice. The appropriate contract and compliance analysis depends on the system, intended use, data, parties, operator roles, applicable law and complete contract suite.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.

Data Processing Agreement in Romania for GDPR controller and processor compliance

Data Processing Agreement Romania: GDPR Guide

A data processing agreement is required when a company engages another party to process personal data on its documented instructions. The label used in the commercial contract is not decisive: the parties must first classify their actual GDPR roles, then align the agreement with the service, security model, subprocessor chain and any international transfers.

In brief

For a Romanian or foreign business subject to the General Data Protection Regulation (GDPR), an Article 28 data processing agreement (DPA) is not a generic confidentiality annex. It must describe the processing and impose specific duties on the processor. A processor DPA is not required where the supplier acts as an independent controller, although controller-to-controller data-sharing provisions may still be appropriate; joint controllers need an Article 26 arrangement. If personal data is transferred outside the European Economic Area, the DPA alone does not provide a Chapter V transfer mechanism, even where transfer clauses are integrated into the same contractual document.

When is a data processing agreement required?

The general rule is that a written DPA is required when one party processes personal data on behalf of another party. Article 28 GDPR requires the controller to appoint only processors that provide sufficient guarantees and to govern the processing through a binding contract or other legal act, in writing, including electronically.

The practical starting point is the service, not the supplier’s preferred contract label. Payroll providers, cloud hosting companies, customer-support platforms, outsourced IT administrators, email delivery services and some marketing vendors commonly act as processors because they handle data for purposes defined by their customer. The same vendor may nevertheless be a controller for separate activities, such as its own billing, fraud prevention or legally required records.

Before signing, map each processing activity and ask who decides why the data is processed and who makes the key decisions regarding the means of processing. Certain non-essential practical means may be left to the processor. The European Data Protection Board’s Guidelines 07/2020 on controller and processor concepts are the relevant official interpretative reference.

Role map

Choose the relationship that best describes the processing

Select a card to see the usual document and the main classification test.

Controller and processor: use an Article 28 DPA.

The controller determines the purposes and makes the key decisions regarding the means of processing; the processor handles data on documented instructions and may decide certain non-essential practical means. Describe the service-specific processing and all mandatory Article 28 controls.

RelationshipMain testUsual documentFrequent mistake
Controller–processorThe supplier processes personal data for the customer’s purposes and on its documented instructions.Article 28 DPA, usually attached to the services agreement.Using a one-page confidentiality clause with no processing details or security annex.
Independent controllersEach party determines its own purposes and makes the key decisions regarding the means of its processing.Controller-to-controller data-sharing terms, transparency allocation and lawful-disclosure provisions.Forcing a processor DPA onto a professional adviser or platform acting for its own lawful purposes.
Joint controllersThe parties jointly determine the purposes and key decisions regarding the means of processing.Transparent Article 26 arrangement allocating responsibilities.Calling one party a processor even though both designed the relevant processing.
Mixed rolesThe role changes by processing activity.Activity-specific clauses covering each role.Applying one label to the entire commercial relationship.

What must an Article 28 DPA contain?

A compliant DPA must identify the processing and include every mandatory control listed in Article 28(3) GDPR. It should specify the subject matter and duration, nature and purpose, types of personal data, categories of data subjects, and the controller’s rights and obligations. It must then translate the statutory requirements into workable contractual duties.

Clause control room

Test the operational core of the DPA

Each control needs both contractual wording and evidence that it can work in practice.

Instructions must be documented and specific enough to control use.

Define permitted purposes, operations, users and transfer instructions. The processor must alert the controller if it considers an instruction unlawful.

Mandatory controlWhat the DPA should settleUseful evidence or annex
Documented instructionsPurposes, permitted operations, access, disclosure, locations and transfers; process for changing instructions.Processing schedule, service description, authorised-user model and change log.
ConfidentialityAuthorised personnel must be bound by contractual or statutory confidentiality.Role-based access, confidentiality undertakings and training records.
Article 32 securityMeasures proportionate to the processing risk, not merely “industry standard security”.Technical and organisational measures annex, certifications, test summaries and remediation process.
SubprocessorsPrior specific or general written authorisation, change notice, objection process and equivalent downstream duties.Current subprocessor list, service and country details, due-diligence records and flow-down terms.
AssistanceSupport for data-subject requests and controller obligations under Articles 32–36.Request workflow, responsibility matrix, response contacts and DPIA support process.
End of serviceController’s choice between return and deletion, copy deletion and lawful-retention exceptions.Export format, deletion timetable, backup treatment and deletion certificate.
Information and auditsEvidence needed to demonstrate compliance and a workable audit or inspection mechanism.Audit reports, questionnaires, certification scope, remediation plan and escalation rights.

The European Commission has adopted optional standard contractual clauses for controllers and processors under Article 28. The parties may adopt the 2021/915 standard clauses or negotiate their own Article 28 terms. Where the standard clauses are used, additional clauses should not directly or indirectly contradict them or prejudice the fundamental rights and freedoms of data subjects.

Why a generic security clause is not enough

The security schedule should describe controls that match the actual data, systems and risks. Article 32 GDPR requires appropriate technical and organisational measures, taking account of the state of the art, implementation cost, processing context and risks to individuals. Depending on the service, relevant controls may include encryption, access management, logging, vulnerability management, backups, resilience, testing, staff controls and incident response.

A clause stating only that the supplier will apply “appropriate” or “industry standard” security gives the controller little evidence and may leave important assumptions unresolved. The annex should also distinguish controls included in the standard service from optional configurations that the customer must activate.

How should subprocessors be managed?

A processor cannot appoint a subprocessor without the controller’s prior specific or general written authorisation. Under a general authorisation, the processor must notify intended additions or replacements in time for the controller to object. The processor must impose equivalent data-protection obligations downstream and remains fully liable to the controller for the subprocessor’s performance of those obligations.

The contract should state what information accompanies a change notice, how long the objection window lasts, what constitutes a reasonable objection and what happens if the parties cannot resolve it. A nominal right to object is of limited value if the controller receives only a company name, with no service description, processing location or transfer information.

The European Data Protection Board’s Opinion 22/2024 on processors and subprocessors is an important due-diligence reference. Controllers should be able to identify the entire processing chain, including relevant subprocessors and, where appropriate, further sub-processing layers, and obtain enough information to assess whether sufficient guarantees exist.

Does a DPA cover international data transfers?

No. A DPA regulates processing on behalf of a controller, but the DPA alone does not provide a Chapter V transfer mechanism. If data moves to, or is remotely accessed from, a country outside the European Economic Area, the parties must separately establish whether an adequacy decision or another valid safeguard applies. The relevant Article 28 clauses and transfer safeguards may nevertheless be integrated into a single contractual document.

This distinction is easy to miss because two different EU instruments are commonly called “SCCs”. Commission Decision (EU) 2021/915 concerns standard clauses for the Article 28 controller–processor relationship. Commission Decision (EU) 2021/914 contains standard contractual clauses for transfers to third countries. Where the transfer clauses apply, the parties must select the correct module, complete the annexes and assess the destination-country context and any necessary supplementary measures.

How quickly must a processor report a data breach?

The GDPR requires the processor to notify the controller without undue delay after becoming aware of a personal data breach. The familiar 72-hour period applies to the controller’s notification to the competent supervisory authority where the legal conditions are met; it is not the processor’s default reporting deadline.

The DPA should therefore set a fast contractual notification route that gives the controller time to investigate and decide whether regulatory or data-subject communications are required. It should define the incident contact, initial information, phased updates, evidence preservation, cooperation, remediation and post-incident report. A fixed period can be useful, but it should not dilute the statutory “without undue delay” standard.

For the controller’s incident process, see our practical GDPR data breach guide for Romania.

What should the controller check before signing?

The controller should test both the contract and the processor’s ability to perform it. Article 28 requires sufficient guarantees, so signature alone is not the end of the due-diligence exercise.

  1. Confirm the role for each activity. Separate processor functions from any independent or joint-controller processing.
  2. Map the data and people involved. Record data categories, data subjects, purposes, systems, locations, retention and sensitive-data elements.
  3. Review the mandatory clauses. Check every Article 28 requirement and remove conflicts with the main services agreement.
  4. Test the security annex. Align the written controls with the service configuration and the risk level.
  5. Identify all relevant subprocessors. Verify functions, locations, change procedure, downstream obligations and transfer safeguards.
  6. Plan incidents and rights requests. Agree contacts, response steps, information fields and internal escalation.
  7. Set the exit route. Define return, export, deletion, backups, certification and any lawful retention.
  8. Retain accountability evidence. Keep the assessment, negotiated terms, approvals, notices and review dates.

Illustrative vendor scenarios

These examples are simplified and do not replace a factual role analysis.

SaaS provider hosting a customer database

The Romanian customer decides why client records are stored and how staff use them. The SaaS provider hosts and supports the database on the customer’s instructions. An Article 28 DPA is normally required, together with a security schedule and a review of hosting and support subprocessors.

Professional adviser receiving matter information

A lawyer, auditor or other regulated adviser may independently determine certain purposes and make key decisions regarding the means of processing because of professional duties and legal obligations. It may be incorrect to classify every such activity as processor work. The engagement terms should describe the actual roles and disclosures.

Cloud subprocessor with access outside the EEA

The immediate processor uses a support provider in a third country. The controller–processor DPA remains necessary, but it is not sufficient. The parties must also examine the relevant transfer mechanism, complete the required documentation and assess whether supplementary safeguards are needed.

How should the DPA interact with the main services agreement?

The documents should work as one contract set. The services agreement, DPA, security schedule, service levels and subprocessor information should use consistent definitions, liability rules, notice mechanisms, termination rights and order-of-precedence clauses.

Commercial limits on liability require particular attention. A DPA cannot remove statutory obligations or the rights of data subjects, while the allocation of contractual risk between the parties depends on the negotiated agreement and applicable law. Audit rights also need balance: the controller requires meaningful evidence, but the process should protect the processor’s security, confidentiality and other customers.

For a wider commercial review, use our contract review checklist for Romania. Technology businesses may also find our IT and SaaS contract services relevant.

Frequently asked questions

Is a DPA required with every service provider?

No. It is required where the provider processes personal data on behalf of the controller. An independent controller relationship may require data-sharing terms instead, while joint controllers need an Article 26 arrangement. The correct classification depends on the actual purposes, decision-making and degree of instruction for each processing activity.

Can the DPA be an annex to the services agreement?

Yes. The GDPR requires a binding written contract or other legal act but does not require a separate standalone document. An annex is common and can be efficient, provided the main agreement and DPA are consistent and the processing description, security measures and subprocessor terms are complete.

Does an Article 28 DPA replace international transfer SCCs?

No. The Article 28 relationship and the Chapter V transfer basis are separate legal questions. Commission Decision 2021/915 contains controller–processor clauses, while Decision 2021/914 contains transfer clauses for third-country transfers. Depending on the data flow, both sets of requirements may be relevant.

Must the controller approve every subprocessor?

The processor needs prior specific or general written authorisation. Under general authorisation, the controller must be informed of intended additions or replacements and given an opportunity to object. The DPA should make that process meaningful by defining the notice content, timing, objection grounds and consequences.

Must a processor report a breach within 72 hours?

The processor’s statutory duty is to notify the controller without undue delay after becoming aware of a personal data breach. The 72-hour rule concerns the controller’s notification to the supervisory authority where notification is legally required. The DPA should set an incident process that allows the controller to meet its own deadline.

Can a processor use personal data for its own product improvement?

Only if the relevant role, purpose and legal basis support that use. A processor cannot simply expand its instructions into an independent purpose. If the provider determines its own purpose and makes the key decisions regarding the means of a separate activity, it may act as a controller for that activity and must satisfy the corresponding GDPR duties.

Review the DPA against the real data flow

A targeted legal review can classify the parties’ roles, check the mandatory Article 28 terms, identify transfer issues and align the DPA with the services agreement, security evidence and subprocessor chain.

Discuss a data processing agreement

Disclaimer: This article provides general information and does not constitute legal advice. It reflects the law and official guidance available as of the date of publication. The correct analysis depends on the actual processing activities, contractual roles, data flows, security measures and jurisdictions involved.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.

Geometric maze illustrating contractual risk assessment during a contract review in Romania

Contract Review in Romania: 12 Clauses to Check

Which contract clauses should a business check before signing?

A Romanian business contract should clearly allocate performance, payment, liability, intellectual-property, data and exit risks. These 12 clauses are the practical starting point for a legal and commercial review.

Contract review in Romania should test more than whether an agreement is formally valid. Before signing, a business should understand what it must deliver, when it will be paid, which losses it may bear, how intellectual property and data may be used, and how the relationship can end.

Commercial contracts are often negotiated under pressure. A supplier is ready to begin, a customer wants the final draft immediately, or a foreign group needs its Romanian operation running without delay. That is precisely when unclear wording, inconsistent annexes and borrowed template clauses are most likely to pass unnoticed. Companies entering the market should connect the contract with the wider steps required to start and operate a business in Romania.

Interconnected architectural structure illustrating how contract clauses work together in a Romanian contract review
A well-structured contract depends on interconnected clauses that allocate obligations, remedies and commercial risks consistently.

Under the Romanian Civil Code, a validly concluded contract is binding on the parties, and contractual negotiations and performance are governed by good faith. A useful review therefore connects the legal wording with the operational deal. It identifies which party controls each risk, whether the agreed remedy can work in practice, and what evidence will be needed if performance is disputed.

The following 12 clauses form a practical checklist for Romanian companies and foreign businesses entering agreements governed by Romanian law or involving a Romanian counterparty.

Parties, capacity and signing authority

The contract should identify the correct legal entities, not merely the brand names used in negotiations. For a Romanian company, check its registered name, registered office, Trade Registry number, fiscal identification code and representative. If a group is involved, establish which entity receives the services, issues invoices, owns the relevant assets and assumes liability.

Signing authority should be verified against the company’s constitutional documents, Trade Registry information, corporate approvals or a power of attorney. A signature block describing someone as a “manager” does not itself resolve whether that person may bind the company for the relevant transaction. The representation rules should be checked against the company’s current Romanian articles of incorporation and the registered powers of its administrators.

The internal authority analysis also matters for potential Romanian company director liability, particularly where a director signs outside approved limits or fails to document a material commercial decision.

Check before signingConfirm the contracting entity, the signatory’s authority, any required corporate approval, the position of affiliates and whether subcontracting or assignment to another group company is permitted.

Scope, deliverables and acceptance

The scope clause should describe the goods or services, specifications, quantities, locations, deadlines, dependencies and exclusions. For project work, it should also establish milestones, acceptance tests, correction periods and a change-control procedure.

Review the main agreement together with proposals, statements of work, order forms and technical annexes. If they conflict, an order-of-precedence clause should determine which document controls. Acceptance by silence should also be tested carefully: specify when the review period begins, what constitutes a valid rejection and what happens when defects are minor. Providers using standard customer documentation should also verify the applicable service contract requirements in Romania.

Common riskThe commercial proposal promises one result, the technical annex describes another and the general conditions allow the supplier to treat delivery as accepted before meaningful testing has taken place.

Price, VAT, invoicing and payment

A complete payment clause states the price or calculation method, currency, VAT treatment, invoicing trigger, payment deadline, supporting documents, bank charges and the procedure for disputing an invoice. It should also explain whether the customer may withhold, deduct or set off amounts and whether the supplier may suspend performance for non-payment.

For B2B transactions, Law no. 72/2013 on late payment contains mandatory protections. Article 5(1) establishes a general 60-calendar-day limit for contractual payment terms between professionals. By exception, the parties may agree a longer payment term, provided that the clause is not abusive under Article 12. A term exceeding 60 days is therefore not automatically invalid, but it should be assessed carefully for gross unfairness to the creditor in light of the statutory criteria and the circumstances of the transaction. Where the applicable conditions are met, late payment can trigger statutory penalty interest and the fixed EUR 40 recovery compensation.

For the calculation rules and available remedies, see our guide to late-payment interest and penalties in Romania.

Term, renewal and minimum commitments

The agreement should state its effective date, initial duration and whether it renews automatically. An automatic renewal clause is not necessarily problematic, but the notice window, notice method and effect of a missed deadline must be clear.

Check minimum purchase commitments, exclusivity, take-or-pay obligations and price changes that continue into a renewal term. Add internal calendar reminders for any deadline that determines whether the company remains bound for another year or loses a renegotiation opportunity.

Check before signingIdentify the earliest exit date, the last date for a non-renewal notice and every financial or operational commitment that survives renewal.

Termination, cure periods and exit assistance

The termination clause should distinguish between serious breach, remediable breach, insolvency-related events, prolonged force majeure and termination for convenience. It should specify whether prior notice is required, how long the defaulting party has to cure, and whether termination operates through a contractual mechanism or requires another legal step.

The Romanian Civil Code regulates remedies for non-performance, including termination under Article 1549 and the related provisions. The contract should not merely say that a party “may terminate immediately”. It should align the grounds, notice mechanics and agreed effects with the type of contract and the intended remedy.

Exit provisions matter just as much as the termination trigger. Address final invoices, transition assistance, return of equipment and documents, data export, deletion, continued licences and the clauses that survive termination.

Penalty clauses and late-payment interest

A penalty clause fixes in advance the consequence of non-performance, defective performance or delay. Under Article 1538 of the Romanian Civil Code, its drafting should identify the protected obligation, the triggering event and the calculation method. The agreement should also state whether a penalty is daily or fixed, whether it is capped and how it interacts with damages and other remedies.

Article 1541 permits a court to reduce a penalty in the statutory circumstances, including where it is manifestly excessive in relation to the loss that the parties could have foreseen when concluding the contract. A high percentage is therefore not a substitute for careful drafting.

Common riskA daily penalty has no cap, applies to several overlapping obligations and continues after termination, creating exposure far beyond the economic value of the contract.

Liability caps, exclusions and indemnities

Liability provisions should allocate risk in proportion to the contract’s value, the parties’ control and the available insurance. Review the general cap, any separate or higher caps, excluded categories of loss, claims procedures and responsibility for employees, affiliates and subcontractors.

Do not assume that an indemnity is a familiar standard clause. It should identify the covered events, third-party claims, control of the defence, settlement authority, notification duties and mitigation. Check whether the limitation of liability applies to the indemnity or whether it creates uncapped exposure.

Any exclusion or limitation must also be tested against mandatory law and the nature of the conduct involved. A clause should not be described as protecting a party against every possible form of unlawful conduct. Where the agreement supports a wider investment or group operation, the liability wording should be reviewed together with the company’s corporate and commercial governance arrangements.

Warranties, regulatory compliance and audit rights

Warranties should be specific to the transaction. Depending on the contract, they may cover conformity with specifications, professional licences, legal compliance, authority, sanctions, anti-bribery, tax status, employment practices, product safety or the absence of third-party rights.

The review should also establish the remedy for an inaccurate warranty. Possible outcomes include correction, replacement, a price adjustment, indemnification or termination. An audit right should define scope, frequency, confidentiality, cost allocation and the treatment of identified non-compliance.

Drafting pointA broad promise to comply with “all applicable laws” may be necessary, but it does not replace transaction-specific duties, evidence requirements and an agreed remediation process.

Force majeure, hardship and change in law

Force majeure and hardship solve different problems. Force majeure concerns an external, unforeseeable, absolutely invincible and unavoidable event under the Civil Code framework. Hardship under Article 1271 addresses an exceptional change that makes performance excessively onerous, subject to the statutory conditions and the allocation of contractual risk.

The clause should define notice, evidence, mitigation, suspension, continued payment obligations and the point at which prolonged disruption permits termination. For regulated or long-term projects, add a change-in-law mechanism explaining who bears new compliance costs and whether price or timing may be adjusted.

Check before signingDo not treat every supplier delay, price increase, staff shortage or market change as force majeure. The clause should distinguish ordinary commercial risk from qualifying events.

Confidentiality and intellectual property

A confidentiality clause should define protected information, permitted use, internal access, legally required disclosures, security standards, duration and return or destruction. Trade-secret protection also depends on practical steps, so access controls and marking procedures should match the contractual wording. A standalone non-disclosure agreement in Romania may be appropriate before sensitive negotiations begin.

For intellectual property, distinguish pre-existing materials from deliverables created under the contract. State whether rights are assigned or licensed and address territory, duration, field of use, sublicensing, modifications, source materials and third-party components.

Romanian Law no. 8/1996 on copyright requires an assignment of economic copyright to specify the transferred rights and, for each, the modes of use, duration, extent and remuneration. A generic sentence stating that the customer “owns everything” may therefore be insufficient for the intended result. Businesses acquiring or licensing valuable assets can obtain a separate review from intellectual property lawyers in Romania.

For ownership arrangements between founders and shareholders, see our guide to shareholder agreements in Romania.

Personal data, security and digital services

If the agreement involves personal data, identify whether each party acts as controller, processor, joint controller or independent controller. When a supplier processes personal data on behalf of a controller, Article 28 of the General Data Protection Regulation requires a contract containing specified safeguards. Our GDPR compliance checklist for Romanian companies explains the wider governance controls that should support those clauses.

Review processing instructions, confidentiality, security measures, subprocessors, assistance with data-subject requests, breach notification, international transfers, audit rights and return or deletion. The commercial agreement and data processing agreement should not contain inconsistent liability, notice or termination rules. More complex vendor arrangements may require assistance from GDPR and data protection lawyers in Romania.

For SaaS and other digital services, also check availability commitments, backups, recovery objectives, vulnerability management, incident cooperation, data portability and access after termination. Technology businesses should align these provisions with their wider technology and digital law obligations and, where relevant, obtain a focused IT and software contract review.

Governing law, jurisdiction and notices

In cross-border contracts, governing law and forum are separate questions. The Rome I Regulation generally allows the parties to choose the law governing their contractual obligations, subject to its safeguards and mandatory rules. The Brussels I bis Regulation governs jurisdiction and the recognition and enforcement of judgments in relevant EU civil and commercial matters.

Consider whether the selected court or arbitral tribunal is proportionate to the likely dispute, where evidence and assets are located, the language and cost of proceedings, and whether an eventual judgment or award can be enforced efficiently.

The notice clause should identify valid addresses, permitted delivery methods, deemed receipt and the process for updating contact details. A termination or claim notice sent to the commercial contact may fail if the contract requires delivery to a different address or by a specific method. Where non-payment is already a concern, the agreement should be tested against the available legal recovery options for unpaid invoices in Romania.

Contract review in Romania: risk map

Contract areaQuestion to answerRisk if unclear
AuthorityIs the correct entity bound by an authorised person?Enforceability, approval and group-liability disputes.
PerformanceWhat exactly must be delivered, tested and accepted?Disputes over completion, defects and payment.
PaymentWhen is money due and what follows from delay?Cash-flow loss, penalties and invoice disputes.
ExitHow can the relationship end and what survives?Lock-in, service interruption and lost data.
LiabilityWhich losses are covered, capped or excluded?Exposure disproportionate to contract value.
IP and dataWho owns or may use assets, information and data?Loss of rights, GDPR exposure and operational dependency.
DisputesWhich law, forum and notice rules apply?Unexpected cost and difficult enforcement.

A practical pre-signing review process

Confirm the commercial dealRecord the intended result, price, timeline and points already agreed before editing legal language.
Read every contract documentReview the agreement, annexes, order forms, proposals, policies and incorporated online terms together.
Rank the risksSeparate legal defects, high-value commercial exposure, operational ambiguity and points that are negotiable preferences.
Propose usable wordingConvert each material issue into a replacement clause, tracked change or clear negotiation question.
Check signing and evidenceConfirm authority, approvals, signature method, final attachments and preservation of the executed version.
Calendar post-signing dutiesTrack notices, renewals, price reviews, certificates, audits and delivery or payment milestones.

Need a Romanian contract reviewed before signing?

Atrium Romanian Lawyers assists Romanian and foreign businesses with contract review, drafting and negotiation. The review can be delivered as tracked changes, replacement clauses, a consolidated draft or a practical risk report adapted to your position in the transaction.

Frequently asked questions

Is a business contract written in English valid in Romania?

Romanian companies can generally conclude commercial contracts in English. The transaction may nevertheless require Romanian-language documents or translations for authorities, courts, employees, consumers, notaries or regulated formalities. The governing-language clause should state which version prevails if the contract is bilingual.

Can a foreign-law contract be used with a Romanian company?

Potentially, yes. In a cross-border contract, the parties may often choose the governing law, but the Rome I framework, mandatory rules, the place of performance and the practical enforcement route must be considered. Choosing foreign law does not automatically remove every Romanian mandatory provision relevant to the transaction.

Are contractual penalties enforceable in Romania?

Romanian law recognises penalty clauses, but the obligation, trigger and calculation must be clear. Article 1541 of the Civil Code permits judicial reduction in the statutory circumstances, including a penalty that is manifestly excessive compared with the foreseeable loss at contract formation.

When should contract review in Romania take place?

Ideally before signing and before the commercial position becomes difficult to change. A new review is also appropriate before renewal, when the scope or price changes, when a party proposes an amendment, or when performance problems and a possible dispute emerge.

What should a foreign company send to the reviewing lawyer?

Send the complete draft and annexes, the commercial proposal, your role in the transaction, the applicable deadline, the principal business concerns and any terms already agreed. Identifying whether you are the customer, supplier, licensor, employer, investor or distributor changes the risk analysis.

Disclaimer: This article provides general legal information and does not constitute legal, tax or commercial advice. Contractual rights and risks depend on the complete document, the transaction, the parties, mandatory rules and the relevant facts.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.