AI governance • Romania • Assessment decisions

DPIA vs FRIA in Romania is a question of two different legal tests. A data protection impact assessment (DPIA) addresses risks arising from personal-data processing under the GDPR. A fundamental rights impact assessment (FRIA) under the AI Act applies to specified deployers of certain high-risk AI systems. Your project may require one, both, or neither mandatory assessment.

When do these obligations apply?

The GDPR assessment requirements already apply. Under the AI Act’s consolidated timetable, Chapter III Sections 1–3, including Article 27, apply to Annex III high-risk systems from 2 December 2027. The corresponding date for Article 6(1)/Annex I product systems is 2 August 2028; that does not extend Article 27 to every product system.

Article 111 contains separate transition provisions for existing systems. A project review should record when the system was placed on the market or put into service and whether subsequent design changes affect its treatment. The future FRIA timetable does not postpone GDPR duties. Source: consolidated AI Act, Articles 111 and 113.

DPIA vs FRIA: the differences that change your project

Both assessments examine potential harm to people. A DPIA is not limited to confidentiality or cybersecurity: it also examines other rights and freedoms affected by personal-data processing. FRIA addresses the impact of the specified AI deployment on fundamental rights.

Click or tap a row to reveal its practical takeaway. Keyboard users: Tab to a green label and press Enter or Space. Swipe the table sideways on a small screen.

GDPR Articles 28, 35–36 and 39; AI Act Article 27.

When does an AI project need a DPIA?

AI use alone does not automatically trigger a DPIA. The controller must assess whether the nature, scope, context and purposes of the processing make a high risk to people likely. Article 35 expressly recognises the relevance of new technologies.

The GDPR identifies particular situations, including systematic and extensive automated evaluation underpinning decisions with legal or similarly significant effects, large-scale processing of special-category or criminal-offence data, and large-scale systematic monitoring of publicly accessible areas. Applicable supervisory-authority lists must also be checked.

For a Romanian deployment, the file should therefore address the applicable requirements and guidance of the Romanian data protection authority, ANSPDCP, alongside Article 35. Record the reasons for a negative screening conclusion too. A supplier’s description of a product as “low risk” is not an assessment of your processing.

Where required, the DPIA must describe the processing and purposes, assess necessity and proportionality, evaluate risks to individuals and specify safeguards. This is a substantive project assessment, not simply a signed template. Source: GDPR Article 35.

For the broader data-protection framework, see our guide to GDPR compliance when using AI in Romania.

Who needs a FRIA under the AI Act?

The Article 27 obligation does not cover every business using high-risk AI. It concerns Article 6(2) high-risk systems and specified categories of deployer, with an exclusion for the critical-infrastructure area in Annex III point 2.

• Bodies governed by public law deploying qualifying systems.
• Private entities providing public services deploying qualifying systems. This status requires analysis; it is not synonymous with every company selling services to the public.
• Deployers of qualifying creditworthiness or credit-scoring systems for natural persons under Annex III point 5(b), which excludes systems used to detect financial fraud.
• Deployers of qualifying life and health insurance risk-assessment or pricing systems for natural persons under Annex III point 5(c).

Classification under Article 6 must be checked first, including the conditions of any applicable exception. The exact intended purpose matters. A financial-sector tool is not automatically a creditworthiness system, and a medical product is not automatically within the Article 27 FRIA route. Source: AI Act Articles 6 and 27 and Annex III.

Explore four deployment scenarios

These hypothetical examples explain the screening logic. They assume the stated facts and do not replace an assessment of the actual system, applicable dates or transition rules.

Can one assessment document cover DPIA and FRIA?

A coordinated file can reduce duplicated work, provided each legal requirement remains identifiable. The consolidated Article 27(4) expressly allows relevant DPIA sections to be cross-referenced or incorporated into FRIA where they already meet the corresponding obligations.

Start with a shared description of the system, purposes, data flows, affected people and safeguards. Then keep a requirement map showing which sections satisfy GDPR Article 35 and which satisfy AI Act Article 27. Identify gaps rather than renaming a DPIA “FRIA”. Source: AI Act Article 27(4)–(5).

As a practical drafting approach, include a separate deployment chapter addressing who may be affected beyond the immediate users, how mistakes influence access to opportunities or services, who can intervene, and how complaints lead to corrective action. Avoid treating GDPR as only a privacy checklist: the DPIA itself must consider risks to rights and freedoms.

What the FRIA needs to address

Article 27 requires the deployment process and intended use, duration and frequency, affected people and groups, specific risks of harm, implementation of human oversight, and measures if risks materialise, including governance and complaint mechanisms. Reusing a supplier assessment in similar cases is permitted, but the deployer must check its fit and update changed or outdated elements. Source: AI Act Article 27(1)–(2).

Who prepares, reviews and owns the decision?

The controller remains responsible for the DPIA; the covered deployer remains responsible for FRIA. A consultant, DPO or supplier can contribute without taking over the organisation’s statutory role.

For the DPIA, seek the designated DPO’s advice and preserve their independent advisory and monitoring function. Obtain relevant processor assistance. For the deployment review, involve the business owner, technical team and people responsible for oversight and complaints. A useful internal decision records outstanding conditions, the person accountable for each safeguard and the circumstances requiring a fresh review. Source: GDPR Articles 28(3)(f), 35(2) and 39; AI Act Article 27.

Contractual cooperation should cover the evidence you need to assess the deployment. Our AI vendor contracts guide addresses information rights, changes and supplier responsibilities.

Must the assessment be sent to an authority?

A DPIA and a FRIA follow different authority procedures. Under GDPR Article 36, prior consultation is required where high residual risk remains that cannot be sufficiently mitigated. There is no general GDPR obligation to submit every DPIA for approval.

Article 27(3) provides for notification of FRIA results to the market surveillance authority using the relevant template, subject to the Article 46(1) exception. That notification is not the GDPR prior-consultation procedure and should not be described as automatic permission to deploy. Confirm the competent authority and operational submission arrangements for the specific deployment. GDPR Article 36; AI Act Article 27(3).

A practical assessment file before deployment

1. Define the use case. Identify the system, version, intended purpose, users, affected people and decisions it informs.
2. Map roles separately. Record GDPR controller/processor roles and the relevant AI Act roles.
3. Screen the legal route. Check prohibited practices, AI classification, DPIA triggers and Article 27 deployer coverage.
4. Record timing. Distinguish existing GDPR duties from future AI Act requirements and applicable transition provisions.
5. Collect evidence. Obtain data-flow information, supplier instructions, meaningful performance limitations, oversight arrangements and relevant testing.
6. Assess harms and safeguards. Describe how the actual deployment may affect people and how controls reduce those risks.
7. Map shared sections. Make each DPIA and FRIA requirement traceable, retaining any necessary separate analysis.
8. Resolve escalation. Identify prior consultation, notification, unresolved risks and conditions preventing launch.
9. Assign review triggers. Consider changes in purpose, model, data, affected groups or decision authority, and evidence from incidents or complaints.

How Atrium Romanian Lawyers Assisted an International Manufacturing Group

Anonymised client matter. The description below omits identifying information and focuses on the legal work performed.

A focused consultation can clarify which assessment route applies and what your team needs before making deployment commitments.

Employee dismissal in Romania is lawful only when the employer relies on a ground recognised by the Labour Code and follows the procedure attached to that specific ground. A genuine business reason is not enough if the required notice, investigation, evaluation, consultation or written decision is defective.

This guide is intended for Romanian companies, foreign investors, HR teams and managers considering an individual or collective dismissal. It reflects the structure of the Romanian Labour Code and highlights the points that most often create litigation risk. For advice on a particular case, see our Romanian employment law services.

Is every employment termination a dismissal?

No. Under Article 58 of the Romanian Labour Code, dismissal is the termination of an individual employment contract at the employer’s initiative. It may be based on reasons related to the employee or on reasons unrelated to the employee.

Dismissal should not be confused with termination by mutual agreement, resignation, expiry of a fixed-term contract, termination by operation of law or written termination during or at the end of a probationary period under Article 31(3). Termination during the probationary period is a distinct mechanism, separate from dismissal. Each route has different conditions. Relabelling a unilateral dismissal as a “mutual termination” does not make it consensual; genuine agreement must exist.

Legal grounds for employee dismissal in Romania

The main grounds are divided between reasons related to the employee and reasons unrelated to the employee. The required evidence and procedure differ substantially.

When is dismissal prohibited?

Before any employee dismissal in Romania, the employer should check both Articles 59 and 60 of the Labour Code. Article 59 prohibits dismissal on protected grounds, including protected characteristics, trade-union membership or activity, lawful participation in a strike and the exercise of specified employment rights. Article 60 creates temporary prohibitions during specified periods, including certified temporary incapacity for work, quarantine, maternity leave, parental leave, leave to care for a sick child, annual leave, paternity leave, caregiver leave and certain emergency family absences. A pregnant employee is protected if the employer knew of the pregnancy before issuing the decision. Separate anti-discrimination and retaliation rules may also apply under Law no. 202/2002 and the Whistleblower Protection Law no. 361/2022.

The protected-period analysis should be made immediately before the dismissal decision is issued and communicated. Article 60 also contains an exception linked to judicial reorganisation, bankruptcy and dissolution of the employer, but it should be applied only after checking the employer’s precise legal status and the special insolvency rules.

Does every dismissed employee receive 20 working days’ notice?

No. Article 75 grants a minimum notice period of 20 working days for dismissal due to medical unfitness, professional inadequacy and redundancy under Articles 65 and 66. It does not create a universal notice period for every type of dismissal. In particular, disciplinary dismissal does not carry the same statutory notice entitlement.

The notice period and its start date should be documented clearly. Employers should not assume that paying an equivalent amount automatically remedies a failure to observe the statutory notice period. If the parties want a negotiated exit with compensation, that should be structured separately as a genuine mutual termination agreement.

How does disciplinary dismissal work?

Employee dismissal in Romania based on misconduct is the most procedure-sensitive route. Before imposing it, the employer must ordinarily conduct the prior disciplinary investigation regulated by Article 251. The process should include a written summons specifying the subject, date, time and place of the meeting, a real opportunity for the employee to present explanations and evidence, and a documented assessment of the defence.

The sanction must also be proportionate. Article 250 requires the employer to consider factors such as the circumstances of the misconduct, degree of fault, consequences, the employee’s general conduct and any previous disciplinary sanctions. A finding that misconduct occurred does not automatically justify dismissal if a lesser sanction is proportionate.

The disciplinary decision must be issued in writing within 30 calendar days from the date the employer became aware of the misconduct, but no later than six months from the date of the act. It must contain all mandatory elements under Article 252 and be communicated within five calendar days of issue. Read our dedicated guide to the disciplinary procedure in Romania.

Evidence that usually matters

• the internal regulation, policies and lawful instructions allegedly breached;
• proof that the employee received or could access those rules;
• emails, access logs, reports, witness statements or other lawfully obtained evidence;
• the summons, interview record, employee’s written defence and supporting documents;
• a reasoned proportionality assessment; and
• proof of issuing and communicating the final decision within the statutory periods.

How should professional inadequacy be documented?

Professional inadequacy concerns the employee’s ability to meet the professional requirements of the role; it is not a disciplinary accusation. Article 61(d) provides the legal ground for dismissal, while Article 63(2) requires the employee to undergo a prior evaluation under the procedure established by the applicable collective labour agreement or, in its absence, the internal regulation.

The evaluation should rely on objective, role-related standards communicated in advance. The job description, performance objectives, prior reviews, training records and concrete work results should tell a consistent story. A hastily created evaluation standard or a process designed around one predetermined outcome is vulnerable to challenge.

Before dismissal, Article 64 requires the employer to offer available positions compatible with the employee’s professional training or, where relevant, work capacity. If no suitable vacancy exists, the employer must seek the support of the territorial employment agency. The employee has three working days to express written consent to an offered position.

What is required for medical-unfitness dismissal?

Medical unfitness under Article 61(c) cannot rest on a manager’s impression or an ordinary performance assessment. It must be established through a decision of the competent medical bodies. The employer must then follow the compatible-vacancy process under Article 64 and grant the minimum statutory notice.

This ground should also be kept distinct from disability discrimination and reasonable workplace accommodation issues. Medical information must be handled with particular attention to confidentiality and data-protection requirements.

When is redundancy lawful?

Employee dismissal in Romania for redundancy is governed principally by Article 65. It is lawful when the employee’s position is effectively eliminated and the elimination has a real and serious cause unrelated to that employee. The employer does not have to prove that dismissal was the only imaginable business choice, but it should be able to show that the reorganisation is genuine and that the eliminated role no longer exists in substance.

A defensible file commonly includes the competent corporate decision, the business rationale, organisational charts before and after implementation, the updated headcount and job descriptions, financial or operational supporting material where relevant, and evidence that the employee’s duties were genuinely removed or redistributed.

A changed job title alone is not decisive. Courts can examine whether a supposedly eliminated position continues in substance or is promptly refilled under a different label.

Where only some identical or comparable positions are removed, the selection issue requires particular care. In Decision no. 30/2020, the High Court declined to rule on the merits and dismissed the recurs în interesul legii as inadmissible. It held that the question concerned applying the law to specific facts rather than resolving a genuine issue of legal interpretation. The decision therefore did not unify the divergent lower-court approaches described in the referral on whether selection criteria are required when an employer eliminates only some positions from a group of identical or similar positions. As a risk-management measure, any criteria used should be objective, consistently applied and supported by evidence.

Employers planning a broader reorganisation may also consult our guide to employee rights during company restructuring in Romania.

When do collective-dismissal rules apply?

A redundancy programme can become a collective dismissal if, within a period of 30 calendar days, the statutory thresholds in Article 68 are reached.

For threshold calculations, certain other employer-initiated terminations for reasons unrelated to the employee may also be counted when the statutory conditions are met. Fragmenting one programme into several documents or dates does not necessarily prevent the collective rules from applying.

The employer must begin consultations with the trade union or employee representatives in good time, provide the written information required by Article 69 and genuinely examine ways to avoid or reduce dismissals and mitigate their consequences. If the programme proceeds, the territorial labour inspectorate and territorial employment agency must receive the statutory notification at least 30 calendar days before dismissal decisions are issued, subject to the detailed Labour Code procedure.

What must the written dismissal decision contain?

The applicable deadline and the mandatory content should be analysed separately. Article 62 establishes the deadline for issuing decisions based on Article 61(b)–(d) and also requires the decision to state its factual and legal reasons, the challenge period and the competent court. Article 76 sets out the other mandatory elements applicable to dismissal decisions, while Article 252 contains the specific requirements for disciplinary decisions. Depending on the case, the written decision should include:

• the factual and legal reasons for dismissal;
• the duration of the notice period, where applicable;
• the collective-dismissal selection criteria, where applicable;
• the list of available positions and the Article 64 response period, where applicable;
• for a disciplinary sanction, the mandatory elements in Article 252, including why the employee’s defence was rejected; and
• the statutory challenge period and competent court, where required.

The decision produces effects from communication to the employee. Communication should therefore be provable. The employer cannot ordinarily defend the case by introducing new dismissal reasons that were absent from the decision.

What are the main employer risks if the dismissal is unlawful?

A failure to comply with the legally required procedure results in absolute nullity under Article 78. Under Article 80, if the court cancels the dismissal, it orders compensation equal to the indexed, increased and updated salaries and the other entitlements the employee would have received. At the employee’s request, the court also restores the parties to the position existing before dismissal by ordering reinstatement.

Employment disputes move quickly and the employer bears the burden of proof under Article 272. A disciplinary decision may be challenged within 30 calendar days of communication under Article 252(5). For most other dismissal-related employment disputes, employees generally have 45 calendar days to challenge the measure under Article 268, calculated from the date on which the person concerned became aware of it, subject to the specific provisions applicable to the type of claim.

Additional exposure may arise from discrimination, whistleblower retaliation, unpaid rights, data-protection violations, collective consultation failures or inconsistent treatment of comparable employees.

A practical pre-dismissal checklist for employers

1. Identify the legal route. Confirm whether the case is dismissal, mutual agreement, resignation, expiry, probationary termination or another statutory form.
2. Check protected status. Verify leave, medical incapacity, pregnancy notifications, representative status, whistleblowing and discrimination risks.
3. Confirm decision-making authority. Make sure the correct corporate or managerial body approves the measure.
4. Audit governing documents. Review the employment contract, job description, internal regulation, policies and collective agreement.
5. Build the evidence file. Preserve documents lawfully and avoid post-hoc rationales.
6. Run the ground-specific procedure. Investigation, professional evaluation, medical decision, vacancy search or reorganisation documentation cannot be interchanged.
7. Check collective thresholds. Look at the complete 30-day programme, not only one employee or one department.
8. Calculate notice correctly. Apply it only where legally required, but do not shorten it.
9. Draft and quality-check the decision. Confirm every mandatory element, factual statement, date and attachment.
10. Plan communication and litigation readiness. Retain proof of delivery and a complete, chronological file.

If employment status itself is uncertain, first review our analysis of employee versus contractor risks in Romania. For prevention at the hiring stage, see our guidance on employment contracts in Romania.

Frequently asked questions

Disclaimer: This article provides general information and does not constitute legal advice. The correct procedure depends on the dismissal ground, employment documents, employee status and facts of the case.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.