AI governance • Romania • Assessment decisions

DPIA vs FRIA in Romania is a question of two different legal tests. A data protection impact assessment (DPIA) addresses risks arising from personal-data processing under the GDPR. A fundamental rights impact assessment (FRIA) under the AI Act applies to specified deployers of certain high-risk AI systems. Your project may require one, both, or neither mandatory assessment.

When do these obligations apply?

The GDPR assessment requirements already apply. Under the AI Act’s consolidated timetable, Chapter III Sections 1–3, including Article 27, apply to Annex III high-risk systems from 2 December 2027. The corresponding date for Article 6(1)/Annex I product systems is 2 August 2028; that does not extend Article 27 to every product system.

Article 111 contains separate transition provisions for existing systems. A project review should record when the system was placed on the market or put into service and whether subsequent design changes affect its treatment. The future FRIA timetable does not postpone GDPR duties. Source: consolidated AI Act, Articles 111 and 113.

DPIA vs FRIA: the differences that change your project

Both assessments examine potential harm to people. A DPIA is not limited to confidentiality or cybersecurity: it also examines other rights and freedoms affected by personal-data processing. FRIA addresses the impact of the specified AI deployment on fundamental rights.

Click or tap a row to reveal its practical takeaway. Keyboard users: Tab to a green label and press Enter or Space. Swipe the table sideways on a small screen.

GDPR Articles 28, 35–36 and 39; AI Act Article 27.

When does an AI project need a DPIA?

AI use alone does not automatically trigger a DPIA. The controller must assess whether the nature, scope, context and purposes of the processing make a high risk to people likely. Article 35 expressly recognises the relevance of new technologies.

The GDPR identifies particular situations, including systematic and extensive automated evaluation underpinning decisions with legal or similarly significant effects, large-scale processing of special-category or criminal-offence data, and large-scale systematic monitoring of publicly accessible areas. Applicable supervisory-authority lists must also be checked.

For a Romanian deployment, the file should therefore address the applicable requirements and guidance of the Romanian data protection authority, ANSPDCP, alongside Article 35. Record the reasons for a negative screening conclusion too. A supplier’s description of a product as “low risk” is not an assessment of your processing.

Where required, the DPIA must describe the processing and purposes, assess necessity and proportionality, evaluate risks to individuals and specify safeguards. This is a substantive project assessment, not simply a signed template. Source: GDPR Article 35.

For the broader data-protection framework, see our guide to GDPR compliance when using AI in Romania.

Who needs a FRIA under the AI Act?

The Article 27 obligation does not cover every business using high-risk AI. It concerns Article 6(2) high-risk systems and specified categories of deployer, with an exclusion for the critical-infrastructure area in Annex III point 2.

• Bodies governed by public law deploying qualifying systems.
• Private entities providing public services deploying qualifying systems. This status requires analysis; it is not synonymous with every company selling services to the public.
• Deployers of qualifying creditworthiness or credit-scoring systems for natural persons under Annex III point 5(b), which excludes systems used to detect financial fraud.
• Deployers of qualifying life and health insurance risk-assessment or pricing systems for natural persons under Annex III point 5(c).

Classification under Article 6 must be checked first, including the conditions of any applicable exception. The exact intended purpose matters. A financial-sector tool is not automatically a creditworthiness system, and a medical product is not automatically within the Article 27 FRIA route. Source: AI Act Articles 6 and 27 and Annex III.

Explore four deployment scenarios

These hypothetical examples explain the screening logic. They assume the stated facts and do not replace an assessment of the actual system, applicable dates or transition rules.

Can one assessment document cover DPIA and FRIA?

A coordinated file can reduce duplicated work, provided each legal requirement remains identifiable. The consolidated Article 27(4) expressly allows relevant DPIA sections to be cross-referenced or incorporated into FRIA where they already meet the corresponding obligations.

Start with a shared description of the system, purposes, data flows, affected people and safeguards. Then keep a requirement map showing which sections satisfy GDPR Article 35 and which satisfy AI Act Article 27. Identify gaps rather than renaming a DPIA “FRIA”. Source: AI Act Article 27(4)–(5).

As a practical drafting approach, include a separate deployment chapter addressing who may be affected beyond the immediate users, how mistakes influence access to opportunities or services, who can intervene, and how complaints lead to corrective action. Avoid treating GDPR as only a privacy checklist: the DPIA itself must consider risks to rights and freedoms.

What the FRIA needs to address

Article 27 requires the deployment process and intended use, duration and frequency, affected people and groups, specific risks of harm, implementation of human oversight, and measures if risks materialise, including governance and complaint mechanisms. Reusing a supplier assessment in similar cases is permitted, but the deployer must check its fit and update changed or outdated elements. Source: AI Act Article 27(1)–(2).

Who prepares, reviews and owns the decision?

The controller remains responsible for the DPIA; the covered deployer remains responsible for FRIA. A consultant, DPO or supplier can contribute without taking over the organisation’s statutory role.

For the DPIA, seek the designated DPO’s advice and preserve their independent advisory and monitoring function. Obtain relevant processor assistance. For the deployment review, involve the business owner, technical team and people responsible for oversight and complaints. A useful internal decision records outstanding conditions, the person accountable for each safeguard and the circumstances requiring a fresh review. Source: GDPR Articles 28(3)(f), 35(2) and 39; AI Act Article 27.

Contractual cooperation should cover the evidence you need to assess the deployment. Our AI vendor contracts guide addresses information rights, changes and supplier responsibilities.

Must the assessment be sent to an authority?

A DPIA and a FRIA follow different authority procedures. Under GDPR Article 36, prior consultation is required where high residual risk remains that cannot be sufficiently mitigated. There is no general GDPR obligation to submit every DPIA for approval.

Article 27(3) provides for notification of FRIA results to the market surveillance authority using the relevant template, subject to the Article 46(1) exception. That notification is not the GDPR prior-consultation procedure and should not be described as automatic permission to deploy. Confirm the competent authority and operational submission arrangements for the specific deployment. GDPR Article 36; AI Act Article 27(3).

A practical assessment file before deployment

1. Define the use case. Identify the system, version, intended purpose, users, affected people and decisions it informs.
2. Map roles separately. Record GDPR controller/processor roles and the relevant AI Act roles.
3. Screen the legal route. Check prohibited practices, AI classification, DPIA triggers and Article 27 deployer coverage.
4. Record timing. Distinguish existing GDPR duties from future AI Act requirements and applicable transition provisions.
5. Collect evidence. Obtain data-flow information, supplier instructions, meaningful performance limitations, oversight arrangements and relevant testing.
6. Assess harms and safeguards. Describe how the actual deployment may affect people and how controls reduce those risks.
7. Map shared sections. Make each DPIA and FRIA requirement traceable, retaining any necessary separate analysis.
8. Resolve escalation. Identify prior consultation, notification, unresolved risks and conditions preventing launch.
9. Assign review triggers. Consider changes in purpose, model, data, affected groups or decision authority, and evidence from incidents or complaints.

How Atrium Romanian Lawyers Assisted an International Manufacturing Group

Anonymised client matter. The description below omits identifying information and focuses on the legal work performed.

A focused consultation can clarify which assessment route applies and what your team needs before making deployment commitments.

Online company registration in Romania is available for many founders, including non-residents. The filing can be submitted electronically or through an authorised representative, but a valid electronic signature is only one part of the route. The documents, signing authority, identity checks and ONRC platform requirements must also align.

This guide explains the online filing route for foreign individuals, overseas companies and Romanian founders. It focuses on the relationship between electronic signatures, filing authority, documents and the National Trade Register Office platform. For the broader choice of entity, capital and corporate structure, see our company formation in Romania guide.

Can you register a Romanian company online?

Romania’s National Trade Register Office online portal offers services including company-name reservation and incorporation. Law No. 265/2022 also regulates online company formation and electronic communication with the Trade Register.

Under Article 105 of Law No. 265/2022, the registrar may exceptionally request physical presence if there is a suspicion of identity falsification. The same provision states that physical presence is not required when the incorporation application and supporting documents, including the articles of association, were prepared by a public notary or lawyer. If presence is exceptionally requested during online formation, the remaining stages may still be completed electronically.

What are the steps for remote company formation in Romania?

The legal sequence is straightforward, but the filing route should be chosen before documents are signed. Select each step below to see its practical purpose.

1. Confirm the company structure. Decide the entity type, ownership, administrators, business activities and signing authority. An SRL is common, but it should not be selected automatically when investment, governance or regulated activities require another structure. See our 2026 guide to Romanian limited liability companies.
2. Reserve the company name. Submit alternatives that comply with the Trade Register rules. Our separate guide explains how to register a company name in Romania.
3. Establish the registered office. Every Romanian company needs a valid registered office and supporting title to use the address. For the documents commonly used in an incorporation file, see our foreign-founder document checklist.
4. Prepare, formalise and translate the documents. Coordinate the articles of association, identity or corporate records, declarations, beneficial-owner information, office evidence and powers of attorney. Foreign public documents may require apostille, legalisation or an applicable exemption, depending on the issuing state, bilateral treaties, EU legislation and the nature of the document, followed by an authorised Romanian translation where required.
5. Sign and file through the selected route. If the electronic filing route is used, the signature and submission must satisfy the applicable ONRC technical and procedural requirements. A properly authorised representative may provide an alternative route, provided that the authority granted complies with the requirements applicable to the filing.
6. Complete post-registration onboarding. After incorporation, organise accounting, tax registrations or options, bank onboarding, employment setup and any permits required for the actual activity.

Which documents do foreign founders usually need?

Do founders need a qualified electronic signature?

The signature route should be tested before execution. Romania’s framework includes Law No. 214/2024 on electronic signatures and trust services, while the Trade Register procedure is governed specifically by Law No. 265/2022 and the portal’s filing requirements. The availability of electronic filing depends not only on the legal validity of the electronic signature but also on the technical and procedural requirements imposed by the National Trade Register Office.

Remote identity checks may also involve regulated identification services. The Romanian Authority for Digitalisation publishes information on remote identification by video means, but the availability and acceptance of a particular method still depend on the institution and transaction.

Is a Romanian notary always required?

The correct answer depends on the document, the country where it is issued and the chosen filing route. For foreign founders, the practical question is usually not “Do I need a notary for the company?” but “Which document, if any, needs notarisation, apostille or legalisation, and in which country?”

How long does remote incorporation take?

Under Articles 105 and 107 of Law No. 265/2022, the registrar generally resolves complete applications on documents within one working day and, when the legal requirements are met, orders registration according to the statutory procedure. Procedural exceptions, requests for additional evidence or a need to remedy the file may affect this stage. The one-working-day period should not be advertised as the total time needed by a foreign founder.

If the file is incomplete or does not meet the legal requirements, Article 106 allows a remedy or completion period of up to 15 calendar days. The practical schedule should therefore separate:

• preparation time for the corporate structure and registered office;
• time for foreign documents, apostille or legalisation and translation;
• the Trade Register review of a complete filing;
• time needed to cure any filing defect; and
• post-incorporation bank, accounting, tax and licensing steps.

Is the bank account part of the online incorporation?

Each bank decides what identification, beneficial-owner, source-of-funds and business-model evidence it needs. Some institutions offer remote onboarding in eligible cases; others may request a video identification, additional documents or physical attendance. Founders should compare banking routes early, especially where the ownership chain is international or the activity carries heightened compliance risk. See our guide to opening a Romanian business bank account as a non-resident.

What most often delays a remote filing?

Remote formation checklist for a foreign founder

1. Confirm the Romanian entity, ownership, administrators and business activities.
2. Choose the online filing or legal-representation route before signing documents.
3. Check each foreign document for issue date, apostille or legalisation and Romanian translation.
4. Secure a compliant registered office and align the supporting document with the intended filing.
5. Map the beneficial owners through the complete international ownership chain.
6. Verify the signature and authority of every shareholder, administrator and representative.
7. Submit one consistent, complete file through the National Trade Register Office route.
8. Plan banking, accounting, tax and sector-specific compliance as separate workstreams.

The bottom line

Remote company formation in Romania is a workable route for many foreign founders, but it is not a single universal online form. The successful approach coordinates Romanian incorporation requirements with the founder’s home-country documents, a valid signing or representation route, registered-office evidence and separate post-registration onboarding.

AI Notice: AI-assisted content, reviewed by a qualified Romanian lawyer.

Directors and officers insurance in Romania can protect managers and companies against certain defence costs and civil claims arising from alleged management errors. It does not cancel a director’s legal duties, guarantee payment of every claim or cover intentional misconduct simply because the allegation concerns a management decision.

This guide is written for Romanian subsidiaries, foreign groups, founders, shareholders and board members assessing management-liability protection. It complements our detailed guide to Romanian company director liability, which explains when personal exposure may arise under company, insolvency and tax law.

What is D&O insurance and what does it protect?

D&O insurance is a liability policy designed to respond to covered claims alleging a wrongful act by an insured director or officer in that management capacity. Depending on the wording, it may fund defence costs and pay covered settlements, judgments or other insured loss. The policy may also reimburse the company where it lawfully indemnifies the individual.

The expression “wrongful act” is usually defined broadly in the policy, but the definition is only the entrance to the coverage analysis. The claim must also fall within the insured persons, insured capacity, policy period, territory and jurisdiction. It must not be removed by an exclusion, and all notification, consent and cooperation requirements must be met.

Is D&O insurance mandatory for Romanian directors?

There is no safe basis for saying that one identical D&O policy is compulsory for every Romanian company and every SRL administrator. The answer depends on the company form, appointment framework, applicable special regulation and corporate decisions.

Article 153¹²(4) of Romanian Companies Law no. 31/1990 applies within the governance regime of joint-stock companies (SA) and should not automatically be assumed to create a general insurance obligation for all SRL administrators. For a limited liability company, the articles of association, shareholders’ decision, mandate terms and any sector-specific legislation should be checked separately.

Romanian law refers to professional liability insurance, while modern D&O insurance is a market product developed by insurers. Although D&O insurance frequently serves this purpose in practice, the legal obligation and the insurance wording should not automatically be treated as identical concepts.

Even where insurance is required by the appointment or corporate framework, a policy bearing the label “D&O” does not automatically satisfy every requirement. The insured roles, limit, territory, duration, run-off protection and exclusions must fit the mandate and risk profile.

Which Romanian director-liability claims may engage the policy?

A D&O policy may be relevant when a director faces a civil claim, investigation or other covered proceeding arising from alleged conduct in office. Whether it responds depends on the precise policy, not merely on the legal label attached to the dispute.

How does a D&O claim move from allegation to payment?

The practical sequence begins before liability is established. Many policies are written on a claims-made or claims-made-and-notified basis. A demand, investigation notice, circumstance or written allegation may trigger immediate notification duties even if no court proceedings have started.

1. Preserve the notice. Keep the demand, authority letter, board papers and delivery evidence.
2. Identify every potentially responsive policy. Check local and global programmes, prior-year policies and any run-off cover.
3. Notify within the required form and period. Do not wait for a final claim value or court filing if the wording requires earlier notice.
4. Obtain consent before material defence expenditure or settlement. Emergency-cost provisions should be checked where prior consent is impracticable.
5. Separate insured and uninsured matters. Allocation may be needed between individuals and the company, covered and uncovered allegations, or several policies.
6. Protect privilege and cooperation. Coordinate Romanian counsel, broker and insurer communications without disclosing privileged analysis unnecessarily.

What does D&O insurance usually not cover?

Exclusions differ materially between insurers and negotiated programmes. The most important distinction is between an allegation and a final conduct determination. Some policies advance defence costs while allegations are unresolved, then apply a dishonesty or personal-profit exclusion only after a final, non-appealable determination or admission. Other wording may be less protective.

Does D&O insurance cover insolvency, tax liability or criminal proceedings?

Not automatically. These are precisely the scenarios where the difference between defence-cost protection and payment of the underlying liability becomes important.

Under Article 169 of Romanian Insolvency Law no. 85/2014, the court may order persons who contributed to insolvency through listed conduct to bear part or all of the debtor’s liabilities within the causally connected loss. A policy must be checked for insolvency-practitioner claims, conduct exclusions, prior-circumstance provisions and the point at which dishonesty is established.

Tax debts, administrative fines, criminal fines, confiscation and amounts representing unlawful gain may be excluded from coverage or may be regarded as non-insurable under applicable mandatory law. Nevertheless, some policies may cover defence costs for a covered person during an investigation or proceeding until an exclusion is established. The precise wording and Romanian public-policy rules control the answer.

A policy cannot prevent an investigation, prosecution, disqualification, regulatory order or the consequences of a final judgment. Insurance is financial protection within contractual and legal boundaries, not a transfer of public-law responsibility.

What should a Romanian company check before buying or renewing D&O cover?

The best review starts with the company’s actual management structure and claim scenarios, not with the premium alone. A low limit, broad entity cover or weak notification clause may leave directors exposed even where the policy looks extensive on a summary page.

How should D&O insurance fit with corporate governance?

Insurance works best when the governance system can show who decided, on what information, under which authority and with which conflict controls. The policy does not replace accurate minutes, authority matrices, financial reporting, compliance escalation or timely insolvency analysis.

Companies should align the policy with the articles of association, director appointment or mandate, shareholder resolutions, group indemnity arrangements and any transaction documents. A share purchase agreement may require run-off cover for outgoing directors, while a shareholder agreement may address nomination rights and insurance commitments. Neither document should promise protection that the policy does not deliver.

Change of control is particularly important. Many policies restrict cover for wrongful acts occurring after an acquisition or other control event. Transaction planning should therefore address tail coverage, continuity dates, notice of known circumstances and the allocation of premium and claims responsibility.

The bottom line

D&O insurance in Romania can be an important layer of financial protection, especially where directors manage material contracts, regulated activity, cross-border operations or financial distress. Its value depends on the wording and the company’s ability to recognise and manage a claim.

The practical review should connect four documents: the legal mandate, the corporate indemnity, the D&O policy and the internal claims protocol. If they use different definitions of director, authority, claim or covered loss, the gap may emerge only when protection is needed.

Frequently asked questions

Disclaimer: This article provides general legal and insurance information and does not constitute legal, tax, insolvency, insurance-brokerage or coverage advice. Coverage depends on the policy wording, facts, applicable law and insurer’s assessment.

AI Notice: AI-assisted content, reviewed by a qualified Romanian lawyer.