The compliance question is no longer whether a business “uses AI”. Most international groups do. The practical questions are which legal entity controls each use, whether the system affects people in Romania, and whether the company is a provider, deployer, importer or distributor for that system.

This guide is written for foreign companies, investors and employers with Romanian operations. It reflects legislation and official information available on 31 July 2026 and explains the rules applicable from 2 August 2026.

What Changes on 2 August 2026?

Regulation (EU) 2026/1744, the AI Omnibus, entered into force on 27 July 2026. It moved the Annex III high-risk deadline to 2 December 2027 and the deadline for high-risk AI embedded in regulated products to 2 August 2028. The European Commission’s updated AI Act timeline confirms these dates.

The original Artificial Intelligence Act remains Regulation (EU) 2024/1689, but it must now be read together with the enacted AI Omnibus.

Does the AI Act Apply to a Foreign Company Operating in Romania?

The Act applies to providers that place AI systems or general-purpose AI models on the EU market, deployers established or located in the EU, importers and distributors, and certain product manufacturers. It can also apply to providers and deployers outside the EU where the system’s output is used in the Union. The Commission’s AI Act scope page sets out the territorial rules.

A foreign group should map the role of each entity rather than treat “the company” as a single actor.

Contracting with a US or other non-EU vendor does not automatically transfer the Romanian deployer’s responsibilities. Conversely, white-labelling, materially modifying or repurposing a tool may move a company into the provider role.

Which AI Uses Should a Company Classify First?

An operational inventory can use four screening groups, but the legal analysis should remain tied to the Act:

• Prohibited practices: uses that must not be deployed, subject to narrow statutory exceptions.
• High-risk systems: Annex III uses and certain AI safety components or regulated products, subject to the revised future dates.
• Article 50 systems: interactive or generative uses and certain emotion-recognition, biometric or synthetic-content uses with transparency duties.
• Other AI systems: systems outside those rules may still be subject to AI literacy, GDPR, consumer, employment, intellectual-property, confidentiality and sector-specific law.

This last point matters. “Minimal risk” does not mean “no compliance”. A low-impact writing assistant may still require staff guidance, data controls and human review.

Which Workplace AI Uses Are Already Prohibited?

The Commission identifies prohibited practices including manipulative or exploitative AI, certain social scoring, certain biometric categorisation, untargeted facial-image scraping, individual predictive policing based solely on profiling, and emotion recognition in workplaces and education, subject to specific exceptions. The AI Omnibus also added a prohibition targeting AI that generates non-consensual sexually explicit or intimate content and child sexual abuse material. See the Commission’s prohibited-practices guidance.

For employers, the label used by a vendor is not decisive. A video-interview tool, wellness platform or workforce-monitoring service may claim to detect engagement, stress, attitude or sentiment without calling the function “emotion recognition”. Review the actual inputs, inferences and purpose.

What Transparency Duties Apply from 2 August 2026?

The Commission published final Article 50 transparency guidance in July 2026.

Does a Customer-Facing Chatbot Need a Disclosure?

Usually, the system should inform a person at the start of the first interaction that they are interacting with AI, unless this is obvious to a reasonably well-informed, observant and circumspect person. The provider bears the design obligation. A business deploying a third-party chatbot should nevertheless verify that the notice is implemented in its actual interface and allocate responsibility in the contract.

Must AI-Assisted Business Content Be Labelled?

Not every AI-assisted text requires a public label. Article 50 focuses on text published to inform the public on matters of public interest. The Commission states that substantive human review or editorial control, together with editorial responsibility, can qualify for an exemption. Spell-checking, formatting or superficial approval is not enough.

For images, audio and video, a deployer must separately assess whether the output is a deepfake. Where disclosure is required, it must be clear to people at first exposure; embedded technical metadata alone does not satisfy the deployer’s obligation.

Is There a Grace Period?

The Commission confirms a narrow grace period only for providers’ machine-readable marking obligation for generative AI systems placed on the market before 2 August 2026. Those systems must comply from 2 December 2026. Content generated before 2 August 2026 need not be labelled retroactively. Other Article 50 duties do not receive a general grace period.

What Must Employers Know About Recruitment and Employee-Management AI?

The AI Act’s Annex III lists systems intended to:

• place targeted job advertisements;
• analyse and filter applications;
• evaluate candidates;
• make decisions affecting work terms, promotion or termination;
• allocate tasks based on behaviour, traits or characteristics; or
• monitor and evaluate worker performance or behaviour.

Some listed systems may fall outside high-risk treatment if they do not create a significant risk and satisfy Article 6(3), for example because they perform a narrow procedural or preparatory task and do not materially influence a decision. Systems that profile natural persons remain high-risk. Providers relying on an exclusion must document the assessment. As of 31 July 2026, the Commission’s detailed high-risk classification guidelines were still in draft following consultation.

What Duties Arrive in December 2027?

Depending on role and use, the high-risk regime includes risk management, data governance, technical documentation, record-keeping, information for deployers, human oversight, accuracy, robustness, cybersecurity, quality management, conformity assessment, registration, post-market monitoring and incident reporting.

Deployers must follow instructions, assign competent human oversight, monitor operation, retain logs under their control, and use relevant and sufficiently representative input data where they control those inputs. Employer deployers must inform workers’ representatives and affected workers before putting a high-risk workplace system into service or use, in accordance with applicable law.

The delay should be used to obtain the documentation and contractual rights that cannot be created at the end of procurement.

What Does AI Literacy Require After the AI Omnibus?

Article 4 has applied since 2 February 2025. The Commission’s updated AI literacy questions and answers recommend a risk-based approach that considers the organisation’s role, the systems used, staff knowledge and the people affected.

There is no mandatory certificate or prescribed course. A defensible programme may include:

• an approved-AI-tools register;
• role-based training for management, HR, procurement, IT, marketing and ordinary users;
• rules on personal, confidential and privileged information;
• verification requirements for AI output;
• escalation for high-impact decisions;
• specific human-oversight training for high-risk systems; and
• internal records of training and guidance.

Reading a vendor’s instructions may be insufficient, particularly where human oversight or affected persons’ rights are at stake. The Commission states that supervision and enforcement of Article 4 begins on 3 August 2026.

How Does the AI Act Interact with GDPR and Employment Law?

Where an AI system processes candidate, worker, customer or other personal data, the GDPR continues to apply. The company must identify a lawful basis, provide transparent information, observe purpose limitation and data minimisation, manage processors and international transfers, protect data, and assess automated decision-making. A data protection impact assessment may be required where processing is likely to create a high risk.

The European Data Protection Board’s Opinion 28/2024 addresses anonymity, legitimate interests and the consequences of unlawfully processed training data. For a Romania-specific overview, see our guide to GDPR compliance when using AI.

Employment projects also require review of discrimination, monitoring, employee information and consultation, collective arrangements and the validity of decisions under Romanian law. A human approval click does not automatically remove automated-decision or discrimination risk if the human reviewer cannot meaningfully change the outcome.

What Should a Foreign Investor Check in AI Due Diligence?

An investor or buyer of a Romanian business should request:

1. the AI systems inventory and owners;
2. provider, deployer, importer and distributor role assessments;
3. the prohibited-practices review;
4. Article 50 notices, labels and technical marking evidence;
5. AI literacy materials and attendance records;
6. vendor contracts, data-processing agreements, audit rights and change notices;
7. GDPR records, data protection impact assessments and automated-decision analysis;
8. the roadmap for Annex III and Annex I systems;
9. complaints, incidents, regulator correspondence and known bias issues; and
10. insurance coverage, warranties, indemnities and remediation budgets.

Representations should be tied to disclosed systems and evidence. A generic warranty that the target “complies with all AI laws” is unlikely to identify which party must remediate a specific tool or fund a delayed conformity project.

Who Supervises the AI Act in Romania?

In March 2026, the Romanian Government approved a memorandum proposing the National Authority for Management and Regulation in Communications (ANCOM) as market-surveillance authority and single point of contact, with sectoral roles for other bodies including the National Bank of Romania, the Financial Supervisory Authority, the national data-protection authority and the Authority for the Digitalisation of Romania.

ANCOM’s own June 2026 notice describes ANCOM as proposed for that role. The national implementing law was therefore still a point to verify as of this guide’s preparation. GDPR matters remain within the competence of the Romanian data-protection authority, while financial and product-sector regulators may have parallel powers.

What Penalties Can Apply?

The Article 99 penalty framework includes:

• up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, whichever is higher for undertakings;
• up to EUR 15 million or 3% for specified operator obligations, including Article 50 transparency duties, whichever is higher for undertakings; and
• up to EUR 7.5 million or 1% for incorrect, incomplete or misleading information supplied to competent authorities or notified bodies, whichever is higher for undertakings.

For SMEs, including start-ups, the applicable ceiling is the lower of the fixed amount and percentage. Authorities must consider factors such as gravity, duration, harm, company size, cooperation, responsibility, mitigation and intent. These are maximum ceilings, not automatic fines.

A Practical Compliance Checklist for August 2026

1. Inventory every AI system used or supplied by the Romanian business, including embedded features in HR, CRM, finance, security, marketing and productivity tools.
2. Map the provider, deployer, importer, distributor and product-manufacturer role for each legal entity.
3. Screen intended and actual uses against Article 5, with specific attention to workplace emotion inference and manipulative functions.
4. Implement Article 50 notices, labels and marking controls for systems in scope from 2 August 2026.
5. Document the narrow legacy grace period separately; do not treat it as a general Article 50 delay.
6. Support AI literacy with risk-based policies, role-specific guidance and internal records.
7. Review HR tools against Annex III and create a 2 December 2027 readiness plan.
8. Align vendor contracts on role, intended purpose, documentation, changes, audit, logs, incidents, cooperation and exit.
9. Integrate the AI review with GDPR, employment, consumer, intellectual-property, confidentiality and sector requirements.
10. Verify the final Romanian competent-authority and penalty implementation framework before notification or regulator contact.
11. Assign an accountable business owner and legal escalation path for every material system.
12. Reassess systems after material updates, new use cases or changes in provider instructions.

The Bottom Line

The 2 August 2026 milestone is narrower than many early compliance plans assumed, but it is not optional. Article 50 transparency controls must work, prohibited uses must remain excluded, and AI literacy must be demonstrable. The AI Omnibus gives companies additional time for the high-risk regime; it does not remove the need to classify HR and other Annex III systems, secure vendor evidence and build human oversight.

A targeted legal review can map the group’s roles, identify the controls required now and convert the 2027 high-risk deadline into a procurement and governance plan.