AI due diligence checklist for foreign investors assessing a Romanian company

Foreign investment • AI governance • Romania

AI due diligence in Romania asks whether a target company’s AI use, data, contracts and public claims support the investment case. It is not a technical demonstration of a model and it is not a generic AI policy review. For a buyer, investor or lender, the question is whether the target has identified the systems it uses, can lawfully operate them, owns or can use the assets it relies on, and has a credible plan for the risks that will remain after closing.

What is AI due diligence in a Romanian transaction?

AI due diligence is a transaction-focused legal and commercial review. It identifies whether the target’s use of AI creates liabilities, restrictions, missing rights or implementation costs that could affect price, risk allocation or post-closing operations.

For a Romanian target, the review should cover the target’s Romanian operations and any AI outputs used in the European Union. The EU AI Act is directly applicable across the EU and operates alongside the GDPR where personal data is processed. A seller’s statement that it uses only a third-party AI tool does not end the inquiry: the target may still be a deployer, customer, controller, employer or regulated business with its own duties.

This guide has a different purpose from our analysis of AI vendor contracts in Romania, which focuses on the agreement with a supplier, and from DPIA vs FRIA in Romania, which focuses on assessment triggers for a deployment. Here, the investor is deciding what must be verified before, at and after a deal.

Start with the target’s actual AI footprint

Do not begin with a broad question such as “Does the company use AI?” Ask what system or model is used, for which decision, with which data, by whom, and whether the target sells, deploys, develops, fine-tunes or merely accesses the tool.

A useful data-room request separates customer-facing products from internal tools. It should identify models, APIs, software providers, hosting and cloud dependencies, integrations, datasets, prompts or knowledge bases, material outputs, users and the decisions influenced by each use case. The inventory should also record planned products or features that have not yet launched but are material to the investment thesis.

Deal-side navigator

Select a deal question to see the first evidence to request

Click or tap a card. Keyboard users can Tab to a card and press Enter or Space. Each selection stays visible until you choose another one.

Business model and footprint

Request a system inventory, product descriptions, roadmaps, supplier contracts, architecture summary and evidence of the target’s material AI claims. Compare marketing language with the technology and operating model actually in use.

Which legal and commercial issues should an investor test?

Click or tap a row to highlight the diligence takeaway. On a small screen, swipe the table sideways.

AI due diligence matrix for a Romanian target
Review area	What to test	Possible deal response
	Whether the target’s product, sales material and internal inventory describe the same systems, functions, limits and dependencies.	Correct the diligence scope, ask for technical confirmation and qualify representations that are broader than the evidence.
	Whether a use case may be prohibited, high-risk, subject to transparency rules or linked to a general-purpose AI model supply chain.	Obtain a classification record, identify compliance timing and budget for any remediation or implementation work.
	Data flows, controller/processor roles, legal bases, Article 22 issues, DPIA screening, security measures and cross-border transfers.	Require a privacy remediation plan, review the DPA and test whether the target can continue the relevant processing after closing.
	Whether datasets, prompts, files or customer information may lawfully be used for development, fine-tuning, testing or supplier improvement.	Limit or stop impermissible use, obtain consents or contractual permissions where appropriate, and reserve a specific risk allocation.
	Ownership and licences for software, open-source components, models, training materials, brand assets, output and third-party claims.	Confirm chain of title, address licence conflicts and tailor warranties or indemnities to the assets that support the valuation.
	Model, cloud and subprocessor dependencies, location, termination, audit evidence, model changes and service continuity.	Seek consent, amendment, transition assistance or a post-closing migration plan if a dependency cannot support the buyer’s intended use.
	Policies, ownership, AI literacy, logs, testing, monitoring, incident response, complaint handling and escalation records.	Set a post-closing governance plan with owners, deadlines and evidence requirements rather than relying on a generic policy.

The European Commission describes the AI Act as a risk-based framework for developers and deployers. It identifies employment, credit scoring and access to essential services among the examples that may be high-risk. See the Commission’s AI Act overview and application timetable.

AI Act review: classify before you value the risk

Do not treat “AI Act compliant” as a sufficient diligence answer. Contractual, sector-specific, data-protection and AI Act obligations must be assessed separately. The investor should identify the system, its intended purpose, the target’s role and the rules that apply now or later. The relevant date can affect both risk allocation and integration planning.

The AI Act’s prohibitions, AI literacy obligations, governance rules, GPAI-model obligations and transparency rules have different application dates from the rules for high-risk systems. The Commission states that Annex III high-risk use cases, including employment and credit-scoring examples, are scheduled to apply from 2 December 2027, while high-risk systems embedded in regulated products have a later date of 2 August 2028. A diligence report should distinguish obligations already applicable from future obligations that could require a funded implementation plan. At the time of publication, the applicable AI Act timetable should be verified against the latest EU legislation and implementation guidance, including the official AI Act Service Desk timeline.

The analysis should also ask whether the target is developing an AI system, placing it on the market, deploying it in its own business, importing it, distributing it or using a third-party service. These labels are not interchangeable with GDPR controller and processor roles. For the contract-facing part of that review, see AI Vendor Contracts in Romania.

GDPR and data review: look beyond the privacy policy

The decisive question is what happens to personal data at each stage of the AI lifecycle. A target may process personal data in training, testing, deployment, monitoring, logs, prompts, support and human review, even where the product is marketed as automated or anonymised.

The review should map the data categories, purposes, retention, recipients, access, transfer mechanisms and contractual roles. Where the use involves profiling, recruitment, credit, insurance, pricing or decisions that may significantly affect individuals, check the actual decision flow and safeguards rather than relying on a generic human-review statement. Article 35 GDPR requires a DPIA where processing is likely to result in a high risk to the rights and freedoms of natural persons; Article 22 has separate rules for certain solely automated decisions.

The European Data Protection Board has also confirmed that the anonymity of an AI model trained with personal data must be assessed case by case. That matters for a target relying on a statement that a model, dataset or output is anonymous. Read EDPB Opinion 28/2024. For the broader framework, see our guide to GDPR compliance when using AI in Romania.

Data, intellectual property and contract rights

AI value is often dependent on rights that sit outside the target’s own code. The investor should trace the legal basis for using data, third-party models, cloud infrastructure, open-source components, output and confidential information.

Review the complete contract suite, not only the signed master agreement. Order forms, online terms, acceptable-use policies, data-processing agreements, security schedules, open-source notices and API terms can all affect the target’s rights. In particular, check whether a provider can use customer or target data for model training, whether the provider can change the model or service unilaterally, and whether the target can export its data and configurations on exit.

Ownership language for AI-generated output should be read carefully. A contractual promise may create a licence or allocation between the parties, but it does not necessarily guarantee exclusivity or copyright protection in every output. The copyright status of AI-generated content may vary depending on the level of human creative input and the applicable jurisdiction. The review should identify the use the target needs to make of the output and whether third-party rights, human authorship requirements, confidentiality or contractual restrictions could limit that use.

What should the investor request in the data room?

Request a current AI inventory. Include internal tools, customer-facing products, models, APIs, plugins, fine-tuning, integrations and material planned features.
Obtain a use-case map. Record intended purpose, users, affected people, decisions, data inputs, outputs, human review and country of deployment.
Collect AI governance records. Ask for role assessments, policies, training records, system documentation, risk logs, testing, monitoring and incident procedures.
Review AI Act screening. Identify prohibited practices, potential high-risk systems, transparency obligations, GPAI dependencies and the applicable timetable.
Map personal-data processing. Review privacy notices, legal bases, Article 22 analysis, DPIAs, processor arrangements, security controls and transfers.
Trace data rights. Check source, licence, consent or other permission for data used in development, testing, fine-tuning and ongoing service delivery.
Review the contract stack. Read supplier, customer, cloud, API, DPA, security, outsourcing and change-control documents together.
Confirm IP and open-source position. Request code provenance, licences, notices, ownership assignments, third-party claims and output-use restrictions.
Test material statements. Compare product marketing, investor materials and customer commitments against the available technical and legal evidence.
Assign the deal response. Separate issues requiring price, warranty, indemnity, condition, remediation, disclosure or post-closing integration action.

How should findings affect the transaction documents?

Translate each material finding into an owner, timing and remedy. A diligence report is useful only if the SPA, investment agreement, disclosure process and integration plan reflect the issues that have been identified.

The appropriate response will depend on the transaction structure and the seller’s ability to remediate. A buyer may need targeted warranties concerning data rights, AI-related regulatory compliance, ownership, contract compliance, absence of claims or material incidents. Confirmed gaps may justify a specific indemnity, a pre-closing remediation covenant, a post-closing plan, a condition or a tailored disclosure. The drafting should not assume that a general compliance warranty captures the actual issue.

Post-closing planning is equally important where the buyer will integrate systems, move data, introduce a new group policy, change suppliers or expand the target’s use case. These changes can alter the GDPR and AI Act analysis. If an assessment is required, the timing should be addressed before the relevant processing or deployment begins. Our DPIA vs FRIA guide explains why those two assessment routes must be screened separately.

When does a separate specialist review become necessary?

A focused AI legal review should be coordinated with corporate, technical, information-security, employment and commercial due diligence when the target develops AI products, relies on proprietary datasets, makes regulated-sector decisions, uses AI in recruitment or credit processes, processes sensitive personal data, markets compliance claims, or has important dependencies on a small number of providers. The workstreams should share the same factual inventory, but each should retain its own legal questions and conclusions.

How Atrium Romanian Lawyers can assist

Atrium Romanian Lawyers can coordinate the legal workstream for AI-related due diligence in a Romanian investment, acquisition or internal reorganisation. The review can cover AI Act role and use-case screening, GDPR and data-contract questions, supplier and customer terms, intellectual property, employment and operational governance, and the translation of findings into transaction documents or an integration plan.

Client experience

AI due diligence during the acquisition of a Romanian technology company

An international investor considered acquiring a Romanian technology company that relied extensively on AI-enabled software products and third-party AI services.

During the due diligence process, the buyer requested confirmation regarding AI Act compliance, data rights, intellectual-property ownership and the target’s dependencies on external AI providers.

The review identified gaps between the target’s public marketing materials and its internal documentation, uncertainties regarding the scope of rights over certain datasets, and contractual limitations affecting the use of third-party AI services after closing.

Atrium Romanian Lawyers coordinated the legal review of the AI use cases, supplier contracts, GDPR implications and intellectual-property position. The findings were translated into targeted warranties, disclosure items and a post-closing remediation plan.

The transaction proceeded with a clearer allocation of regulatory, contractual and operational risks and with a structured roadmap for post-closing compliance measures.

This example has been anonymised and simplified for publication. The appropriate legal analysis depends on the system, data, contract structure and facts of each matter.

Book a Consultation Digital & Tech Law Services

Frequently asked questions

Does every investment in a Romanian company need AI due diligence?

No. The scope should be proportionate to the target’s actual use of AI and the importance of that use to the transaction. A company using a limited internal tool may require a focused review. A target selling AI-enabled products, using sensitive data or making decisions affecting people may need a deeper legal and technical workstream.

Is AI due diligence the same as an AI Act compliance audit?

No. AI Act compliance is one part of the review. Transaction diligence also considers ownership, licences, customer commitments, personal data, confidentiality, technical dependencies, product claims, change control and what the buyer will need after closing. The correct scope follows the investment thesis and the target’s operating reality.

Can a seller rely on a supplier’s AI compliance statement?

Supplier information can be relevant evidence, but it does not by itself establish that the target’s own deployment is compliant. The investor should check whether the statement identifies the actual system, model, purpose, data, users, territory, contract terms and responsibilities relevant to the target’s use case.

Should a buyer ask for the target’s DPIAs?

Where the target operates AI systems involving personal data and has conducted or screened for a DPIA, the relevant material should be reviewed subject to confidentiality controls. The question is not simply whether a document exists, but whether it reflects the current processing, risks, safeguards, changes and any residual issues requiring follow-up.

Can AI findings be addressed after closing?

Sometimes. The decision depends on the nature of the issue, legal exposure, urgency, operational dependency and the buyer’s ability to control remediation. A defensible post-closing plan should identify the owner, evidence, budget, deadlines and the effect on continued use. Some issues may need to be resolved before closing or before a planned deployment.

What is the most common gap in AI diligence?

A frequent gap is that the target has a high-level AI policy or vendor contract but no reliable inventory linking systems, use cases, data, roles, evidence and decision owners. The first practical step is usually to build that factual map before drawing legal conclusions or negotiating transaction protection.

DPIA and FRIA assessment paths for an AI project in Romania

21Sep

DPIA vs FRIA in Romania: Which Assessment Does Your AI Project Need?

by Simona Rotaru Digital Law

AI governance • Romania • Assessment decisions

DPIA vs FRIA in Romania is a question of two different legal tests. A data protection impact assessment (DPIA) addresses risks arising from personal-data processing under the GDPR. A fundamental rights impact assessment (FRIA) under the AI Act applies to specified deployers of certain high-risk AI systems. Your project may require one, both, or neither mandatory assessment.

When do these obligations apply?

The GDPR assessment requirements already apply. Under the AI Act’s consolidated timetable, Chapter III Sections 1–3, including Article 27, apply to Annex III high-risk systems from 2 December 2027. The corresponding date for Article 6(1)/Annex I product systems is 2 August 2028; that does not extend Article 27 to every product system.

Article 111 contains separate transition provisions for existing systems. A project review should record when the system was placed on the market or put into service and whether subsequent design changes affect its treatment. The future FRIA timetable does not postpone GDPR duties. Source: consolidated AI Act, Articles 111 and 113.

DPIA vs FRIA: the differences that change your project

Both assessments examine potential harm to people. A DPIA is not limited to confidentiality or cybersecurity: it also examines other rights and freedoms affected by personal-data processing. FRIA addresses the impact of the specified AI deployment on fundamental rights.

Click or tap a row to reveal its practical takeaway. Keyboard users: Tab to a green label and press Enter or Space. Swipe the table sideways on a small screen.

Two assessments, separate applicability tests
Decision point	DPIA: GDPR Article 35	FRIA: AI Act Article 27
	Personal-data processing likely to create high risks to individuals, assessed in its context.	A covered deployer using an in-scope Article 6(2)/Annex III high-risk system.
	The controller, with DPO advice where a DPO is designated and relevant processor assistance.	The deployer covered by Article 27.
	Processing, necessity, proportionality, risks to people and safeguards.	Deployment context, affected groups, risks of harm, human oversight and responses.
	Before the relevant processing begins; review when risk changes.	Before first use where the obligation applies; update changed or outdated elements.
	Prior consultation when the Article 36 threshold is met; no universal filing requirement for every DPIA.	Notify results to the market surveillance authority under Article 27(3), subject to its exception.
	Shared evidence can support the assessment of the actual processing.	Relevant DPIA sections may be cross-referenced or incorporated; remaining requirements still need coverage.

GDPR Articles 28, 35–36 and 39; AI Act Article 27.

When does an AI project need a DPIA?

AI use alone does not automatically trigger a DPIA. The controller must assess whether the nature, scope, context and purposes of the processing make a high risk to people likely. Article 35 expressly recognises the relevance of new technologies.

The GDPR identifies particular situations, including systematic and extensive automated evaluation underpinning decisions with legal or similarly significant effects, large-scale processing of special-category or criminal-offence data, and large-scale systematic monitoring of publicly accessible areas. Applicable supervisory-authority lists must also be checked.

For a Romanian deployment, the file should therefore address the applicable requirements and guidance of the Romanian data protection authority, ANSPDCP, alongside Article 35. Record the reasons for a negative screening conclusion too. A supplier’s description of a product as “low risk” is not an assessment of your processing.

Where required, the DPIA must describe the processing and purposes, assess necessity and proportionality, evaluate risks to individuals and specify safeguards. This is a substantive project assessment, not simply a signed template. Source: GDPR Article 35.

For the broader data-protection framework, see our guide to GDPR compliance when using AI in Romania.

Who needs a FRIA under the AI Act?

The Article 27 obligation does not cover every business using high-risk AI. It concerns Article 6(2) high-risk systems and specified categories of deployer, with an exclusion for the critical-infrastructure area in Annex III point 2.

Bodies governed by public law deploying qualifying systems.
Private entities providing public services deploying qualifying systems. This status requires analysis; it is not synonymous with every company selling services to the public.
Deployers of qualifying creditworthiness or credit-scoring systems for natural persons under Annex III point 5(b), which excludes systems used to detect financial fraud.
Deployers of qualifying life and health insurance risk-assessment or pricing systems for natural persons under Annex III point 5(c).

Classification under Article 6 must be checked first, including the conditions of any applicable exception. The exact intended purpose matters. A financial-sector tool is not automatically a creditworthiness system, and a medical product is not automatically within the Article 27 FRIA route. Source: AI Act Articles 6 and 27 and Annex III.

Explore four deployment scenarios

These hypothetical examples explain the screening logic. They assume the stated facts and do not replace an assessment of the actual system, applicable dates or transition rules.

Candidate ranking: DPIA and FRIA can diverge

A private manufacturer uses extensive automated applicant evaluation to support hiring decisions. These facts point to a DPIA requirement under Article 35(3)(a), even if a person makes the final decision. Recruitment may also fall within Annex III. However, on the assumption that the manufacturer is neither a public-law body nor a private public-service provider, its employer status alone does not trigger Article 27 FRIA.

Consumer credit: prepare for both assessments

A lender uses an in-scope high-risk system to score individuals for loan eligibility. Systematic and extensive profiling with significant consequences can trigger a DPIA. Article 27 separately covers qualifying deployers under Annex III point 5(b). Address the applicable FRIA timetable and any transition provisions, rather than assuming both duties started on the same date.

Public benefits: assess deployment and processing together

A public body uses a qualifying high-risk system to assess eligibility for essential assistance benefits. Its status and use case bring Article 27 into the analysis. The personal-data processing needs separate DPIA screening, including relevant public-task legislation and any Article 35(10) position. One completed assessment does not automatically discharge the other.

Drafting assistant: examine the actual workflow

A team drafts generic product descriptions without personal data or decisions about people. On those narrow facts, the workflow does not itself establish a DPIA or Article 27 FRIA requirement. Check account data, logs and supplier processing separately. Introducing customer records, employee evaluation or regulated decisions changes the analysis. Other duties may still apply.

Can one assessment document cover DPIA and FRIA?

A coordinated file can reduce duplicated work, provided each legal requirement remains identifiable. The consolidated Article 27(4) expressly allows relevant DPIA sections to be cross-referenced or incorporated into FRIA where they already meet the corresponding obligations.

Start with a shared description of the system, purposes, data flows, affected people and safeguards. Then keep a requirement map showing which sections satisfy GDPR Article 35 and which satisfy AI Act Article 27. Identify gaps rather than renaming a DPIA “FRIA”. Source: AI Act Article 27(4)–(5).

As a practical drafting approach, include a separate deployment chapter addressing who may be affected beyond the immediate users, how mistakes influence access to opportunities or services, who can intervene, and how complaints lead to corrective action. Avoid treating GDPR as only a privacy checklist: the DPIA itself must consider risks to rights and freedoms.

What the FRIA needs to address

Article 27 requires the deployment process and intended use, duration and frequency, affected people and groups, specific risks of harm, implementation of human oversight, and measures if risks materialise, including governance and complaint mechanisms. Reusing a supplier assessment in similar cases is permitted, but the deployer must check its fit and update changed or outdated elements. Source: AI Act Article 27(1)–(2).

Who prepares, reviews and owns the decision?

The controller remains responsible for the DPIA; the covered deployer remains responsible for FRIA. A consultant, DPO or supplier can contribute without taking over the organisation’s statutory role.

For the DPIA, seek the designated DPO’s advice and preserve their independent advisory and monitoring function. Obtain relevant processor assistance. For the deployment review, involve the business owner, technical team and people responsible for oversight and complaints. A useful internal decision records outstanding conditions, the person accountable for each safeguard and the circumstances requiring a fresh review. Source: GDPR Articles 28(3)(f), 35(2) and 39; AI Act Article 27.

Contractual cooperation should cover the evidence you need to assess the deployment. Our AI vendor contracts guide addresses information rights, changes and supplier responsibilities.

Must the assessment be sent to an authority?

A DPIA and a FRIA follow different authority procedures. Under GDPR Article 36, prior consultation is required where high residual risk remains that cannot be sufficiently mitigated. There is no general GDPR obligation to submit every DPIA for approval.

Article 27(3) provides for notification of FRIA results to the market surveillance authority using the relevant template, subject to the Article 46(1) exception. That notification is not the GDPR prior-consultation procedure and should not be described as automatic permission to deploy. Confirm the competent authority and operational submission arrangements for the specific deployment. GDPR Article 36; AI Act Article 27(3).

A practical assessment file before deployment

Define the use case. Identify the system, version, intended purpose, users, affected people and decisions it informs.
Map roles separately. Record GDPR controller/processor roles and the relevant AI Act roles.
Screen the legal route. Check prohibited practices, AI classification, DPIA triggers and Article 27 deployer coverage.
Record timing. Distinguish existing GDPR duties from future AI Act requirements and applicable transition provisions.
Collect evidence. Obtain data-flow information, supplier instructions, meaningful performance limitations, oversight arrangements and relevant testing.
Assess harms and safeguards. Describe how the actual deployment may affect people and how controls reduce those risks.
Map shared sections. Make each DPIA and FRIA requirement traceable, retaining any necessary separate analysis.
Resolve escalation. Identify prior consultation, notification, unresolved risks and conditions preventing launch.
Assign review triggers. Consider changes in purpose, model, data, affected groups or decision authority, and evidence from incidents or complaints.

How Atrium Romanian Lawyers Assisted an International Manufacturing Group

Anonymised client matter. The description below omits identifying information and focuses on the legal work performed.

Questions examined

Whether the candidate-data processing required a DPIA;
Whether the use of the system could trigger a FRIA under the AI Act;
What human-oversight and documentation measures were needed before implementation.

Legal analysis

Our review of the recruitment process identified extensive automated evaluations of candidates with a significant impact on access to employment opportunities. The company therefore decided to complete a DPIA before implementation.

We also carried out a separate analysis of the system’s classification under the AI Act, including the organisation’s status and the obligations applicable to the deployer. The review confirmed that the DPIA and any FRIA analysis had to be treated separately because their legal triggers differ.

Measures adopted

Documentation of the decision logic and system limitations;
Mandatory stages of human verification;
Internal procedures for challenging results and handling complaints;
Updated contractual documentation and AI-governance workflows.

Practical result

Following the project, the company was able to continue the implementation on the basis of stronger documentation concerning compliance and risk management.

A focused consultation can clarify which assessment route applies and what your team needs before making deployment commitments.

Book a Consultation Data Protection Services

Frequently asked questions

Does every AI project need both a DPIA and a FRIA?

No. Screen personal-data processing under GDPR Article 35 and, separately, the system and deployer under AI Act Article 27. One assessment may be mandatory while the other is not. A negative screening result does not remove other applicable legal obligations.

Does human review remove the need for a DPIA?

Not automatically. Article 35 has its own risk test, and its automated-evaluation category is not confined to solely automated decisions. Genuine human oversight can affect risks and safeguards, but a human signature does not by itself settle DPIA applicability.

Does a private employer need a statutory FRIA for recruitment AI?

Not solely because it is an employer using high-risk recruitment AI. Article 27 covers specified deployers and uses. Check whether the organisation is a public-law body or private public-service provider, while independently assessing its GDPR and other AI Act obligations.

Can we rely on the supplier’s impact assessment?

Supplier evidence can support the work, and Article 27 permits reliance on existing assessments in similar cases. The organisation still needs to check whether the document addresses its actual deployment, affected groups, safeguards and applicable obligations. A generic assurance is insufficient evidence of that fit.

Can we wait until the FRIA application date to conduct a DPIA?

No, if GDPR already requires a DPIA for the proposed processing. The DPIA must precede that processing. The AI Act timetable and transition provisions must be analysed separately and do not suspend GDPR requirements.

Does completing an assessment authorise the project?

No. An assessment documents analysis and safeguards; it does not supply a missing legal basis, legalise prohibited AI or override unresolved legal restrictions. Complete any required consultation or notification procedure and resolve conditions that prevent lawful deployment.

AI vendor contracts in Romania under the EU AI Act and GDPR

18Sep

AI Vendor Contracts in Romania: EU AI Act and GDPR Clauses

by Simona Rotaru Contract Law, Data Protection, Digital Law

An AI vendor contract should do more than grant access to a platform. It should identify the system and intended use, allocate regulatory roles, control the use of business and personal data, preserve evidence, set performance and security obligations, and provide a workable exit if the supplier, model or law changes.

Key points for companies buying AI services in Romania:

Classify the AI use and the parties’ roles before negotiating warranties and liability.
Do not assume that a standard SaaS agreement or a GDPR DPA covers AI-specific risk.
State whether prompts, files, outputs and usage data may be retained or used for training.
Require enough information, logs and cooperation to meet the customer’s own legal duties.
Connect service changes, security incidents and regulatory events to notice, remediation and exit rights.

This guide is intended for Romanian companies, foreign groups operating in Romania, technology suppliers, procurement teams and businesses implementing generative or other AI tools. It focuses on contract structure. For the wider regulatory framework, read our EU AI Act guide for foreign companies.

Why does an AI vendor contract need a separate review?

AI services can change after signature. A supplier may replace a model, add a subprocessor, change data-retention settings, modify safety controls or alter the geographic delivery chain. Outputs may also be probabilistic rather than repeatable. These features create risks that are not fully addressed by ordinary clauses on software access, uptime and confidentiality.

The EU AI Act allocates obligations according to the system, risk category and operator role. The GDPR applies in parallel where personal data is processed. The contract cannot transfer away statutory responsibility, but it can secure the information, instructions, evidence and cooperation needed for each party to perform its own obligations.

Practical distinction: the AI Act analysis, the GDPR role analysis and the commercial allocation of risk are related but separate. A supplier described as a “provider” under the AI Act is not automatically a “processor” under the GDPR.

Start with the AI use, not the vendor’s template

Before redlining the agreement, the customer should record what the system will do, whose decisions it will influence, what data enters the system, who receives the output and whether the tool will be integrated into employment, credit, insurance, education, essential services, biometric or other sensitive workflows. The same product can create different legal exposure when deployed for a different purpose.

Contract navigator

Build the AI contract in five connected layers

Select a layer to see the question that should be answered before signature.

System and intended use

Identify the product, model, version, functions, integrations, users, prohibited uses and decision context. Classification begins with the actual deployment.

AI vendor due diligence before contract negotiation

A customer cannot negotiate intelligently without basic information about the service. The due-diligence request should be proportionate to the use and risk, but it commonly covers:

the legal entity supplying the service and the entities supporting it;
the model or models used, hosting locations and material third-party dependencies;
the intended purpose, known limitations and prohibited uses;
data sources, retention rules and whether customer data is used for training or improvement;
security controls, incident history, business continuity and disaster recovery;
testing, accuracy or performance information relevant to the deployment;
subcontractors, subprocessors and international data transfers; and
the supplier’s process for regulatory requests, complaints, audit evidence and system changes.

For high-risk deployments, the customer may require contractual access to sufficient documentation, instructions, logs and compliance information to enable it to perform its own obligations under the AI Act. The scope of access should reflect the parties’ respective roles and may need to protect the supplier’s trade secrets and intellectual-property rights. The European Commission’s AI Act information page and its AI Act Service Desk are useful starting points, but the contract must still reflect the particular system and transaction.

What if the service relies on a general-purpose AI model?

Where the service relies on a general-purpose AI model, the customer should also consider whether contractual information rights are needed regarding the model provider, model updates, transparency documentation and downstream restrictions affecting the deployment. These provisions should be tailored to the customer’s position in the AI value chain and should not imply that the customer is entitled to the provider’s complete technical documentation.

What clauses should an AI vendor agreement contain?

Contract layer	What the clause should resolve	Risk if unclear
System and permitted use	Product, model, version, functionality, users, integrations, territories, intended purpose and prohibited uses.	The service is used outside its tested or agreed purpose.
Regulatory roles	AI Act operator roles, GDPR roles, responsibility matrix and cooperation duties.	Each party assumes the other will supply evidence or perform a mandatory task.
Data and training	Permitted inputs, retention, model training, improvement, isolation, deletion and export.	Confidential or personal data is retained or reused beyond the customer’s expectation.
Performance and oversight	Relevant metrics, limitations, testing, human review, logs, notices and remediation.	Outputs cannot be evaluated, challenged or reconstructed when a problem occurs.
Security and incidents	Technical measures, vulnerability management, notification triggers, timing and cooperation.	The customer learns too late or receives too little information to respond lawfully.
IP and output rights	Rights in inputs, outputs, configurations, documentation, feedback and third-party materials.	The customer lacks the rights needed for its intended commercial use.
Change control	Notice of model, policy, subprocessor, location and functionality changes, plus testing and objection rights.	A compliant deployment becomes materially different during the contract.
Liability and exit	Warranties, indemnities, caps, insurance, suspension, termination, transition, export and deletion.	The remedy is commercially unusable when the service fails or must be withdrawn.

Click a row, or focus it and press Enter, to highlight one negotiation layer.

1. Define the system, version and intended purpose

The agreement should identify what is actually being supplied. “AI services” is rarely sufficient. The specification should address the model or service version, functions, interfaces, customer environment, authorised users, territories, dependencies and intended use. If classification or performance depends on a specific configuration, that configuration should be documented.

2. Allocate AI Act and GDPR roles separately

The parties should record their assumed roles under the AI Act and set out who provides instructions, documentation, logs, notices and regulatory cooperation. A separate analysis is required under the GDPR. Depending on the facts, the parties may be controller and processor, independent controllers or, in a narrower class of cases, joint controllers.

Where the supplier processes personal data on the customer’s behalf, Article 28 GDPR terms may be required. See our dedicated guide to the Data Processing Agreement in Romania. The DPA should not be treated as the complete AI contract, and the main agreement should not conflict with it.

3. Control prompts, files, outputs and training use

The contract should distinguish customer content, personal data, telemetry, feedback and output. It should state whether each category may be stored, reviewed by humans, used to improve the service or used to train a shared model. Where “no training” is promised, the clause should explain its scope, including whether safety review, abuse monitoring or service analytics remain permitted.

The European Data Protection Board has emphasised that whether an AI model is anonymous must be assessed case by case. A supplier’s assertion that its model is anonymous should therefore be supported by facts rather than accepted as a label. See the EDPB’s summary of Opinion 28/2024.

4. Make performance, limitations and human oversight usable

Conventional uptime metrics do not measure output quality. Depending on the use, the contract may need agreed tests, documented limitations, error reporting, performance monitoring, bias or drift controls, escalation and human-review requirements. The AI Act’s accuracy requirements should not be treated as a guarantee of error-free outputs. Any contractual accuracy or performance commitment should define the relevant task, dataset, test method, threshold and remedy.

5. Require evidence and audit cooperation

The customer may need records to complete an impact assessment, answer a regulator, investigate a complaint or demonstrate human oversight. The agreement should define which information is available, in what format, how quickly and subject to what confidentiality protections. In practice, enterprise suppliers may satisfy some audit requirements through independent certifications, reports and controlled information-sharing mechanisms rather than unrestricted customer audits. Those materials can support due diligence, but they do not automatically answer system-specific questions.

6. Coordinate security and incident notification

Security clauses should address access controls, encryption where appropriate, vulnerability management, segregation, personnel access, business continuity and incident cooperation. Notification should be triggered by defined events and delivered early enough for the customer to meet its own legal and operational duties. Different events may activate different regimes, so a personal-data breach, an incident affecting the AI system and an ordinary service outage should not be collapsed into one undefined term.

7. Address intellectual property and third-party claims

The contract should distinguish rights in customer inputs, supplier technology, configurations, fine-tuning, documentation, feedback and outputs. It should also allocate responsibility for claims involving training material, output, trademarks, confidential information and third-party components. Broad statements that the customer “owns the output” may be insufficient if the supplier cannot grant exclusivity or if protectability depends on applicable law and human contribution. Ownership language should be assessed together with applicable copyright rules, which may require sufficient human authorship for copyright protection.

8. Control subcontractors, subprocessors and model dependencies

An AI service may depend on model providers, cloud infrastructure, safety services and specialist subprocessors. The contract should identify the relevant chain, require notice of material changes and preserve appropriate objection or termination rights. For personal data, the subprocessor mechanism must align with Article 28 GDPR and any applicable international-transfer safeguards.

9. Regulate model and policy changes

Suppliers often reserve broad rights to modify models, acceptable-use policies and technical features. The customer should seek prior notice of material changes, enough information to reassess the deployment and a remedy when a change materially reduces functionality, alters data use, affects compliance or creates an unacceptable risk.

10. Connect liability to the risks that matter

Liability provisions should be read together with warranties, indemnities, insurance and remedies. A general cap may be commercially unsuitable for confidentiality breaches, unlawful data use, IP claims or deliberate misconduct, while unlimited liability for every model error may be unacceptable to a supplier, particularly where outputs remain subject to human review. The negotiated position should reflect control, foreseeability, fees, insurance and the consequences of the intended use.

11. Preserve suspension, termination and transition rights

The contract should explain what happens if the service becomes prohibited, materially non-compliant, insecure or unsuitable for the agreed purpose. Exit terms should cover data and prompt export, configuration records, transition assistance, continuing access where necessary, deletion, certification and surviving confidentiality or audit duties.

12. Align the whole contract suite

The main agreement, order form, specification, DPA, security schedule, service levels and online policies should be checked together. An order of precedence is important where one document allows training while another prohibits it, or where a linked policy can be changed unilaterally. Our broader contract review checklist explains the commercial clauses that remain relevant alongside the AI-specific controls.

Customer and supplier priorities are not identical

A customer usually seeks transparency, stable functionality, control of its data, evidence for compliance and practical exit rights. A supplier needs a defined intended use, customer cooperation, restrictions against misuse, protection for reusable technology and a liability position proportionate to fees and control. A balanced contract should not hide this tension. It should identify which party can prevent, detect and remedy each risk.

Practical experience: how Atrium approaches an AI contract review

A typical client mandate begins with the operating facts, not a generic AI checklist. Atrium Romanian Lawyers first maps the proposed use, data flows, parties, model dependencies and decisions affected by the tool. We then review the full contract suite, identify provisions that do not match the deployment and separate mandatory compliance points from negotiable commercial risk.

The work may include a priority risk report, tracked changes, replacement clauses and a negotiation list for the business and technical teams. Particular attention is given to training rights, confidentiality, GDPR roles, security incidents, documentation, model changes, intellectual property, liability and exit. This section describes our review method and does not disclose any client’s confidential facts.

AI vendor contract checklist before signature

Document the system, intended use, users and decision context.
Complete the AI Act role assessment and determine whether the deployment may involve prohibited, high-risk, transparency or other regulated AI use cases.
Map personal data, confidential information and international transfers.
Collect the main agreement, order, DPA, security schedule and linked policies.
Confirm whether customer data, prompts or outputs may be used for training.
Test whether supplier documentation supports the customer’s compliance duties.
Define relevant performance measures, limitations and human oversight.
Align incident notification with legal and operational deadlines.
Review IP ownership, licences, third-party material and claims.
Control material changes to models, policies, locations and subcontractors.
Model liability for realistic failure scenarios.
Plan suspension, export, transition and deletion before deployment begins.

Frequently asked questions

Does every AI vendor contract need a GDPR DPA?

No. A DPA is required where the factual relationship meets the controller-processor conditions under Article 28 GDPR. Other arrangements may involve independent or joint controllers. The roles should be assessed from the actual processing, not only from the labels in the contract.

Can an AI supplier use customer prompts to train its model?

That depends on the contract, product settings, supplier role, transparency and applicable data-protection and confidentiality rules. The agreement should state clearly which data may be used, for what purpose, for how long and whether an effective opt-out or enterprise isolation applies.

Does an AI Act clause transfer compliance responsibility to the supplier?

No. A contract can allocate tasks, information duties, warranties and remedies, but it cannot remove statutory obligations imposed on a party by law. Each operator should understand and perform the duties attached to its own role.

Should the contract name the underlying AI model?

Usually, the system and relevant dependencies should be described with enough precision to understand what is being supplied. If the supplier may change the underlying model, the contract should address notice, testing, material degradation, data implications and the customer’s available remedies.

Who owns AI-generated output?

The answer depends on the contract, the output, applicable intellectual-property law, human contribution and third-party material. The agreement should distinguish ownership from a licence to use and should address infringement claims and supplier restrictions.

Can a Romanian lawyer review a foreign vendor’s English-language AI contract?

Yes, where the agreement concerns a Romanian company, Romanian operations or applicable EU and Romanian requirements. The scope should identify whether separate advice is needed for clauses governed exclusively by another country’s law.

Negotiating an AI vendor contract connected with Romania?

Atrium Romanian Lawyers assists customers and technology suppliers with AI, SaaS and IT contract review, drafting and negotiation, including GDPR, security, intellectual-property, liability and exit provisions.

Discuss the contract with a Romanian lawyer

Disclaimer: This article provides general information and does not constitute legal advice. The appropriate contract and compliance analysis depends on the system, intended use, data, parties, operator roles, applicable law and complete contract suite.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.

Two corporate professionals reviewing AI transparency controls, compliance dashboards, and synthetic content verification tools on screens in an office setting.

1Aug

EU AI Act in Romania: 2026 Guide for Foreign Companies

by Simona Rotaru Digital Law

Artificial intelligence and digital regulation · 2026

EU AI Act in Romania: 2026 Guide for Foreign Companies

Foreign companies operating in Romania may be subject to the EU AI Act even when the parent company, vendor or development team is outside the European Union. This practical guide explains the scope rules, the obligations already applying in 2026, the later high-risk deadlines and the records a Romanian business should build now.

The analysis should be read together with the official AI Act text, the Commission’s AI Act implementation page and the current guidance available through the AI Act Service Desk.

What is the practical answer for a foreign company?

A Romanian subsidiary, branch or other local operation should begin with an inventory of the AI systems it provides, deploys, imports, distributes or uses for work. The company should then identify whether the system is prohibited, high-risk, subject to transparency duties, or outside the main AI Act obligations. The label used by the vendor is not decisive: the same tool may create different legal questions depending on its function, users, outputs and place of use.

Scope first

Map the Romanian entity, the foreign group, the provider, the deployer, the users and where the output is used. A foreign parent does not automatically remove EU exposure.

Article 2 analysis

Obligations now

AI literacy, prohibited-practice controls, GPAI-related obligations and the new transparency rules must be considered according to the applicable role and system.

2026 operating baseline

Evidence later

Keep an AI register, vendor file, training record, human-oversight process and incident route so the business can show how it reached its classification.

Governance that scales

Key point: the AI Act does not create a universal “AI officer” requirement for every Romanian business. Responsibility must be allocated in a way that fits the company’s systems, roles, risk profile and existing compliance structure.

AI Act timeline for companies operating in Romania

The original AI Act timetable has been supplemented by the Digital Omnibus on AI. The current implementation page of the European Commission identifies the dates below. A deadline table should be treated as a planning tool, not as a substitute for checking the final text and any sector-specific transition rule.

Completed1 August 2024
Entry into force

The Regulation entered into force. The legal framework began its transition period, while later provisions were scheduled to apply in stages.

Applied2 February 2025
Prohibitions and literacy

The prohibited-practice rules and the Article 4 AI-literacy obligation became applicable. Businesses should already have training and prohibited-use controls in place.

Applied2 August 2026
Transparency and supervision

Transparency obligations for certain AI systems, broader enforcement powers and the Commission’s AI Office and national authorities’ implementation work become operational.

Deferred2 December 2027
Selected high-risk uses

Following the Digital Omnibus, high-risk systems in sensitive Annex III areas, including employment, apply from this date. Product-embedded high-risk rules have a later transition.

Rule or milestone	Current application point	What the Romanian operation should do
Prohibited AI practices	Applied from 2 February 2025; an additional prohibition concerning certain non-consensual intimate or child sexual abuse material applies from 2 December 2026.	Screen use cases before procurement or deployment and escalate any practice that may manipulate, exploit, socially score or infer protected characteristics.
AI literacy	Applied from 2 February 2025 and enforced by national market-surveillance authorities from 2 August 2026.	Adopt role-based training and retain evidence of the measures taken, rather than relying on a generic awareness email.
Transparency rules	Applied from 2 August 2026 for the relevant Article 50 systems and outputs.	Review chatbot notices, synthetic-content marking, deepfake disclosures and the editorial process for public-interest text.
Annex III high-risk systems	Selected high-risk use cases, including employment, apply from 2 December 2027 after the Digital Omnibus transition.	Classify and plan early. The later date does not remove GDPR, employment, consumer or fundamental-rights duties that may apply now.
High-risk systems in regulated products	Extended transition until 2 August 2028 under the current Commission summary.	Coordinate product-safety, sectoral and AI Act analysis with the provider and any notified-body or conformity route.

The Commission’s current AI Act timeline identifies the staged dates and the changes introduced by the Digital Omnibus.

Does the AI Act apply to a foreign company operating in Romania?

Often, yes. The scope is not limited to companies incorporated in an EU Member State. The Regulation covers providers placing AI systems or general-purpose AI models on the Union market, deployers located in the Union, and providers or deployers in a third country where the output produced by the system is used in the Union. Importers, distributors, certain product manufacturers, authorised representatives and affected persons are also expressly addressed.

This creates several common patterns for international groups. A US or UK parent may provide a generative AI platform used by its Romanian subsidiary. A Romanian company may deploy a recruitment tool supplied by a vendor in another country. A group may centralise procurement and security while the local entity makes decisions affecting Romanian workers or customers. The legal analysis should identify each role instead of treating “the group” as a single operator.

Question 1Is the system used in the EU?

If the Romanian entity deploys the system, or its output is used in Romania or elsewhere in the Union, the scope analysis moves beyond the location of the parent company.

Question 2Who provides it?

Record the provider, importer, distributor, group company, authorised representative and vendor chain. Contract labels are useful evidence but do not replace the legal role analysis.

Question 3Who deploys it?

Identify the business unit that determines the purpose and use. The deployer may be the Romanian company, a foreign shared-service centre or another group entity depending on the facts.

Question 4Who is affected?

Employees, applicants, customers and other persons in the Union may be affected even when the technical processing or model hosting takes place outside Romania.

Do not rely on the hosting location alone: cloud hosting, a foreign parent or a vendor’s “EU AI Act compliant” statement does not by itself determine whether the Romanian entity has obligations.

Which AI uses should a Romanian company classify first?

A useful first inventory is operational rather than theoretical. Start with tools that make recommendations, rank people, generate customer-facing outputs, analyse sensitive information, control access to services or influence employment decisions. Include tools purchased by individual teams if company data or company accounts are used.

Business use	Why it needs early review	First evidence to collect
Recruitment, CV screening or candidate scoring	Employment and access-to-self-employment uses are listed in Annex III and may engage high-risk analysis once the relevant rules apply.	Vendor description, decision logic, data sources, human review and impact on applicants.
Employee monitoring, task allocation or performance evaluation	AI used to affect working relationships or monitor behaviour may fall within the employment category and also raise labour-law and GDPR questions.	Purpose, affected groups, indicators, decision owner, notice, consultation and challenge route.
Customer chatbot or voice assistant	Interactive systems may require a clear notice that the person is interacting with AI unless the interaction is obvious in context.	Interface screenshots, notice wording, escalation to a person and accessibility check.
AI-generated public-facing images, audio or text	Article 50 can require machine-readable marking or disclosure, subject to the relevant exception and content type.	Generation workflow, labelling method, human review, editorial responsibility and publication record.
Credit, insurance, access or eligibility decisions	Some essential private or public service uses are listed as high-risk and can intersect with anti-discrimination and sectoral rules.	Decision criteria, datasets, human oversight, explanation path and affected-person rights.

Do not classify a system only by the word “AI” in a sales brochure. Ask what the tool actually does, which people it affects, whether it generates or ranks content, whether it makes or supports a decision, and whether it is integrated into a regulated product. The Commission’s AI Act Service Desk provides tools and guidance that can support this initial assessment.

Which AI practices are prohibited?

The AI Act bans certain practices because their risks are considered unacceptable. Examples include harmful manipulation or deception, harmful exploitation of vulnerabilities, social scoring, certain forms of individual criminal-offence prediction, untargeted scraping to create facial-recognition databases, workplace or education emotion recognition, and biometric categorisation to infer protected characteristics, subject to the precise legal wording and exceptions.

For a foreign company with Romanian staff, the workplace emotion-recognition prohibition deserves particular attention. A vendor may market a “wellbeing”, “engagement” or “productivity” product without describing it as emotion recognition. The business should look at the functionality and the data signals used, not only the product name. The same applies to tools that claim to infer personality, intent, reliability or risk from communications.

Procurement gate

Require the business owner to describe the system’s purpose, data sources, affected people and output before purchase or activation.

Red-flag review

Escalate tools involving vulnerability exploitation, social scoring, biometric inference, emotion recognition or behavioural prediction.

Decision record

Record why the company concluded that a use is permitted, prohibited, outside scope or subject to another compliance route.

What transparency duties apply from 2 August 2026?

Article 50 covers specific interactions and outputs. A provider of an AI system intended to interact directly with natural persons must ensure that people are informed that they are interacting with an AI system unless this is obvious in context. Providers of systems generating synthetic audio, image, video or text must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, subject to the stated limits and exceptions.

Deployers have additional duties in defined situations. People exposed to emotion-recognition or biometric-categorisation systems must be informed. A deployer of an image, audio or video deepfake must disclose that the content was artificially generated or manipulated, subject to the artistic and other exceptions. Text generated or manipulated by AI and published to inform the public on matters of public interest must also be disclosed, but the obligation does not apply where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility.

This is why the website’s ordinary AI Notice and a public disclosure under Article 50 should not be treated as identical. An editorial footer may be useful transparency, but it does not automatically satisfy every machine-readable marking or user-facing notice requirement. Each workflow should be checked according to the system, output, audience and publication context.

Practical control: create a short content decision tree: AI-assisted editing, substantially generated content, deepfake or synthetic media, public-interest text, customer interaction. Assign the corresponding label, machine-readable marker, human review and approval record.

Does every AI-generated business article or image need a label?

No single answer applies to every output. The AI Act distinguishes between the type of system, the type of output and the way the content is published or presented. Standard editing that does not substantially alter the input may fall within an exception to the machine-readable marking duty. A human review and editorial-control exception may apply to certain public-interest text. Deepfakes have their own disclosure rule, while chatbots require a direct-interaction analysis.

The company should document the workflow instead of making a broad statement such as “all AI content is exempt” or “all AI content must be labelled in the same way”. Keep the prompt or source material where appropriate, the generated version, the human changes, the responsible editor, the final label and the publication channel. This is particularly useful where content is repurposed across websites, advertisements, social media and customer communications.

What does AI literacy require?

Article 4 requires providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy for staff and other persons dealing with the operation and use of AI systems on their behalf. The measures should take account of technical knowledge, experience, education, training, the context in which the systems are used and the people or groups on whom the systems are used.

This is a context-based obligation, not a fixed annual course or a universal certification. A marketing employee using a writing assistant, an HR manager using a candidate-ranking tool and an engineer managing a model deployment do not need identical training. The employer should explain relevant limitations, data handling, hallucination and reliability risks, prohibited uses, escalation routes, human review and the consequences of relying on outputs.

Identify AI users

List employees, contractors and other persons acting on the company’s behalf who operate or use an AI system. Include occasional users where the risk justifies it.

Match training to context

Separate basic safe-use guidance from role-specific instruction for HR, legal, customer service, developers, procurement and management.

Keep training records

Retain the audience, date, topics, materials, completion evidence and any follow-up testing or policy acknowledgement.

Update after change

Reassess training when a new system, material model update, high-risk use, incident or regulatory guidance changes the risk profile.

The Commission’s AI-literacy Q&A explains that enforcement of Article 4 is handled by national market-surveillance authorities and that there is no one-size-fits-all competence framework. A Romanian business should therefore build a proportionate internal record rather than wait for a template course.

What should employers know about recruitment and workplace AI?

Annex III identifies AI systems intended for recruitment or selection, including targeted job advertising, application analysis and candidate evaluation. It also identifies systems used to make decisions affecting terms of work-related relationships, promotion or termination, allocate tasks based on individual behaviour or personal traits, or monitor and evaluate performance and behaviour.

Under the current Commission timeline, the rules for high-risk systems in these sensitive areas apply from 2 December 2027 following the Digital Omnibus transition. This does not create a compliance holiday. A Romanian employer must still consider GDPR, Romanian labour law, anti-discrimination rules, information duties, collective arrangements, employment records, confidentiality and the possibility of human challenge. A vendor’s score should not become an unexplained substitute for a lawful employment decision.

Before deploying such a tool, the employer should identify who makes the final decision, what the AI output means, whether a person can disregard it, what data is used, whether a candidate or employee can obtain an explanation, and what happens if the system produces an incorrect or discriminatory result. The analysis should also consider whether the foreign group’s HR platform is being deployed by the Romanian entity or merely accessed for central administration.

Separate the dates: the later high-risk deadline concerns the AI Act’s high-risk requirements. It does not suspend GDPR or employment-law obligations that may arise from the same processing or decision today.

Vendor contracts and AI due diligence

A foreign company should not accept a short vendor statement as its entire AI Act file. The contract and due-diligence record should allow the Romanian operation to understand the system’s intended purpose, role allocation, technical limitations, data use, security, logging, human oversight, incident cooperation, transparency features and change-management process.

Purpose and role

Ask whether the supplier is a provider, GPAI provider, importer, distributor or another operator, and whether the Romanian entity is a deployer. Retain the product description, role matrix and contract.

Data and outputs

Check what data is processed, where it is stored, whether prompts or outputs train a model, and whether personal data can be isolated. Keep the data-flow map, DPA and security schedule.

Human oversight

Confirm whether the operator can intervene, override, suspend or test the system and whether those limits are communicated. Keep the operating procedure and testing logs.

Incidents and changes

Agree how model changes, outages, security events and regulatory requests are communicated. Keep notice SLAs, version history and audit rights.

Exit and continuity

Plan how the company will retrieve records, delete data and continue operations if the tool is withdrawn or reclassified. Keep the exit and retention plan.

Where the tool is supplied by a group company, the intercompany agreement should be tested in the same way as an external vendor contract. The Romanian entity may need practical access to information even when procurement, model management and security are centralised abroad.

How does the AI Act interact with GDPR and Romanian employment law?

The AI Act does not replace GDPR. Article 2 expressly preserves the application of Union data-protection, privacy and communications rules. A company may therefore need a lawful basis, purpose limitation, data minimisation, transparency, retention controls, processor arrangements, security measures and, where relevant, a data-protection impact assessment in addition to its AI Act analysis.

Workplace deployment adds another layer. If an AI tool ranks applicants, monitors employees, allocates tasks or recommends termination, the employer should consider the Labour Code, anti-discrimination protections, employee information and consultation, internal policies and the safeguards around automated decision-making. A human reviewer is important, but “human in the loop” is not a complete answer if the reviewer simply approves an unexplained score.

For customer-facing systems, consumer-protection and sectoral obligations may also apply. For regulated products, product-safety rules, conformity assessment and technical documentation may interact with the AI Act. The right approach is a combined compliance map that shows which regime addresses which risk.

AI Act

Classifies the system and creates duties tied to the operator role, risk level, transparency, literacy and governance.

GDPR

Controls personal-data processing, individual rights, security, profiling and the relationship between controller and processor.

Employment and sector law

Protects workers, customers and regulated activities through additional information, fairness, safety and challenge requirements.

Who supervises the AI Act in Romania?

Enforcement is shared. The European Commission’s AI Office supervises general-purpose AI providers and certain connected systems, while national competent authorities supervise other AI systems. The European Data Protection Supervisor has a specific role for systems used by EU institutions. The Romanian entity should monitor the national designation and implementation measures relevant to its activity instead of assuming that every question goes to one central EU authority.

The AI Act also allows complaints, investigations, information requests and other enforcement tools. The applicable authority may consider the nature, gravity and duration of an infringement, affected persons, the operator’s size and turnover, cooperation, responsibility, mitigation and whether the conduct was intentional or negligent.

What penalties can apply?

Article 99 sets maximum levels for several categories, while Member States establish the detailed national penalty and enforcement rules. Non-compliance with prohibited practices can reach up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher. Other listed operator obligations, including certain deployer and transparency duties, can reach up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher. Incorrect, incomplete or misleading information supplied to authorities can attract a separate maximum of EUR 7.5 million or 1% of worldwide annual turnover.

For SMEs and start-ups, Article 99 provides a lower-of-the-two limits approach for the amounts or percentages referred to in the provision. The figures are maximums, not automatic fines. Authorities must assess the individual circumstances and procedural safeguards remain relevant. Companies should avoid both extremes: treating the maximum as inevitable or assuming that a small local subsidiary has no exposure because the parent owns the technology.

Practical AI Act compliance checklist for a Romanian operation

01 · InventoryBuild the AI register

List systems, vendors, users, business owners, locations, outputs, affected people and group-company relationships. Include pilots and shadow AI.

02 · ClassifyAssign the legal route

Screen scope, prohibited practices, high-risk categories, transparency duties, GPAI dependencies, sector rules and applicable transition dates.

03 · ControlPut safeguards in place

Set access rules, human review, notices, marking, training, procurement controls, incident escalation and data-protection measures.

04 · EvidenceKeep the decision trail

Retain the classification rationale, vendor file, contract, training evidence, approvals, tests, incidents, changes and review date.

Create an inventory

Owner: Legal, IT, procurement and business owners. Output: an AI register with purpose, provider, deployer, data and affected persons.

Approve use cases

Owner: management with legal and security input. Output: a classification note, prohibited-use sign-off and escalation route.

Train users

Owner: HR, compliance and system owners. Output: role-based AI-literacy materials and completion evidence.

Review public outputs

Owner: marketing, communications and editorial owners. Output: a disclosure, marking and human-review record.

Monitor change

Owner: system owner and vendor manager. Output: version, incident, access, performance and reassessment logs.

Common mistakes made by foreign groups

“The parent handles it”

Central governance can help, but the Romanian operation still needs to know its role, local use, affected people and evidence available to it.

“The vendor is compliant”

Vendor compliance material is an input. It does not answer whether the Romanian entity is a deployer, importer or affected operator in the actual workflow.

“The deadline is 2027”

The later high-risk date does not postpone AI literacy, prohibited-practice controls, transparency duties or GDPR and employment-law analysis.

“A human checked it”

A nominal reviewer may not provide meaningful oversight. Define authority to challenge, override, document and stop the system.

“A footer solves labelling”

Website disclosure, user notice and machine-readable marking answer different questions. Match the control to the content and channel.

“Only official AI tools count”

Shadow AI used with company data can create the same confidentiality, data-protection and output risks as an approved platform.

Frequently asked questions

Does the AI Act apply if our parent company is outside the EU?

It may. Scope can arise because the Romanian entity deploys an AI system in the Union or because output from a third-country system is used in the Union. Analyse the actual provider, deployer, importer and output-use roles.

Are AI recruitment tools high-risk from 2 August 2026?

Not necessarily under the current transition timetable. Annex III includes recruitment and worker-management uses, but the Commission currently identifies 2 December 2027 for the selected sensitive high-risk areas after the Digital Omnibus changes. GDPR, employment and anti-discrimination duties can apply earlier.

Must employees disclose every use of ChatGPT or another writing assistant?

No universal AI Act rule requires disclosure of every private drafting step. The right control depends on the system, output, audience, content type, company policy and whether Article 50 applies. The employer should set a clear internal policy for confidential or regulated material.

Is an AI officer mandatory in Romania?

The AI Act does not impose a universal AI-officer title for every company. A foreign group should nevertheless allocate responsibility for inventory, classification, training, procurement, transparency, incidents and regulatory liaison.

Does using a human reviewer remove AI Act and GDPR risk?

No. Meaningful human oversight can be important, but it does not erase the underlying classification, transparency, data-protection, fairness or employment-law analysis. The reviewer must have information, time and authority to challenge the output.

Can we rely entirely on the AI vendor’s compliance statement?

No. Vendor material should be verified against the Romanian workflow, contract, data, users and role allocation. Keep evidence of the questions asked, the answers received and the decision made by the company.

Need to assess AI use in a Romanian business?

A Romanian business lawyer can help map the group structure, classify AI systems, review vendor terms, align GDPR and employment safeguards, and prepare a proportionate evidence file.

Contact Atrium Romanian Lawyers

This page provides general information only and does not constitute legal advice, a legal opinion or the creation of a lawyer-client relationship. Legal solutions depend on the specific facts, systems, contracts and legislation in force at the relevant time.

AI Notice: AI-assisted content, reviewed by a qualified Romanian lawyer.

6Mar

Evaluating the Cost of Non-Compliance with AI Laws in the EU

by Simona Rotaru Digital Law

Evaluating the Cost of Non-Compliance with AI Laws in the EU

Are you ready for huge financial hits for ignoring AI rules in the European Union?

The EU Artificial Intelligence Act brings a complex set of rules.

These rules could hurt your business’s profits a lot.

Understanding non-compliance with AI laws in the EU is key.

The rules are strict for AI development and use.

If you break them, you could face fines up to €35 million or 7% of your global sales.

Businesses in Romania and companies worldwide in the EU must take these AI rules seriously.

The financial risks are big. So, following these rules is not just a must, but a smart move.

Key Takeaways

Maximum fines can reach €35 million or 7% of global turnover;
Three-tiered penalty system based on violation severity;
High-risk AI systems face stringent compliance requirements;
Penalties designed to be effective and dissuasive;
Compliance costs estimated at 17% overhead on AI spending.

Understanding the EU AI Act’s Penalty Framework

EU AI Act Regulatory Enforcement

The European Union has created a detailed plan to tackle algorithmic bias and ai accountability lapses with its AI Act.

As AI grows, from 58% use in 2019 to 72% by 2024, strong rules are needed.

Regulatory Authority Overview

The AI Act sets up a detailed system to handle AI transparency and oversight failures.

Key parts of this system include:

Comprehensive risk assessment methodology;
Proactive monitoring of AI system implementations;
Stringent compliance requirements.

Key Stakeholders and Enforcement Bodies

Many groups are key in making sure AI rules are followed across Europe. The main players are:

Stakeholder	Responsibility
European Commission	Overall regulatory supervision
National Authorities	Local implementation and enforcement
AI Providers	Compliance and risk mitigation

Scope of Application

The EU AI Act covers a wide range of AI system providers, including:

Providers within the EU market;
Importers and distributors;
Product manufacturers using AI technologies.

The Act starts on 1 August 2024 and will be fully in place by 2 August 2026.

Companies must get ready for strict rules to avoid fines.

The Three-Tier Penalty System for AI Violations

The European Union has a detailed three-tier penalty system for AI ethics and accountability.

This system ensures penalties match the severity of violations.

It’s part of the European AI governance framework.

The penalty tiers are designed to handle different levels of non-compliance:

Tier 1 (Severe Violations): Fines up to €35 million or 7% of global turnover;
Tier 2 (High-Risk Violations): Fines up to €20 million or 4% of global turnover;
Tier 3 (Minor Non-Compliance): Fines up to €10 million or 2% of global turnover.

Your organization needs to know these AI liability frameworks to avoid big financial risks.

The system targets specific problematic practices, including:

Subliminal manipulation techniques;
Exploitation of vulnerable populations;
Unauthorized biometric identification systems;
Social scoring mechanisms.

AI ethics enforcement is key as these penalties show the EU’s commitment to protecting individual rights.

Organizations must have strong risk management strategies to meet these complex regulatory needs.

By 2026, member states will have solid AI governance systems in place.

This makes proactive compliance a legal must and a strategic move for businesses in the European market.

Maximum Penalties and Financial Implications

The EU AI Act has a strict penalty system.

This could greatly affect your company’s money.

It’s key to know these fines to keep your AI transparent and avoid big money losses.

Penalties vary based on how well your AI follows the rules.

If your AI doesn’t meet standards, you could face big money penalties.

Calculation Methods for Fines

The EU has a clear way to figure out fines for AI mistakes.

They look at several things:

How bad the AI mistake is;
Your company’s yearly income;
What kind of AI mistake it is;
How much harm the AI could cause.

Impact on Company Revenue

The money impact can be huge.

For the worst AI mistakes, fines can be up to €40 million or 7% of your company’s yearly income.

These big fines show how important it is to check your AI well and be ready for problems.

Special Considerations for SMEs

The EU AI Act helps small businesses.

It has smaller fines for Small and Medium Enterprises.

This way, it keeps the rules strict but also considers if a small business can afford it.

Violation Type	Maximum Penalty
Prohibited AI Practices	€40 million or 7% of turnover
High-Risk AI System Non-Compliance	€20 million or 4% of turnover
Providing False Information	€5 million or 1% of turnover

Being proactive about following the rules can help avoid these money problems.

It shows you care about using AI the right way.

Non-Compliance with AI Laws in the EU: A Detailed Look

The European Union’s rules on AI mark a big step towards responsible AI use.

It’s key for companies in the EU to understand these rules well.

The AI Act sets up a system to check AI systems based on their risks and how they affect society.

Some main reasons for not following EU AI laws include:

Not doing thorough risk checks;
Not being clear about how AI works;
Ignoring rules for AI accountability;
Not following ethical AI guidelines.

The rules vary based on the AI’s risk level.

High-risk AI systems have the toughest rules.

Companies need to be very careful to avoid big fines.

Risk Category	Compliance Requirements	Potential Penalties
Unacceptable Risk	Complete Prohibition	Up to €35 million
High-Risk Systems	Extensive Documentation	Up to 7% of Global Turnover
Limited Risk	Transparency Obligations	Up to €15 million

Your company should focus on AI ethics and make strong plans for following the rules.

The EU AI Act asks for careful handling of AI, with a big focus on areas like education and law.

Also, 60% of companies don’t know the AI rules that apply to them.

This lack of knowledge is a big risk, with fines up to €30 million or 6% of global sales.

Prohibited AI Practices and Associated Penalties

The European Union’s AI Act sets strict rules for using AI.

It aims to protect human rights and ensure AI is used responsibly.

Knowing what’s banned is key for companies to stay compliant and avoid big fines.

The EU has set limits for AI systems that could harm people or values.

These rules focus on practices that might hurt users or go against ethics.

High-Risk AI Systems: Complete Check

Companies need to check their AI systems carefully.

The rules highlight certain high-risk uses that need extra attention:

Biometric identification systems;
Critical infrastructure management;
Employment and workforce screening;
Educational assessment technologies;
Access to essential public and private services.

Transparency Violations and Consequences

Being open about AI use is critical.

Companies must tell people when they’re dealing with AI.

This ensures people know what’s happening and can give their consent.

Violation Type	Maximum Penalty
Prohibited AI Practices	€35,000,000 or 7% global turnover
Specific Provision Breaches	€15,000,000 or 3% global turnover
Misleading Information	€7,500,000 or 1% global turnover

Data Governance and Ethical Considerations

AI must be developed with ethics in mind.

Certain activities are banned, including:

Social scoring systems;
Untargeted facial recognition;
Emotional manipulation;
Exploitative AI targeting vulnerable populations.

Your company needs to have strong AI governance plans.

This is to meet the complex rules and avoid legal trouble.

Impact on Business Operations and Compliance Costs

Dealing with AI legal risks is a big challenge for European businesses.

The EU AI Act brings new rules that affect how you run your business and your budget.

Small businesses find it hard to meet the new AI rules.

EU studies say one high-risk AI product could cost up to €400,000 to comply with.

These costs cover many areas:

Quality management system implementation;
Risk assessment documentation;
Transparency reporting;
Ongoing compliance monitoring.

Breaking AI rules in Europe can be very costly.

Fines can be up to 7% of global sales or €35 million.

Breaches of AI ethics also have serious effects beyond money.

Companies need to check their AI systems carefully.

They should:

Do thorough risk assessments;
Keep detailed records;
Have clear AI rules;
Keep checking for compliance.

Even though following these rules costs money, it can help you stay ahead.

Companies that follow these rules will earn more trust from customers.

They will also show they are responsible in the changing European rules.

Requirements for High-Risk AI Systems and Transparency Obligations

The EU AI Act sets clear rules for managing high-risk AI systems.

It focuses on AI accountability EU and artificial intelligence governance.

These rules aim to stop unethical AI use by requiring clear transparency and documentation.

Understanding AI regulations is key for companies working with high-risk AI systems.

It’s important to know the main rules to follow.

Documentation Requirements

Your company must keep detailed records of AI system development.

These records should cover the whole life cycle of the AI.

They should include:

Comprehensive system description;
Development methodology;
Training data verification;
Performance metrics;
Risk assessment records.

Risk Management Systems

Having a strong risk management system is vital for ai accountability.

Your system should find, check, and lower risks in AI use.

Risk Management Component	Key Requirements
Identification	Comprehensive risk assessment
Evaluation	Quantitative and qualitative risk analysis
Mitigation	Proactive risk reduction strategies

Quality Management Standards

The EU AI Act requires strict quality standards for high-risk AI systems.

Your quality system must keep checking, validating, and improving AI tech.

Following these rules shows your dedication to ethical AI development.

It also protects your company from fines under the eu ai act.

Compliance Strategies and Risk Mitigation

Understanding AI legal frameworks is complex.

Your company needs to act early to meet the EU AI Act’s standards by 2026.

This is key to avoiding legal issues.

Effective AI risk management strategies include:

Conduct thorough risk assessments for all AI systems;
Implement robust AI transparency protocols;
Develop detailed records of AI development processes;
Set up ongoing checks and evaluations.

AI oversight needs a detailed plan.

You must set up internal rules that follow the EU AI Act.

This means:

Creating clear AI use guidelines;
Training staff on legal rules;
Carrying out regular audits;
Having a dedicated AI compliance team.

There are big financial risks.

Fines can be up to €35 million or 7% of global sales.

Small businesses need to watch out for special penalty rules.

For expert advice on these rules, reach out to our Romanian Law Office.

Economic Impact of AI Regulation in the European Union

The European Union’s approach to AI governance is changing the digital world.

It has big economic effects.

Your business needs to get how the EU AI Act works.

This Act sets strict rules for AI.

It aims to make AI trustworthy while keeping innovation alive.

It’s all about finding a balance.

Experts say there will be big economic hurdles for EU businesses.

The Act’s rules will cost companies up to €36 billion.

Small businesses might struggle the most, needing to invest in complex risk management.

The impact goes beyond just the cost.

The EU is becoming a leader in responsible tech.

Your company can stand out by using ethical AI.

This could give you an edge in markets that value transparency.

Adapting to these new rules is key.

Companies that plan well for AI compliance will do better.

The rules push for tech that’s more responsible and focused on people.

FAQ

What are the key financial risks of non-compliance with the EU AI Act?

Not following the EU AI Act can lead to big fines.

These fines can be up to 7% of your global sales or €35 million, whichever is more.

These fines are meant to make companies follow AI rules in Europe.

How does the EU AI Act categorize AI systems for regulatory purposes?

The Act sorts AI systems by risk level.

High-risk systems, like those in critical areas, have strict rules.

The level of risk decides the rules and fines for each AI system.

What constitutes a transparency violation under the EU AI Act?

Not being clear when using an AI system is a big no-no.

It’s also wrong to hide how an AI works or what it can do.

These mistakes can lead to big fines and show the EU’s focus on AI fairness.

How will the EU AI Act impact small and medium-sized enterprises (SMEs)?

SMEs get special help under the Act.

They get easier ways to follow the rules and might get support.

But, they must also make sure their AI systems are up to par.

What are the primary prohibited AI practices under the regulation?

The Act bans AI that’s too risky.

This includes systems that identify people in real-time, score people, or manipulate them.

Breaking these rules can lead to the biggest fines.

How can businesses prepare for compliance with the EU AI Act?

To get ready, do a thorough AI check, set up good risk management, and be open about AI development.

Also, train staff on AI ethics and keep an eye on compliance.

Getting legal advice can also help a lot.

What are the key documentation requirements for high-risk AI systems?

High-risk AI systems need lots of records.

This includes risk checks, how well the AI works, and data used to train it.

These records help keep AI use honest and open.

How does the EU AI Act compare to other global AI regulations?

The EU AI Act is the most detailed AI rule globally.

It’s known for its focus on risk, ethics, and big fines for breaking the rules.

It might set a standard for AI rules around the world.

What are the possible long-term economic benefits of these regulations?

At first, following these rules might cost a lot.

But, they aim to make AI trustworthy.

This could give European companies an edge.

The EU wants to encourage innovation and trust in AI.

How will penalties be calculated under the EU AI Act?

Fines will depend on how serious the mistake is.

They could be a percentage of sales or a fixed amount.

The exact fine will look at the mistake, if it was on purpose, and how much harm it caused.

What is the EU AI Act?

The EU AI Act is a comprehensive regulatory framework designed by the European Union to govern the use and development of artificial intelligence within its member states.

This act categorizes ai systems into different risk levels, ensuring that high-risk AI systems are subject to strict compliance measures.

The AI Act aims to promote innovation while safeguarding fundamental rights and societal values, reflecting the EU’s commitment to ethical AI governance.

What are high-risk ai systems?

High-risk AI systems are defined under the EU AI Act as those that can significantly impact people’s lives, such as systems used in critical infrastructure, education, employment, law enforcement, and biometric identification.

These systems must comply with rigorous standards of transparency, accountability, and ethical considerations to mitigate potential risks to fundamental rights and ensure public safety.

What are the penalties for non-compliance with the EU AI Act?

The EU AI Act outlines significant penalties for non-compliance, which can include fines based on the annual turnover of the offending organization.

For serious violations, the penalties can reach up to 6% of the global revenue or €30 million, whichever is higher.

This stringent approach underscores the importance of adhering to the regulations set forth to promote safe and responsible AI practices.

What is considered non-compliance with the prohibition?

Non-compliance with the prohibition refers to the failure to adhere to specific restrictions imposed by the EU AI Act, particularly those regarding prohibited ai practices.

Examples include the use of social scoring systems or deploying AI models without sufficient transparency measures.

Organizations found in violation may face severe penalties, emphasizing the need for strict compliance with the regulatory framework.

What types of ai practices are prohibited under the EU AI Act?

The EU AI Act identifies several prohibited AI practices that pose a threat to fundamental rights and public safety.

These include systems that manipulate human behavior, exploit vulnerabilities.

3Mar

Best Practices for Ensuring AI Compliance in European Businesses

by Simona Rotaru Digital Law

Best Practices for Ensuring AI Compliance in European Businesses

A staggering €35 million or 7% of a company’s worldwide annual turnover – that’s the maximum fine for violating AI rules under the EU AI Act.

This law, signed on August 1st, 2024, will change how European businesses handle AI.

Companies have until 2026 to make sure their AI practices meet these new standards.

The EU AI Act sets up a detailed framework for AI rules.

It divides AI systems into four risk levels: unacceptable, high, limited, and minimal.

This system is key to managing AI risks, making companies review their AI use and ensure they follow the rules.

AI Compliance in European Businesses

For European businesses, like those in Romania, it’s vital to understand and follow these rules.

The Act affects any company whose AI systems touch EU residents.

This shows how important it is to have strong AI compliance measures, not just to avoid fines but to promote responsible innovation.

Key Takeaways

EU AI Act enforces strict penalties for non-compliance, up to €35 million or 7% of annual turnover;
Full implementation expected by 2026, requiring immediate action from businesses;
AI systems categorized into four risk levels, with specific requirements for each;
Global impact: regulations apply to all AI systems affecting EU residents;
Emphasis on transparency, accountability, and ethical AI development.

Understanding the EU AI Act Framework and Scope

The EU AI Act is a big step in regulating AI in Europe.

It aims to make AI trustworthy and encourage innovation.

Let’s explore its main points and how it affects businesses.

Key Objectives and Principles

The AI Act focuses on making AI accountable and transparent.

It uses a risk-based approach, dividing AI systems into four levels.

This balance aims to protect safety and rights while allowing innovation.

Unacceptable risk: 8 prohibited practices;
High risk: Strict obligations for critical applications;
Limited risk: Transparency requirements;
Minimal risk: No specific rules.

Stakeholders Affected by the Regulation

The EU AI Act affects many in the AI field.

Providers, deployers, importers, and distributors must follow rules based on their role and AI’s risk level.

This ensures AI is used responsibly.

Timeline for Implementation

The EU AI Act will be implemented in phases:

2 February 2025: Initial provisions take effect;
2 August 2025: Governance rules for general-purpose AI models apply;
2 August 2026: Full application of the AI Act;
2 August 2027: Extended transition for high-risk AI systems in regulated products.

This timeline helps businesses adjust and meet the new AI rules.

It supports the growth of reliable AI systems.

EU AI Act Framework

AI Compliance in European Businesses: Risk Classification System

The European AI strategy has a detailed risk classification system for AI.

It aims to ensure ai fairness and ethics.

It also promotes responsible ai deployment in different sectors.

Prohibited AI Practices

The EU AI Act bans some AI uses.

These include systems for controlling behavior, social scoring, and real-time biometric identification.

This rule helps protect fundamental rights, as part of the European AI strategy.

High-Risk AI Systems

High-risk AI systems have strict rules.

They are used in critical areas like infrastructure, education, and law enforcement.

These systems need thorough ai audits and must pass conformity assessments before they can be used.

AI compliance risk classification

Limited and Minimal Risk Categories

AI systems with lower risks have less strict rules.

They don’t have to follow specific laws but are encouraged to follow voluntary guidelines.

This balance allows for innovation while keeping ethics in mind.

Risk Category	Examples	Regulatory Approach
Prohibited	Social scoring AI	Banned
High-Risk	AI in critical infrastructure	Strict regulations
Limited Risk	Chatbots	Transparency requirements
Minimal Risk	AI-enhanced video games	Voluntary guidelines

Essential Requirements for AI System Providers and Deployers

The EU AI Act has strict rules for AI system providers and deployers.

These rules aim to make AI trustworthy and follow ethical practices.

Providers must prepare AI systems carefully before they hit the market.

Deployers focus on using these systems safely and legally.

AI providers must take strong steps to protect privacy and manage data well.

They also need to keep detailed records for 10 years after the system is introduced.

This helps follow AI regulation and improve data privacy.

Deployers are key to keeping AI trustworthy.

They must keep system logs for at least six months.

They also need to report serious incidents within 15 days.

For big disruptions, they have only two days to report.

Requirement	Providers	Deployers
Documentation Retention	10 years	6 months (logs)
Incident Reporting	15 days	15 days
Critical Incident Reporting	2 days	2 days
CE Marking	Required	Not applicable

Providers must put CE markings on high-risk AI systems.

They also need to have an EU representative if they’re outside the union.

These steps help meet AI regulation standards in the European market.

Data Governance and Privacy Requirements

As AI Regulation in Europe evolves, businesses face complex data governance and privacy rules.

The EU AI Act, set to take effect in 2026, brings new challenges.

It works with GDPR to ensure strong AI ethics and governance.

GDPR Alignment with AI Systems

AI systems must follow GDPR principles like lawfulness, fairness, and transparency.

You must ensure your AI practices meet these standards, mainly for high-risk areas like finance and healthcare.

Do Data Protection Impact Assessments for high-risk activities to stay compliant.

Data Quality and Management Standards

High-quality data is vital for ai bias mitigation and following rules.

The EU AI Act stresses strict data management, mainly for high-risk AI systems.

You need to have strong data governance to avoid penalties and keep client trust.

This includes managing various data sources well and ensuring data minimization.

Documentation and Record-Keeping

Keeping detailed records is essential to show you’re following the rules.

Keep records of AI training data, biases, and system performance.

For high-risk AI systems, log activity and do regular checks.

Also, remember, importers must keep EU declarations of conformity and technical documentation for ten years after market placement.

By focusing on these data governance and privacy needs, you’ll be ready for the changing AI regulation in Europe.

This will help you develop ethical and responsible AI.

Transparency and Explainability Obligations

The EU AI Act makes it clear how AI systems must be transparent and explainable.

These rules help make sure AI is fair and protects privacy.

Companies need to tell users when they’re dealing with AI, unless it’s very obvious or used for legal reasons like catching criminals.

For AI systems that are very high-risk, providers must give ‘instructions for use’.

These instructions should include details on how the system works, its accuracy, and its security.

The Act also requires detailed technical documents for audits and ongoing checks.

AI-generated content, like deepfakes, must be labeled as artificial.

This helps stop fake information and protects people.

The Act also creates a database for high-risk AI systems.

This makes it easier for the public to learn about these technologies.

High-risk AI systems need to be transparent so users understand how they work;
AI companies must tell users when they’re not talking to a human;
Providers must make sure their AI solutions are effective, work well together, are strong, and reliable.

These rules help follow ethical AI guidelines and support AI governance.

By being open and clear, businesses can gain trust and follow the EU AI Act.

This could lead to more people using AI and feeling confident about it.

Risk Management and Compliance Monitoring

European businesses need strong risk management and compliance monitoring to follow the EU AI Act.

These steps help make sure AI is trustworthy and keeps data safe.

Risk Assessment Frameworks

Businesses must create detailed risk assessment frameworks for AI accountability.

These frameworks spot risks, check their impact, and plan how to fix them.

Regular checks help companies stay on top of new challenges and follow rules.

Continuous Monitoring Systems

It’s key to have systems that watch AI all the time.

These systems check how AI is doing, find odd things, and make sure it follows rules.

By always watching AI, companies can catch and fix problems early.

Incident Response Protocols

Having clear plans for AI problems is very important.

These plans should say how to find, report, and fix issues.

Quick action helps reduce harm and shows a company’s commitment to AI safety.

Component	Purpose	Key Benefits
Risk Assessment	Identify and evaluate AI risks	Proactive risk mitigation
Continuous Monitoring	Track AI system performance	Early issue detection
Incident Response	Address AI-related issues	Minimize possible damages

By using these risk management and compliance monitoring steps, European businesses can make sure their AI systems follow rules.

This keeps trust with everyone involved.

Penalties and Enforcement Measures

The EU AI Act has strict penalties for not following the rules.

It focuses on making sure AI is transparent and private.

Businesses need to know these rules to avoid fines and stay in line with GDPR and AI laws.

Financial Penalties Structure

The Act has a system of fines based on how serious the violation is:

Up to €35 million or 7% of global annual turnover for prohibited AI practices;
Up to €15 million or 3% for violations of specific provisions;
Up to €7.5 million or 1% for providing misleading information.

Small businesses are capped at lower fines to help them stay afloat while keeping the rules strict.

Compliance Violations Categories

Violations are split into levels based on their impact on AI safety and ethics.

Serious violations include banned AI practices.

Less serious ones might be not monitoring AI well or not keeping proper records.

Enforcement Mechanisms

Here’s how the AI Act will be enforced:

Member States report to the European Commission every year;
The new AI Office will watch over General-Purpose AI Models;
Authorities can investigate and take documents.

These steps help keep AI safe and transparent across the EU.

Violation Type	Maximum Fine	Effective Date
Prohibited AI Practices	€35M or 7% of turnover	August 2, 2025
Other Obligations	€15M or 3% of turnover	August 2, 2025
Misleading Information	€7.5M or 1% of turnover	August 2, 2025

Implementation Strategies for Business Compliance

The EU AI Act will start in August 2026. Businesses need to act fast to follow the rules.

They must set up strong ai governance frameworks.

These should cover risk assessment, quality management, and cybersecurity to protect data and avoid risks.

Companies should keep a list of their AI use cases and systems.

This list helps them know where they need to focus on compliance.

They also need to do regular checks and audits to make sure AI systems are fair and transparent.

Building trustworthy AI is key to following the rules.

This means adding privacy and ethics into AI development from the start.

Companies should also have clear rules with AI vendors and check AI systems often for fairness and accuracy.

Training programs are important for AI risks.

Employees working with critical systems, like those making credit decisions, need more training.

This is different from those doing less sensitive tasks.

If you need help with these strategies, contact our lawyers in Romania at office@theromanianlawyers.com.

Our Romanian law office can offer great advice on AI compliance for European businesses.

Challenges and Considerations for Global Companies

Global companies face unique challenges in implementing responsible AI deployment strategies that comply with the EU AI Act.

They must harmonize international AI regulations with robust ai risk mitigation strategies.

Companies need to navigate diverse regulatory landscapes while keeping up with EU standards.

A key challenge is conducting thorough ai bias and fairness audits across different cultural contexts.

They need to develop culturally sensitive evaluation methods.

This ensures AI systems remain unbiased and fair in various global markets.

Implementing AI transparency and accountability measures on a global scale is another hurdle.

Companies must create standardized processes for explaining AI decisions to stakeholders from diverse backgrounds.

This may involve developing multilingual explainability tools and adapting communication strategies to local norms.

Challenge	Impact	Mitigation Strategy
Regulatory Harmonization	Increased compliance costs	Develop unified global compliance framework
Cross-cultural Bias Audits	Potential market exclusion	Culturally-sensitive AI evaluation methods
Global Transparency	Trust issues in local markets	Multilingual explainability tools

While challenging, early compliance with the EU AI Act can provide a strategic advantage.

As other regions look to the EU as a model for AI regulations, companies that adapt now may find themselves better positioned in the global market.

Future Trends and Evolving Regulatory Landscape

The AI regulatory scene is changing fast. By 2026, the EU AI Act will fully come into play.

It will bring a new risk-based system for AI apps.

This means companies will need to update their privacy and security measures.

Recent stats show AI governance is becoming more critical:

56% of organizations plan to use Generative AI in the next year;
72% of companies already use AI, seeing improvements in many areas;
Only 18% of organizations have a council for responsible AI governance.

As rules get stricter, companies could face big fines.

The EU AI Act might fine violators up to €35 million or 7% of their global income.

To keep up, companies need to train their AI teams and follow strict ethics guidelines.

The future of AI rules will include more audits and risk checks.

Healthcare and finance will need special plans to use AI ethically and follow the law.

Conclusion: Embracing Ethical AI for Sustainable Growth

The EU AI Act is a big change in artificial intelligence.

It got 523 votes in favor, setting a new AI governance standard.

Your business needs to follow these rules to avoid fines up to 7% of global turnover.

It’s important to have a good ai risk assessment strategy.

The Act covers all AI systems in the EU market, no matter where they are.

High-risk AI systems must go through checks and be registered in an EU database.

This ensures AI systems are safe and trustworthy.

It also makes sure they respect basic rights.

Ai fairness testing is now a must for following the rules.

The European AI Office will make sure everyone follows the Act.

There’s also an AI Sandbox for testing within ethical limits.

These rules start on August 1, 2024, with most parts taking effect on August 2, 2026.

Understanding the EU AI regulation can be tough.

For help with compliance, contact our lawyers in Romania at office@theromanianlawyers.com.

By using ethical AI, your business can grow sustainably in this new AI world.

FAQ

What is the EU AI Act and why is it important for European businesses?

The EU AI Act is a new rule for AI in the European Union.

It helps businesses by setting rules for ethical AI use.

It also makes sure AI is governed well and meets certain standards.

How does the EU AI Act classify AI systems based on risk?

The Act sorts AI systems into four risk levels.

There are banned practices, high-risk systems, systems with limited risk, and those with minimal risk.

Each level has its own rules. Knowing this helps businesses understand their duties.

What are the essential requirements for AI system providers and deployers under the EU AI Act?

Providers and deployers must focus on data quality and system reliability.

They also need to ensure human oversight and transparency.

These steps are key from start to finish to follow the Act’s rules.

How does the EU AI Act intersect with existing data protection regulations like GDPR?

The Act works with the GDPR to protect data.

Businesses must follow GDPR rules for AI use.

Keeping data safe and well-documented is essential for following both laws.

What are the transparency and explainability requirements under the EU AI Act?

The Act requires clear information about AI systems.

Businesses must make AI decisions clear and explainable.

This builds trust and follows the regulation.

What risk management and compliance monitoring measures are required by the EU AI Act?

The Act demands good risk management and constant checks.

Businesses need to have plans for risks and keep an eye on their AI systems.

This keeps them in line with the Act.

What are the penalties for non-compliance with the EU AI Act?

Breaking the Act can cost up to €30 million or 6% of global sales.

The fine depends on the violation’s impact.

This shows how serious following the Act is.

How can businesses implement AI compliance measures in line with the EU AI Act?

Businesses can start by making AI inventories and doing impact assessments.

They should also think about privacy and ethics in AI.

Keeping AI systems up to date is key.

For complex issues, getting legal advice is a good idea.

What challenges do global companies face in complying with the EU AI Act?

Global companies must align with many AI rules worldwide.

They need a global plan for AI compliance.

This means adjusting their current systems to fit EU rules.

What future trends are expected in AI regulation?

We might see more AI offices and independent bodies.

The rules will likely change, so businesses need to stay updated.

Being ethical and flexible in AI compliance is important for growth.

15Nov

Legal Requirements for Incorporation of AI Startups in Romania

by Simona Rotaru Digital Law

Legal Requirements for Incorporation of AI Startups in Romania

To successfully incorporate an AI startup in Romania and meet the necessary legal requirements, there are several key considerations you need to keep in mind.

At present, Romania does not have a specific legal framework dedicated to regulating AI or ML.

However, the European Commission is currently working on the Artificial Intelligence Act, which aims to strengthen Europe’s position in promoting human-centric, sustainable, secure, inclusive, and trustworthy AI.

The AI Act covers various aspects such as risk assessment, dataset quality, traceability, documentation, and security.

In addition to complying with the AI Act, it is crucial for AI startups to adhere to the General Data Protection Regulation (GDPR), which addresses data protection and privacy.

When incorporating an AI startup in Romania, it is important to consider additional technical requirements that buyers may have, such as proficiency in programming languages, experience in Big Data Technologies, and familiarity with agile project management.

Furthermore, it is essential to take into account industry-specific standards and regulations when offering AI or ML software services.

To ensure compliance, it is recommended that you stay updated with the development of laws and regulations related to AI in Romania.

By staying informed, you can effectively navigate the legal landscape and establish a legally compliant AI startup in Romania.

Market Entry Requirements for AI and ML Software Development Services in Europe

To successfully enter the European market for AI and ML software development services, there are specific requirements and certifications that AI startups need to comply with.

While the general market entry requirements for software development can be found in a separate study, it is crucial to consider the unique requirements for AI and ML services.

The upcoming European AI Act, currently being prepared, will play a significant role in regulating AI development in Europe.

This act will provide a legal framework for monitoring and regulating AI, ensuring that it is human-centric, sustainable, secure, inclusive, and trustworthy.

In addition to the legal considerations, buyers in the European market often have additional technical requirements.

These may include knowledge of programming languages, experience in Big Data Technologies, and familiarity with agile project management.

It’s essential to stay updated with industry-specific standards and regulations when offering AI or ML software services.

When planning to enter the European market, it is crucial for AI startups to stay informed about the specific requirements for different industries, segments, and countries within Europe.

Understanding these market entry requirements will help AI startups tailor their strategies and ensure compliance with the legal and technical aspects of operating in the European market.

Table: Market Entry Requirements for AI and ML Software Development Services in Europe

Requirement	Description
Compliance with the European AI Act	Ensure adherence to the forthcoming AI Act to meet legal obligations and regulatory requirements.
Technical Expertise	Possess the necessary technical skills, including knowledge of programming languages and experience in Big Data Technologies.
Familiarity with Agile Project Management	Understand and implement agile project management methodologies to effectively deliver AI and ML software development services.
Industry-specific Standards and Regulations	Stay updated with the specific standards and regulations relevant to the target industries and segments in the European market.

Market Channels for AI and ML Software Development Services in Romania

When it comes to entering the market for AI and ML software development services in Romania, there are various market channels that AI startups can utilize.

Understanding and leveraging these channels is essential for a successful market entry strategy.

Some of the key market channels for AI and ML software development services in Romania include:

1. Subcontracting through European service providers:

Subcontracting through established European service providers is a common and realistic market entry channel for AI startups.

This allows startups to tap into the existing networks and expertise of established companies in the industry.

By partnering with these service providers, AI startups can gain access to a wider customer base and benefit from their established reputation and relationships.

2. Online platforms:

Online platforms provide a convenient and accessible market channel for AI and ML software development services.

Platforms such as freelancing websites or dedicated marketplaces for AI services allow startups to showcase their expertise and connect with potential clients.

These platforms often have a large user base and provide opportunities for startups to secure projects and build their portfolio.

3. Direct engagement with end-user industries:

Another market channel for AI startups is to directly engage with specific end-user industries.

By understanding the needs and challenges of these industries, startups can tailor their services to address specific pain points.

This approach requires thorough research and industry knowledge to identify the most relevant industries and establish connections with key stakeholders.

Overall, choosing the right market channel is crucial for the success of AI startups in Romania.

Whether it’s subcontracting through service providers, utilizing online platforms, or directly engaging with end-user industries, each channel offers its own advantages and considerations.

By carefully evaluating these options and selecting the most suitable channels, AI startups can effectively penetrate the Romanian market and establish a strong foothold in the industry.

Market Channel	Advantages	Considerations
Subcontracting through European service providers	Access to established networks and expertise Leverage reputation and relationships of service providers	Competition from other subcontractors Ensuring contractual agreements align with startup’s goals
Online platforms	Wide user base and potential for project acquisition Opportunity to build a portfolio and reputation	Competition from other AI startups and service providers Platform fees and commission
Direct engagement with end-user industries	Customized services to address specific industry needs Opportunity for long-term partnerships and industry expertise	Requires significant industry research and knowledge Establishing trust and credibility with industry stakeholders

Incorporation Process for AI Startups in Romania

The process of incorporating an AI startup in Romania involves several important steps and considerations.

To ensure a smooth and compliant incorporation, it is recommended to consult legal or tax advisors who specialize in Romanian business law. Here is an overview of the key aspects:

Choosing the Legal Form

When incorporating an AI startup in Romania, you will need to choose the appropriate legal form for your business.

The most common options are stock companies (SA) and limited liability companies (SRL).

Each legal form has its own advantages and requirements, so it is crucial to assess the specific needs and goals of your AI startup before making a decision.

Name Availability and Reservation

Before moving forward, it is important to check the availability of your desired company name on the Trade Register’s official website.

If the name is available, you can proceed with the name reservation process, which can also be done through the Trade Register.

This step ensures that your chosen name will be reserved for your AI startup during the incorporation process.

Registration and Documentation

Once the name reservation is completed, you will need to establish a registered office for your AI startup and draft a constitutive act.

The Constitutive Act outlines the company’s bylaws, including its purpose, management structure, and shareholder rights.

Additionally, you will be required to prepare declarations and deposit the share capital to a bank.

Finally, you will need to submit all the necessary documents for registration at the National Trade Office to officially incorporate your AI startup.

Steps	Description
Choose the Legal Form	Decide between SA and SRL based on your business needs and goals.
Name Availability and Reservation	Check the availability of your desired company name and reserve it through the Trade Register.
Establish Registered Office and Draft Constitutive Act	Create a physical office address and draft the bylaws of your AI startup.
Prepare Declarations and Deposit Share Capital	Prepare the necessary declarations and deposit the required share capital to a bank.
Submit Documents for Registration	Submit all the required documents to the National Trade Office for the official registration of your AI startup.

It is important to note that the costs associated with incorporation may vary depending on the legal form chosen and other factors.

Additionally, staying updated with the latest legislative and fiscal news in Romania is essential to ensure compliance with any changes in the legal framework.

Compliance and Risks for AI Companies in Europe

Compliance with AI regulations is of utmost importance for AI companies operating in Europe, including Romania.

The proposed EU AI Act, expected to have a significant impact on AI development, will provide a legal framework for monitoring and regulating AI.

It is crucial for AI companies to understand and adhere to these regulations to avoid potential penalties.

Failure to comply with AI regulations can result in fines of up to €30 million or 6% of the company’s total annual turnover.

To mitigate risks and ensure compliance, AI companies must prioritize data privacy, implement secure machine learning models, and establish robust data governance.

In addition, complying with existing regulations such as the General Data Protection Regulation (GDPR) is essential.

Non-compliance with AI regulations poses financial and reputational risks for AI companies.

It can hinder innovation and collaboration within the AI industry, impacting business growth and opportunities.

Therefore, AI companies should proactively implement solutions that facilitate compliance and stay updated with the evolving regulatory landscape.

To navigate the legal framework and ensure compliance, AI companies operating in Romania should seek legal counsel and stay informed about AI legislation and regulations.

By taking a proactive approach to compliance, AI companies can thrive in the European market while maintaining trust and integrity.

F A Q about AI Company Registration in Romania

1. What are the requirements for registering an AI company in Romania?

To register an AI company in Romania, you need to comply with the Romanian laws and regulations related to company formation.

You must submit the necessary documentation to the National Trade Register Office and fulfill the capital requirements as per the Company Law in Romania.

2. How can I start a business that is leveraging AI in Romania?

To initiate a startup in Romania that focuses on using artificial intelligence, you should follow the process of incorporation and fulfill the necessary legal requirements.

Pay attention to the specific regulations related to technology startups in the country.

3. What type of company structure can be formed for AI businesses in Romania?

You can establish various types of companies in Romania, including a limited liability company or a joint stock company.

Each structure has its own shareholder requirements and vat implications, so consult with a legal advisor to determine the most suitable structure for your AI business.

4. What are the specific steps for registering an AI company name in Romania?

When choosing a company name for your AI business, ensure that it is unique and complies with the Romanian Company Law.

You need to submit an application to the National Trade Register Office and follow their guidelines for company name registration.

5. How can foreign entrepreneurs establish an AI startup in Romania?

Foreign entrepreneurs intending to set up an AI startup in Romania must first decide on the type of company they wish to form.

They will then need to comply with the regulations set by the authorities regarding capital requirements and other legal aspects.

What is AI due diligence in a Romanian transaction?

Start with the target’s actual AI footprint

Select a deal question to see the first evidence to request

Which legal and commercial issues should an investor test?

AI Act review: classify before you value the risk

GDPR and data review: look beyond the privacy policy

Data, intellectual property and contract rights

What should the investor request in the data room?

How should findings affect the transaction documents?

When does a separate specialist review become necessary?

How Atrium Romanian Lawyers can assist

AI due diligence during the acquisition of a Romanian technology company

Related guides

AI vendor contracts

DPIA versus FRIA

GDPR and AI

Frequently asked questions

When do these obligations apply?

DPIA vs FRIA: the differences that change your project

When does an AI project need a DPIA?

Who needs a FRIA under the AI Act?

Explore four deployment scenarios

Candidate ranking: DPIA and FRIA can diverge

Consumer credit: prepare for both assessments

Public benefits: assess deployment and processing together

Drafting assistant: examine the actual workflow

Can one assessment document cover DPIA and FRIA?

What the FRIA needs to address

Who prepares, reviews and owns the decision?

Must the assessment be sent to an authority?

A practical assessment file before deployment

How Atrium Romanian Lawyers Assisted an International Manufacturing Group

Questions examined

Legal analysis

Measures adopted

Practical result

Related guides

The broader GDPR framework for AI

The wider AI Act compliance programme

Supplier evidence and contractual cooperation

Frequently asked questions

Why does an AI vendor contract need a separate review?

Start with the AI use, not the vendor’s template

AI vendor due diligence before contract negotiation

What if the service relies on a general-purpose AI model?

What clauses should an AI vendor agreement contain?

1. Define the system, version and intended purpose

2. Allocate AI Act and GDPR roles separately

3. Control prompts, files, outputs and training use

4. Make performance, limitations and human oversight usable

5. Require evidence and audit cooperation

6. Coordinate security and incident notification

7. Address intellectual property and third-party claims

8. Control subcontractors, subprocessors and model dependencies

9. Regulate model and policy changes

10. Connect liability to the risks that matter

11. Preserve suspension, termination and transition rights

12. Align the whole contract suite

Customer and supplier priorities are not identical

Practical experience: how Atrium approaches an AI contract review

AI vendor contract checklist before signature

Frequently asked questions

Negotiating an AI vendor contract connected with Romania?

Related guides and services

EU AI Act in Romania: 2026 Guide for Foreign Companies

What is the practical answer for a foreign company?

Scope first

Obligations now

Evidence later

AI Act timeline for companies operating in Romania

Does the AI Act apply to a foreign company operating in Romania?

Which AI uses should a Romanian company classify first?

Which AI practices are prohibited?

Procurement gate

Red-flag review

Decision record

What transparency duties apply from 2 August 2026?

Does every AI-generated business article or image need a label?

What does AI literacy require?

Identify AI users