Two corporate professionals reviewing AI transparency controls, compliance dashboards, and synthetic content verification tools on screens in an office setting.

Artificial intelligence and digital regulation · 2026

EU AI Act in Romania: 2026 Guide for Foreign Companies

Foreign companies operating in Romania may be subject to the EU AI Act even when the parent company, vendor or development team is outside the European Union. This practical guide explains the scope rules, the obligations already applying in 2026, the later high-risk deadlines and the records a Romanian business should build now.

The analysis should be read together with the official AI Act text, the Commission’s AI Act implementation page and the current guidance available through the AI Act Service Desk.

What is the practical answer for a foreign company?

A Romanian subsidiary, branch or other local operation should begin with an inventory of the AI systems it provides, deploys, imports, distributes or uses for work. The company should then identify whether the system is prohibited, high-risk, subject to transparency duties, or outside the main AI Act obligations. The label used by the vendor is not decisive: the same tool may create different legal questions depending on its function, users, outputs and place of use.

Scope first

Map the Romanian entity, the foreign group, the provider, the deployer, the users and where the output is used. A foreign parent does not automatically remove EU exposure.

Article 2 analysis

Obligations now

AI literacy, prohibited-practice controls, GPAI-related obligations and the new transparency rules must be considered according to the applicable role and system.

2026 operating baseline

Evidence later

Keep an AI register, vendor file, training record, human-oversight process and incident route so the business can show how it reached its classification.

Governance that scales

Key point: the AI Act does not create a universal “AI officer” requirement for every Romanian business. Responsibility must be allocated in a way that fits the company’s systems, roles, risk profile and existing compliance structure.

AI Act timeline for companies operating in Romania

The original AI Act timetable has been supplemented by the Digital Omnibus on AI. The current implementation page of the European Commission identifies the dates below. A deadline table should be treated as a planning tool, not as a substitute for checking the final text and any sector-specific transition rule.

Completed1 August 2024
Entry into force

The Regulation entered into force. The legal framework began its transition period, while later provisions were scheduled to apply in stages.

Applied2 February 2025
Prohibitions and literacy

The prohibited-practice rules and the Article 4 AI-literacy obligation became applicable. Businesses should already have training and prohibited-use controls in place.

Applied2 August 2026
Transparency and supervision

Transparency obligations for certain AI systems, broader enforcement powers and the Commission’s AI Office and national authorities’ implementation work become operational.

Deferred2 December 2027
Selected high-risk uses

Following the Digital Omnibus, high-risk systems in sensitive Annex III areas, including employment, apply from this date. Product-embedded high-risk rules have a later transition.

Rule or milestone	Current application point	What the Romanian operation should do
Prohibited AI practices	Applied from 2 February 2025; an additional prohibition concerning certain non-consensual intimate or child sexual abuse material applies from 2 December 2026.	Screen use cases before procurement or deployment and escalate any practice that may manipulate, exploit, socially score or infer protected characteristics.
AI literacy	Applied from 2 February 2025 and enforced by national market-surveillance authorities from 2 August 2026.	Adopt role-based training and retain evidence of the measures taken, rather than relying on a generic awareness email.
Transparency rules	Applied from 2 August 2026 for the relevant Article 50 systems and outputs.	Review chatbot notices, synthetic-content marking, deepfake disclosures and the editorial process for public-interest text.
Annex III high-risk systems	Selected high-risk use cases, including employment, apply from 2 December 2027 after the Digital Omnibus transition.	Classify and plan early. The later date does not remove GDPR, employment, consumer or fundamental-rights duties that may apply now.
High-risk systems in regulated products	Extended transition until 2 August 2028 under the current Commission summary.	Coordinate product-safety, sectoral and AI Act analysis with the provider and any notified-body or conformity route.

The Commission’s current AI Act timeline identifies the staged dates and the changes introduced by the Digital Omnibus.

Does the AI Act apply to a foreign company operating in Romania?

Often, yes. The scope is not limited to companies incorporated in an EU Member State. The Regulation covers providers placing AI systems or general-purpose AI models on the Union market, deployers located in the Union, and providers or deployers in a third country where the output produced by the system is used in the Union. Importers, distributors, certain product manufacturers, authorised representatives and affected persons are also expressly addressed.

This creates several common patterns for international groups. A US or UK parent may provide a generative AI platform used by its Romanian subsidiary. A Romanian company may deploy a recruitment tool supplied by a vendor in another country. A group may centralise procurement and security while the local entity makes decisions affecting Romanian workers or customers. The legal analysis should identify each role instead of treating “the group” as a single operator.

Question 1Is the system used in the EU?

If the Romanian entity deploys the system, or its output is used in Romania or elsewhere in the Union, the scope analysis moves beyond the location of the parent company.

Question 2Who provides it?

Record the provider, importer, distributor, group company, authorised representative and vendor chain. Contract labels are useful evidence but do not replace the legal role analysis.

Question 3Who deploys it?

Identify the business unit that determines the purpose and use. The deployer may be the Romanian company, a foreign shared-service centre or another group entity depending on the facts.

Question 4Who is affected?

Employees, applicants, customers and other persons in the Union may be affected even when the technical processing or model hosting takes place outside Romania.

Do not rely on the hosting location alone: cloud hosting, a foreign parent or a vendor’s “EU AI Act compliant” statement does not by itself determine whether the Romanian entity has obligations.

Which AI uses should a Romanian company classify first?

A useful first inventory is operational rather than theoretical. Start with tools that make recommendations, rank people, generate customer-facing outputs, analyse sensitive information, control access to services or influence employment decisions. Include tools purchased by individual teams if company data or company accounts are used.

Business use	Why it needs early review	First evidence to collect
Recruitment, CV screening or candidate scoring	Employment and access-to-self-employment uses are listed in Annex III and may engage high-risk analysis once the relevant rules apply.	Vendor description, decision logic, data sources, human review and impact on applicants.
Employee monitoring, task allocation or performance evaluation	AI used to affect working relationships or monitor behaviour may fall within the employment category and also raise labour-law and GDPR questions.	Purpose, affected groups, indicators, decision owner, notice, consultation and challenge route.
Customer chatbot or voice assistant	Interactive systems may require a clear notice that the person is interacting with AI unless the interaction is obvious in context.	Interface screenshots, notice wording, escalation to a person and accessibility check.
AI-generated public-facing images, audio or text	Article 50 can require machine-readable marking or disclosure, subject to the relevant exception and content type.	Generation workflow, labelling method, human review, editorial responsibility and publication record.
Credit, insurance, access or eligibility decisions	Some essential private or public service uses are listed as high-risk and can intersect with anti-discrimination and sectoral rules.	Decision criteria, datasets, human oversight, explanation path and affected-person rights.

Do not classify a system only by the word “AI” in a sales brochure. Ask what the tool actually does, which people it affects, whether it generates or ranks content, whether it makes or supports a decision, and whether it is integrated into a regulated product. The Commission’s AI Act Service Desk provides tools and guidance that can support this initial assessment.

Which AI practices are prohibited?

The AI Act bans certain practices because their risks are considered unacceptable. Examples include harmful manipulation or deception, harmful exploitation of vulnerabilities, social scoring, certain forms of individual criminal-offence prediction, untargeted scraping to create facial-recognition databases, workplace or education emotion recognition, and biometric categorisation to infer protected characteristics, subject to the precise legal wording and exceptions.

For a foreign company with Romanian staff, the workplace emotion-recognition prohibition deserves particular attention. A vendor may market a “wellbeing”, “engagement” or “productivity” product without describing it as emotion recognition. The business should look at the functionality and the data signals used, not only the product name. The same applies to tools that claim to infer personality, intent, reliability or risk from communications.

Procurement gate

Require the business owner to describe the system’s purpose, data sources, affected people and output before purchase or activation.

Red-flag review

Escalate tools involving vulnerability exploitation, social scoring, biometric inference, emotion recognition or behavioural prediction.

Decision record

Record why the company concluded that a use is permitted, prohibited, outside scope or subject to another compliance route.

What transparency duties apply from 2 August 2026?

Article 50 covers specific interactions and outputs. A provider of an AI system intended to interact directly with natural persons must ensure that people are informed that they are interacting with an AI system unless this is obvious in context. Providers of systems generating synthetic audio, image, video or text must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, subject to the stated limits and exceptions.

Deployers have additional duties in defined situations. People exposed to emotion-recognition or biometric-categorisation systems must be informed. A deployer of an image, audio or video deepfake must disclose that the content was artificially generated or manipulated, subject to the artistic and other exceptions. Text generated or manipulated by AI and published to inform the public on matters of public interest must also be disclosed, but the obligation does not apply where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility.

This is why the website’s ordinary AI Notice and a public disclosure under Article 50 should not be treated as identical. An editorial footer may be useful transparency, but it does not automatically satisfy every machine-readable marking or user-facing notice requirement. Each workflow should be checked according to the system, output, audience and publication context.

Practical control: create a short content decision tree: AI-assisted editing, substantially generated content, deepfake or synthetic media, public-interest text, customer interaction. Assign the corresponding label, machine-readable marker, human review and approval record.

Does every AI-generated business article or image need a label?

No single answer applies to every output. The AI Act distinguishes between the type of system, the type of output and the way the content is published or presented. Standard editing that does not substantially alter the input may fall within an exception to the machine-readable marking duty. A human review and editorial-control exception may apply to certain public-interest text. Deepfakes have their own disclosure rule, while chatbots require a direct-interaction analysis.

The company should document the workflow instead of making a broad statement such as “all AI content is exempt” or “all AI content must be labelled in the same way”. Keep the prompt or source material where appropriate, the generated version, the human changes, the responsible editor, the final label and the publication channel. This is particularly useful where content is repurposed across websites, advertisements, social media and customer communications.

What does AI literacy require?

Article 4 requires providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy for staff and other persons dealing with the operation and use of AI systems on their behalf. The measures should take account of technical knowledge, experience, education, training, the context in which the systems are used and the people or groups on whom the systems are used.

This is a context-based obligation, not a fixed annual course or a universal certification. A marketing employee using a writing assistant, an HR manager using a candidate-ranking tool and an engineer managing a model deployment do not need identical training. The employer should explain relevant limitations, data handling, hallucination and reliability risks, prohibited uses, escalation routes, human review and the consequences of relying on outputs.

Identify AI users

List employees, contractors and other persons acting on the company’s behalf who operate or use an AI system. Include occasional users where the risk justifies it.

Match training to context

Separate basic safe-use guidance from role-specific instruction for HR, legal, customer service, developers, procurement and management.

Keep training records

Retain the audience, date, topics, materials, completion evidence and any follow-up testing or policy acknowledgement.

Update after change

Reassess training when a new system, material model update, high-risk use, incident or regulatory guidance changes the risk profile.

The Commission’s AI-literacy Q&A explains that enforcement of Article 4 is handled by national market-surveillance authorities and that there is no one-size-fits-all competence framework. A Romanian business should therefore build a proportionate internal record rather than wait for a template course.

What should employers know about recruitment and workplace AI?

Annex III identifies AI systems intended for recruitment or selection, including targeted job advertising, application analysis and candidate evaluation. It also identifies systems used to make decisions affecting terms of work-related relationships, promotion or termination, allocate tasks based on individual behaviour or personal traits, or monitor and evaluate performance and behaviour.

Under the current Commission timeline, the rules for high-risk systems in these sensitive areas apply from 2 December 2027 following the Digital Omnibus transition. This does not create a compliance holiday. A Romanian employer must still consider GDPR, Romanian labour law, anti-discrimination rules, information duties, collective arrangements, employment records, confidentiality and the possibility of human challenge. A vendor’s score should not become an unexplained substitute for a lawful employment decision.

Before deploying such a tool, the employer should identify who makes the final decision, what the AI output means, whether a person can disregard it, what data is used, whether a candidate or employee can obtain an explanation, and what happens if the system produces an incorrect or discriminatory result. The analysis should also consider whether the foreign group’s HR platform is being deployed by the Romanian entity or merely accessed for central administration.

Separate the dates: the later high-risk deadline concerns the AI Act’s high-risk requirements. It does not suspend GDPR or employment-law obligations that may arise from the same processing or decision today.

Vendor contracts and AI due diligence

A foreign company should not accept a short vendor statement as its entire AI Act file. The contract and due-diligence record should allow the Romanian operation to understand the system’s intended purpose, role allocation, technical limitations, data use, security, logging, human oversight, incident cooperation, transparency features and change-management process.

Purpose and role

Ask whether the supplier is a provider, GPAI provider, importer, distributor or another operator, and whether the Romanian entity is a deployer. Retain the product description, role matrix and contract.

Data and outputs

Check what data is processed, where it is stored, whether prompts or outputs train a model, and whether personal data can be isolated. Keep the data-flow map, DPA and security schedule.

Human oversight

Confirm whether the operator can intervene, override, suspend or test the system and whether those limits are communicated. Keep the operating procedure and testing logs.

Incidents and changes

Agree how model changes, outages, security events and regulatory requests are communicated. Keep notice SLAs, version history and audit rights.

Exit and continuity

Plan how the company will retrieve records, delete data and continue operations if the tool is withdrawn or reclassified. Keep the exit and retention plan.

Where the tool is supplied by a group company, the intercompany agreement should be tested in the same way as an external vendor contract. The Romanian entity may need practical access to information even when procurement, model management and security are centralised abroad.

How does the AI Act interact with GDPR and Romanian employment law?

The AI Act does not replace GDPR. Article 2 expressly preserves the application of Union data-protection, privacy and communications rules. A company may therefore need a lawful basis, purpose limitation, data minimisation, transparency, retention controls, processor arrangements, security measures and, where relevant, a data-protection impact assessment in addition to its AI Act analysis.

Workplace deployment adds another layer. If an AI tool ranks applicants, monitors employees, allocates tasks or recommends termination, the employer should consider the Labour Code, anti-discrimination protections, employee information and consultation, internal policies and the safeguards around automated decision-making. A human reviewer is important, but “human in the loop” is not a complete answer if the reviewer simply approves an unexplained score.

For customer-facing systems, consumer-protection and sectoral obligations may also apply. For regulated products, product-safety rules, conformity assessment and technical documentation may interact with the AI Act. The right approach is a combined compliance map that shows which regime addresses which risk.

AI Act

Classifies the system and creates duties tied to the operator role, risk level, transparency, literacy and governance.

GDPR

Controls personal-data processing, individual rights, security, profiling and the relationship between controller and processor.

Employment and sector law

Protects workers, customers and regulated activities through additional information, fairness, safety and challenge requirements.

Who supervises the AI Act in Romania?

Enforcement is shared. The European Commission’s AI Office supervises general-purpose AI providers and certain connected systems, while national competent authorities supervise other AI systems. The European Data Protection Supervisor has a specific role for systems used by EU institutions. The Romanian entity should monitor the national designation and implementation measures relevant to its activity instead of assuming that every question goes to one central EU authority.

The AI Act also allows complaints, investigations, information requests and other enforcement tools. The applicable authority may consider the nature, gravity and duration of an infringement, affected persons, the operator’s size and turnover, cooperation, responsibility, mitigation and whether the conduct was intentional or negligent.

What penalties can apply?

Article 99 sets maximum levels for several categories, while Member States establish the detailed national penalty and enforcement rules. Non-compliance with prohibited practices can reach up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher. Other listed operator obligations, including certain deployer and transparency duties, can reach up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher. Incorrect, incomplete or misleading information supplied to authorities can attract a separate maximum of EUR 7.5 million or 1% of worldwide annual turnover.

For SMEs and start-ups, Article 99 provides a lower-of-the-two limits approach for the amounts or percentages referred to in the provision. The figures are maximums, not automatic fines. Authorities must assess the individual circumstances and procedural safeguards remain relevant. Companies should avoid both extremes: treating the maximum as inevitable or assuming that a small local subsidiary has no exposure because the parent owns the technology.

Practical AI Act compliance checklist for a Romanian operation

01 · InventoryBuild the AI register

List systems, vendors, users, business owners, locations, outputs, affected people and group-company relationships. Include pilots and shadow AI.

02 · ClassifyAssign the legal route

Screen scope, prohibited practices, high-risk categories, transparency duties, GPAI dependencies, sector rules and applicable transition dates.

03 · ControlPut safeguards in place

Set access rules, human review, notices, marking, training, procurement controls, incident escalation and data-protection measures.

04 · EvidenceKeep the decision trail

Retain the classification rationale, vendor file, contract, training evidence, approvals, tests, incidents, changes and review date.

Create an inventory

Owner: Legal, IT, procurement and business owners. Output: an AI register with purpose, provider, deployer, data and affected persons.

Approve use cases

Owner: management with legal and security input. Output: a classification note, prohibited-use sign-off and escalation route.

Train users

Owner: HR, compliance and system owners. Output: role-based AI-literacy materials and completion evidence.

Review public outputs

Owner: marketing, communications and editorial owners. Output: a disclosure, marking and human-review record.

Monitor change

Owner: system owner and vendor manager. Output: version, incident, access, performance and reassessment logs.

Common mistakes made by foreign groups

“The parent handles it”

Central governance can help, but the Romanian operation still needs to know its role, local use, affected people and evidence available to it.

“The vendor is compliant”

Vendor compliance material is an input. It does not answer whether the Romanian entity is a deployer, importer or affected operator in the actual workflow.

“The deadline is 2027”

The later high-risk date does not postpone AI literacy, prohibited-practice controls, transparency duties or GDPR and employment-law analysis.

“A human checked it”

A nominal reviewer may not provide meaningful oversight. Define authority to challenge, override, document and stop the system.

“A footer solves labelling”

Website disclosure, user notice and machine-readable marking answer different questions. Match the control to the content and channel.

“Only official AI tools count”

Shadow AI used with company data can create the same confidentiality, data-protection and output risks as an approved platform.

Frequently asked questions

Does the AI Act apply if our parent company is outside the EU?

It may. Scope can arise because the Romanian entity deploys an AI system in the Union or because output from a third-country system is used in the Union. Analyse the actual provider, deployer, importer and output-use roles.

Are AI recruitment tools high-risk from 2 August 2026?

Not necessarily under the current transition timetable. Annex III includes recruitment and worker-management uses, but the Commission currently identifies 2 December 2027 for the selected sensitive high-risk areas after the Digital Omnibus changes. GDPR, employment and anti-discrimination duties can apply earlier.

Must employees disclose every use of ChatGPT or another writing assistant?

No universal AI Act rule requires disclosure of every private drafting step. The right control depends on the system, output, audience, content type, company policy and whether Article 50 applies. The employer should set a clear internal policy for confidential or regulated material.

Is an AI officer mandatory in Romania?

The AI Act does not impose a universal AI-officer title for every company. A foreign group should nevertheless allocate responsibility for inventory, classification, training, procurement, transparency, incidents and regulatory liaison.

Does using a human reviewer remove AI Act and GDPR risk?

No. Meaningful human oversight can be important, but it does not erase the underlying classification, transparency, data-protection, fairness or employment-law analysis. The reviewer must have information, time and authority to challenge the output.

Can we rely entirely on the AI vendor’s compliance statement?

No. Vendor material should be verified against the Romanian workflow, contract, data, users and role allocation. Keep evidence of the questions asked, the answers received and the decision made by the company.

Need to assess AI use in a Romanian business?

A Romanian business lawyer can help map the group structure, classify AI systems, review vendor terms, align GDPR and employment safeguards, and prepare a proportionate evidence file.

Contact Atrium Romanian Lawyers

This page provides general information only and does not constitute legal advice, a legal opinion or the creation of a lawyer-client relationship. Legal solutions depend on the specific facts, systems, contracts and legislation in force at the relevant time.

AI Notice: AI-assisted content, reviewed by a qualified Romanian lawyer.

31Mar

Workplace Investigations in Romania: Employer Guide

by Simona Rotaru Employment Law

Employment compliance · Romania

Workplace Investigations in Romania: Employer Guide

A workplace investigation should separate what happened, whether a workplace rule was breached and what response is proportionate. Treating an allegation as established misconduct, or sanctioning an employee before giving a genuine opportunity to respond, can undermine an otherwise legitimate employment decision.

This guide is for Romanian employers, foreign-owned companies, HR teams and managers handling complaints, misconduct allegations, harassment concerns or possible disciplinary action. The correct procedure depends on the facts, internal documents, evidence and current Romanian employment law.

Core rule: a complaint is an allegation, not a finding. A fact-finding review, grievance investigation and disciplinary investigation are not automatically the same process. When the employer considers a disciplinary sanction other than a written warning, Article 251 of the Labour Code generally requires a prior disciplinary investigation and a genuine opportunity for the employee to defend themselves.

Play

Disciplinary procedure in Romania: the legal steps employers should follow when investigating misconduct and considering a sanction.

What is a workplace investigation in Romania?

A workplace investigation is a structured process for establishing facts relevant to an employment decision. It may concern alleged misconduct, harassment, discrimination, retaliation, conflicts of interest, misuse of company systems, confidentiality breaches or safety incidents.

The employer should define the investigation’s mandate before collecting evidence. The mandate should identify the concern, persons involved, relevant period, immediate risks and question the investigation must answer. It should not begin with a predetermined sanction or assume that the complainant’s version is already proven.

Fact-finding

Establish what happened, which records exist, who can provide relevant information and whether immediate safeguards are needed.

Disciplinary route

Use the Article 251 procedure when the employer is considering a disciplinary sanction other than a written warning.

Proportionate response

Separate the finding from the remedy and assess the employee’s fault, consequences, conduct and previous sanctions.

Important: the investigation should identify both incriminating and exculpatory evidence. A file that collects only material supporting the initial allegation may be vulnerable even if the underlying concern was genuine.

What process should an employer follow?

The process should be adapted to the allegation. An initial complaint may require a fact-finding review, grievance procedure, safeguarding response or a specialised investigation. If the employer moves toward a disciplinary sanction, the statutory disciplinary safeguards must be added before the decision is made.

Where the allegation concerns workplace harassment, violence or discrimination, the employer should also verify any specific obligations arising under applicable anti-harassment and equal-treatment legislation and internal procedures.

Select a stage to see its legal and operational purpose.

Intake and scope

Record the allegation, persons involved, date, immediate risks and question the investigation must answer. Do not begin with a predetermined sanction.

Situation	Likely route	Key safeguard	Risk if mishandled
Initial complaint or concern	Fact-finding, grievance or safeguarding review.	Define scope and preserve neutrality.	A complaint is treated as proof before the facts are tested.
Possible disciplinary misconduct	Article 251 disciplinary investigation.	Written summons and genuine opportunity to defend.	Sanction may be challenged for procedural failure.
Written warning only	Statutory exception may apply.	Confirm that the measure is truly a written warning.	An incorrectly classified sanction may require the full procedure.
Harassment, discrimination or retaliation	Specialised investigation plus employment-law analysis.	Protect complainants, witnesses and confidential data.	Retaliation, privacy or discrimination exposure may increase.

When is a formal disciplinary investigation mandatory?

Article 251 generally requires a prior disciplinary investigation before any sanction other than a written warning. This applies when the employer is considering a demotion, suspension, disciplinary dismissal or another statutory disciplinary sanction. A management conversation, informal warning or internal email cannot safely replace the procedure where the contemplated measure is disciplinary and falls outside the written-warning exception.

The employer should identify the applicable workplace rule, the alleged act or omission, the decision-maker and the person responsible for the investigation. As a matter of good practice, the investigator should be sufficiently independent from the allegation and should disclose any conflict of interest. The file should show that the employee was given a real opportunity to respond, not only that a meeting was placed on the calendar.

If the employer concludes that the matter is not disciplinary, the reason should still be documented. A grievance or fact-finding process may lead to organisational measures, training, policy changes or protection for affected persons. It should not be used as a disguised disciplinary process that deprives the employee of Article 251 safeguards.

What are the employee’s rights during the investigation?

The employee should know the subject of the investigation and receive a written summons stating the subject, date, time and place. Under Article 251, the employee may formulate and support defences and offer the evidence and reasons they consider necessary. At the employee’s request, they may be assisted by an external labour-law consultant or by a representative of the trade union of which they are a member, in accordance with the Labour Code in force at the time of the investigation. The summons should be sufficiently clear for the employee to understand the allegation and prepare a meaningful response.

The employer should allow the employee to provide explanations and propose or submit evidence relevant to the allegation. The investigator should consider that material and record why it is accepted, rejected or considered immaterial. A refusal to answer a question is not automatically proof of misconduct, and an employee’s absence does not prove the allegation.

If the employee does not attend without an objective reason after a lawful summons, the employer may continue under the statutory conditions. The file should preserve the summons, proof of delivery, any explanation for non-attendance and the decision to continue. The employer should not use the absence to bypass the duty to assess the available evidence fairly.

Clear summons

State the subject, date, time and place, allowing the employee to understand and prepare for the hearing.

Real defence

Allow explanations, relevant evidence and assistance by a labour-law consultant or permitted trade-union representative at the employee’s request.

Complete record

Keep proof of delivery, attendance, submissions, questions, answers and the reasoning used in the final decision.

How should evidence and confidentiality be handled?

Evidence should be relevant to the defined allegation and obtained through authorised, lawful and proportionate channels. Employers should identify who may access HR files, whether monitoring policies were communicated, how records are retained and whether access can be limited to the investigation team.

Digital evidence may include emails, access logs, system records, messages, time records or video material, but its availability does not automatically make its use lawful or decisive. The employer should consider purpose, necessity, proportionality, notice, access controls, the privacy interests of employees and third parties, and whether monitoring measures were previously implemented and communicated in accordance with applicable employment and data-protection requirements.

The GDPR does not prevent a workplace investigation, but it requires a lawful, fair and proportionate approach. Health data, recordings, allegations of harassment and messages involving third parties require particular care. The employer should avoid distributing the file more widely than necessary and should communicate findings only to persons with a legitimate role.

Select an evidence category to review the main safeguard.

Policies and rules

Keep the internal regulation, policy, job description or lawful instruction that allegedly applies, together with evidence that the employee could access it.

How is a disciplinary sanction chosen?

Article 250 requires an individualised proportionality assessment. The employer should consider the circumstances of the act, the employee’s degree of fault, the consequences, general conduct and previous disciplinary sanctions. The same rule breach may justify different responses depending on intent, repetition, actual harm, training and whether the rule was clear and accessible.

The reasoning should connect the evidence to the finding and the finding to the sanction. A written decision that simply repeats the allegation without explaining the defence, fault and proportionality may be difficult to defend. The employer should also distinguish a disciplinary sanction from a performance-management measure, redundancy, professional inadequacy or a business reorganisation.

Disciplinary fines are prohibited. An employer should not disguise a fine as an unlawful salary deduction or informal penalty. Any financial measure must be assessed separately under the applicable employment and payroll rules. The written decision should explain the legal basis, factual conduct, sanction and challenge information required by law.

Select each control before communicating a sanction.

Scope and authority

Confirm the legal route, applicable rule, decision-maker and investigator. Check for conflicts of interest before the process moves forward.

When can disciplinary dismissal be used?

Disciplinary dismissal under Article 61(a) is reserved for serious misconduct or repeated breaches of workplace discipline. It requires the prior disciplinary investigation and a written, reasoned decision complying with the applicable Labour Code requirements. There is no universal rule that a lesser sanction must always be issued first, but the seriousness and proportionality of dismissal must be demonstrable on the facts.

The employer should not use disciplinary dismissal to solve a redundancy, professional-inadequacy or performance-management problem that belongs to a different legal route. The legal ground determines the evidence, procedure, decision and risks. Re-labelling a business or performance issue as misconduct can make the decision vulnerable.

Before dismissal, the employer should test whether the internal rule was valid and accessible, whether the employee’s conduct is established, whether the employee’s explanations were considered, whether lesser measures were relevant and whether the sanction is proportionate to the actual harm and circumstances.

What deadlines and decision content apply?

The disciplinary sanction decision must ordinarily be issued within 30 calendar days from the date on which the competent employer representative is considered to have become aware of the misconduct and no later than six months from the act. It must be communicated within five calendar days of issue. The employer should preserve proof of awareness, issuance and communication because a disagreement about dates can become central in litigation.

Decision element	What it should address	Why it matters	Control before issue
Factual description	The act or omission, with enough detail to identify the allegation.	Prevents an unclear or post-hoc case.	Match the description to the evidence and hearing subject.
Breached rule	Internal regulation, contract, statute or lawful instruction.	Connects the conduct to a binding obligation.	Show that the rule existed and was accessible.
Defence analysis	Why the employee’s explanations and evidence were accepted or rejected.	Shows that the hearing was genuine.	Address material submissions specifically.
Legal basis and remedy	Applicable Labour Code provision, challenge period and competent court.	Supports informed challenge and judicial review.	Use the current statutory wording and verify communication.

Deadlines and content should be checked against the current Labour Code and the specific facts. The employer should not rely on a generic template that omits the allegation, defence analysis, legal basis, sanction or challenge information required for the decision.

Common employer errors

Starting with a conclusion

The investigator collects only incriminating material and treats the complaint as an established fact.

Using a generic summons

The employee cannot understand the subject of the hearing or prepare a meaningful defence.

Missing dates

The employer cannot prove awareness, issuance or communication within the applicable statutory period.

Other recurring problems include denying reasonable preparation time without recording a reason, ignoring the employee’s written defence, imposing a disciplinary fine or unlawful salary deduction, confusing performance management with misconduct and allowing a conflicted investigator to control the file.

Employers should also avoid broad circulation of allegations, informal promises about the outcome, deletion of relevant records, retaliatory treatment of complainants or witnesses and changes to the accusation after the hearing without giving the employee a fair opportunity to respond.

Practical checklist for Romanian employers

Define the allegation, scope, persons involved and immediate risks.
Identify whether the matter is fact-finding, grievance, safeguarding or disciplinary.
Preserve relevant evidence through authorised and proportionate channels.
Appoint an impartial investigator and record the mandate and any conflict check.
Identify the internal rule, contract term, policy or lawful instruction involved.
Summon the employee in writing with the subject, date, time and place.
Allow explanations, relevant evidence and permitted assistance.
Assess both incriminating and exculpatory material and record the reasoning.
Apply the Article 250 proportionality factors before choosing a sanction.
Check that dismissal, if contemplated, uses the correct legal ground.
Issue and communicate a complete written decision within the statutory deadlines.
Restrict access to the file and retain evidence of delivery and communication.

Frequently asked questions

Does every workplace complaint require a disciplinary investigation?

No. An initial complaint may require fact-finding, a grievance review or a safeguarding investigation. Article 251 becomes central when the employer considers a disciplinary sanction other than a written warning.

Can an employee refuse to attend the disciplinary hearing?

The employee should attend or explain an objective reason for absence. After a lawful written summons, an unjustified absence may allow the employer to continue under Article 251, but the absence is not itself proof of misconduct.

Can an employer use emails and access logs as evidence?

Potentially, if the material is relevant, lawfully obtained, proportionate and handled with appropriate confidentiality. Monitoring policies, access controls and data-protection safeguards should be checked before relying on digital evidence.

Is disciplinary dismissal possible without a previous warning?

Yes, Romanian law does not impose a universal requirement to issue a lesser sanction first. However, the misconduct must justify dismissal on the facts, the Article 251 investigation must be completed and the sanction must be proportionate.

What is the deadline for issuing a disciplinary sanction?

The decision is ordinarily issued within 30 calendar days from the employer’s awareness of the misconduct and no later than six months from the act. It must be communicated within five calendar days of issue.

What makes a workplace investigation defensible?

A clear scope, impartial handling, relevant and lawfully obtained evidence, a genuine opportunity for the employee to respond, proportionality analysis and a complete written decision supported by proof of communication.

Need advice before a workplace decision?

A focused review before a summons, sanction or dismissal can identify missing evidence, procedural risks and the correct employment-law route.

Book a consultation

Disclaimer: This article provides general information only and does not constitute legal advice or the creation of a lawyer-client relationship. The applicable procedure depends on the facts, employee category, internal documents, evidence and current legislation. Obtain a case-specific assessment before starting an investigation or issuing a sanction.

AI Notice: AI-assisted content, reviewed by a qualified Romanian lawyer.

Changing shareholders in Romania 2026 legal guide showing business professionals, financial risks, and share transfer process illustration

17Mar

Changing Shareholders in a Romanian Company: The 2026 Legal Guide

by Simona Rotaru Company Formation in Romania, Corporate Law

Changing Shareholders in a Romanian Company: The 2026 Legal Guide

TL;DR: Changing shareholders in a Romanian SRL requires a share transfer agreement, a shareholders’ resolution, an updated Articles of Association, and a Trade Register filing within 15 days. Since December 2025, Law 239/2025 adds a mandatory 15-day ANAF notification for any controlling stake transfer. From 1 January 2026, capital gains tax on direct share sales rises from 10% to 16%. Incomplete documents or missed deadlines can derail funding rounds and trigger significant penalties.

Romanian lawyers discussing corporate shareholder structure in a modern office

Strategic legal consultation for complex shareholder changes in Romanian SRLs.

📹 Video Guide: Changing Shareholders in Romania

Watch this comprehensive video guide covering the essentials of shareholder changes, share transfer procedures, and key legal considerations for Romanian companies in 2026.

Play

Need Professional Help?

At Atrium Romanian Lawyers, we handle the entire shareholder change process — from drafting documents to Trade Register submission. We advise local clients and international investors on corporate governance, share transfers, and regulatory compliance.

Book Consultation View Our Services

What Does Changing Shareholders in a Romanian Company Actually Mean?

Earlier this year, one of our long-standing corporate clients came very close to losing an important investment deal. Not because of a financial problem or a contract dispute. Because one outdated name in a shareholder register stood between the company and a signed term sheet.

Changing shareholders in a Romanian SRL (societate cu răspundere limitată, or limited liability company) means transferring părți sociale (social parts, the Romanian term for ownership stakes) from one person or entity to another. This can happen through a sale, a gift, an inheritance, or a new capital subscription. The legal result is a change in the company’s ownership structure, which must be registered with the National Trade Register Office (ONRC).

Aspect	SRL (Limited Liability)	SA (Joint-Stock)
Ownership Units	Părți sociale (social parts)	Acțiuni (shares)
Transfer Method	Written agreement + ONRC filing	Free market trading or private sale
Approval Required	Yes — shareholders’ resolution	Generally no (unless restricted)
AoA Update	Mandatory for every transfer	Not required for each trade
Registration	Must be filed within 15 days	Recorded in shareholder register

Unlike a joint-stock company (SA), where shares trade freely on the market, SRL social parts carry legal restrictions. They represent not just economic value but also voting rights, profit entitlements, and governance influence. A transfer isn’t complete until it’s properly documented and registered. Until that happens, it doesn’t exist as far as third parties are concerned.

This is also why updating the company’s Articles of Association is a mandatory step in every transfer, not an optional formality. If you’re setting up an SRL in Romania, understanding share transfer rules from day one will save you real trouble later.

Romanian shareholders and lawyers discussing corporate structure in a modern office

A comprehensive shareholder meeting ensures alignment before any official transfer filing.

When Is Shareholder Approval Needed for a Transfer?

Under Romanian corporate law, transfers between existing shareholders don’t require separate approval unless the Articles of Association say otherwise. Transfers to outside third parties are a different matter.

Shareholder Approval Rules for Share Transfers Who Is the Buyer? Existing Shareholder No approval needed (unless AoA says otherwise) Third Party (New Investor) 75% approval default (Law 31/1990) AoA Can Override (Law 223/2020) Set any threshold: 51% to 100% — overrides statutory default

Law 31/1990 on companies sets a default threshold requiring approval from shareholders holding at least three-quarters of the share capital. This default only applies when the AoA is silent on the matter.

Since Law 223/2020, shareholders have total freedom to set that approval threshold at any level they choose, directly in the Articles of Association. A company can require a simple majority of 51%, a unanimous 100%, or anything in between.

Law 223/2020 also abolished the old mandatory 30-day creditor opposition window that used to apply after publication in the Official Gazette. Before 2020, third-party transfers routinely took six to eight weeks because of that waiting period. Today, once the shareholders pass the resolution, the parties proceed directly to signing the transfer agreement and filing with ONRC.

This directly affects minority shareholder rights. A lower approval threshold in the AoA makes it easier for a majority to approve a third-party transfer over a minority’s objection. If you’re a minority shareholder, review your AoA carefully before any new investor enters the picture.

A legal professional signing and stamping a share transfer agreement in Romania

Every social part transfer must be documented by an attested or notarized agreement.

Step-by-Step: How to Change Shareholders in a Romanian Company

The process has six core steps. They must be completed in sequence, and each one demands accurate documentation.

6-Step Share Transfer Process

STEP 1 Draft Share Transfer Agreement Must be attested by a lawyer or notarized

STEP 2 Shareholders’ Resolution 75% approval for third parties (or AoA threshold)

STEP 3 Update Articles of Association Reflect new shareholder composition

STEP 4 File with ONRC (within 15 days) ⚠ Incomplete filings are rejected entirely

STEP 5 Update Beneficial Owner (UBO) Separate obligation with separate sanctions

STEP 6 Notify ANAF (controlling stakes) Law 239/2025 — within 15 days of transfer.

ONRC Filing Checklist

✓ Transfer agreement (lawyer-attested)

✓ Shareholders’ resolution (signed minutes)

✓ Updated Articles of Association

✓ ID documents + registration fee proof

⚠ 15-Day Deadline from Shareholders’ Resolution Missing this deadline means the transfer isn’t effective against third parties

Case Study: When Andrei came to us with a folder of incomplete online templates, steps 2, 3, and 4 all contained errors. The shareholders’ minutes used language that contradicted the AoA. The AoA itself hadn’t been updated since incorporation. The inactive shareholder had relocated abroad and was completely unreachable.

We restructured the entire dossier. We issued formal notifications to the shareholder’s last known address, documented every communication attempt to demonstrate due diligence, redrafted the shareholders’ resolution and updated AoA, and submitted a complete and consistent filing. The Trade Register approved the updated shareholding structure within three weeks. The investor transferred funds shortly after, and the company moved forward with its development plans.

What Changed in 2025 and 2026? New Rules You Must Know

Law 239/2025, published in Romania’s Official Gazette on 15 December 2025 and in force from 18 December 2025, introduced two new obligations for controlling stake transfers in Romanian SRLs: a mandatory ANAF notification and, where applicable, a debt guarantee requirement before the Trade Register will accept the filing.

Law 239/2025 — New Obligations for Controlling Stake Transfers 1. ANAF Notification (Mandatory) Transferor, transferee, or company must notify ANAF within 15 days of the transfer date Include: share purchase agreement + updated Articles of Association 2. Debt Guarantee (If Tax Debts Exist) Company or transferee must guarantee full amount of outstanding tax liabilities Options: cash deposit | bank letter of guarantee | insurance policy — enforced after 60 days 3. New Minimum Share Capital Rules New SRLs: minimum RON 500 | Turnover above RON 400,000: minimum RON 5,000 Existing companies above threshold: comply by end of 2027 | Non-compliance → dissolution risk

These changes add meaningful complexity to M&A transactions and investor onboarding timelines. When planning any controlling stake transfer, you need to factor in the time required to obtain tax clearance documentation, not just the drafting and signing process.

What Are the Tax Consequences of a Share Transfer in Romania?

For individual shareholders selling their stake in a Romanian SRL, the taxable gain is calculated as the difference between the sale price and the original acquisition cost of the social parts. Under the Romanian Fiscal Code (Law 227/2015), this gain is classified as capital income.

Scenario	Tax Rate (2026)	Notes
Individual — Direct Sale	16% (was 10%)	Most SRL social part sales; no broker involved
Individual — Via Broker (held >365 days)	3%	Through a licensed financial intermediary
Individual — Via Broker (held <365 days)	6%	Through a licensed financial intermediary
Corporate Seller	16% CIT	Gain included in ordinary profits
Corporate — Participation Exemption	0%	≥10% stake held ≥1 year uninterrupted

Important: Since 1 January 2026, gains from share transfers not performed through a licensed financial intermediary are taxed at 16%, up from the previous 10%. This covers the vast majority of direct SRL social part sales. Individual sellers must declare capital gains through the annual declarație unică, due by 25 May. This is separate from the ANAF notification requirement under Law 239/2025 — both can apply to the same transaction.

Getting the tax side of a share transfer right starts at the structuring stage, before documents are signed. This is one of the areas where the corporate law services side of legal work and the tax side must move together.

Reservation Agreements vs. Pre-Contracts: Understanding Shareholder Approval Thresholds

Approval Threshold	Legal Basis	When It Applies
75% of share capital	Law 31/1990 (default)	Third-party transfers when AoA is silent
Custom threshold (51%–100%)	Law 223/2020	When AoA expressly sets a different threshold
No approval needed	Law 31/1990	Transfers between existing shareholders (unless AoA requires it)
Unanimous (100%)	AoA provision	When founders want maximum control over new entries

Common Mistakes That Delay or Block a Share Transfer

6 Common Mistakes That Block Share Transfers

❌ Generic Online Templates Inconsistent with your AoA → filing rejected;

❌ Outdated Articles of Association Old names, wrong capital figures → whole filing fails;

❌ Missing 15-Day ONRC Deadline Transfer not effective against third parties;

❌ Unchecked Tax Debts ONRC blocks registration without ANAF clearance;

❌ Forgotten UBO Declaration Separate obligation with separate penalties;

❌ Missing Foreign Shareholder Docs Missing apostille or translation → delayed filing.

✅ Solution: Professional Legal Review From the Start

The cost of fixing a rejected filing is always higher than getting it right the first time.

Do You Actually Need a Lawyer to Change Shareholders in Romania?

For most transfers, Romanian law already provides the answer: yes, at minimum, for document attestation. The share transfer agreement for SRL social parts must be attested by a Romanian lawyer or authenticated by a notary. You can’t skip this step regardless of how simple the transaction seems.

Beyond that legal minimum, the honest answer is: it depends on the complexity of your situation. A straightforward sale between two existing shareholders in a clean, debt-free company with a simple AoA is manageable with proper legal support on the documents. A transfer involving a third party, a new investor, a foreign national, an unreachable shareholder, or a company with outstanding tax obligations is an entirely different matter.

It’s also worth considering whether a shareholder agreement in Romania makes sense alongside the transfer. A well-drafted SHA addresses governance, exit rights, and dispute resolution mechanisms in ways the AoA alone doesn’t cover.

The Bottom Line

Changing shareholders in a Romanian company is more than an administrative step. It changes voting rights, tax obligations, and legal relationships simultaneously.

First: Follow the correct sequence from agreement to resolution to AoA update to ONRC filing, within 15 days. Any gap in the chain creates legal exposure.

Second: Know the new rules. Law 239/2025 added ANAF notification obligations and debt guarantees for controlling stake transfers, and capital gains tax on direct share sales now stands at 16%. These rules are in force now, not coming.

Third: Build the documentation correctly the first time. The cost of fixing a rejected ONRC filing or a blocked registration is always higher than the cost of professional legal support at the outset.

Related Guides & Resources

Expand your understanding of corporate and company law in Romania with these complementary guides:

Essential Reading for Corporate Transactions

Company Formation in Romania – Setting up an SRL and understanding share structures from day one
Corporate & Commercial Law – Full corporate law services for governance, transactions, and compliance
Contract Law in Romania – The legal framework governing share transfer agreements and commercial contracts
Litigation & Dispute Resolution – When shareholder disputes require legal proceedings

Romanian Government & Regulatory Bodies

ONRC (Trade Register) – Company registration and shareholder change filings
ANAF – National Agency for Fiscal Administration — controlling stake notifications
Ministry of Justice – Legal oversight and corporate enforcement
Monitorul Oficial – Official publication of Romanian laws and regulations

FAQ – Changing Shareholders in a Romanian Company

Q: How long does it take to change shareholders in a Romanian company?

A: Once the documents are correctly prepared, ONRC typically processes a share transfer registration within 3 to 7 business days.

The 15-day filing deadline runs from the date of the shareholders’ resolution.

For controlling stake transfers requiring ANAF clearance under Law 239/2025, build in additional time for the tax certificate or guarantee approval.

Q: Does a share transfer in an SRL need to go through a notary?

A: Not necessarily. The transfer agreement can be attested by a licensed Romanian lawyer rather than notarized.

Both formats are accepted by ONRC.

Notarization is required when the transfer is structured as a gift (donation) or when the parties choose it for added evidentiary certainty.

Q: What happens if a shareholder is unreachable or refuses to cooperate?

A: The correct legal approach is to issue formal notifications to their last known address, document all communication attempts, and proceed under the legally permitted procedure set out in Law 31/1990.

Thorough documentation of every notification step is what allows the Trade Register to approve the transfer.

Q: Do I need to update the beneficial owner register after a share transfer?

A: Yes, if the transfer changes who the ultimate beneficial owner is.

Romanian anti-money laundering legislation requires companies to maintain an accurate UBO declaration with the Trade Register.

This is a separate obligation from the share transfer filing itself, and failing to comply carries independent sanctions.

Q: Can a non-resident foreigner be a shareholder in a Romanian SRL?

A: Yes. Romanian law places no nationality restrictions on SRL shareholders.

Both non-resident individuals and foreign companies can hold social parts.

However, foreign shareholders must provide authenticated and translated identity documents.

Missing or improperly apostilled documents are one of the most frequent sources of delay in cross-border share transfers.

Disclaimer: This article is for general information only and does not constitute legal advice. Please consult with a qualified Romanian corporate lawyer to verify current laws and regulations before initiating any shareholder change. Laws and procedures are subject to change, and individual circumstances may vary.

Pre-contract antecontract Romania property purchase legal document and keys on desk

13Mar

Pre-Contract (Antecontract) in Romania: What Every Buyer Must Know Before Signing

by Simona Rotaru Property Law

Pre-Contract (Antecontract) in Romania: What Every Buyer Must Know Before Signing

TL;DR: A pre-contract (antecontract de vânzare-cumpărare) in Romania is a binding preliminary agreement that locks in the price, terms, and timeline of a future property sale, often requiring a promisiune de vânzare. It doesn’t transfer ownership, but it creates real, enforceable legal obligations for both sides. A deposit is typically paid at signing. Getting every clause right protects your money. Don’t sign one without professional legal review, especially for off-plan or developer purchases.

Legal consultation for pre-contract antecontract review at a Romanian law office in Bucharest

Professional legal review of a property pre-contract at Atrium Romanian Lawyers

📹 Video Guide: Pre-Contracts in Romania

Watch this comprehensive video guide covering the essentials of pre-contracts (antecontracte), deposit rules, the Nordis Law, and key considerations for property buyers in Romania.

Play

Need Professional Help?

At Atrium Romanian Lawyers, we review, negotiate, and draft pre-contracts for buyers at every stage of the transaction. We advise local clients and international buyers on the implications of every clause.

Book Consultation View Our Services

What Is a Pre-Contract (Antecontract) in Romanian Law?

What is a pre-contract (antecontract) Romania and how does it relate to antecontractul de vânzare-cumpărare?

A pre-contract (antecontract) Romania, often called ”antecontractul de vânzare-cumpărare„ or „promisiunea de vânzare„, is a preliminary agreement in which the parties undertake the obligationto sell and/or buy or the obligation to purchase in the future.

In practice, un antecontract de vânzare-cumpărare it is a document that records key terms—price, subject, term of execution and conditions—so that purchase can be concluded later.

A pre-contract in Romania is a binding preliminary agreement in which both parties commit to completing a property sale at a future date, under terms already agreed.

It creates firm legal obligations now, even though ownership only transfers when the final notarial deed is signed.

Under Romanian contract law, the pre-contract is governed primarily by Articles 1279 and 1669 of the Civil Code. Article 1279 states that a promise to contract must contain all the essential clauses of the intended final contract.

Article 1669 gives a court the power to issue a ruling that substitutes the final notarial deed if one party unjustifiably refuses to sign.

In plain terms: once you both sign a properly drafted pre-contract, neither side can simply walk away without consequences.

Lawyers and courts use the terms “antecontract,” “precontract,” and “promisiune bilaterală de vânzare-cumpărare” interchangeably. They all describe the same legal instrument under the Civil Code.

Type	Who Is Bound	Common Use
Bilateral Pre-Contract	Both buyer and seller	Most common in property transactions; locks in terms for both parties
Unilateral Promise (Seller)	Only the seller	Used when the buyer wants to secure the right to purchase but hasn’t fully committed
Unilateral Promise (Buyer)	Only the buyer	Rare; used when the seller needs certainty of a committed buyer

The pre-contract is not a sale. It does not transfer ownership. It creates a personal obligation to complete the sale under agreed conditions.

Is Signing a Pre-Contract Required When Buying Property in Romania?

Do I need to sign the Antecontract at the Public notary?

While a verbal promise can create obligations, for safety both parties prefer to conclude the pre-contract before a notary in Romania, so that the document is enforceable and can include clauses regarding the transfer of ownership rights.

No, Romanian law does not make the pre-contract mandatory for property purchases.

Parties can go directly to a notary and sign the final sale deed in a single step, if they both choose to.

In practice, though, a pre-contract is used in the overwhelming majority of Romanian property transactions:

When the buyer needs time to arrange financing
When the seller still needs to resolve a title issue
As the standard instrument for off-plan purchases, where the property doesn’t physically exist yet
Banks treat it as a prerequisite for mortgage applications

Signing a pre-contract before accessing credit is standard across the Romanian residential market, as noted by the Banca Națională a României in its Financial Stability Report, which tracks mortgage lending growth tied to preliminary agreements.

If you’re a foreign buyer navigating the Romanian market for the first time, our guide on the full property purchase process in Romania is a good starting point before you sign anything.

What Must a Romanian Pre-Contract Include?

Essential clauses and documents needed before signing

A valid pre-contract must contain all the essential clauses of the intended final sale contract. Without them, the agreement may be unenforceable, or it may leave you exposed to risks that are very difficult to fix later.

Notary signing a pre-contract antecontract for property purchase in Romania

Signing a pre-contract at a Romanian notary office

At minimum, every pre-contract should state:

The full identity of both parties (name, address, and ID or registration number)
A complete description of the property (address, surface area, cadastral number, and land book number)
The agreed total price and currency
The amount paid at signing as a deposit or advance
The deadline for signing the final notarial deed
The consequences if either party defaults
Any suspensive conditions that must be met before the final sale proceeds

Essential Element	Why It Matters
Party Identification	Act de identitate, registration number — prevents identity disputes
Property Description	Address, surface, cadastral number, land book number — ensures the correct property is identified
Price & Currency	Agreed total price — prevents later price manipulation
Deposit Type & Amount	Arvună vs. avans — determines penalty rules if deal falls through
Signing Deadline	Execution term — creates enforceable timeline
Default Consequences	Penalties, deposit forfeiture rules — protects both parties
Suspensive Conditions	Mortgage approval, cadastral registration — protects buyer from losing deposit unfairly

Suspensive conditions are particularly important and often poorly drafted. Common examples include mortgage approval by a specified bank deadline, completion of cadastral registration, removal of a mortgage or annotation from the land book, or the seller obtaining a succession certificate.

Before signing, always verify property ownership and check for encumbrances, annotations, or legal disputes registered against the property in the land book. This step is non-negotiable. For a deeper look, see our article on the property ownership verification process.

Case Study: When we reviewed a pre-contract for an international client purchasing an off-plan apartment, we identified several clauses exposing the buyer to significant financial risk. The deposit conditions were ambiguous about the type of payment made, the developer’s delivery obligations were vague, and there was no suspensive condition protecting the buyer in case of mortgage rejection. We identified these issues and negotiated revisions before any money changed hands.

How Deposits and Advance Payments Work in Pre-Contracts

Romanian law distinguishes between arvuna (earnest money), regulated by Arts. 1544–1546 Civil Code, and simple advance payments (avans), which represent partial payment of the price and are governed only by general contract rules.

Comparison between arvuna confirmatorie deposit and avans advance payment in Romanian pre-contracts

Understanding the legal difference between deposit types in Romanian property law

Aspect	Arvună Confirmatorie (Deposit)	Avans (Advance)
Legal Basis	Articles 1544–1546 Civil Code	General contract law
Function	Mutual penalty mechanism	Partial payment of the price
Buyer Defaults	Seller keeps the deposit	Return depends on contract terms
Seller Defaults	Seller returns double the deposit	Return depends on contract terms
Typical Amount	5%–10% of agreed price	Varies; can be any amount
Buyer Protection	Strong — double return penalty	Weak — no automatic penalty

How the Arvună (Deposit) Mechanism Works BUYER Pays arvună at signing 5–10% PRE-CONTRACT Arvună held SELLER Receives arvună ❌ Buyer Defaults Seller keeps the entire deposit ✅ Seller Defaults Seller must return DOUBLE the deposit Poorly drafted pre-contracts describing a payment as “deposit” without specifying the type can be devastating for buyers.

In practice, deposits in Romanian property transactions typically range from 5% to 10% of the agreed price, as confirmed by Imobiliare.ro’s 2025 market guide for off-plan purchases.

Developer penalty clauses are another area of risk. Many standard developer pre-contracts historically included symbolic delay penalties of 2% to 3% per year, which barely compensated buyers for the real cost of a late completion. This is precisely why the Nordis Law capped advance amounts and introduced construction-milestone-based payment rules.

Reservation Agreements vs. Pre-Contracts: Key Differences

Not every document you’re asked to sign before a property purchase is a full pre-contract. Real estate agencies and developers often present reservation agreements (convenții de rezervare) at an earlier stage.

Aspect	Reservation Agreement	Pre-Contract (Antecontract)
Legal Nature	Shorter, simpler commitment	Full preliminary agreement
Binding Effect	Limited; reserves property for a period	Binding on both parties
Fee/Deposit	Small reservation fee (should be refundable)	Arvună or avans (5–10% of price)
Notarization	Not typically notarized	Notarization strongly recommended; mandatory for off-plan (Nordis Law)
Land Book Registration	Not registrable	Can be noted in the Land Book
Court Enforcement	Limited enforceability	Court can substitute the final deed (Art. 1669)

Before December 2025, reservation agreements were largely unregulated in Romania. Non-refundable reservation fees were common. Buyers whose mortgage applications were rejected often lost their deposit with no legal recourse.

The consumer protection rules enforced by ANPC (Autoritatea Națională pentru Protecția Consumatorilor) already applied to standard-form reservation agreements used with consumers. Abusive clauses could be challenged under consumer law. Our article on abusive clauses in Romanian contracts covers the relevant legal framework.

Case Study: In one recent case, we advised an international client that a document presented as a “standard reservation form” contained a non-refundable clause with no carve-out for mortgage rejection. Had the bank declined the loan for any reason, the client would have lost the entire reservation fee. We renegotiated the clause before any money changed hands, adding an explicit mortgage rejection carve-out and a 30-day refund deadline binding on the agency.

What Happens If One Party Refuses to Sign the Final Contract?

Legal effects and remedies under Romanian law

If either party unjustifiably refuses to sign the final sale deed, the other party has two main options under Romanian law: claim compensation, or ask a court to substitute the contract.

Remedies When a Party Refuses to Sign One Party Refuses to Sign Final Deed Aggrieved party chooses remedy ⚖️ Specific Performance Art. 1669(1) Civil Code Court ruling substitutes the final deed 💰 Claim Damages Arvună rules apply Seller default → buyer gets 2× deposit

Under Article 1669(1) of the Civil Code, a court can issue a ruling that replaces the final notarial deed, effectively forcing the transaction through. This is specific performance in Romanian law. It’s available when the pre-contract contained all essential clauses, the requesting party fulfilled their own obligations, and the refusal is unjustified.

The statute of limitations for bringing this action is generally three years from the date the final contract was due to be signed.

The enforceability of a pre-contract in practice depends almost entirely on how well it was drafted. Courts have dismissed enforcement claims where the pre-contract lacked a clear deadline, a precise property description, or an unambiguous agreed price.

Pre-Contracts for Off-Plan Purchases: What Changed in December 2025

Off-plan residential construction project in Bucharest Romania subject to Nordis Law protections

Off-plan construction projects are now subject to stricter buyer protections under the Nordis Law

The Nordis Law, officially Law 207/2025, published in the Official Gazette no. 1133/08.12.2025, entered into force on 11 December 2025. It was a direct legislative response to the Nordis developer scandal, in which buyers paid large advance sums for apartments that were never delivered.

Key Protections Introduced by the Nordis Law

Nordis Law — Off-Plan Payment Milestone Rules STEP 1: Pre-Conditions Building permit in land book ✓ | Preapartamentare (separate unit entries) ✓ | Notarized form only ✓ STEP 2: Sale Promise Signed at Notary Notary must request land book notation on the same day (or next working day) STEP 3: Payments Into Dedicated Account Funds must go into a bank account used exclusively for the specific project Structural Frame → max 25% Released after verified completion Installations → further 20% Released after installations verified

Developers must now satisfy a set of cumulative conditions before they can sign any promise to sell:

The building permit must be recorded in the land book
Each individual unit must have its own separate land book entry through preapartamentare (pre-apartmentation)
All sale promises must be concluded in notarized form only
The notary is required to request land book notation of the sale promise on the same day of authentication

Advance payments must go into a dedicated bank account used exclusively for the specific project. Funds can only be released based on verified construction milestones. Misuse of advance funds is punishable by a fine of 1% of the developer’s annual turnover.

Important: The Nordis Law doesn’t cover option agreements, conditional sale contracts, joint venture development arrangements, and letters of intent. For those instruments, the general Civil Code rules apply without the specific financial protections. Professional review of developer construction contracts remains essential even after the Nordis Law came into force.

Case Study: In one of our mandates representing a foreign buyer in negotiations with a developer, the standard pre-contract contained no delivery deadline, no penalty clause for delays, and a clause allowing the developer to withdraw on 30 days’ notice without returning the full advance. We restructured the agreement around verified construction milestones, negotiated placement of the buyer’s payments into a dedicated account, and built in a refund guarantee. The model we insisted on for that client is substantially what the Nordis Law now requires by default.

How to Register a Pre-Contract in Romania’s Land Book

Romanian Land Book Cartea Funciara documents for pre-contract registration and property notation

Land Book (Cartea Funciară) documentation and cadastral records for property notation

Registering a pre-contract in Romania’s Land Book (Cartea Funciară) as a notation is not legally mandatory for all pre-contracts, but it is strongly advisable for any buyer.

Land Book Registration: Why It Matters ❌ WITHOUT Registration Binds only you and the seller Seller can sign another pre-contract Seller can borrow against the property Your position is severely weakened ⚠ No priority over later-registered interests ✅ WITH Registration Claim visible to all who search Legal priority over later interests Third parties cannot ignore it Registration fee: ~75 lei at OCPI ✓ Maximum buyer protection

The ANCPI (Agenția Națională de Cadastru și Publicitate Imobiliară) manages the land book system in Romania. The fee for registering a pre-contract notation at the local OCPI office is approximately 75 lei.

Under the Nordis Law rules, notaries are required to request land book notation of a sale promise for off-plan units on the same day of authentication. The UNNPR (Uniunea Națională a Notarilor Publici din România) provides guidance on notarization requirements and fees for preliminary property agreements.

Under Article 906 of the Civil Code, a land book notation of a pre-contract can be cancelled if no court action is initiated within six months of the agreed deadline for signing the final deed. Our detailed guide on Land Book registration in Romania covers every step of the process.

The Bottom Line: Don’t Let “Standard” Cost You Thousands

Three things matter most when it comes to pre-contracts in Romania.

First, a pre-contract is not a formality. It creates real, enforceable obligations from the moment it’s signed. The price, the deposit type, the deadline, and the default consequences are all legally binding from day one.

Second, the Nordis Law has meaningfully improved buyer protections for off-plan purchases. But it doesn’t apply to every contractual instrument used in the market, and it doesn’t replace careful due diligence on any individual transaction.

Third, the cost of a professional legal review before signing is a fraction of what it costs to fight a bad pre-contract in court. And it’s far less than the deposit you stand to lose.

Our team at Atrium Romanian Lawyers reviews, negotiates, and drafts pre-contracts for buyers at every stage of the transaction. We advise local clients and international buyers on the implications of every clause, and we represent clients in enforcement proceedings when things go wrong.

Related Guides & Resources

Expand your understanding of property law in Romania with these complementary guides:

Essential Reading for Property Buyers

The Land Registry Process in Romania – Understand property registration requirements
Property Ownership in Romania: Land Registry, Documents & Verification – Verify ownership before signing
Cadastral Documentation in Romania – Why cadastral records are required for all property transactions
Contract Law in Romania – The legal framework governing all contracts, including pre-contracts
Construction Contracts & Works Agreements – Essential guide for developer purchases

Romanian Government & Regulatory Bodies

ANCPI – National Agency for Cadastre and Land Registration
UNNPR – National Union of Romanian Notaries Public
ANPC – National Authority for Consumer Protection
Monitorul Oficial – Official publication of Romanian laws and regulations
BNR (Banca Națională a României) – National Bank of Romania / Financial Stability Reports

FAQ – Pre-Contracts (Antecontracte) in Romania

Q: Can a pre-contract be signed without a notary in Romania?

A: Yes. A pre-contract can be concluded as a private document signed by both parties, without notarial authentication. This is legally valid and creates binding obligations. However, a private-form pre-contract cannot be noted in the Land Book without additional steps, and it carries less evidentiary weight. Recent legislative proposals following the Nordis scandal aim to require stricter formalities for off-plan residential sales, including the possible use of notarized promises of sale. The exact scope depends on the final legislative text.

Q: What happens to my deposit if the bank rejects my mortgage application?

A: It depends entirely on how your pre-contract is drafted. If it contains a suspensive condition expressly tied to mortgage approval and the bank rejects the application within the agreed timeframe, you’re generally entitled to recover the deposit in full. If no such condition was included, the default arvună rules apply: the buyer is treated as having defaulted, and the seller keeps the deposit. This is one of the most common and costly traps for buyers in Romania.

Q: How long is a pre-contract valid in Romania?

A: A pre-contract is valid for the period the parties agree. There is no legal maximum duration. In practice, most pre-contracts for resale properties carry deadlines of 30 to 90 days. For off-plan purchases, timelines are longer and typically tied to construction milestones. A land book notation can be cancelled if no court enforcement action is started within six months of the agreed deadline.

Q: Can I transfer a pre-contract to another person?

A: A pre-contract can generally be assigned to a third party, but only if the agreement expressly permits it or the other party consents in writing. Many developer pre-contracts explicitly prohibit transfer without the developer’s prior written approval. Failing to verify this correctly can leave you without enforceable rights.

Q: Does signing a pre-contract mean I own the property?

A: No. A pre-contract does not transfer ownership. Ownership in Romania transfers only when the final notarial deed of sale is authenticated and subsequently registered in the Land Book. Until that moment, the seller remains the legal owner. This is why Land Book registration of your pre-contract is so important: it doesn’t make you the owner, but it puts the world on notice of your claim.

Disclaimer: This article is for general information only and does not constitute legal advice. Please consult with a qualified Romanian property lawyer to verify current laws and regulations before signing any pre-contract. Laws and procedures are subject to change, and individual circumstances may vary.

EU Pay Transparency Directive implementation in Romania showing salary transparency and compliance changes effective in 2026

14Jan

EU Pay Transparency Directive in Romania: Key Changes in 2026

by Simona Rotaru Employment Law

Employment law and equal pay · Romania

EU Pay Transparency Directive in Romania: Key Changes in 2026

Directive (EU) 2023/970 introduces a wider transparency framework for equal pay for equal work or work of equal value. Romanian employers should prepare for changes in recruitment, pay structures, employee information rights and gender-pay reporting, while distinguishing the EU requirements from the Romanian rules and implementing measures actually in force.

The European transposition deadline was 7 June 2026. This guide explains the Directive’s minimum framework and the practical questions Romanian employers should verify against the current national legislation, draft measures and administrative practice.

Play

Video guide: what the EU Pay Transparency Directive may change for Romanian employers and employees.

Short answer: the Directive requires employers to use transparent, objective and gender-neutral pay practices. It addresses salary information before recruitment, employee access to pay data, pay-setting criteria, gender-pay reporting for larger employers and remedies for discrimination. The Directive is not a substitute for checking the Romanian transposition law and the national rules applicable to the employer.

What does the Pay Transparency Directive change?

The Directive moves equal-pay compliance from a purely reactive model toward documented pay structures, accessible information and measurable employer responsibilities.

For Romanian companies, the most important practical point is timing. The Directive required Member States to adopt the measures necessary for transposition by 7 June 2026. That European deadline does not mean that every employer in Romania can apply one uniform checklist without checking national legislation. Romanian employers should separate the EU minimum requirements from the domestic rules that define procedures, authorities, sanctions and any additional obligations.

Recruitment transparency

Candidates should receive the initial remuneration or salary range based on objective, gender-neutral criteria, and employers should not ask for salary history.

Employee information rights

Employees receive a route to request information about their own pay and average pay levels for comparable work, broken down by gender.

Pay-gap reporting

Employers with at least 100 workers face phased reporting obligations under the Directive, subject to national implementation.

Legal safeguard: do not publish a Romanian employer checklist that treats the Directive alone as the complete domestic law. Verify the current transposition status, implementing acts and the competent Romanian authorities before taking a fixed compliance position.

Employer readiness navigator

Use the controls below to see the main question that should be addressed in each workstream.

Select a workstream to open its first compliance question.

Recruitment

Review whether the employer can state an initial salary or range before the relevant recruitment stage and remove questions about current or previous pay.

Recruitment transparency and salary history

Under Article 5 of Directive (EU) 2023/970, job applicants are entitled to information about the initial remuneration or range for the position, set according to objective and gender-neutral criteria. The information must be supplied early enough to permit informed and transparent negotiation, for example in the job advertisement or before the interview.

The Directive also prohibits employers from asking applicants about their pay history in current or previous employment. This affects more than a single interview question. Recruitment teams should review application forms, recruiter scripts, interview templates, reference checks, automated screening flows and agency instructions.

Job titles and vacancy notices should be gender-neutral and recruitment should be organised in a non-discriminatory manner. A salary range is not meaningful if it is so broad that it conceals the employer’s real pay position. The employer should be able to explain the objective criteria used to set the range and the criteria used to determine the final offer.

Before advertising

Define the role, comparable job category, remuneration components and objective range-setting criteria.

During recruitment

Disclose the relevant range at the required stage and remove questions about current or previous salary.

Before the offer

Record the criteria supporting the final offer and keep the process consistent across comparable candidates.

Employee rights to pay information

The Directive gives workers a right to request, in writing, information about their individual remuneration level and the average remuneration levels, broken down by sex, for categories of workers performing the same work or work of equal value. Remuneration is broader than basic salary and may include relevant variable or supplementary components under the applicable framework.

Employers should create a controlled process for receiving, verifying and answering requests. The response should use a defensible job-category methodology and should not disclose identifiable salary information about another individual. The Directive contemplates a written response within two months, subject to the wording of the national implementing rules.

Employers must also communicate the right to request pay information and the prohibition on retaliation at least once a year. Pay secrecy clauses cannot be used to prevent workers from disclosing their own pay for the purpose of enforcing equal-pay rights. Confidentiality obligations may still protect personal data and legitimate business information, but they should not be drafted as a disguised prohibition on exercising statutory rights.

Select the step that should be documented when a pay request arrives.

Receive

Record the date, scope and written form of the request, then assign responsibility for the response.

Objective pay structures and work of equal value

Pay transparency cannot work without a defensible method for comparing roles. The Directive refers to objective, gender-neutral criteria including skills, effort, responsibility and working conditions. Other factors may be relevant if they are genuinely connected to the work and applied consistently.

Employers should avoid relying only on job titles. Two positions with different titles may involve comparable value, while identical titles may cover materially different responsibilities. The assessment should address qualifications, experience, technical and non-technical skills, decision-making, emotional or physical effort, working environment, hazards and scheduling requirements where relevant.

Soft skills must not be undervalued because they are associated with traditionally female-dominated roles. A pay architecture should therefore explain how the employer evaluates communication, organisation, care, negotiation, customer-facing work and other relevant skills without allowing subjective stereotypes to determine pay.

Workstream	Question for the employer	Evidence to retain
Role definition	What duties, responsibility and working conditions define the role?	Job description, organisation chart and evaluation criteria.
Pay range	What objective factors explain the lower and upper end of the range?	Pay bands, approval record and recruitment documentation.
Comparable work	Which workers perform the same work or work of equal value?	Job architecture, category methodology and review notes.
Pay difference	Can a difference be explained by objective, gender-neutral criteria?	Experience, performance, responsibility and other relevant evidence.

Gender-pay reporting thresholds

The Directive establishes phased reporting obligations for employers with at least 100 workers. The number of workers, the reporting reference period, the calculation methodology and the route through which information is supplied must be checked against the national implementing framework.

Employer size	Directive reporting timetable	Practical preparation
250 or more workers	First information due by 7 June 2027, then annually.	Build annual data collection, validation and representative-facing reporting.
150–249 workers	First information due by 7 June 2027, then every three years.	Prepare the same data architecture with a three-year reporting cycle.
100–149 workers	First information due by 7 June 2031, then every three years.	Start role mapping and data-quality work before the first reporting year.
Under 100 workers	No mandatory reporting under the Directive’s minimum threshold, unless national law provides otherwise.	Maintain fair recruitment and pay structures and monitor Romanian legislation.

Reported information may include the overall gender pay gap, gaps in supplementary or variable components, the distribution of workers across pay quartiles and gaps by worker category. Employers should not wait until the first report is due to discover that payroll data, job categories or variable-pay records cannot be reconciled.

When does a joint pay assessment become relevant?

Where the reported pay difference reaches at least 5% in a category of workers, is not justified by objective and gender-neutral criteria and has not been remedied within the period contemplated by the Directive, the employer may need to carry out a joint pay assessment with worker representatives. The exact procedure and competent bodies depend on national implementation.

A joint pay assessment is not a substitute for ordinary pay governance. Employers should first test whether the job categories are coherent, whether remuneration components have been captured consistently, whether part-time and full-time work have been treated correctly and whether objective explanations are documented rather than reconstructed after a complaint.

The process can involve identifying the scale and causes of the difference, reviewing the criteria used for pay and proposing remedies. Worker representatives may have a role in the assessment. Employers should therefore prepare a secure data room, a methodology note and a process for handling questions without disclosing unnecessary personal data.

Important: a 5% difference is not, by itself, proof of unlawful discrimination. It is a trigger for further analysis when the Directive’s other conditions are also met. Conversely, a smaller difference is not an automatic safe harbour if other evidence suggests unequal pay.

Remedies, enforcement and burden of proof

The Directive requires Member States to establish effective, proportionate and dissuasive penalties and to provide effective remedies for workers who suffer loss because of pay discrimination. The amounts and domestic enforcement mechanisms are matters for Romanian implementing legislation and should not be invented in an employer guide before the current national text is verified.

Remedies may include recovery of underpaid remuneration, compensation for loss, interest and other forms of relief available under the applicable law. The Directive also strengthens access to evidence and can affect the allocation of the burden of proof where transparency obligations have not been respected. Romanian employers should therefore treat documentation as part of substantive compliance, not as an administrative afterthought.

Employers should also protect workers and their representatives from retaliation for exercising pay-transparency rights. A complaint, pay request or discussion about remuneration should not be treated as misconduct merely because it creates an uncomfortable management conversation.

Romanian employers: what to prepare now

Even while national implementation is being confirmed, employers can take low-regret steps that do not depend on a particular Romanian form or sanction. The aim is to understand the organisation’s pay logic, identify data gaps and avoid recruitment practices that are difficult to defend later.

Map roles and create a working classification for the same work and work of equal value.
Document objective, gender-neutral criteria for pay ranges, progression and variable remuneration.
Remove salary-history questions from forms, scripts, recruiter instructions and agency briefs.
Decide when and how the initial salary or range will be communicated to candidates.
Review confidentiality clauses so they do not restrict lawful equal-pay discussions.
Create a written route for employee information requests and assign responsibility for responses.
Test whether payroll and HRIS data can produce reliable gender and worker-category comparisons.
Check how bonuses, allowances, benefits, overtime and other remuneration components are recorded.
Prepare a confidential process for investigating unexplained pay differences.
Monitor Romanian transposition legislation, implementing acts and guidance from competent authorities.

How should multinational groups prepare their Romanian entities?

Groups operating in more than one Member State should avoid copying a group policy into Romania without a local legal review. The Directive provides a common minimum framework, but the Romanian transposition law may determine the language, reporting channel, authorities, consultation rights, sanctions and interaction with existing equal-treatment rules.

The Romanian entity should be able to identify its own workers, roles, pay components and reporting threshold even where payroll or HR systems are centralised abroad. Group-level data may support the analysis, but it should not obscure the Romanian employer’s responsibilities or transfer personal data without an appropriate legal and security framework.

Multinationals should also reconcile the Directive with recruitment practices used by external agencies, shared-service centres and automated tools. A policy is useful only if it reaches the people who write job advertisements, conduct interviews, approve offers and answer employee requests.

Frequently asked questions

What is the EU Pay Transparency Directive?

Directive (EU) 2023/970 strengthens equal-pay enforcement through recruitment transparency, employee information rights, objective pay structures and phased gender-pay reporting.

Does the Directive apply to Romanian employers?

It covers public and private employers within its scope, but the practical Romanian procedures, authorities, sanctions and any additional obligations depend on the national implementing framework.

Can Romanian employers ask candidates about salary history?

The Directive prohibits asking applicants about their current or previous pay. Employers should remove those questions from interviews, forms, references and recruitment instructions.

Must employers publish a salary range?

The Directive requires applicants to receive information about the initial remuneration or range early enough for informed negotiation. The precise Romanian format and timing should be checked against national implementation.

What is the 5% pay-gap threshold?

A difference of at least 5% may trigger further assessment when it is not justified by objective, gender-neutral criteria and has not been remedied within the relevant period. It is not automatic proof of discrimination or an automatic safe harbour.

When does pay-gap reporting start?

Under the Directive, employers with at least 150 workers have first reporting obligations by 7 June 2027, while employers with 100–149 workers begin by 7 June 2031. Romanian law may define the domestic reporting process.

Need to prepare for pay-transparency rules?

A Romanian employment lawyer can review recruitment practices, pay structures, employee-information procedures and gender-pay data before the national framework creates avoidable risk.

Book a consultation

Disclaimer: This article provides general information only and does not constitute legal advice or the creation of a lawyer-client relationship. The practical obligations depend on Directive (EU) 2023/970, Romanian transposition measures, implementing rules, employer size, pay structures and the facts of the case. Check the current legal framework before taking action.

AI Notice: AI-assisted content, reviewed by a qualified Romanian lawyer.

30Dec

The Developer’s Checklist: Mastering Construction Contracts & Works Agreements in Romania

by Simona Rotaru Consulting

The Developer’s Checklist: Mastering Construction Contracts & Works Agreements in Romania

Navigating the intricacies of construction contracts in Romania requires a comprehensive understanding of Romanian law and the specific nuances of the construction sector.

This guide serves as a checklist for developers and investors involved in construction projects in Romania, offering insights into construction contracts, works agreements, standard forms, and key considerations for successful project execution.

📹 Video Guide: Construction Contracts in Romania

Watch this comprehensive video guide covering the essentials of construction contracts, regulatory compliance, and key considerations for developers and investors in Romania.

Play

Need Professional Help?

At Atrium Romanian Lawyers, we assist clients with corporate & commercial law, construction contracts, works agreements, and construction dispute resolution.

Book Consultation View Our Services

Understanding Construction Contracts in Romania

Definition and Importance of Construction Contracts

A construction contract in Romania is a legally binding agreement, typically classified under Romanian law as a works agreement (contract de antrepriză), between two or more parties that outlines the scope of construction work, the obligations of each party, and the payment terms.

The object of the contract is to define the responsibilities and rights concerning a construction project, in accordance with the Romanian Civil Code.

Construction contracts in Romania are crucial for establishing project expectations, allocating risk, and providing a contractual framework for dispute resolution under Romanian law.

As a specialized subset of contract law in Romania, construction agreements must comply with mandatory civil law provisions while addressing sector-specific requirements.

Types of Construction Contracts in Romania

Several types of construction contracts are used in Romania, depending on project structure and risk allocation.

These include design and build contracts, EPC contracts, and contracts based on standard forms such as FIDIC contracts.

Understanding these distinctions is important for selecting an appropriate contractual framework for a construction project in Romania.

The chosen contract type influences procurement strategies, risk management, and project governance, including compliance with public procurement procedures where applicable.

For property and real estate development, proper contract selection is essential to protect your investment.

Standard Forms of Construction Contracts

Use of Standard Contract Templates

In Romania, standard forms of construction contracts are frequently used, particularly in complex or international construction projects.

These contracts are often based on international models and offer familiarity for foreign investors and contractors.

Standard construction contracts must be reviewed and, where necessary, amended to ensure compliance with mandatory Romanian civil law provisions and project-specific legal requirements.

Their use does not override Romanian law, particularly in public construction projects.

FIDIC Contracts in Romania

Are FIDIC contracts enforceable in Romania? Yes, provided they comply with mandatory Romanian civil law and public procurement rules where applicable.

FIDIC contracts, developed by the International Federation of Consulting Engineers, are widely used in Romania, particularly for infrastructure and publicly funded projects.

Romanian law does not formally recognize FIDIC as a legal standard, but FIDIC-based contracts are enforceable when compliant with mandatory Romanian law.

In public procurement contexts, FIDIC provisions are frequently substantially amended by statute, especially in relation to variations and claims, payment mechanisms, engineer’s role, and dispute resolution.

Key Aspects of Works Agreements in Romania

Essential Elements of a Works Agreement

A works agreement in Romania should clearly define the object of the contract, including the scope of construction work, timelines, and technical requirements.

While Romanian law does not impose a fixed list of essential clauses, clarity on payment schedules, variation procedures, liability for defects, and dispute resolution mechanisms is essential for proper contract performance.

Performance bonds or guarantees may be included where required by the parties, lenders, or public authorities, but they are not mandatory elements under Romanian civil law.

Parties Involved in Construction Agreements

Construction agreements in Romania typically involve the beneficiary (beneficiar), the contractor (antreprenor), and, where applicable, subcontractors performing specialized construction work.

In public construction projects, the beneficiary is a contracting authority, and the involvement of parties is governed by public procurement legislation, which may restrict contractual freedom and impose mandatory clauses.

Contractual Obligations and Rights

Romanian construction contracts must clearly define the contractual obligations and rights of the parties.

These include obligations relating to execution of construction work, payment of the contract price, cooperation, and compliance with technical and legal standards.

Both parties have rights under Romanian law, including the right to claim damages, penalties, suspension, or termination in case of breach, subject to the Romanian Civil Code.

Navigating Romanian Construction Law

Overview of Romanian Construction Regulations

Construction projects in Romania are subject to a regulatory framework covering zoning, building permits, safety standards, and technical compliance.

Romanian law governs these requirements, and non-compliance may lead to administrative sanctions or suspension of works.

Investors involved in construction projects in Romania must ensure compliance with applicable construction regulations to avoid delays or legal complications.

Before commencing any construction work, ensure that proper cadastral documentation and property ownership verification are in place, as these form the legal foundation for obtaining construction permits.

Public Procurement Procedures in Construction

Public procurement procedures for construction work in Romania are governed primarily by Law no. 98/2016 on public procurement and related secondary legislation, which transpose EU procurement directives into Romanian law.

These procedures impose mandatory rules regarding contract award, performance guarantees, amendments, and payment mechanisms.

Compliance with public procurement procedures is essential for contractors participating in public construction projects in Romania.

Construction Disputes in Romania

Common Sources of Disputes

Construction disputes in Romania commonly arise from contract interpretation, payment issues, variations, delays, or construction work quality.

Understanding these risk factors helps developers and contractors mitigate conflicts throughout the project lifecycle.

Dispute Resolution Mechanisms

Construction contracts often include dispute resolution clauses providing for litigation before Romanian courts or arbitration, in accordance with Romanian civil law.

Romania is a party to the New York Convention, enabling enforcement of foreign arbitral awards, subject to public policy limits.

When construction disputes arise, litigation and dispute resolution services can help protect your interests.

Can international arbitration be used in Romanian construction contracts? Yes. Romania is a party to the New York Convention, allowing recognition and enforcement of arbitral awards, subject to public policy exceptions and statutory limits in public contracts.

Effective Contract Management Strategies

Construction Contract Management Best Practices

Effective management of construction contracts in Romania requires careful drafting, monitoring of performance, and proper documentation of variations and claims.

A well-managed construction contract helps mitigate risks related to time overruns, cost increases, and disputes, protecting both parties throughout the construction project.

Risk Management in Construction Contracts

Risk management in Romanian construction contracts involves identifying and allocating risks related to design, ground conditions, regulatory changes, and force majeure events.

Romanian law allows contractual risk allocation, subject to mandatory statutory limits and public policy considerations.

Dispute Avoidance and Resolution Techniques

Clear contractual clauses, regular communication, and proactive management can reduce the risk of construction disputes in Romania.

When disputes arise, mediation or arbitration may offer efficient alternatives to litigation, depending on the contractual framework and project type.

Specialized Contract Types in Romanian Construction

EPC Contracts: Structure and Implications

EPC contracts in Romania are commonly used for large-scale and infrastructure projects.

These contracts allocate significant responsibility to the contractor for design, procurement, and execution.

However, under Romanian law, risk transfer is not absolute, and liability remains subject to statutory limitations, force majeure provisions, and agreed contractual caps.

Design and Build Contracts in Romania

Design and build contracts are widely used in Romania, particularly in private construction projects.

Under this model, a single contractor assumes responsibility for both design and construction, based on employer-defined requirements.

This contractual approach reduces coordination risks when properly structured and provides clear accountability for project delivery.

Useful Resources & Links

Romanian Government & Regulatory Bodies

ONRC (Trade Registry) – Company registration and construction permits
Ministry of Justice – Legal oversight and contract enforcement
Ministry of Development – Construction regulations and standards
Monitorul Oficial (Official Gazette) – Official publication of Romanian laws and regulations

Construction & Dispute Resolution

CCIR (Chamber of Commerce and Industry) – Domestic arbitration and contract dispute resolution
ICC (International Chamber of Commerce) – International arbitration services
VIAC (Vienna International Arbitration Centre) – International arbitration
FIDIC – International Federation of Consulting Engineers
New York Convention – Recognition and enforcement of foreign arbitral awards

Legal Resources & International Construction Law

ICLG – Construction & Engineering Law Report: Romania – Comprehensive overview of Romanian construction law
Global Arbitration Review – Construction Arbitration in Romania – Expert insights on dispute resolution
Global Legal Insights – International Arbitration in Romania – Current arbitration procedures and enforcement

Atrium Romanian Lawyers Services

Related Guides & Resources

Expand your understanding of construction and property law in Romania with these complementary guides:

Essential Reading for Construction Projects

The Land Registry Process in Romania – Understand property registration requirements for development projects
Service Contract Requirements in Romania – Related contractual frameworks and mandatory compliance elements
Property Ownership in Romania: Land Registry, Documents & Verification – Verify ownership and documentation before construction commences

FAQ – Construction Contracts & Works Agreements in Romania

Q: Do construction contracts in Romania need to be in written form?

A: Written form is not generally required for validity under Romanian civil law in private projects but is mandatory in public procurement and strongly recommended for evidentiary and enforcement purposes.

Q: What are the main types of construction contracts used in Romania?

A: Romanian practice includes traditional works contracts, design and build contracts, EPC/turnkey contracts, and various pricing structures such as lump-sum and unit price agreements.

The choice depends on project structure, risk allocation, and regulatory requirements.

Q: Are FIDIC contracts enforceable in Romania?

A: Yes, provided they comply with mandatory Romanian civil law and public procurement rules where applicable.

FIDIC contracts are widely used in Romania, especially for infrastructure and publicly funded projects.

Q: What is the regulatory framework for public construction projects in Romania?

A: Public procurement procedures for construction work in Romania are governed primarily by Law no. 98/2016 on public procurement and related secondary legislation, which transpose EU procurement directives into Romanian law.

Q: What are common sources of construction disputes in Romania?

A: Construction disputes in Romania commonly arise from contract interpretation, payment issues, variations, delays, or construction work quality.

Proper contract management and clear documentation can help mitigate these disputes.

Q: Can construction disputes be resolved through arbitration in Romania?

A: Yes. Both domestic and international arbitration are commonly used, subject to statutory limitations in public projects.

Romania is a party to the New York Convention, enabling recognition and enforcement of foreign arbitral awards.

Q: What law governs construction contracts in Romania?

A: Substantive contractual issues are governed by the Romanian Civil Code, while disputes and enforcement are governed by procedural law.

Public procurement contracts are also subject to Law no. 98/2016 on public procurement.

Conclusion: Mastering Construction Contracts in Romania

Construction contracts and works agreements in Romania require careful legal and commercial planning.

Developers and contractors must understand Romanian construction law, select appropriate contract types, manage risks, and ensure regulatory compliance.

Early involvement of legal and technical advisers is essential for minimizing construction disputes in Romania and ensuring successful project delivery.

Disclaimer: This article is for general information only and does not constitute legal advice. Please consult with a qualified Romanian construction lawyer to verify current laws and regulations before finalizing your construction contracts. Laws and procedures are subject to change, and individual circumstances may vary.

Smiling Romanian lawyer holding a legal book with text “Register Company Name in Romania” on a bright background

30Oct

Register Your Company Name in Romania

by Simona Rotaru Company Formation in Romania, Corporate Law

Company formation in Romania

Registering a Company Name in Romania

Before incorporating a Romanian company, founders normally need to check and reserve an available company name with the National Trade Register Office (ONRC).

This guide explains the legal role of name reservation, the main restrictions, the filing routes available to foreign founders and the steps that follow once the reservation has been issued.

Book an Online Consultation Company Formation Guide

Play

Company name reservation in Romania: a practical overview for founders.

Short answer: name reservation is an early company-formation step, but it is not the same as incorporating the company and it does not replace a trademark search. The reserved name must still be used within the applicable period and accepted in the context of the incorporation filing.

What Does Company Name Reservation Mean?

Company name reservation is the procedure through which the ONRC checks the proposed name against the applicable legal requirements and records the availability of the name for the applicant. The applicant normally submits several alternatives in a stated order of preference.

The reservation is connected to a future registration application. It does not, by itself, create a company, confer legal personality or prove that the name is available as a trademark, domain name or social-media handle.

What the Name Reservation Does and Does Not Protect

It supports the incorporation file

The proof of availability or reservation is used in the next stage of the company-registration process, together with the constitutional documents and other required information.

It is not trademark registration

A company name and a trademark serve different legal functions. A separate trademark clearance and registration strategy may be needed if the name is important to the business.

It is not an unlimited exclusivity right

The legal effect of the reservation is limited by the applicable company and Trade Register rules. Similarity, misleading elements, protected terms and the later incorporation file may still matter.

Key Legal Requirements for a Romanian Company Name

The proposed name must be sufficiently distinctive and must comply with the rules applicable to the chosen legal form. The name should not be identical or confusingly similar to a name already recorded, and it should not mislead third parties about the company, its activities or its relationship with a public authority.

Use a name that can be distinguished from existing registered names.
Include the legal form where required, such as SRL or SA.
Avoid protected or restricted words unless the required prior approval is available.
Do not imply an official connection with Romanian public authorities.
Check whether the proposed name creates conflict with an existing brand or trademark.
Prepare alternatives because availability is assessed against the ONRC records.

Does the name have to contain a Romanian word?

There is no safe basis for presenting a general rule that every company name must contain a Romanian word. The analysis depends on the proposed wording, the legal form, distinctiveness, public-order restrictions and the applicable ONRC practice. A foreign-language name should therefore be checked rather than automatically treated as prohibited or acceptable.

Restricted or sensitive terms

Certain protected terms, including terms referring to public authorities or regulated sectors, may require prior approval under applicable Romanian law or may be rejected when they suggest a protected institution or official connection. The exact assessment depends on the wording and context. For a sensitive name, the approval requirement should be checked before the filing is submitted.

How to Reserve a Company Name in Romania

Define the business and legal form

Clarify whether the planned entity is an SRL, SA or another registrable structure. The legal form affects the required designation and the incorporation documents.

Prepare several name options

Prepare a ranked list of alternatives. Each option should be checked for distinctiveness, restricted wording, misleading references and possible trademark conflicts.

Submit the name-reservation request

The request may be handled through the ONRC service channels, including the online portal where the applicable technical and identity requirements are met. The applicant should use the current ONRC form and instructions.

Respond to any clarification or rejection

A name may be rejected because it is unavailable, insufficiently distinctive, misleading or subject to an approval requirement. A new proposal may then be submitted.

Use the reservation in the incorporation file

Once the reservation document is available, continue with the articles of association, registered office, beneficial-owner information, activity codes, declarations and other documents required for incorporation.

Online Filing, Electronic Signatures and Foreign Founders

Cross-border filing checkpoint

Romanian citizenship is generally not required for shareholders or founders of a Romanian company. Depending on the filing route, they may act personally or through an authorised representative.

An online filing does not automatically mean that every document may be signed in the same way. The current ONRC portal rules and the form of each document must be checked before submission.

ONRC route

The application may be submitted online, at the counter or through another permitted channel, subject to the current technical and procedural requirements.

Foreign documents

Documents may require a Romanian translation, authentication, apostille or legalisation, depending on their origin and type.

Representation

A representative may act only with the authority and in the form required by the applicable rules. A power of attorney should be checked before it is signed abroad.

Where a founder does not meet the technical requirements for direct online filing, representation may be considered. Banking, identity checks, immigration formalities and sector-specific approvals may still require separate steps.

How Long Is the Reservation Valid?

The reservation document is not indefinite. Applicants should verify the validity period stated in the reservation document itself and in the current ONRC procedures. The incorporation application should be prepared and filed within that period.

Because the reservation period, portal workflow and procedural requirements may change, this page does not present a fixed deadline as universally applicable without checking the current ONRC information. An expired reservation may require a new request and a fresh availability assessment.

Costs and Filing Fees

The total cost depends on the filing route, the services requested and the documents involved. It may include an ONRC service tariff, publication costs where applicable, translation or legalisation costs and professional fees. The exact amount should be confirmed against the current ONRC tariff schedule and the specific application.

For this reason, the former fixed estimate of EUR 5–10 should not be treated as a current universal fee for every name-reservation case.

What Happens After the Name Is Reserved?

Name reservation is only one stage of company formation. The next steps may include:

Registered office

Choose and document the registered office in accordance with the current ONRC requirements.

Articles of association

Prepare the constitutional documents and confirm the company’s ownership and management structure.

CAEN activities

Confirm the company’s activities under the current CAEN classification and identify any sector-specific authorisations.

Beneficial owner

Identify the beneficial owner and prepare the relevant declaration or information for the incorporation file.

Share capital

Organise the share capital and any other corporate information required for the chosen legal form.

Complete filing

Submit the complete incorporation application with the ONRC and respond to any request for corrections or additional documents.

Reservation does not guarantee that the complete incorporation file will be admitted. The Trade Register authorities may examine the full application and may request corrections or additional documents.

How Atrium Romanian Lawyers Can Help

Atrium Romanian Lawyers assists foreign founders with the practical and legal steps involved in establishing a business in Romania, including:

Name assessment

Review of proposed names, legal-form wording, distinctiveness issues and potential red flags.

ONRC preparation

Preparation and coordination of the reservation and incorporation documentation, including foreign-founder formalities.

Formation strategy

Advice on the SRL structure, registered office, activities, representation and the documents needed for the next stage.

Discuss Your Company Formation

Frequently Asked Questions

Can a foreigner reserve a company name in Romania?

Yes. Romanian citizenship is generally not required for shareholders or founders of a Romanian company. The filing route, identification documents and representation formalities must be checked for the specific case.

Does name reservation create a company?

No. It is an early step connected with the future incorporation filing. The company obtains legal personality only after the incorporation is admitted and registered.

Is a reserved company name protected as a trademark?

No. Company-name reservation and trademark protection are separate matters. A trademark clearance should be considered before investing in branding or launching the business.

Do I need a qualified electronic signature?

Not every possible filing route has the same signature requirements. The answer depends on the ONRC channel, the person signing, the documents and the applicable technical rules. The current portal instructions should be checked before filing.

What if the proposed name is rejected?

The applicant may need to submit another proposed name or correct the application, depending on the reason for rejection. A rejection does not necessarily prevent the company from being incorporated under another compliant name.

Can I reserve a name and incorporate later?

Yes, but the reservation is subject to a limited validity period. Applicants should verify the validity period stated in the reservation document itself and in the current ONRC procedures, and the complete incorporation file should be prepared before the reservation expires.

Related Company Formation Resources

Official reference: The ONRC is the institution responsible for the Romanian Trade Register and publishes the current forms, procedures and service information on its website and online portal.

Disclaimer: This page provides general information only and does not constitute legal advice, a legal opinion or the creation of a lawyer-client relationship. Legal solutions depend on the specific facts and documents involved.

AI Notice: AI-assisted content, reviewed by a qualified Romanian lawyer.

17Oct

AI Weaponization and Cybercrime Threat in 2025: What Every Organization Needs to Know

by Simona Rotaru Data Protection, Digital Law

Play

AI Weaponization and Cybercrime Threat in 2025: What Every Organization Needs to Know

Direct Answer: Global cybercrime is projected to cost the world $10.5 trillion annually by 2025, which translates to approximately $19.9 million per minute in losses worldwide.

With AI-powered attacks occurring approximately every 39 seconds, organizations must urgently adopt AI-driven defensive strategies and implement robust governance frameworks to protect against hyper-personalized phishing, advanced malware, and deepfake fraud.

Legal and compliance teams should establish incident response protocols immediately.

Introduction: The AI-Powered Cybercrime Crisis

The cybersecurity landscape of 2025 is fundamentally transformed. Artificial Intelligence (AI) has become both the weapon and the shield in modern cyber warfare.

Malicious actors are weaponizing AI at an unprecedented scale, creating attacks that are more sophisticated, faster, and accessible to criminals with minimal technical expertise.

This shift demands immediate action from business leaders, compliance officers, and legal professionals.

The stakes have never been higher—and neither have the regulatory consequences for inadequate cybersecurity measures.

The Financial Impact of AI-Powered Cybercrime in 2025

Understanding the Scale of Cyber Losses

Global cybercrime costs are projected to reach $10.5 trillion annually by 2025, according to Cybersecurity Ventures.

This represents an unprecedented transfer of economic wealth—greater than the GDP of most countries.

To put this in perspective: The world loses approximately $19.9 million per minute to cybercrime.

That’s $1.2 billion per hour, or $28.8 billion per day.

Why These Numbers Matter for Your Organization

Cybercrime isn’t just a technology problem—it’s a business crisis with legal implications.

For law firms and professional services organizations, a single data breach can result in average costs of $4.88 million. Beyond financial impact, a breach can result in:

Regulatory fines under GDPR, CCPA, and industry-specific regulations
Client trust erosion and reputational damage
Malpractice liability if client confidential information is compromised
Mandatory breach notifications with cascading legal consequences

Attack Velocity: The Speed of Modern Threats

In 2023, a cyberattack occurred approximately every 39 seconds globally, translating into over 2,200 cases per day.

This demonstrates the relentless and automated nature of modern threats.

The velocity of attacks continues to accelerate.

Organizations that rely on manual security monitoring are already behind the curve.

How AI Is Being Weaponized by Cybercriminals

The Dual-Use Dilemma: When AI Turns Malicious

Artificial Intelligence presents a fundamental paradox.

The same technologies that drive innovation can be weaponized for criminal purposes.

AI has lowered the barrier to entry for sophisticated cybercrime, enabling individuals with minimal technical expertise to execute complex attacks.

Cybercriminals are embedding AI throughout their entire operations—from victim profiling and data analysis to creating false identities and automating large-scale attacks.

AI Jailbreaking: Bypassing Safety Guardrails

AI jailbreaking is the process of manipulating public AI systems (like ChatGPT, Gemini, and Claude) to bypass their ethical safety restrictions.

Threat actors use specialized prompt injections to force AI models to generate harmful content.

Key Statistics on Jailbreaking:

Discussions related to jailbreaking methods increased by 52% on cybercrime forums in 2024
Mentions of “jailbreaks” against public AI applications grew 51% from 2023 to 2024, with predictions for 2025 to be significantly higher
Instant messaging channels like Discord and Telegram have become primary distribution channels for new jailbreak techniques

Common Jailbreaking Techniques:

Role-play prompts instructing AI to adopt specific personas (e.g., “act as a hacker”)
Social engineering techniques targeting AI safety systems
Prompt injection attacks designed to override safety protocols
Chained requests that gradually escalate harmful behavior

Organizations must educate employees on these risks.

Even well-intentioned staff can inadvertently expose sensitive information when using public AI tools without proper security awareness.

Dark AI Tools: The Underground Market for Malicious AI

Dark AI tools are uncensored, purpose-built AI systems designed explicitly for cybercrime, operating without ethical guardrails and facilitating illegal activities including phishing, malware generation, and fraud.

The Scale of the Dark AI Market:

200% increase in mentions of malicious AI tools in 2024
Dark AI tools now operate as AI-as-a-Service (AIaaS) models with subscription pricing
Entry costs range from $60 to $700 per month, making sophisticated attacks affordable for novice criminals

Notable Dark AI Tools Threatening Organizations

WormGPT

WormGPT was promoted in underground forums beginning July 2023 as a “blackhat alternative” to commercial AI tools, based on the GPT-J language model and specialized for phishing and business email compromise (BEC) attacks.

Customized specifically for malicious activities
Focuses on crafting highly convincing phishing emails
Assists in BEC attacks targeting financial transactions
Reportedly used by 1,500+ cybercriminals as of 2023

FraudGPT

FraudGPT, circulating on the dark web and Telegram channels since July 2023, is advertised as an all-in-one solution for cyber-criminals with subscription fees ranging from $200 per month to $1,700 per year. FraudGPT provides:

Writing phishing emails and social engineering content
Creating exploits, malware, and hacking tools
Discovering vulnerabilities and compromised credentials
Providing hacking tutorials and cybercrime advice

Additional Dark AI Tools:

EvilAI: Based on GPT-4 and Mistral architecture, trained on malware scripts and phishing pages
DarkGPT: Jailbroken GPT-4 variant designed for OSINT and credential stuffing
WolfGPT and GhostGPT: Similar tools offering malware and vulnerability research capabilities

Five Key AI-Enhanced Cybercrime Attack Vectors

1. Hyper-Personalized Phishing and Social Engineering

Generative AI has revolutionized phishing attacks by enabling mass personalization at scale.

Cybercriminals now craft emails that precisely mimic executives’ writing styles, using publicly available data to increase authenticity.

How AI Enhances Phishing:

AI automation reduces phishing attack costs by over 95%, allowing cybercriminals to launch thousands of personalized campaigns simultaneously
Language adaptation: AI generates culturally and linguistically appropriate messages
Deepfake technology: AI clones executive voices and faces with increasing accuracy
Scale amplification: Criminals can target entire organizations at minimal cost

Real-World Example: The Ferrari CEO Deepfake Incident (July 2024)

In July 2024, an executive at Ferrari received WhatsApp messages that appeared to be from CEO Benedetto Vigna, with follow-up calls using AI voice cloning to mimic Vigna’s distinctive Southern Italian accent. The attack included requests for urgent financial transactions related to a confidential acquisition, but the executive detected the fraud by asking a personal question only the real CEO could answer.

Legal Implications:

Failing to implement anti-phishing controls can expose your firm to negligence claims if compromised client data results in loss or liability.

Courts increasingly expect organizations to deploy AI-driven email security.

2. Malware and Exploit Development

AI streamlines malware creation by automatically optimizing code for evasion and functionality.

Threat actors use AI tools to generate sophisticated malware that bypasses traditional antivirus and behavioral detection systems.

AI’s Role in Malware Development:

Automated payload optimization
Evasion technique generation
Ransomware code synthesis
Info-stealer refinement

Notable Examples:

MalGEN: A framework for synthesizing novel malware samples that successfully bypass current antivirus engines due to their stealthy characteristics
Open-source models like Dolphin Mixtral 7B used within the Ollama framework to generate ransomware code (often falsely claimed as “educational research”)

3. Vulnerability Research and Network Exploitation

Cybercriminals leverage AI for automated reconnaissance, accelerating their ability to identify exploitable security gaps in target systems.

AI-Powered Vulnerability Exploitation:

Automated network scanning and analysis
Rapid vulnerability identification in software packages and libraries
Pattern recognition across security weaknesses
Potential exploitation planning

Nation-State Actors Using AI Tools:

Iranian-backed APT groups have used AI tools for vulnerability research on defense organizations.

Chinese and Russian threat actors similarly employ AI for reconnaissance and infrastructure analysis.

Compliance Alert: Your IT infrastructure must assume nation-state-level threats.

Legacy security systems are insufficient.

4. Identity Fraud and Financial Crimes

Generative AI enables sophisticated identity fraud through deepfakes that bypass Know Your Customer (KYC) and liveness verification systems used by banks and financial institutions.

Deepfake-Enabled Fraud Vectors:

Account opening fraud: Attackers create synthetic identities using deepfake images
Loan application fraud: AI-generated faces and documents bypass verification
Credit card fraud: Synthetic identity theft on an unprecedented scale
Wire transfer manipulation: Voice cloning for telephone-based fraud

Tools Used:

FraudGPT: Specifically marketed for generating phishing pages and finding vulnerable credit card systems
DeepFaceLab and Resemble AI: Industry-standard deepfake generation tools
Deepfake images bypassing biometric verification with increasing success rates

5. Automated Cyber Attacks (DDoS, Credential Stuffing, OSINT)

AI enables criminals to automate high-volume attacks that depend on scale and speed, making defenses that rely on human response obsolete.

AI-Optimized Attack Types:

DDoS Attacks: AI controls massive botnets, adapting attack vectors in real-time to evade filters
Credential Stuffing: Automated testing of breached credentials across platforms, with AI learning from failures
OSINT (Open-Source Intelligence): Automated reconnaissance and target profiling at scale

Example: The hacktivist group “Moroccan Soldiers” claimed to use AI-driven evasion techniques to launch more successful DDoS attacks while bypassing security controls.

Agentic AI: The Next Evolution of AI-Powered Attacks

What Is Agentic AI?

Agentic AI represents a fundamental escalation in cybercriminal capabilities.

Unlike traditional AI tools that provide advice on attack methods, agentic AI systems autonomously execute complex, multi-stage cyberattacks with minimal human intervention.

These systems can:

Make tactical decisions during active attacks
Pursue open-ended goals like “infiltrate this system” or “compromise this network”
Chain prompts together to achieve complex objectives
Adapt strategies based on real-time feedback

Real-World Case: Autonomous Ransomware Operations

Security researchers documented a sophisticated cybercriminal using agentic AI to:

Automate reconnaissance of target networks
Harvest victims’ credentials automatically
Penetrate secured networks
Analyze exfiltrated financial data to determine appropriate ransom amounts
Generate psychologically targeted, visually alarming ransom notes

This represents a new threat paradigm where AI doesn’t just assist criminals—it orchestrates entire attack campaigns.

Nation-State Exploitation of AI Tools

Google’s Report on State-Sponsored AI Abuse:

Advanced Persistent Threat (APT) actors states are actively integrating AI tools into their cyber campaigns across multiple attack lifecycle phases:

Infrastructure research: Identifying and profiling target environments
Reconnaissance: Gathering intelligence on target organizations
Vulnerability research: Discovering exploitable security gaps
Payload development: Creating malware and exploit code

Iranian-Backed APTs: Identified as the heaviest users of AI tools for defense organization research and phishing content creation.

Legal Consequence: Organizations handling sensitive government contracts or defense-related work must assume they are targets of nation-state AI-powered attacks.

The Critical Vulnerability of AI Supply Chains

What Is an AI Supply Chain?

The AI supply chain encompasses every stage of AI system development: data sourcing, model training, deployment, maintenance, and continuous learning. Each phase introduces potential vulnerabilities.

Key AI Supply Chain Risks

Data Poisoning: Malicious data introduced during training causes AI models to learn faulty, unsafe behaviors. A compromised training dataset can produce unreliable models deployed across an organization.

Model Theft: Proprietary AI models represent significant intellectual property. Threat actors can steal models directly or through supply chain compromise, then repurpose them for malicious activities.

Adversarial Attacks: Carefully crafted inputs trick AI models into producing harmful outputs or exposing sensitive information.

Third-Party Component Compromise: Organizations often rely on pre-trained models and open-source libraries. A compromised component can propagate vulnerabilities across multiple systems enterprise-wide.

Model Drift: Continuous learning mechanisms can introduce unintended behavioral changes, creating security vulnerabilities over time.

Strategic Importance

Securing the AI supply chain is now a strategic, economic, and national security priority—particularly as AI becomes integrated into safety-critical systems in healthcare, defense, and financial services.

Fighting AI with AI: Essential Defensive Strategies

The New Reality: AI-Driven Defense Is Non-Negotiable

Traditional, reactive cybersecurity is obsolete. Organizations must deploy advanced AI systems for real-time threat detection, predictive analysis, and autonomous response.

The Mandate for AI-Powered Defense:

Threat detection speed increases from hours to minutes
Response automation eliminates human delay
Pattern recognition identifies novel attack types
Behavioral analysis spots anomalies traditional tools miss

How AI Strengthens Defenses

AI-Powered Threat Detection: Advanced AI systems analyze email patterns, tone, structure, and sender behavior to identify red flags that traditional tools miss.

These systems can quarantine threats and alert users instantly.

Behavioral Analysis: Move beyond static signature-based detection to monitor actions like:

Attempts to encrypt files
Efforts to disable security controls
Unusual network traffic patterns
Anomalous user behavior (login location, timing, device)

Adaptive Authentication: AI flags risky logins based on geographic location inconsistencies, access timing anomalies, device fingerprinting changes, and frequency patterns.

DDoS Mitigation: AI manages traffic flow in real-time, recognizing abnormal patterns and dynamically scaling defenses before systems crash.

Strategic Framework: Secure AI Supply Chain Architecture

Organizations should adopt a multi-layered security framework integrating three key defensive concepts:

1. Blockchain for Data Provenance

Blockchain creates an immutable ledger tracking data origins and integrity throughout the AI lifecycle.

Benefits:

Verifies dataset authenticity and integrity
Prevents undetected poisoning attacks
Enables end-to-end traceability
Ensures regulatory compliance for sensitive industries

2. Federated Learning

Federated learning allows AI models to learn from distributed data sources without centralizing raw data, significantly reducing exposure to attacks.

Advantages:

Reduces centralized data breach risk
Prevents large-scale poisoning attacks
Protects individual data privacy
Maintains model effectiveness

3. Zero-Trust Architecture (ZTA)

Zero-Trust principles (“never trust, always verify”) secure deployment by enforcing continuous authentication at every system level, micro-segmentation isolating compromised components, behavior-based anomaly detection, and rapid isolation protocols for suspicious activity.

Implementing Proactive Mitigation Strategies

1. Testing and Evaluation Solutions

Action Items:

Evaluate security and reliability of all GenAI applications against prompt injection attacks
Conduct continuous assessment of your AI environment against adversarial attacks
Deploy automated, intelligence-led red teaming platforms
Document findings and remediation timelines

Compliance Note: Regulatory bodies increasingly expect documented AI security testing. Failure to test creates liability exposure.

2. Employee Education and Training Procedures

Training Components:

Educate staff on fraud recognition and phishing scenarios
Conduct simulations exposing employees to realistic deepfake threats
Train teams on emotional manipulation techniques used by attackers
Emphasize the importance of pausing before acting on unusual requests

Best Practice: Quarterly security awareness training, with mandatory deepfake vulnerability simulations.

3. Adopt AI Cyber Solutions

Implementation:

Integrate AI-based cybersecurity solutions for real-time threat detection
Deploy advanced LLM agents for autonomous threat response
Establish 24/7 monitoring with AI-powered security operations centers
Implement automated response protocols for common attack types

4. Active Defense Monitoring

Essential Protocols:

Monitor evolving cybercriminal tactics and AI tool exploitation techniques
Maintain offline backups of critical data (ransomware protection)
Implement rigorous system update and patching procedures
Track threat intelligence from credible security agencies

Critical Point: Unpatched software represents your organization’s largest vulnerability. Establish a zero-tolerance patching policy.

5. Organizational Defense Review

Assessment Areas:

Review account permissions and role privileges to limit lateral movement
Deploy email filtering and multi-factor authentication (MFA)
Establish role-based access control (RBAC) principles
Conduct quarterly access reviews

Legal and Compliance Implications for Organizations

Regulatory Expectations for Cybersecurity

Regulatory bodies—from the SEC to GDPR enforcers—now expect organizations to document AI security measures taken to protect sensitive data. Requirements include:

Implement reasonable security controls appropriate to the threat level
Maintain incident response protocols with defined escalation procedures
Conduct regular security audits and penetration testing

Failure to meet these expectations can result in:

Regulatory fines under GDPR (often 4-6% of global revenue)
Criminal liability for executives in some jurisdictions
Civil litigation from affected parties
Mandatory breach notifications and public disclosures

Incident Response: What Your Organization Should Have in Place

Your organization should establish a documented incident response plan including:

Identification procedures: How threats are detected and confirmed
Containment protocols: Immediate steps to limit damage
Eradication processes: Removing threat actors from systems
Recovery procedures: Restoring normal operations
Communication plans: Notifying affected parties, regulators, and law enforcement

Legal Recommendation: Have your incident response plan reviewed by legal counsel to ensure compliance with notification requirements in your jurisdictions.

Local Business and Professional Services Considerations

Why Location Matters in Cybersecurity

For professional services firms operating across multiple jurisdictions, cybersecurity compliance requirements vary significantly.

European operations face GDPR requirements, while U.S. operations must comply with state-specific breach notification laws and industry regulations.

Multi-Jurisdiction Compliance Framework

Establish protocols for:

Client data location and handling
Jurisdictional breach notification requirements
Cross-border data transfer restrictions
Local incident reporting obligations

Recommendation: Consult with legal counsel in each jurisdiction where you operate to establish compliant data handling procedures.

Conclusion: The Urgency of Action

The weaponization of AI has ushered in a new chapter of cybersecurity challenges marked by unprecedented attack velocity, complexity, and accessibility.

Cybercriminals are leveraging tools like WormGPT and sophisticated jailbreaking techniques to automate every stage of their operations—from reconnaissance to fraud execution.

Organizations can no longer rely on traditional, reactive defenses.

The imperative is clear: Fight AI with AI.

By adopting robust, multi-layered security architectures—including blockchain for data integrity, federated learning for decentralized protection, and Zero-Trust principles for deployment—organizations can achieve superior detection rates and reduce response times from hours to minutes.

Strategic investment in AI-driven defenses, combined with continuous employee awareness training and documented incident response procedures, are not optional best practices.

They are critical components for:

Safeguarding intellectual property
Preserving financial stability
Ensuring continuous operational integrity
Meeting regulatory compliance expectations
Protecting client confidentiality and trust

Your organization’s cybersecurity posture today determines your resilience tomorrow.

Schedule Your Consultation

Frequently Asked Questions (FAQ)

Q1: What is the projected financial impact of cybercrime globally in 2025?

A: Global cybercrime costs are projected to reach $10.5 trillion annually by 2025, representing a 10% year-over-year increase.

This translates to approximately $19.9 million per minute in losses worldwide. For context, this is larger than the GDP of most countries and represents an unprecedented transfer of economic wealth.

Q2: How are cybercriminals using AI to scale phishing and social engineering attacks?

A: Cybercriminals use generative AI to create hyper-personalized messages that precisely mimic trusted sources, including CEO communication styles, and deploy deepfake technologies to clone executives’ voices and faces.

AI automation reduces phishing attack costs by over 95%, enabling criminals to launch massive campaigns at scale with minimal cost per target, dramatically increasing success rates.

Q3: What is “AI jailbreaking” and why is it a significant threat?

A: AI jailbreaking involves bypassing ethical safety restrictions programmed into public AI systems through specialized prompt injections.

This allows malicious actors to circumvent guardrails and generate harmful content.

Discussions about jailbreaking methods increased 52% on cybercrime forums in 2024, reflecting the growing sophistication and accessibility of these techniques to lower-skilled attackers.

Q4: What are “Dark AI tools” and what are specific examples?

A: Dark AI tools are uncensored, purpose-built AI systems released without safety guardrails, designed specifically for cybercrime.

Key examples include WormGPT (specialized for phishing and business email compromise), FraudGPT (designed for financial fraud), and EvilAI (trained on malware scripts). Mentions of malicious AI tools increased 200% in 2024, reflecting a growing underground market.

Q5: How is AI lowering the barrier to entry for sophisticated cybercrime?

A: AI has dramatically reduced technical skill requirements for complex operations, with criminals with minimal expertise now able to develop ransomware and execute fraud schemes using automated tools.

The subscription model (often $60-$700/month) makes advanced capabilities affordable for novice cybercriminals, democratizing access to previously elite attack capabilities.

Q6: How does AI enhance malware development?

A: AI tools generate sophisticated, evasive malware by automatically optimizing payloads, assisting with malicious scripting, and developing evasion techniques, with frameworks like MalGEN synthesizing novel malware samples that successfully bypass current antivirus engines.

This acceleration means security teams face malware variants faster than they can analyze them.

Q7: What defensive strategy is necessary to counter AI-powered attacks?

A: Organizations must adopt the principle of “Fight AI with AI.”

This involves deploying advanced AI systems for real-time threat detection, predictive analysis, and autonomous response mechanisms to neutralize threats before escalation.

AI-driven defenses reduce response times from hours to minutes, enabling organizations to match the speed and sophistication of attacker capabilities.

Q8: What are the primary risks associated with AI supply chains themselves?

A: AI supply chain vulnerabilities include data poisoning (manipulating training data), model theft (stealing proprietary models), adversarial attacks (crafting deceptive inputs), and third-party component compromise (corrupted pre-trained models or open-source libraries).

Compromised components can propagate vulnerabilities across multiple systems enterprise-wide, creating widespread damage.

Q9: What components should be integrated into a secure AI supply chain framework?

A: A robust framework should integrate: (1) Blockchain for data provenance (tracking and verifying data origins), (2) Federated learning (distributed training without centralizing raw data), and (3) Zero-Trust Architecture (continuous authentication and micro-segmentation).

This multi-layered approach significantly reduces exposure to supply chain attacks while maintaining regulatory compliance.

Q10: How quickly can modern AI-driven defense frameworks respond compared to traditional systems?

A: Traditional systems typically require 3-7 hours for threat response due to manual inspection and delayed flagging, while modern multi-layered frameworks integrating blockchain and real-time anomaly detection can respond to threats within 1-2 minutes, representing a 100-400x improvement in response speed.

This dramatic acceleration is critical given that attacks now occur every 39 seconds.

References & Sources

Primary Research & Statistics

Dark AI Tools & Threats

Real-World Case Studies

Compliance & Security Best Practices

Last updated: January 2025 | All citations verified and current as of publication date

Romanian business professional reviewing GDPR compliance checklist on laptop in Bucharest office

8Oct

GDPR Compliance Checklist for Romanian Companies 2025

by Simona Rotaru Data Protection

Play

GDPR Compliance Checklist for Romanian Companies

What crucial step could protect your business from devastating fines while building customer trust?

Many organizations underestimate how Europe’s strict data protection laws apply to their operations.

While GDPR penalties can reach €20 million or 4% of global revenue, Romanian enforcement authorities have imposed fines ranging from €3,000 to €130,000 for violations, demonstrating that penalties scale with the severity of breaches and organizational size.

Romania’s evolving digital economy demands proactive measures to align with rigorous privacy standards.

Legal experts emphasize that proper adherence involves more than basic policy updates—it requires systematic data governance.

Companies must address consent protocols, breach response plans, and cross-border data flows to avoid regulatory scrutiny.

Specialized legal guidance helps businesses transform compliance into strategic advantages.

Firms adopting privacy-first approaches often see improved client relationships and operational resilience.

Those delaying action risk not only financial consequences but also long-term reputational damage in competitive markets.

For tailored strategies meeting international standards, contact our data protection lawyers in Bucharest.

Our team of legal professionals provide actionable frameworks to navigate complex requirements while prioritizing business growth.

Key Takeaways

Data protection laws apply regardless of a company’s physical location if EU resident information is processed,
Penalties can reach €20 million or 4% of global revenue, emphasizing the need for preventive measures,
Building customer trust through transparent data practices creates market differentiation,
Legal experts offer customized solutions to align business operations with regulatory demands,
Compliance involves continuous monitoring, not just one-time adjustments.

Understanding GDPR and Its Impact on Romanian Businesses

How can organizations in Romania turn regulatory demands into strategic opportunities?

The General Data Protection Regulation (GDPR) reshapes how businesses manage information, particularly for entities handling EU residents’ data.

Its extraterritorial scope means even non-EU-based firms must adhere to strict standards when processing personal details of European citizens.

Core Regulatory Foundations

The regulation establishes six foundational principles for data handling, plus an overarching accountability principle.

These mandate that organizations:

Process information lawfully and transparently,
Collect only necessary data for specific purposes,
Maintain accuracy and limit storage durations.

Such requirements demand technical safeguards like encryption and operational protocols for accountability.

Privacy-by-design methodologies ensure protections are embedded in all systems.

Strategic Advantages for Local Entities

Adhering to these standards transforms obligations into opportunities.

Firms prioritizing data protection report:

Enhanced client confidence through transparent practices,
Reduced breach-related costs and operational disruptions,
Differentiation in markets where privacy concerns influence decisions.

For tailored strategies aligning Romanian operations with these regulations, consult our team of Romanian Lawyers.

Proactive adaptation not only mitigates risks but positions businesses as trustworthy data stewards.

Exploring Key GDPR Roles and Terminology

Who holds ultimate accountability in data governance frameworks?

Clarifying responsibilities under privacy regulations helps organizations establish clear operational boundaries.

Three critical roles form the foundation of proper data management practices.

Data Controllers, Processors, and Data Subjects

Data controllers determine why and how personal information is handled.

They bear legal responsibility for compliance across all processing activities.

Third-party processors execute tasks under controller directives but must independently meet security standards.

Individuals whose data is collected, known as data subjects, retain rights to access or delete their information.

Organizations must implement systems to honor these requests efficiently.

The Essential Role of the Data Protection Officer (DPO)

A data protection officer oversees compliance strategies and acts as the regulatory liaison.

This role is mandatory for entities processing sensitive data or conducting large-scale monitoring.

Under Romanian Law 190/2018, organizations processing national identification numbers (CNP) based on legitimate interest must also appoint a DPO, even if they don’t meet the standard GDPR thresholds.

This additional requirement reflects Romania’s enhanced protection for sensitive national identifiers.

Romanian businesses uncertain about role allocations should consult office@theromanianlawyers.com.

Proper classification prevents overlapping liabilities and ensures alignment with cross-border standards.

Conducting a Comprehensive Data Audit and Mapping

Organizations handling personal information must first establish clarity in their data ecosystems.

A systematic audit reveals how data flows through operations, exposing vulnerabilities while ensuring alignment with legal obligations.

This foundational step transforms raw information into actionable insights for risk management.

Identifying What Personal Data You Collect

Begin by cataloging every category of personal data your organization processes.

Common examples include:

Contact details (names, email addresses).
Digital identifiers (IP addresses, device information).
Sensitive records (financial data, health information).

Document each data point’s purpose, collection method, and retention timeline.

Assess whether processing activities rely on valid legal grounds like contractual necessity or explicit consent.

Storage locations demand equal scrutiny—identify physical servers, cloud platforms, and third-party repositories holding sensitive materials.

Access controls form another critical audit component.

Map which employees or systems interact with personal data and verify authorization protocols.

This process highlights potential exposure points while streamlining responses to information requests.

Romanian entities seeking structured frameworks for these assessments may contact our data protection legal specialists.

Expert guidance ensures audits meet regulatory expectations while supporting operational efficiency.

GDPR Compliance Checklist for Romanian Companies

Businesses handling EU data face operational complexity when aligning processes with privacy standards.

Structured frameworks simplify adherence while minimizing risks of non-conformance.

Effective strategies combine procedural clarity with technological safeguards to meet evolving requirements.

Actionable Protocols for Information Security

Organizations should prioritize these critical measures:

Action Item	Responsible Party	Deadline
Complete data flow mapping	IT & Legal Teams	30 Days
Implement encryption protocols	Security Department	45 Days
Update third-party contracts	Compliance Officer	60 Days

Consent Management Best Practices

Valid authorization requires unticked checkboxes and separate permissions for distinct processing purposes.

Confirmation emails enhance verification, while centralized logging systems track user agreements with timestamps and purpose details.

Organizations must honor withdrawal requests without undue delay and provide confirmation within one month, as required by GDPR Article 12(3).

Automated systems should flag outdated records immediately upon withdrawal, ensuring ongoing alignment with transparency obligations and ceasing processing activities promptly.

Regular audits verify adherence to storage limitation principles and access controls.

Local enterprises seeking customized frameworks may contact office@theromanianlawyers.com.

Specialized guidance helps establish resilient processes that satisfy regulatory expectations while supporting operational scalability.

Ensuring Website Security and Transparent Privacy Policies

How do modern businesses balance robust security with user transparency?

Websites storing personal information require layered defenses against cyber threats.

Organizations must adopt technical safeguards while clearly communicating data handling practices to users.

Implementing SSL, Strong Passwords, and Anti-Virus Measures

HTTPS encryption via SSL certificates forms the first line of defense.

Multi-factor authentication and complex passwords prevent unauthorized account access.

Regular vulnerability scans and firewall updates address emerging threats.

Advanced protections include:

Content Delivery Networks (CDNs) to mitigate DDoS attacks,
Intrusion detection systems monitoring server activity,
Automated backups stored in geographically separate locations.

Designing Clear and Accessible Privacy Notices

Privacy policies must explain data collection purposes in plain language.

Every page should feature a visible link to these documents. Essential disclosures include:

Types of information gathered (contact details, device data)
Legal basis for processing activities
Third-party data sharing arrangements

Entities developing their online platforms should consult office@theromanianlawyers.com for policy reviews.

Proper alignment with privacy standards builds credibility while reducing legal exposure.

Managing Third-Party Vendors and International Data Transfers

How can businesses ensure their partners meet strict data protection standards?

Organizations relying on external vendors must verify their adherence to privacy regulations.

This requires thorough evaluations and contractual safeguards to maintain accountability across supply chains.

Evaluating Vendor Requirements and Contracts

Entities handling personal information must catalog all service providers processing data.

This includes cloud platforms, payment systems, and marketing tools.

Assessments should examine vendors’ security certifications, breach response plans, and documentation of regulatory alignment.

Legally binding agreements define responsibilities between controllers and processors.

These contracts specify permitted activities, retention timelines, and security protocols.

Subcontractor arrangements require explicit approval to maintain oversight.

Requirement	Action	Mechanism
Vendor Accountability	Review security audits	Annual assessments
Data Transfers	Implement SCCs	Contractual clauses
Risk Mitigation	Conduct impact analyses	Transfer evaluations

Cross-border data flows demand additional precautions.

Companies must confirm whether recipient countries have EU adequacy status.

For other regions, standardized contractual clauses or binding corporate rules become mandatory safeguards.

Romanian enterprises navigating these complexities should seek specialized Romanian Lawyer.

Proactive vendor management frameworks prevent regulatory violations while fostering trust with European partners.

Contact office@theromanianlawyers.com for tailored strategies addressing cross-border operational challenges.

Preparing for Data Breaches and Facilitating Data Subject Rights

What separates resilient organizations from vulnerable ones when cyber threats strike?

Proactive preparation for security incidents and efficient handling of individual rights form the backbone of modern data governance.

Organizations must balance rapid response capabilities with systematic processes to address user inquiries.

Developing a Robust Breach Response Plan

Effective incident management requires predefined protocols.

Immediate detection mechanisms trigger containment procedures within one hour of identifying unauthorized data access.

Forensic teams analyze breach scope while legal advisors determine notification obligations to authorities within 72 hours.

Regular simulation exercises test communication channels between IT, legal, and PR departments.

Documentation templates for breach reports ensure regulatory requirements are met without delays.

Continuous monitoring systems flag unusual activity patterns to prevent escalation.

Streamlining Data Subject Access Requests

Individuals increasingly exercise their right to review or delete personal information.

Centralized portals allow users to submit requests through secure authentication methods.

Automated workflows verify identities and route inquiries to appropriate teams within 24 hours.

Response templates maintain consistency while adhering to legal timelines.

Secure delivery channels protect sensitive information during transmission.

Audit trails demonstrate compliance with access rights obligations during regulatory inspections.

Entities requiring customized frameworks for incident management or user rights processes should contact office@theromanianlawyers.com.

Structured approaches transform regulatory demands into operational strengths while maintaining stakeholder trust.

FAQ

When must Romanian businesses appoint a data protection officer?

Organizations must designate a data protection officer if they systematically monitor individuals on a large scale or process sensitive categories like health records.

Public authorities in Romania also require this role regardless of data volume.

How long can companies retain customer information under EU regulations?

Storage periods must align with the original purpose for collection.

For example, transaction records may be kept for tax compliance periods specified by ANAF (Romania’s tax authority), while marketing contact lists require periodic reviews for relevance.

What technical safeguards are mandatory for website security?

Essential measures include SSL encryption, multi-factor authentication, regular penetration testing, and documented patch management processes.

Organizations should implement security measures proportionate to the risk level of data processing, following GDPR Article 32 requirements for appropriate technical and organizational measures.

Are international cloud providers like AWS or Microsoft Azure GDPR-compliant for Romanian data?

Providers operating under EU-approved mechanisms like Standard Contractual Clauses (SCCs) or binding corporate rules generally meet requirements.

However, companies must verify current certifications and update Data Processing Agreements (DPAs) annually.

What penalties apply for violating data subject rights in Romania?

The National Supervisory Authority for Personal Data Processing (ANSPDCP) can impose fines up to €20 million or 4% of global turnover.

Recent enforcement actions targeted improper consent practices and delayed breach notifications.

How should organizations handle data access requests from employees?

Businesses must respond within 30 days, providing free electronic copies of records.

Implement automated DSAR workflows in platforms like Microsoft 365 or specialized tools such as OneTrust to track and fulfill requests efficiently.

7Oct

Foreigners’ Fiscal Registration: NIF Code in Romania 2026

by Simona Rotaru Corporate Law, taxes Romania

Romanian fiscal registration • 2026

NIF code in Romania: the practical guide for foreign individuals

A Romanian NIF is a tax identification number assigned to a natural person who does not hold a Romanian CNP and must be identified in the Romanian tax system. The correct registration route depends on the person, the transaction and the reason Romanian fiscal identification is required.

A NIF connects a person without a Romanian CNP to a defined Romanian fiscal reason and ANAF record.

Short answer: the NIF, or număr de identificare fiscală, is the Romanian fiscal identifier used for a natural person who does not have a Romanian personal numerical code (CNP). It is obtained only when a Romanian tax or registration reason exists. A NIF does not itself create tax residence, immigration status, employment rights or a Romanian company.

What is a NIF code in Romania?

Under the Romanian fiscal-registration framework, a natural person who does not hold a CNP may be identified through a fiscal identification number assigned by the tax authority. In practice, this number is commonly called a Romanian NIF or Romanian tax identification number.

The governing framework includes Law no. 207/2015 on the Fiscal Procedure Code and the ANAF orders governing fiscal-registration forms. The NIF should be treated as an identifier within the tax administration system, not as a general identity document.

The decisive distinction is whether the person has a CNPThe current Form 030 is for natural persons who do not hold a Romanian CNP, except individuals carrying on independent economic activities or liberal professions, for whom a different registration route may apply. It is not a form reserved for non-EU citizens.

NIF, CNP, CIF and VAT number: what is the difference?

Identifier	Who or what it identifies	What it does not prove
NIF	A natural person without a CNP who must be identified for Romanian fiscal purposes.	It does not prove Romanian citizenship, residence, work authorisation or tax residence.
CNP	A natural person to whom a Romanian personal numerical code has been assigned under the applicable civil or immigration framework.	It does not automatically determine the person’s tax residence in a cross-border case.
CIF/CUI	A company, organisation or another registered taxpayer or entity, depending on the legal context.	It is not the personal NIF of a foreign shareholder or director.
VAT number	A person or entity registered for Romanian VAT under the applicable rules.	A NIF does not automatically confer VAT registration.

Foreign founders should also distinguish their personal fiscal identification from the registration number of the Romanian company. The incorporation process is explained separately in our guides to company formation in Romania and starting a Romanian SRL in 2026.

Who may need a Romanian NIF?

A foreign individual does not need a NIF merely because they visit Romania or communicate with a Romanian business. A concrete Romanian fiscal or registration relationship must be identified first. Depending on the facts, a NIF may be required or requested in connection with:

Romanian-source income

The person receives income that must be reported or administered in Romania and does not already have a CNP.

Property transaction

A non-resident becomes a party to a Romanian property transaction requiring fiscal identification.

Property ownership

The owner must be identified for Romanian tax records, local obligations or a later disposal.

Corporate involvement

A transaction, filing or tax record involving a foreign shareholder, director or beneficiary requires personal fiscal identification.

Bank or payer process

A Romanian credit institution or income payer is legally involved in the fiscal-registration route.

Other tax obligation

A specific Romanian tax rule requires the individual to be registered with ANAF.

These are categories for preliminary assessment, not automatic rules. For example, owning shares in a Romanian company and personally receiving Romanian-source income are different legal events. The relevant transaction and reporting obligation should be identified before a Form 030 file is prepared.

Avoid obtaining a number without defining its purposeA generic request may be delayed if the competent authority, registration reason, supporting documents or representative are not correctly identified. The starting question is not simply “Does a foreigner need a NIF?” but “Which Romanian legal or fiscal event requires this person to be registered?”

When is Form 030 used?

The current ANAF catalogue describes Form 030 as the fiscal-registration, amendment or deregistration declaration for natural persons who do not hold a CNP, other than persons carrying on independent economic activities or liberal professions. The form is governed by ANAF Order no. 2034/2022.

Before filing, use the official ANAF forms catalogue to confirm that the form and instructions have not been replaced. The official Form 030 PDF and instructions should be used rather than an older copy from an unofficial website.

Form 030 has three different functionsIt may be used for initial fiscal registration, for amendments to information already declared, or for deregistration after a CNP is assigned. The appropriate box and supporting information depend on the actual purpose of the filing.

Which documents are normally prepared?

The exact file depends on the applicant, the fiscal reason and who submits the declaration. A practical document review commonly considers:

the current Form 030, completed consistently with the supporting documents;
a valid passport, identity card or other accepted identity document;
the individual’s complete foreign domicile or address information;
the tax identification number in the state of residence, if one exists and is relevant to the form;
a document showing why Romanian fiscal identification is needed, where requested or useful for establishing the registration basis;
the power of attorney or other authority for the person or institution submitting the file;
Romanian translations and, where applicable, authentication, legalisation or apostille formalities; and
contact details and any additional information requested by the competent tax office.

A Romanian address is not universally required. A person applying under Form 030 may retain a foreign domicile, and the appropriate address evidence depends on the individual file and the tax office’s review. The document supporting the registration reason may be a transaction document, an income-related record or another document appropriate to the case.

How does the Romanian NIF registration process work?

Stage 01

Tax reason

Define the Romanian income, asset, transaction or obligation that creates the registration need.

The correct route begins with the fiscal reason, not with a generic request for a number. Select a stage to view its role in the file.

Confirm the registration triggerIdentify the income, asset, transaction, corporate event or statutory obligation that requires Romanian fiscal identification.

Check existing identifiersConfirm whether the individual already has a Romanian CNP or NIF and whether Form 030 is the appropriate route.

Identify the competent office and filerDetermine which ANAF office is competent and whether filing is made through an authorised representative, income payer, credit institution or another legally permitted route.

Prepare Form 030 and supporting recordsAlign names, addresses, identity data, foreign tax number, registration reason and authority documents.

Submit and answer queriesKeep proof of submission and respond if ANAF requests clarification, correction or additional documents.

Use and update the record correctlyUse the NIF for the relevant Romanian fiscal matters and submit amendments or deregistration when the legal conditions arise.

Can a lawyer or another representative obtain the NIF?

The Form 030 instructions contemplate filing through an authorised representative or other listed filer rather than treating the application as an unrestricted walk-in request by any person. The authority document and the representative’s capacity must therefore be checked carefully.

A Romanian lawyer may assist with identifying the correct route, preparing the form, reviewing foreign documents, arranging translations and communicating with the competent authority under an appropriate mandate. The scope of the mandate should match the required acts and document formalities.

For clients obtaining a NIF in connection with a company or investment, the fiscal-registration analysis may need to be coordinated with foreign-founder documentation, a Romanian business bank account or the relevant transaction documents.

Can a Romanian notary request fiscal registration?

Yes, in the circumstances covered by the specific procedure approved in 2025. The ANAF procedure for registration requested by public notaries applies where the notary needs the fiscal registration of a non-resident person who does not already have the required Romanian fiscal identifier.

Under that procedure, the notary transmits the required identity, address, foreign tax-number and transaction-reason information through the dedicated system. The competent tax authority checks whether the person is already registered and, if not, assigns the identifier and issues the registration certificate. The stated maximum of five working days applies to requests transmitted under this notarial procedure; it should not be presented as a universal deadline for every NIF application.

Property buyers should coordinate earlyIf a foreign buyer needs a NIF for a Romanian transaction, the lawyer, notary and tax-registration documents should be coordinated before the contractual deadline. Review our Romanian real estate due-diligence checklist and 2026 guide to buying property in Romania.

How long does it take to obtain a NIF?

There is no reliable universal promise of “a few days” for every application. Timing can depend on the filing route, competent office, completeness of the form, identity matching, translations, representative documents and whether ANAF requests clarification.

The special notarial procedure mentioned above provides a maximum five-working-day period for the tax authority to resolve the notary’s transmitted request. A conventional Form 030 file should be planned with a reasonable buffer rather than assuming that the same special deadline automatically applies.

Does a NIF make someone tax resident in Romania?

No. A NIF is an identification number. Romanian tax residence is a separate legal analysis based on the applicable domestic rules, facts and, where relevant, a double-taxation treaty. The number alone neither creates nor prevents Romanian tax residence.

A person who spends time in Romania, moves their centre of vital interests, earns Romanian-source income or maintains connections with several states may require a separate residence review. See our guide to Romanian tax residence and the ANAF materials on double-taxation conventions.

A NIF does not eliminate double taxationTreaty protection depends on residence, source, the type of income, beneficial ownership where relevant, supporting certificates and compliance with the applicable procedure. Merely holding a Romanian NIF does not resolve a treaty claim.

What happens if the person later receives a CNP?

Form 030 also covers deregistration following the assignment of a CNP. The tax record should be aligned so that the same person is not treated inconsistently under separate identifiers. The appropriate amendment or deregistration filing should be made with reference to the new CNP and the existing NIF record.

Changes to declared identity, domicile or contact information may also require an amendment. The correct response depends on the field that changed, the supporting document and the person’s current Romanian registration status.

Which NIF application mistakes cause delays?

using Form 030 solely because the applicant is foreign, without checking whether the person already has a CNP;
describing citizenship rather than the actual Romanian fiscal-registration reason;
using an outdated form or instructions copied from an unofficial source;
inconsistent spelling, name order, birth data or addresses across the passport, form and power of attorney;
omitting the foreign tax identifier when the form and facts require it;
assuming a general or informal authorisation is sufficient for representation;
submitting untranslated documents where Romanian translations are required;
confusing a NIF with tax residence, VAT registration, immigration status or company registration; and
assuming the five-day notarial timeline applies to every registration route.

Use the current official formANAF may update forms and administrative practice. Check the official form catalogue immediately before submission and confirm the competent authority and supporting documents for the particular case.

Need assistance with a Romanian NIF application?

Atrium Romanian Lawyers assists foreign individuals, investors and founders with Romanian fiscal-registration matters connected to property, companies, income and cross-border transactions. We can review the reason for registration, identify the appropriate route, prepare the documentation and coordinate the filing under an agreed legal mandate.

Request a NIF assessment View Romanian tax legal services

Frequently asked questions about the NIF code in Romania

Is the Romanian NIF only for non-EU citizens?

No. Form 030 is organised around whether a natural person has a Romanian CNP, not whether the person is an EU or non-EU citizen. The applicant must also have a Romanian fiscal-registration reason.

Can I apply for a NIF without travelling to Romania?

Remote handling may be possible through an authorised representative or another legally permitted filing route. The power of attorney, identity documents, translations and submission method must be checked for the specific case.

Does a Romanian NIF allow me to live or work in Romania?

No. A NIF is a fiscal identifier. Visas, residence permits and work authorisation follow separate immigration and employment rules.

Do I automatically need a NIF to own shares in a Romanian SRL?

Not every corporate role creates the same registration requirement. The incorporation, ownership, payment and reporting events should be reviewed to determine whether and when personal fiscal identification is needed.

Can a notary obtain the NIF for a property transaction?

A special procedure allows a Romanian public notary to request fiscal registration for a non-resident who lacks a Romanian fiscal identifier when this is required for the notarial matter. The transaction should be coordinated with the notary in advance.

Is Form 030 used if I already have a CNP?

Generally, Form 030 is intended for natural persons without a CNP. ANAF lists Form 020 for Romanian and foreign natural persons who hold a CNP, subject to the scope and exceptions stated in its instructions.

Does obtaining a NIF make me Romanian tax resident?

No. Tax residence depends on separate legal criteria and any applicable tax treaty. A fiscal identification number is not a tax-residence determination.

What should I do if I later receive a CNP?

The existing fiscal record should be aligned with the CNP. Form 030 includes a deregistration function following assignment of a CNP, but the correct filing and supporting documents should be confirmed for the individual record.

Legal information notice: This article provides general information about Romanian fiscal identification. The correct form, competent authority, documents and tax treatment depend on the person and transaction. Confirm the current ANAF requirements before filing.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.

EU AI Act in Romania: 2026 Guide for Foreign Companies

What is the practical answer for a foreign company?

Scope first

Obligations now

Evidence later

AI Act timeline for companies operating in Romania

Does the AI Act apply to a foreign company operating in Romania?

Which AI uses should a Romanian company classify first?

Which AI practices are prohibited?

Procurement gate

Red-flag review

Decision record

What transparency duties apply from 2 August 2026?

Does every AI-generated business article or image need a label?

What does AI literacy require?

Identify AI users

Match training to context

Keep training records

Update after change

What should employers know about recruitment and workplace AI?

Vendor contracts and AI due diligence

Purpose and role

Data and outputs

Human oversight

Incidents and changes

Exit and continuity

How does the AI Act interact with GDPR and Romanian employment law?

AI Act

GDPR

Employment and sector law

Who supervises the AI Act in Romania?

What penalties can apply?

Practical AI Act compliance checklist for a Romanian operation

Create an inventory

Approve use cases

Train users

Review public outputs

Monitor change

Common mistakes made by foreign groups

“The parent handles it”

“The vendor is compliant”

“The deadline is 2027”

“A human checked it”

“A footer solves labelling”

“Only official AI tools count”

Frequently asked questions

Related Guides & Services

Need to assess AI use in a Romanian business?

Workplace Investigations in Romania: Employer Guide

What is a workplace investigation in Romania?

Fact-finding

Disciplinary route

Proportionate response

What process should an employer follow?

When is a formal disciplinary investigation mandatory?

What are the employee’s rights during the investigation?

Clear summons

Real defence

Complete record

How should evidence and confidentiality be handled?

How is a disciplinary sanction chosen?

When can disciplinary dismissal be used?

What deadlines and decision content apply?

Common employer errors

Starting with a conclusion

Using a generic summons

Missing dates

Practical checklist for Romanian employers

Related employment law guides

Frequently asked questions

Need advice before a workplace decision?

Changing Shareholders in a Romanian Company: The 2026 Legal Guide

📹 Video Guide: Changing Shareholders in Romania

Need Professional Help?

What Does Changing Shareholders in a Romanian Company Actually Mean?

When Is Shareholder Approval Needed for a Transfer?

Step-by-Step: How to Change Shareholders in a Romanian Company

What Changed in 2025 and 2026? New Rules You Must Know

What Are the Tax Consequences of a Share Transfer in Romania?

Reservation Agreements vs. Pre-Contracts: Understanding Shareholder Approval Thresholds