AI vendor contracts in Romania under the EU AI Act and GDPR

An AI vendor contract should do more than grant access to a platform. It should identify the system and intended use, allocate regulatory roles, control the use of business and personal data, preserve evidence, set performance and security obligations, and provide a workable exit if the supplier, model or law changes.

Key points for companies buying AI services in Romania:

Classify the AI use and the parties’ roles before negotiating warranties and liability.
Do not assume that a standard SaaS agreement or a GDPR DPA covers AI-specific risk.
State whether prompts, files, outputs and usage data may be retained or used for training.
Require enough information, logs and cooperation to meet the customer’s own legal duties.
Connect service changes, security incidents and regulatory events to notice, remediation and exit rights.

This guide is intended for Romanian companies, foreign groups operating in Romania, technology suppliers, procurement teams and businesses implementing generative or other AI tools. It focuses on contract structure. For the wider regulatory framework, read our EU AI Act guide for foreign companies.

Why does an AI vendor contract need a separate review?

AI services can change after signature. A supplier may replace a model, add a subprocessor, change data-retention settings, modify safety controls or alter the geographic delivery chain. Outputs may also be probabilistic rather than repeatable. These features create risks that are not fully addressed by ordinary clauses on software access, uptime and confidentiality.

The EU AI Act allocates obligations according to the system, risk category and operator role. The GDPR applies in parallel where personal data is processed. The contract cannot transfer away statutory responsibility, but it can secure the information, instructions, evidence and cooperation needed for each party to perform its own obligations.

Practical distinction: the AI Act analysis, the GDPR role analysis and the commercial allocation of risk are related but separate. A supplier described as a “provider” under the AI Act is not automatically a “processor” under the GDPR.

Start with the AI use, not the vendor’s template

Before redlining the agreement, the customer should record what the system will do, whose decisions it will influence, what data enters the system, who receives the output and whether the tool will be integrated into employment, credit, insurance, education, essential services, biometric or other sensitive workflows. The same product can create different legal exposure when deployed for a different purpose.

Contract navigator

Build the AI contract in five connected layers

Select a layer to see the question that should be answered before signature.

System and intended use

Identify the product, model, version, functions, integrations, users, prohibited uses and decision context. Classification begins with the actual deployment.

AI vendor due diligence before contract negotiation

A customer cannot negotiate intelligently without basic information about the service. The due-diligence request should be proportionate to the use and risk, but it commonly covers:

the legal entity supplying the service and the entities supporting it;
the model or models used, hosting locations and material third-party dependencies;
the intended purpose, known limitations and prohibited uses;
data sources, retention rules and whether customer data is used for training or improvement;
security controls, incident history, business continuity and disaster recovery;
testing, accuracy or performance information relevant to the deployment;
subcontractors, subprocessors and international data transfers; and
the supplier’s process for regulatory requests, complaints, audit evidence and system changes.

For high-risk deployments, the customer may require contractual access to sufficient documentation, instructions, logs and compliance information to enable it to perform its own obligations under the AI Act. The scope of access should reflect the parties’ respective roles and may need to protect the supplier’s trade secrets and intellectual-property rights. The European Commission’s AI Act information page and its AI Act Service Desk are useful starting points, but the contract must still reflect the particular system and transaction.

What if the service relies on a general-purpose AI model?

Where the service relies on a general-purpose AI model, the customer should also consider whether contractual information rights are needed regarding the model provider, model updates, transparency documentation and downstream restrictions affecting the deployment. These provisions should be tailored to the customer’s position in the AI value chain and should not imply that the customer is entitled to the provider’s complete technical documentation.

What clauses should an AI vendor agreement contain?

Contract layer	What the clause should resolve	Risk if unclear
System and permitted use	Product, model, version, functionality, users, integrations, territories, intended purpose and prohibited uses.	The service is used outside its tested or agreed purpose.
Regulatory roles	AI Act operator roles, GDPR roles, responsibility matrix and cooperation duties.	Each party assumes the other will supply evidence or perform a mandatory task.
Data and training	Permitted inputs, retention, model training, improvement, isolation, deletion and export.	Confidential or personal data is retained or reused beyond the customer’s expectation.
Performance and oversight	Relevant metrics, limitations, testing, human review, logs, notices and remediation.	Outputs cannot be evaluated, challenged or reconstructed when a problem occurs.
Security and incidents	Technical measures, vulnerability management, notification triggers, timing and cooperation.	The customer learns too late or receives too little information to respond lawfully.
IP and output rights	Rights in inputs, outputs, configurations, documentation, feedback and third-party materials.	The customer lacks the rights needed for its intended commercial use.
Change control	Notice of model, policy, subprocessor, location and functionality changes, plus testing and objection rights.	A compliant deployment becomes materially different during the contract.
Liability and exit	Warranties, indemnities, caps, insurance, suspension, termination, transition, export and deletion.	The remedy is commercially unusable when the service fails or must be withdrawn.

Click a row, or focus it and press Enter, to highlight one negotiation layer.

1. Define the system, version and intended purpose

The agreement should identify what is actually being supplied. “AI services” is rarely sufficient. The specification should address the model or service version, functions, interfaces, customer environment, authorised users, territories, dependencies and intended use. If classification or performance depends on a specific configuration, that configuration should be documented.

2. Allocate AI Act and GDPR roles separately

The parties should record their assumed roles under the AI Act and set out who provides instructions, documentation, logs, notices and regulatory cooperation. A separate analysis is required under the GDPR. Depending on the facts, the parties may be controller and processor, independent controllers or, in a narrower class of cases, joint controllers.

Where the supplier processes personal data on the customer’s behalf, Article 28 GDPR terms may be required. See our dedicated guide to the Data Processing Agreement in Romania. The DPA should not be treated as the complete AI contract, and the main agreement should not conflict with it.

3. Control prompts, files, outputs and training use

The contract should distinguish customer content, personal data, telemetry, feedback and output. It should state whether each category may be stored, reviewed by humans, used to improve the service or used to train a shared model. Where “no training” is promised, the clause should explain its scope, including whether safety review, abuse monitoring or service analytics remain permitted.

The European Data Protection Board has emphasised that whether an AI model is anonymous must be assessed case by case. A supplier’s assertion that its model is anonymous should therefore be supported by facts rather than accepted as a label. See the EDPB’s summary of Opinion 28/2024.

4. Make performance, limitations and human oversight usable

Conventional uptime metrics do not measure output quality. Depending on the use, the contract may need agreed tests, documented limitations, error reporting, performance monitoring, bias or drift controls, escalation and human-review requirements. The AI Act’s accuracy requirements should not be treated as a guarantee of error-free outputs. Any contractual accuracy or performance commitment should define the relevant task, dataset, test method, threshold and remedy.

5. Require evidence and audit cooperation

The customer may need records to complete an impact assessment, answer a regulator, investigate a complaint or demonstrate human oversight. The agreement should define which information is available, in what format, how quickly and subject to what confidentiality protections. In practice, enterprise suppliers may satisfy some audit requirements through independent certifications, reports and controlled information-sharing mechanisms rather than unrestricted customer audits. Those materials can support due diligence, but they do not automatically answer system-specific questions.

6. Coordinate security and incident notification

Security clauses should address access controls, encryption where appropriate, vulnerability management, segregation, personnel access, business continuity and incident cooperation. Notification should be triggered by defined events and delivered early enough for the customer to meet its own legal and operational duties. Different events may activate different regimes, so a personal-data breach, an incident affecting the AI system and an ordinary service outage should not be collapsed into one undefined term.

7. Address intellectual property and third-party claims

The contract should distinguish rights in customer inputs, supplier technology, configurations, fine-tuning, documentation, feedback and outputs. It should also allocate responsibility for claims involving training material, output, trademarks, confidential information and third-party components. Broad statements that the customer “owns the output” may be insufficient if the supplier cannot grant exclusivity or if protectability depends on applicable law and human contribution. Ownership language should be assessed together with applicable copyright rules, which may require sufficient human authorship for copyright protection.

8. Control subcontractors, subprocessors and model dependencies

An AI service may depend on model providers, cloud infrastructure, safety services and specialist subprocessors. The contract should identify the relevant chain, require notice of material changes and preserve appropriate objection or termination rights. For personal data, the subprocessor mechanism must align with Article 28 GDPR and any applicable international-transfer safeguards.

9. Regulate model and policy changes

Suppliers often reserve broad rights to modify models, acceptable-use policies and technical features. The customer should seek prior notice of material changes, enough information to reassess the deployment and a remedy when a change materially reduces functionality, alters data use, affects compliance or creates an unacceptable risk.

10. Connect liability to the risks that matter

Liability provisions should be read together with warranties, indemnities, insurance and remedies. A general cap may be commercially unsuitable for confidentiality breaches, unlawful data use, IP claims or deliberate misconduct, while unlimited liability for every model error may be unacceptable to a supplier, particularly where outputs remain subject to human review. The negotiated position should reflect control, foreseeability, fees, insurance and the consequences of the intended use.

11. Preserve suspension, termination and transition rights

The contract should explain what happens if the service becomes prohibited, materially non-compliant, insecure or unsuitable for the agreed purpose. Exit terms should cover data and prompt export, configuration records, transition assistance, continuing access where necessary, deletion, certification and surviving confidentiality or audit duties.

12. Align the whole contract suite

The main agreement, order form, specification, DPA, security schedule, service levels and online policies should be checked together. An order of precedence is important where one document allows training while another prohibits it, or where a linked policy can be changed unilaterally. Our broader contract review checklist explains the commercial clauses that remain relevant alongside the AI-specific controls.

Customer and supplier priorities are not identical

A customer usually seeks transparency, stable functionality, control of its data, evidence for compliance and practical exit rights. A supplier needs a defined intended use, customer cooperation, restrictions against misuse, protection for reusable technology and a liability position proportionate to fees and control. A balanced contract should not hide this tension. It should identify which party can prevent, detect and remedy each risk.

Practical experience: how Atrium approaches an AI contract review

A typical client mandate begins with the operating facts, not a generic AI checklist. Atrium Romanian Lawyers first maps the proposed use, data flows, parties, model dependencies and decisions affected by the tool. We then review the full contract suite, identify provisions that do not match the deployment and separate mandatory compliance points from negotiable commercial risk.

The work may include a priority risk report, tracked changes, replacement clauses and a negotiation list for the business and technical teams. Particular attention is given to training rights, confidentiality, GDPR roles, security incidents, documentation, model changes, intellectual property, liability and exit. This section describes our review method and does not disclose any client’s confidential facts.

AI vendor contract checklist before signature

Document the system, intended use, users and decision context.
Complete the AI Act role assessment and determine whether the deployment may involve prohibited, high-risk, transparency or other regulated AI use cases.
Map personal data, confidential information and international transfers.
Collect the main agreement, order, DPA, security schedule and linked policies.
Confirm whether customer data, prompts or outputs may be used for training.
Test whether supplier documentation supports the customer’s compliance duties.
Define relevant performance measures, limitations and human oversight.
Align incident notification with legal and operational deadlines.
Review IP ownership, licences, third-party material and claims.
Control material changes to models, policies, locations and subcontractors.
Model liability for realistic failure scenarios.
Plan suspension, export, transition and deletion before deployment begins.

Frequently asked questions

Does every AI vendor contract need a GDPR DPA?

No. A DPA is required where the factual relationship meets the controller-processor conditions under Article 28 GDPR. Other arrangements may involve independent or joint controllers. The roles should be assessed from the actual processing, not only from the labels in the contract.

Can an AI supplier use customer prompts to train its model?

That depends on the contract, product settings, supplier role, transparency and applicable data-protection and confidentiality rules. The agreement should state clearly which data may be used, for what purpose, for how long and whether an effective opt-out or enterprise isolation applies.

Does an AI Act clause transfer compliance responsibility to the supplier?

No. A contract can allocate tasks, information duties, warranties and remedies, but it cannot remove statutory obligations imposed on a party by law. Each operator should understand and perform the duties attached to its own role.

Should the contract name the underlying AI model?

Usually, the system and relevant dependencies should be described with enough precision to understand what is being supplied. If the supplier may change the underlying model, the contract should address notice, testing, material degradation, data implications and the customer’s available remedies.

Who owns AI-generated output?

The answer depends on the contract, the output, applicable intellectual-property law, human contribution and third-party material. The agreement should distinguish ownership from a licence to use and should address infringement claims and supplier restrictions.

Can a Romanian lawyer review a foreign vendor’s English-language AI contract?

Yes, where the agreement concerns a Romanian company, Romanian operations or applicable EU and Romanian requirements. The scope should identify whether separate advice is needed for clauses governed exclusively by another country’s law.

Negotiating an AI vendor contract connected with Romania?

Atrium Romanian Lawyers assists customers and technology suppliers with AI, SaaS and IT contract review, drafting and negotiation, including GDPR, security, intellectual-property, liability and exit provisions.

Discuss the contract with a Romanian lawyer

Disclaimer: This article provides general information and does not constitute legal advice. The appropriate contract and compliance analysis depends on the system, intended use, data, parties, operator roles, applicable law and complete contract suite.

AI Notice: AI-assisted content, reviewed and approved by a qualified Romanian lawyer.

Two corporate professionals reviewing AI transparency controls, compliance dashboards, and synthetic content verification tools on screens in an office setting.

1Aug

EU AI Act in Romania: 2026 Guide for Foreign Companies

by Simona Rotaru Digital Law

Artificial intelligence and digital regulation · 2026

EU AI Act in Romania: 2026 Guide for Foreign Companies

Foreign companies operating in Romania may be subject to the EU AI Act even when the parent company, vendor or development team is outside the European Union. This practical guide explains the scope rules, the obligations already applying in 2026, the later high-risk deadlines and the records a Romanian business should build now.

The analysis should be read together with the official AI Act text, the Commission’s AI Act implementation page and the current guidance available through the AI Act Service Desk.

What is the practical answer for a foreign company?

A Romanian subsidiary, branch or other local operation should begin with an inventory of the AI systems it provides, deploys, imports, distributes or uses for work. The company should then identify whether the system is prohibited, high-risk, subject to transparency duties, or outside the main AI Act obligations. The label used by the vendor is not decisive: the same tool may create different legal questions depending on its function, users, outputs and place of use.

Scope first

Map the Romanian entity, the foreign group, the provider, the deployer, the users and where the output is used. A foreign parent does not automatically remove EU exposure.

Article 2 analysis

Obligations now

AI literacy, prohibited-practice controls, GPAI-related obligations and the new transparency rules must be considered according to the applicable role and system.

2026 operating baseline

Evidence later

Keep an AI register, vendor file, training record, human-oversight process and incident route so the business can show how it reached its classification.

Governance that scales

Key point: the AI Act does not create a universal “AI officer” requirement for every Romanian business. Responsibility must be allocated in a way that fits the company’s systems, roles, risk profile and existing compliance structure.

AI Act timeline for companies operating in Romania

The original AI Act timetable has been supplemented by the Digital Omnibus on AI. The current implementation page of the European Commission identifies the dates below. A deadline table should be treated as a planning tool, not as a substitute for checking the final text and any sector-specific transition rule.

Completed1 August 2024
Entry into force

The Regulation entered into force. The legal framework began its transition period, while later provisions were scheduled to apply in stages.

Applied2 February 2025
Prohibitions and literacy

The prohibited-practice rules and the Article 4 AI-literacy obligation became applicable. Businesses should already have training and prohibited-use controls in place.

Applied2 August 2026
Transparency and supervision

Transparency obligations for certain AI systems, broader enforcement powers and the Commission’s AI Office and national authorities’ implementation work become operational.

Deferred2 December 2027
Selected high-risk uses

Following the Digital Omnibus, high-risk systems in sensitive Annex III areas, including employment, apply from this date. Product-embedded high-risk rules have a later transition.

Rule or milestone	Current application point	What the Romanian operation should do
Prohibited AI practices	Applied from 2 February 2025; an additional prohibition concerning certain non-consensual intimate or child sexual abuse material applies from 2 December 2026.	Screen use cases before procurement or deployment and escalate any practice that may manipulate, exploit, socially score or infer protected characteristics.
AI literacy	Applied from 2 February 2025 and enforced by national market-surveillance authorities from 2 August 2026.	Adopt role-based training and retain evidence of the measures taken, rather than relying on a generic awareness email.
Transparency rules	Applied from 2 August 2026 for the relevant Article 50 systems and outputs.	Review chatbot notices, synthetic-content marking, deepfake disclosures and the editorial process for public-interest text.
Annex III high-risk systems	Selected high-risk use cases, including employment, apply from 2 December 2027 after the Digital Omnibus transition.	Classify and plan early. The later date does not remove GDPR, employment, consumer or fundamental-rights duties that may apply now.
High-risk systems in regulated products	Extended transition until 2 August 2028 under the current Commission summary.	Coordinate product-safety, sectoral and AI Act analysis with the provider and any notified-body or conformity route.

The Commission’s current AI Act timeline identifies the staged dates and the changes introduced by the Digital Omnibus.

Does the AI Act apply to a foreign company operating in Romania?

Often, yes. The scope is not limited to companies incorporated in an EU Member State. The Regulation covers providers placing AI systems or general-purpose AI models on the Union market, deployers located in the Union, and providers or deployers in a third country where the output produced by the system is used in the Union. Importers, distributors, certain product manufacturers, authorised representatives and affected persons are also expressly addressed.

This creates several common patterns for international groups. A US or UK parent may provide a generative AI platform used by its Romanian subsidiary. A Romanian company may deploy a recruitment tool supplied by a vendor in another country. A group may centralise procurement and security while the local entity makes decisions affecting Romanian workers or customers. The legal analysis should identify each role instead of treating “the group” as a single operator.

Question 1Is the system used in the EU?

If the Romanian entity deploys the system, or its output is used in Romania or elsewhere in the Union, the scope analysis moves beyond the location of the parent company.

Question 2Who provides it?

Record the provider, importer, distributor, group company, authorised representative and vendor chain. Contract labels are useful evidence but do not replace the legal role analysis.

Question 3Who deploys it?

Identify the business unit that determines the purpose and use. The deployer may be the Romanian company, a foreign shared-service centre or another group entity depending on the facts.

Question 4Who is affected?

Employees, applicants, customers and other persons in the Union may be affected even when the technical processing or model hosting takes place outside Romania.

Do not rely on the hosting location alone: cloud hosting, a foreign parent or a vendor’s “EU AI Act compliant” statement does not by itself determine whether the Romanian entity has obligations.

Which AI uses should a Romanian company classify first?

A useful first inventory is operational rather than theoretical. Start with tools that make recommendations, rank people, generate customer-facing outputs, analyse sensitive information, control access to services or influence employment decisions. Include tools purchased by individual teams if company data or company accounts are used.

Business use	Why it needs early review	First evidence to collect
Recruitment, CV screening or candidate scoring	Employment and access-to-self-employment uses are listed in Annex III and may engage high-risk analysis once the relevant rules apply.	Vendor description, decision logic, data sources, human review and impact on applicants.
Employee monitoring, task allocation or performance evaluation	AI used to affect working relationships or monitor behaviour may fall within the employment category and also raise labour-law and GDPR questions.	Purpose, affected groups, indicators, decision owner, notice, consultation and challenge route.
Customer chatbot or voice assistant	Interactive systems may require a clear notice that the person is interacting with AI unless the interaction is obvious in context.	Interface screenshots, notice wording, escalation to a person and accessibility check.
AI-generated public-facing images, audio or text	Article 50 can require machine-readable marking or disclosure, subject to the relevant exception and content type.	Generation workflow, labelling method, human review, editorial responsibility and publication record.
Credit, insurance, access or eligibility decisions	Some essential private or public service uses are listed as high-risk and can intersect with anti-discrimination and sectoral rules.	Decision criteria, datasets, human oversight, explanation path and affected-person rights.

Do not classify a system only by the word “AI” in a sales brochure. Ask what the tool actually does, which people it affects, whether it generates or ranks content, whether it makes or supports a decision, and whether it is integrated into a regulated product. The Commission’s AI Act Service Desk provides tools and guidance that can support this initial assessment.

Which AI practices are prohibited?

The AI Act bans certain practices because their risks are considered unacceptable. Examples include harmful manipulation or deception, harmful exploitation of vulnerabilities, social scoring, certain forms of individual criminal-offence prediction, untargeted scraping to create facial-recognition databases, workplace or education emotion recognition, and biometric categorisation to infer protected characteristics, subject to the precise legal wording and exceptions.

For a foreign company with Romanian staff, the workplace emotion-recognition prohibition deserves particular attention. A vendor may market a “wellbeing”, “engagement” or “productivity” product without describing it as emotion recognition. The business should look at the functionality and the data signals used, not only the product name. The same applies to tools that claim to infer personality, intent, reliability or risk from communications.

Procurement gate

Require the business owner to describe the system’s purpose, data sources, affected people and output before purchase or activation.

Red-flag review

Escalate tools involving vulnerability exploitation, social scoring, biometric inference, emotion recognition or behavioural prediction.

Decision record

Record why the company concluded that a use is permitted, prohibited, outside scope or subject to another compliance route.

What transparency duties apply from 2 August 2026?

Article 50 covers specific interactions and outputs. A provider of an AI system intended to interact directly with natural persons must ensure that people are informed that they are interacting with an AI system unless this is obvious in context. Providers of systems generating synthetic audio, image, video or text must ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, subject to the stated limits and exceptions.

Deployers have additional duties in defined situations. People exposed to emotion-recognition or biometric-categorisation systems must be informed. A deployer of an image, audio or video deepfake must disclose that the content was artificially generated or manipulated, subject to the artistic and other exceptions. Text generated or manipulated by AI and published to inform the public on matters of public interest must also be disclosed, but the obligation does not apply where the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility.

This is why the website’s ordinary AI Notice and a public disclosure under Article 50 should not be treated as identical. An editorial footer may be useful transparency, but it does not automatically satisfy every machine-readable marking or user-facing notice requirement. Each workflow should be checked according to the system, output, audience and publication context.

Practical control: create a short content decision tree: AI-assisted editing, substantially generated content, deepfake or synthetic media, public-interest text, customer interaction. Assign the corresponding label, machine-readable marker, human review and approval record.

Does every AI-generated business article or image need a label?

No single answer applies to every output. The AI Act distinguishes between the type of system, the type of output and the way the content is published or presented. Standard editing that does not substantially alter the input may fall within an exception to the machine-readable marking duty. A human review and editorial-control exception may apply to certain public-interest text. Deepfakes have their own disclosure rule, while chatbots require a direct-interaction analysis.

The company should document the workflow instead of making a broad statement such as “all AI content is exempt” or “all AI content must be labelled in the same way”. Keep the prompt or source material where appropriate, the generated version, the human changes, the responsible editor, the final label and the publication channel. This is particularly useful where content is repurposed across websites, advertisements, social media and customer communications.

What does AI literacy require?

Article 4 requires providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy for staff and other persons dealing with the operation and use of AI systems on their behalf. The measures should take account of technical knowledge, experience, education, training, the context in which the systems are used and the people or groups on whom the systems are used.

This is a context-based obligation, not a fixed annual course or a universal certification. A marketing employee using a writing assistant, an HR manager using a candidate-ranking tool and an engineer managing a model deployment do not need identical training. The employer should explain relevant limitations, data handling, hallucination and reliability risks, prohibited uses, escalation routes, human review and the consequences of relying on outputs.

Identify AI users

List employees, contractors and other persons acting on the company’s behalf who operate or use an AI system. Include occasional users where the risk justifies it.

Match training to context

Separate basic safe-use guidance from role-specific instruction for HR, legal, customer service, developers, procurement and management.

Keep training records

Retain the audience, date, topics, materials, completion evidence and any follow-up testing or policy acknowledgement.

Update after change

Reassess training when a new system, material model update, high-risk use, incident or regulatory guidance changes the risk profile.

The Commission’s AI-literacy Q&A explains that enforcement of Article 4 is handled by national market-surveillance authorities and that there is no one-size-fits-all competence framework. A Romanian business should therefore build a proportionate internal record rather than wait for a template course.

What should employers know about recruitment and workplace AI?

Annex III identifies AI systems intended for recruitment or selection, including targeted job advertising, application analysis and candidate evaluation. It also identifies systems used to make decisions affecting terms of work-related relationships, promotion or termination, allocate tasks based on individual behaviour or personal traits, or monitor and evaluate performance and behaviour.

Under the current Commission timeline, the rules for high-risk systems in these sensitive areas apply from 2 December 2027 following the Digital Omnibus transition. This does not create a compliance holiday. A Romanian employer must still consider GDPR, Romanian labour law, anti-discrimination rules, information duties, collective arrangements, employment records, confidentiality and the possibility of human challenge. A vendor’s score should not become an unexplained substitute for a lawful employment decision.

Before deploying such a tool, the employer should identify who makes the final decision, what the AI output means, whether a person can disregard it, what data is used, whether a candidate or employee can obtain an explanation, and what happens if the system produces an incorrect or discriminatory result. The analysis should also consider whether the foreign group’s HR platform is being deployed by the Romanian entity or merely accessed for central administration.

Separate the dates: the later high-risk deadline concerns the AI Act’s high-risk requirements. It does not suspend GDPR or employment-law obligations that may arise from the same processing or decision today.

Vendor contracts and AI due diligence

A foreign company should not accept a short vendor statement as its entire AI Act file. The contract and due-diligence record should allow the Romanian operation to understand the system’s intended purpose, role allocation, technical limitations, data use, security, logging, human oversight, incident cooperation, transparency features and change-management process.

Purpose and role

Ask whether the supplier is a provider, GPAI provider, importer, distributor or another operator, and whether the Romanian entity is a deployer. Retain the product description, role matrix and contract.

Data and outputs

Check what data is processed, where it is stored, whether prompts or outputs train a model, and whether personal data can be isolated. Keep the data-flow map, DPA and security schedule.

Human oversight

Confirm whether the operator can intervene, override, suspend or test the system and whether those limits are communicated. Keep the operating procedure and testing logs.

Incidents and changes

Agree how model changes, outages, security events and regulatory requests are communicated. Keep notice SLAs, version history and audit rights.

Exit and continuity

Plan how the company will retrieve records, delete data and continue operations if the tool is withdrawn or reclassified. Keep the exit and retention plan.

Where the tool is supplied by a group company, the intercompany agreement should be tested in the same way as an external vendor contract. The Romanian entity may need practical access to information even when procurement, model management and security are centralised abroad.

How does the AI Act interact with GDPR and Romanian employment law?

The AI Act does not replace GDPR. Article 2 expressly preserves the application of Union data-protection, privacy and communications rules. A company may therefore need a lawful basis, purpose limitation, data minimisation, transparency, retention controls, processor arrangements, security measures and, where relevant, a data-protection impact assessment in addition to its AI Act analysis.

Workplace deployment adds another layer. If an AI tool ranks applicants, monitors employees, allocates tasks or recommends termination, the employer should consider the Labour Code, anti-discrimination protections, employee information and consultation, internal policies and the safeguards around automated decision-making. A human reviewer is important, but “human in the loop” is not a complete answer if the reviewer simply approves an unexplained score.

For customer-facing systems, consumer-protection and sectoral obligations may also apply. For regulated products, product-safety rules, conformity assessment and technical documentation may interact with the AI Act. The right approach is a combined compliance map that shows which regime addresses which risk.

AI Act

Classifies the system and creates duties tied to the operator role, risk level, transparency, literacy and governance.

GDPR

Controls personal-data processing, individual rights, security, profiling and the relationship between controller and processor.

Employment and sector law

Protects workers, customers and regulated activities through additional information, fairness, safety and challenge requirements.

Who supervises the AI Act in Romania?

Enforcement is shared. The European Commission’s AI Office supervises general-purpose AI providers and certain connected systems, while national competent authorities supervise other AI systems. The European Data Protection Supervisor has a specific role for systems used by EU institutions. The Romanian entity should monitor the national designation and implementation measures relevant to its activity instead of assuming that every question goes to one central EU authority.

The AI Act also allows complaints, investigations, information requests and other enforcement tools. The applicable authority may consider the nature, gravity and duration of an infringement, affected persons, the operator’s size and turnover, cooperation, responsibility, mitigation and whether the conduct was intentional or negligent.

What penalties can apply?

Article 99 sets maximum levels for several categories, while Member States establish the detailed national penalty and enforcement rules. Non-compliance with prohibited practices can reach up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher. Other listed operator obligations, including certain deployer and transparency duties, can reach up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher. Incorrect, incomplete or misleading information supplied to authorities can attract a separate maximum of EUR 7.5 million or 1% of worldwide annual turnover.

For SMEs and start-ups, Article 99 provides a lower-of-the-two limits approach for the amounts or percentages referred to in the provision. The figures are maximums, not automatic fines. Authorities must assess the individual circumstances and procedural safeguards remain relevant. Companies should avoid both extremes: treating the maximum as inevitable or assuming that a small local subsidiary has no exposure because the parent owns the technology.

Practical AI Act compliance checklist for a Romanian operation

01 · InventoryBuild the AI register

List systems, vendors, users, business owners, locations, outputs, affected people and group-company relationships. Include pilots and shadow AI.

02 · ClassifyAssign the legal route

Screen scope, prohibited practices, high-risk categories, transparency duties, GPAI dependencies, sector rules and applicable transition dates.

03 · ControlPut safeguards in place

Set access rules, human review, notices, marking, training, procurement controls, incident escalation and data-protection measures.

04 · EvidenceKeep the decision trail

Retain the classification rationale, vendor file, contract, training evidence, approvals, tests, incidents, changes and review date.

Create an inventory

Owner: Legal, IT, procurement and business owners. Output: an AI register with purpose, provider, deployer, data and affected persons.

Approve use cases

Owner: management with legal and security input. Output: a classification note, prohibited-use sign-off and escalation route.

Train users

Owner: HR, compliance and system owners. Output: role-based AI-literacy materials and completion evidence.

Review public outputs

Owner: marketing, communications and editorial owners. Output: a disclosure, marking and human-review record.

Monitor change

Owner: system owner and vendor manager. Output: version, incident, access, performance and reassessment logs.

Common mistakes made by foreign groups

“The parent handles it”

Central governance can help, but the Romanian operation still needs to know its role, local use, affected people and evidence available to it.

“The vendor is compliant”

Vendor compliance material is an input. It does not answer whether the Romanian entity is a deployer, importer or affected operator in the actual workflow.

“The deadline is 2027”

The later high-risk date does not postpone AI literacy, prohibited-practice controls, transparency duties or GDPR and employment-law analysis.

“A human checked it”

A nominal reviewer may not provide meaningful oversight. Define authority to challenge, override, document and stop the system.

“A footer solves labelling”

Website disclosure, user notice and machine-readable marking answer different questions. Match the control to the content and channel.

“Only official AI tools count”

Shadow AI used with company data can create the same confidentiality, data-protection and output risks as an approved platform.

Frequently asked questions

Does the AI Act apply if our parent company is outside the EU?

It may. Scope can arise because the Romanian entity deploys an AI system in the Union or because output from a third-country system is used in the Union. Analyse the actual provider, deployer, importer and output-use roles.

Are AI recruitment tools high-risk from 2 August 2026?

Not necessarily under the current transition timetable. Annex III includes recruitment and worker-management uses, but the Commission currently identifies 2 December 2027 for the selected sensitive high-risk areas after the Digital Omnibus changes. GDPR, employment and anti-discrimination duties can apply earlier.

Must employees disclose every use of ChatGPT or another writing assistant?

No universal AI Act rule requires disclosure of every private drafting step. The right control depends on the system, output, audience, content type, company policy and whether Article 50 applies. The employer should set a clear internal policy for confidential or regulated material.

Is an AI officer mandatory in Romania?

The AI Act does not impose a universal AI-officer title for every company. A foreign group should nevertheless allocate responsibility for inventory, classification, training, procurement, transparency, incidents and regulatory liaison.

Does using a human reviewer remove AI Act and GDPR risk?

No. Meaningful human oversight can be important, but it does not erase the underlying classification, transparency, data-protection, fairness or employment-law analysis. The reviewer must have information, time and authority to challenge the output.

Can we rely entirely on the AI vendor’s compliance statement?

No. Vendor material should be verified against the Romanian workflow, contract, data, users and role allocation. Keep evidence of the questions asked, the answers received and the decision made by the company.

Need to assess AI use in a Romanian business?

A Romanian business lawyer can help map the group structure, classify AI systems, review vendor terms, align GDPR and employment safeguards, and prepare a proportionate evidence file.

Contact Atrium Romanian Lawyers

This page provides general information only and does not constitute legal advice, a legal opinion or the creation of a lawyer-client relationship. Legal solutions depend on the specific facts, systems, contracts and legislation in force at the relevant time.

AI Notice: AI-assisted content, reviewed by a qualified Romanian lawyer.

30May

Freelancing vs. Employment Contract in Romania: What’s Better Legally?

by Simona Rotaru Employment Law

Freelancing vs. Employment Contract in Romania: What’s Better Legally?

Are you trying to figure out the best way to work in Romania?

You might be thinking about freelancing or traditional jobs.

Both have their own legal benefits and financial perks.

Romania’s work scene has changed a lot.

Now, more people are choosing to work for themselves.

This gives them the chance to be more flexible and make choices that fit their career goals.

The job market in Romania is pushing people to think differently about work.

It’s important to know the legal differences between freelancing and traditional jobs.

This helps you understand your rights, duties, and what it might mean for your money.

Key Takeaways

Romania’s professional landscape increasingly supports flexible work arrangements;
Legal distinctions between freelance and employment contracts significantly impact professional strategies;
Financial and regulatory considerations are key when choosing work models;
Professional autonomy and risk management differ between employment and freelance status;
Understanding legal frameworks is essential for making informed career decisions.

Understanding Legal Status in Romanian Labor Market

The Romanian labor market is complex for those in the gig economy.

It’s important to know the difference between dependent and independent work.

This is key for employers and workers to understand labor laws in Romania.

The Romanian Fiscal Code outlines the rules for different work setups.

It affects employee rights and taxes. This law helps decide who is considered a worker based on certain criteria.

Defining Dependent Activities

Dependent activities have a few main points:

Direct subordination to an employer;
Fixed working schedule;
Predetermined workplace;
Employer-provided equipment and resources.

Defining Independent Activities

Independent activities are different, with:

Autonomous work arrangement;
Flexible working hours;
Self-managed professional services;
Personal risk and investment.

Key Legal Framework Differences

The legal differences between these types affect work relationships, social security, and taxes.

Workers and businesses must check their work setup to follow Romanian labor laws.

Knowing these legal details helps workers and companies make smart choices in Romania’s labor market.

Freelancing vs. Employment Contract in Romania

Understanding the Romanian labor market is key.

It’s important to know the difference between freelancing and traditional jobs.

Romania’s flexible work options let professionals design their careers with more freedom.

Independent contractor laws in Romania give workers a lot of freedom.

Freelancers can use these laws to build careers that fit their skills and lifestyle.

Freelancing offers tax benefits;
Employment contracts provide more structured social benefits Romania;
Independent work allows for greater schedule flexibility;
Traditional employment ensures more consistent income streams.

Choosing between freelancing and a job depends on your career goals and how much risk you’re willing to take.

Freelance work in Romania supports entrepreneurship while protecting workers’ rights.

Professionals need to think about several things:

Income stability;
Legal protections;
Tax implications;
Long-term career development.

Freelancing offers flexibility and the chance for higher earnings.

On the other hand, traditional jobs provide steady income and strong social security benefits.

Legal Distinctions Between Contractors and Employees

Understanding employment laws in Romania is key.

It’s important to know the differences between contractors and full-time employees.

Romanian labor laws set clear criteria for these distinctions.

These criteria affect rights, responsibilities, and legal duties.

The Romanian legal system looks at work relationships closely.

It uses several key factors to decide the type of work arrangement.

Subordination Criteria

Subordination is the main difference between contractors and full-time employees in Romania.

The rights of contractors differ from those of employees.

This is based on several key criteria:

Direct management control;
Work schedule compliance;
Reporting hierarchies;
Performance evaluation processes.

Workplace Integration

Workplace integration is also key in determining work relationships.

The following elements help tell if someone is an independent contractor or an employee:

Physical workspace utilization;
Company resource access;
Organizational communication channels;
Team participation requirements.

Risk and Responsibility Distribution

Aspect	Contractor	Employee
Financial Risk	High Personal Risk	Minimal Personal Risk
Equipment Provision	Self-Funded	Employer-Provided
Legal Liability	Personal Responsibility	Shared Organizational Responsibility

Those working in Romania’s labor market need to understand these legal differences.

This ensures they follow the law and protect their interests.

Tax Implications and Financial Considerations

Understanding taxes for independent contractors in Romania is key.

The country’s tax system has both benefits and challenges for freelancers.

It’s important to know the financial landscape well.

Romania has a flat tax rate of 10% for all income.

This rate is the same for both employees and freelancers.

It makes managing finances easier for freelancers.

Flat tax rate of 10% for individual income;
Self-employed professionals responsible for personal tax filings;
Mandatory social contribution calculations;
Potential tax deductions for business expenses.

Freelancers in Romania must register with tax authorities and keep detailed financial records.

They need to know about tax reporting and possible benefits.

Financial planning for freelancers in Romania is different from traditional jobs.

Remote work adds complexity to taxes.

It requires careful financial planning.

Financial Aspect	Employee Status	Freelance Status
Tax Rate	10% Flat Rate	10% Flat Rate
Social Contributions	Employer Managed	Self-Managed
Expense Deductions	Limited	More Flexible

Freelancers need to plan their finances wisely.

This ensures they stay tax-efficient and compliant in Romania’s rules.

Contractual Rights and Obligations

Understanding the legal side of work in Romania is key.

The country has two main work setups: full-time jobs and freelance work.

Each has its own rules to protect workers and employers.

The laws around work contracts in Romania are very important.

They help workers feel secure and flexible in their jobs.

Knowing these differences helps people choose the right career path.

Employment Contract Requirements

Full-time jobs in Romania follow strict rules from the Romanian Labor Code.

The main points are:

Mandatory written contract detailing job responsibilities;
Clear specification of work hours and compensation;
Explicit definition of employee rights and obligations;
Provisions for social security and benefits.

Freelance Contract Elements

Freelance deals offer more freedom but need to be well-written for legal safety.

Important parts are:

Scope of work and deliverable specifications;
Payment terms and conditions;
Project timeline and milestones;
Intellectual property rights allocation.

Termination Provisions

Tax and work-life balance issues vary between jobs and freelance work.

Termination rules also differ.

Jobs usually have more set rules than freelance work.

It’s important for professionals to know their contract well.

This ensures they are protected and can have a good career.

Social Security and Benefits Comparison

Understanding employee benefits in Romania is key.

It’s important to know the differences between working as an employee and being a freelancer.

The social security system has its own rules for each choice.

Employees in Romania get many benefits.

These include:

Mandatory health insurance coverage;
Pension fund contributions;
Paid annual leave;
Sick leave compensation;
Maternity and paternity leave benefits.

Freelancers in Romania face different rules.

They must handle their social insurance on their own.

This gives them freedom but also more responsibility.

It’s important to know these rules before deciding how to work.

Freelancers need to plan for their social security:

Registering with local social security authorities;
Making regular self-employed contributions;
Purchasing supplemental health insurance;
Creating personal retirement savings strategies.

Choosing between being an employee or a freelancer affects your future.

You need to think about your risk level and financial goals.

This choice is important in Romania’s changing work scene.

Business Structure Options for Freelancers

Freelancers in Romania have many legal ways to organize their work.

It’s important to know the business structures that fit with labor laws for freelancers in Romania.

The Romanian legal system has three main business structure options for freelancers.

Each has its own tax rules and regulations.

PFA (Persoană Fizică Autorizată): Individual Authorized Person

The PFA is the simplest business structure for solo entrepreneurs. It has key features like:

Easy registration process;
Low administrative costs;
Direct personal tax responsibility;
Great for small freelance projects.

SRL (Limited Liability Company): Scalable Business Entity

An SRL offers more legal protection for freelancers who want to grow.

It has benefits such as:

Separate legal entity status;
Limited personal liability;
Potential tax savings;
Opportunities for investment and growth.

Civil Contract Options: Flexible Professional Arrangements

Civil contracts give freelancers flexible work arrangements with clients.

They allow professionals to set work terms while keeping their independence under freelance laws in Romania.

Choosing the right business structure needs careful thought.

It depends on your professional goals, financial situation, and future plans.

Intellectual Property Rights and Ownership

Understanding intellectual property (IP) rights in contract work in Romania is key.

The rules on who owns created work vary between employees and independent contractors.

This makes it vital to have clear contracts.

For employees in Romania, the law usually says the employer owns the work done.

Unless a contract says differently, the employer owns what’s created during work hours.

Employee IP ownership defaults to the employer;
Independent contractors usually retain original IP rights;
Explicit contract terms are key for IP protection.

Remote work in Romania adds more complexity to who owns what.

Independent contractors have more protection for their ideas.

When deciding to work as a contractor or employee, it’s important to make detailed agreements.

These should cover who owns what, how it can be used, and any payment for it.

Important steps to protect intellectual property include:

Make sure who owns what is clear in the first contract;
State who can use the work and any limits;
Set out how much to pay for using someone’s ideas;
Add clauses about keeping information secret.

Experts in law should be consulted to make sure all IP is protected.

This helps both sides in professional settings in Romania.

Working Hours and Flexibility Considerations

Freelancing in Romania brings unique benefits in work hours and flexibility.

Unlike regular jobs, freelancers can set their own schedules.

They can work when they’re most productive and feel best.

Freelancing in Romania also means more freedom.

Freelancers can enjoy several key benefits:

Complete control over daily work schedule;
Ability to work from multiple locations;
Potential for increased productivity during peak personal energy times;
Opportunity to balance professional and personal commitments.

But freelancing also has its downsides. It can be hard to keep work and personal life separate.

Without set hours, freelancers might work too much and earn irregularly.

They need to be good at managing themselves to avoid burnout.

Freelance taxes in Romania add another layer of complexity.

Freelancers must keep track of their hours, manage projects, and keep accurate records.

This is to follow local tax laws.

Managing work hours as a freelancer requires careful planning.

Here are some tips:

Set clear boundaries between work and personal time;
Create a daily routine;
Use time-tracking tools for project management;
Take regular breaks to stay productive.

Freelancing in Romania needs discipline and planning.

Freelancers must balance their freedom with the need to be professional.

This is key to success in the Romanian market.

Registration and Compliance Requirements

Starting a remote work career in Romania means you need to know the legal rules.

Freelancers and employees have different paths to follow in the Romanian job market.

Freelancers first need to register with the National Trade Register Office (ONRC).

This step sets the legal rules for working on your own.

Register as a Persoană Fizică Autorizată (PFA);
Get the right business permits;
Get a tax ID number;
Sign up for social security.

Freelancers need to have certain documents ready.

These include:

Your ID;
Proof of your skills;
A business plan;
Tax compliance papers.

For employees, the rules are different. Employers handle most of the paperwork.

This includes social security and health insurance.

The whole process for freelancers usually takes 3-5 business days.

It’s important to have all your documents in order to follow the law in Romania.

Common Industries for Freelancing in Romania

The Romanian gig economy is growing fast. It offers many flexible work options for freelancers.

This shows how self-employment and full-time jobs are both viable in Romania.

Digital skills and online work have opened new doors.

They let people choose to work as independent contractors in Romania’s changing economy.

IT and Digital Services

Romania’s tech sector is booming for freelancers.

Jobs in software development, web design, cybersecurity, and digital marketing are plentiful.

These roles are perfect for those who want to work on their own terms.

Software engineering;
Mobile application development;
Cloud computing solutions;
Digital infrastructure consulting.

Creative Industries

Creative fields in Romania are also ripe for freelancers.

Graphic design, content creation, multimedia production, and digital arts offer flexible careers.

They suit skilled individuals who prefer independent work.

Graphic design services;
Video production;
Digital marketing content;
Brand communication strategies.

Professional Services

Consulting, translation, legal advice, and financial services are also good for freelancers.

These areas in Romania’s professional world offer opportunities for independent work.

Management consulting;
Technical translation;
Financial advisory;
Legal research services.

Conclusion

Choosing between freelancing and traditional jobs in Romania needs careful thought.

Freelancers face both benefits and challenges, like tax implications.

Knowing your rights is key when deciding your career path.

Freelancing in Romania offers freedom and tax benefits.

But, it also means less job security and fewer social benefits.

Planning well and understanding the law can help manage these risks.

Experts say it’s smart to do your homework and maybe talk to a Romanian lawyer before switching jobs.

Romania’s laws help both freelancers and employees make good choices for their careers and lives.

If you’re unsure about Romania’s job rules, seek advice from Romanian legal experts.

FAQ

What is the difference between a freelancer and an employee in Romania?

In Romania, the main difference is in control and supervision.

Employees work under direct supervision with fixed hours.

Freelancers, on the other hand, work independently, set their own hours, and often work on projects for multiple clients.

How do I choose between freelancing and traditional employment in Romania?

Think about job security, taxes, benefits, and what you prefer.

Employees get stability and benefits.

Freelancers have flexibility and can earn more but handle their own taxes and insurance.

What tax obligations do freelancers have in Romania?

Freelancers in Romania pay a flat tax and social security contributions.

They also need health insurance.

The exact taxes depend on their business type and income, with different rules than for employees.

What business structures are available for freelancers in Romania?

Freelancers can choose from PFA, SRL, or civil contracts.

Each has its own tax rules, paperwork, and liability protection.

It’s important to pick the right one for your business.

How do intellectual property rights work for freelancers in Romania?

Intellectual property rights for freelancers are set in their contracts.

Unlike employees, freelancers must agree on IP rights in their contracts to protect their work.

What are the social security implications for freelancers?

Freelancers in Romania must handle their social security on their own.

This means paying for pension, health insurance, and more.

It’s more complex and can be more expensive than for employees.

What industries are most suitable for freelancing in Romania?

IT, digital services, creative fields, and consulting are best for freelancing in Romania.

These areas offer many opportunities for independent work due to their project-based nature and demand for skills.

What registration requirements exist for freelancers in Romania?

Freelancers need to register with local authorities and get a tax ID.

They must also choose a business structure.

This involves paperwork, fees, and ongoing compliance with Romanian laws.

How do working hours differ between freelancers and employees?

Employees have fixed hours by law, while freelancers set their own.

Freelancers must manage their time well, meet deadlines, and keep professional standards.

What legal protections do freelancers have in Romania?

Freelancers have fewer legal protections than employees.

They must write clear contracts, negotiate terms, and handle legal risks themselves.

Despite this, they have more freedom in choosing projects and managing their work.

What are the main differences between employment contracts in Romania and freelancing arrangements?

In Romania, the distinction between employment contracts and freelancing arrangements is significant from both legal and financial perspectives.

An employment contract (contract individual de muncă) is governed by the Romanian Labor Code and establishes a subordination relationship between the employee and employer.

Freelancers in Romania typically operate as independent contractors, either through a PFA (Persoană Fizică Autorizată) or other legal entity forms.

The key differences include:

1. Legal framework: Employment contracts are strictly regulated by the Romanian Labour Code, while freelancing activities are governed by civil law and tax regulations, often through civil contracts or service agreements.

2. Subordination: An employee works under the direct supervision and control of the employer, following a predetermined schedule and procedures.

An independent contractor in Romania has autonomy regarding how, when, and where they complete their work.

3. Social protection: Employees in Romania are entitled to social benefits including paid vacation, sick leave, maternity leave, and unemployment benefits.

Freelancers must arrange their own social protection.

4. Tax responsibility: For employees, the employer handles tax withholding and social contributions.

Freelancers are responsible for their own tax and social contribution obligations.

14May

Remote Work in Romania: What Employers Need to Know

by Simona Rotaru Labor Law

Employment law · Romania

Remote Work in Romania: What Employers Need to Know

Remote work can improve recruitment, retention and business continuity, but the arrangement should be classified correctly and documented before it begins. Romanian employers should distinguish telework from work at home and mobile work, then align the employment contract, working-time records, health and safety measures, data protection and cross-border analysis.

This guide is intended for Romanian employers, foreign-owned companies, HR teams and employees working remotely from Romania. The correct solution depends on the role, the location, the technology used, the contract and the facts of each arrangement.

Practical rule: if an employee regularly performs work outside the employer’s premises using information and communications technology, the arrangement may fall under Romania’s telework framework. Telework is based on the parties’ agreement and must be expressly included in the individual employment contract or an amendment. A company should not rely on an informal “work from home” email when the legal arrangement is actually telework.

What is remote work in Romania?

“Remote work” is a useful business expression, but it is not a single legal category. The first step is to identify how, where and with what technology the work is performed. The classification affects the contract, the employer’s control methods, working-time records, occupational safety, data security and, in some cases, tax, social-security and immigration obligations.

Romania’s Law no. 81/2018 regulates telework. In broad terms, telework is a form of work organisation in which an employee regularly and voluntarily performs duties in a place other than the employer’s premises, using information and communications technology, under conditions agreed with the employer. The statutory definition refers to activity performed at least one day per month in such a location.

Telework is different from a general flexible-hours arrangement. A flexible schedule changes when the employee works. Telework changes, at least in part, where the employee works and how the employer manages the activity. The two arrangements can coexist, but they should not be treated as interchangeable.

Telework

Regular and voluntary work outside the employer’s premises using information and communications technology, expressly agreed in the employment contract.

Work at home

A distinct Labour Code arrangement in which the employee performs work at home and may organise the schedule under the applicable legal and contractual conditions.

Mobile work

Work performed at changing locations because the nature of the job requires mobility. It is not automatically telework simply because a laptop or phone is used.

Do not conflate categories: the phrase “remote employee” does not determine the legal regime. Review the actual work pattern, the employment contract and the reason why work is performed away from the employer’s premises.

Which legal route fits the arrangement?

Select the closest description to see the main legal question. The selector is a practical classification aid, not a substitute for reviewing the contract and actual working pattern.

Choose the work arrangement that best describes the facts.

Telework

Check whether the employee regularly works outside the employer’s premises with ICT and document the arrangement expressly in the employment contract or amendment.

Arrangement	Core question	Contract focus	Additional risk
Telework	Is work regularly performed elsewhere using ICT?	Express telework clause and statutory telework particulars.	Unclear place of work, monitoring, working time or H&S controls.
Work at home	Is the employee working at home under the Labour Code’s home-work rules?	Home address, schedule and applicable contractual conditions.	Using a telework template for a legally different arrangement.
Mobile work	Does the job inherently require changing work locations?	Mobility, travel, records and expenses.	Failure to distinguish mobility from voluntary telework.
Cross-border remote work	Where is the work physically performed and for how long?	Country, duration, reporting and applicable employment terms.	Tax, social security, immigration and permanent-establishment exposure.

When must telework be included in the employment contract?

Under Law no. 81/2018, telework is based on the agreement of the parties and is expressly provided in the individual employment contract for a new employee or by an amendment for an existing employee. The employer should complete this step before the employee begins working under the telework arrangement.

A general remote-work policy may be useful, but it does not replace an express contractual provision where the statutory telework regime applies. The policy can explain approval workflows, equipment, security, availability and office attendance. The contract or amendment should still contain the legally relevant terms for the individual arrangement.

Any later change to an essential contractual element should be reviewed before implementation. For example, a material change to the place of work, the number of remote days, the schedule, the applicable reporting method or the employee’s cross-border location may require an updated contract, amendment, employee-register transmission or separate legal analysis.

Before recruitment

Decide whether the role can lawfully and operationally be performed by telework, at home, through mobility or through a mixed arrangement.

Before the first remote day

Sign the employment contract or amendment, communicate the rules and provide the equipment, instructions and training required for the role.

Before changing the model

Review whether the change affects the contract, working-time records, H&S assessment, data security or another jurisdiction.

What should a Romanian telework clause contain?

The contract should be drafted for the actual arrangement, not copied from a generic remote-work policy. Law no. 81/2018 identifies specific matters to be included in the individual employment contract or amendment. The drafting should also remain consistent with the Labour Code, internal regulations, occupational safety documents and data-protection information.

Depending on the role and arrangement, the clause should address the days or periods when the employee works at the employer’s premises, the place or places from which telework may be performed, how the employer checks activity and how the employee reports, the method for recording the beginning and end of working time, the responsibilities for occupational safety, the equipment and maintenance arrangements, data-protection requirements and measures designed to prevent professional isolation.

The agreement should be sufficiently practical. If the employer expects attendance at meetings, access to confidential information, use of specific devices, availability during fixed hours or periodic office attendance, the clause and related policy should say so clearly. Vagueness can create disputes about supervision, performance, overtime, expenses and whether an employee was authorised to work from a particular location.

Select a drafting control before approving the clause.

Location and office days

State the permitted place or places and the days or periods when the employee is expected to work at the employer’s premises, where applicable.

Employer obligations for equipment, health and safety and data

Remote work does not remove the employer’s responsibility to organise work lawfully. The employer should identify the equipment needed for the role, define who provides and maintains it, establish a secure method for access to company systems and communicate rules for confidential information, personal data and incident reporting.

Occupational safety measures should reflect the place and manner in which the work is performed. The employer should provide the information and training required by the applicable health and safety rules, establish how compliance is checked within the legal limits and document the employee’s responsibilities. A remote arrangement should not be approved without considering ergonomics, electrical safety, working conditions, emergency reporting and the practical limits of inspecting a private home.

Data protection requires more than telling employees to use a password. The organisation should apply appropriate technical and organisational measures, including access control, device security, authentication, secure connections, rules for printing or storing documents, restrictions on family or third-party access, incident reporting and secure return or deletion of company data. Monitoring should be necessary, proportionate, transparent and consistent with employment and data-protection requirements.

Control area	Employer should define	Evidence to retain	Typical failure
Equipment	Devices, software, maintenance, replacement and permitted personal-device use.	Handover record, policy acknowledgement and support process.	Unsecured personal devices or unclear responsibility for repairs.
Working time	Schedule, availability, start and end records, breaks and overtime approval.	Time records, instructions and approved exceptions.	Assuming remote work means unlimited availability or no overtime.
Health and safety	Risk information, training, workstation expectations and incident reporting.	Training record, risk assessment and reported-incident file.	No practical safety process because work occurs at home.
Data protection	Access, storage, confidentiality, monitoring, breach reporting and retention.	Policy, privacy information, access logs and incident record.	Using screenshots, keystroke tools or broad monitoring without a lawful basis.

Working time, availability and the right to disconnect

A remote employee remains protected by the applicable working-time rules. The employer should define the schedule or availability windows, the method for recording the start and end of work, the approval process for overtime and the arrangements for rest breaks and daily and weekly rest. Remote work is not a waiver of these protections.

The employer should also avoid confusing performance measurement with permanent availability. Clear objectives, deliverables, communication windows and escalation channels are usually more defensible than constant surveillance. If the company expects an employee to answer messages outside working hours, it should assess whether this creates overtime, rest-period or health concerns.

Flexible schedules may be agreed alongside telework. They should be documented in a way that makes the employee’s actual working time capable of being recorded. The contract, internal rules and remote-work policy should not contradict each other, particularly where one document promises flexibility and another imposes fixed availability without explaining the relationship.

Practical safeguard: define when the employee must be reachable, how urgent work is escalated and how time outside the normal schedule is authorised and recorded. This protects both the employee and the employer’s evidence in a later dispute.

Employees with children and special remote-work requests

Article 118^1 of the Labour Code currently provides that, on request, employees who have children in their care up to the statutory age may benefit from four days per month of work at home or telework, except where the nature or type of work does not permit it. The provision should be checked against the current wording and the facts of the individual role before an employer accepts or rejects a request.

The employer should examine the nature of the work, the employee’s role, the requested days, operational requirements and any contractual or internal rules. A request should not be rejected by simply stating that the company does not generally offer remote work if the statutory conditions are potentially met. Conversely, a role that requires physical presence, equipment, customer contact or secure on-site activity may need a documented assessment of why the arrangement is not workable.

This statutory right should also be distinguished from a general policy allowing occasional home working. The documents may overlap operationally, but the legal basis and the employer’s assessment are not necessarily identical.

Cross-border remote work from Romania

An employee who works remotely from Romania for an employer established elsewhere may trigger issues that do not arise in an ordinary domestic telework arrangement. The physical location of the work, the employee’s residence, the length and regularity of the presence, the employer’s business activity and the applicable international and EU rules all matter.

The review may involve Romanian employment law, social-security coordination, payroll withholding, tax residence, permanent-establishment risk, immigration status, data transfers and local registration or notification requirements. A foreign employer should not assume that a Romanian employee can work indefinitely from Romania merely because the work is performed online and the salary is paid from abroad.

Likewise, a Romanian employer sending an employee to work from another country should establish the country, duration, reporting line, employer instructions, local mandatory employment protections and social-security position before the arrangement begins. Article 18 of the Labour Code may require specific information where the employee is to perform work abroad, and separate rules may apply to posted workers or other assignments.

The digital nomad visa, where relevant, is an immigration route and does not automatically settle employment, payroll, tax or social-security questions. Immigration permission, employment-law compliance and tax treatment should be analysed separately and then reconciled.

Location

Identify the country where the employee is physically working, not only the country where the employer or client is incorporated.

Duration

Record the start date, expected duration, travel pattern and whether the work is occasional, regular or permanent.

Employer exposure

Check payroll, social security, immigration, data transfer and possible permanent-establishment consequences before approval.

Tax, social security and immigration checks

Remote work can change the compliance profile even where the employment contract remains unchanged. Tax treatment may depend on residence, the place where work is performed, treaty rules, employer obligations and the facts of the assignment. Social-security coverage may depend on the applicable EU coordination rules, certificates, posting status or another international instrument.

Immigration status is a separate question. A foreign national may have permission to stay in Romania without having an unrestricted right to work for a particular employer. A Romanian employee working abroad may also need local work authorisation or registration even if the employee remains on the Romanian payroll.

Employers should obtain advice before treating a remote arrangement as tax-neutral, payroll-neutral or immigration-neutral. The prudent approach is to prepare a short country-and-facts memo that records the proposed location, duration, employing entity, reporting line, customer contact, equipment, travel and intended end date.

Use this order when reviewing a new remote-work request.

Employment route

Classify the arrangement and confirm whether the contract or amendment contains the required place-of-work, control and working-time terms.

Remote work policies and internal governance

A good remote-work policy translates the contract into an operating system. It should identify who approves remote work, which locations are permitted, how office attendance is scheduled, how equipment is used, who may access confidential information, how incidents are reported and what happens when the arrangement no longer works operationally.

The policy should also explain performance expectations, communication standards, working-time recording, overtime approval, absence reporting, leave, business travel, return of equipment and the procedure for changing or ending the remote arrangement. If monitoring is used, the employer should explain its purpose, scope, legal basis, retention and access in the appropriate privacy information and employment documents.

Managers should receive guidance as well. Inconsistent treatment between teams can create discrimination, equal-treatment or employee-relations risks. A manager should not impose an informal rule that conflicts with the contract, statutory working-time protections, a collective agreement or a documented company policy.

Common employer mistakes

Informal approval only

The employee works remotely under an email or chat message even though the statutory telework terms were never added to the contract.

One template for everything

The company uses the same document for telework, work at home, mobile work and cross-border assignments.

Permanent availability

The employer measures commitment by response speed and overlooks working-time records, rest and overtime controls.

Unlawful monitoring

The company introduces screenshots, webcam checks or keystroke monitoring without a prior necessity and proportionality assessment.

Unsecured data

Employees use personal devices, public networks or shared rooms without adequate access, confidentiality and incident rules.

Cross-border assumption

The parties assume that online work from another country has no payroll, tax, social-security or immigration consequence.

Other recurring problems include failing to record the permitted work location, omitting the method for recording working time, not updating REGES-ONLINE where a reportable contractual change occurs, overlooking occupational safety training and allowing a remote arrangement to continue after its factual conditions have changed.

Practical checklist for Romanian employers

Identify whether the arrangement is telework, work at home, mobile work, flexible scheduling or cross-border work.
Confirm that the role can be performed safely and effectively from the proposed location.
Check the employee’s contract, job description, collective rules and internal regulations.
Include the telework arrangement expressly in the contract or amendment where Law no. 81/2018 applies.
State permitted locations, office days, reporting lines, working-time records and availability windows.
Define equipment, software, maintenance, expenses, security and return arrangements.
Provide occupational safety information and training appropriate to the remote work model.
Apply proportionate data-security controls and communicate the privacy and monitoring rules.
Define how overtime, rest, leave, absence, incidents and business travel are handled.
Check whether the change must be transmitted in REGES-ONLINE before it takes effect.
For cross-border work, review tax, payroll, social security, immigration, data and permanent-establishment issues.
Keep a record of approvals, amendments, training, equipment handover and later changes.

Frequently asked questions

Does Romanian telework have to be written into the employment contract?

Yes, where the statutory telework regime applies, the arrangement is expressly included in the individual employment contract for a new employee or by an amendment for an existing employee. A general policy or informal email should not be treated as a substitute.

Is working from home the same as telework?

Not necessarily. Work at home and telework are distinct legal arrangements. The correct classification depends on the statutory conditions, the place and manner of work, the use of ICT and the agreed contractual terms.

Can an employer monitor a remote employee’s computer?

Monitoring may be possible in limited circumstances, but it should be necessary, proportionate, transparent and consistent with employment and data-protection requirements. The employer should review prior information, lawful access, purpose, retention and the impact on privacy before using monitoring tools.

Who pays for equipment used during telework?

The contract and applicable rules should address the equipment, installation, checking and maintenance responsibilities. Employers should define the position clearly and avoid relying on an informal assumption that employees will permanently use personal devices for company work.

Can an employee work remotely from another country?

Possibly, but the request requires a separate cross-border assessment. Tax, social security, immigration, employment law, data protection and permanent-establishment issues may arise depending on the country, duration, role and business activity.

Do remote employees have normal working-time protections?

Yes. Remote work does not by itself remove working-time, rest, overtime, leave or health and safety protections. The employer should define and retain a reliable method for recording working time and managing availability.

Need to review a remote-work arrangement?

A Romanian employment lawyer can assess the correct work model, contract wording, internal policy and cross-border risks before the arrangement is implemented.

Book a consultation

Disclaimer: This article provides general information only and does not constitute legal advice or the creation of a lawyer-client relationship. The correct solution depends on the role, location, contract, working pattern and current Romanian and cross-border rules. Obtain a case-specific assessment before implementing or changing a remote-work arrangement.

AI Notice: AI-assisted content, reviewed by a qualified Romanian lawyer.

Why does an AI vendor contract need a separate review?

Start with the AI use, not the vendor’s template

AI vendor due diligence before contract negotiation

What if the service relies on a general-purpose AI model?

What clauses should an AI vendor agreement contain?

1. Define the system, version and intended purpose

2. Allocate AI Act and GDPR roles separately

3. Control prompts, files, outputs and training use

4. Make performance, limitations and human oversight usable

5. Require evidence and audit cooperation

6. Coordinate security and incident notification

7. Address intellectual property and third-party claims

8. Control subcontractors, subprocessors and model dependencies

9. Regulate model and policy changes

10. Connect liability to the risks that matter

11. Preserve suspension, termination and transition rights

12. Align the whole contract suite

Customer and supplier priorities are not identical

Practical experience: how Atrium approaches an AI contract review

AI vendor contract checklist before signature

Frequently asked questions

Negotiating an AI vendor contract connected with Romania?

Related guides and services

EU AI Act in Romania: 2026 Guide for Foreign Companies

What is the practical answer for a foreign company?

Scope first

Obligations now

Evidence later

AI Act timeline for companies operating in Romania

Does the AI Act apply to a foreign company operating in Romania?

Which AI uses should a Romanian company classify first?

Which AI practices are prohibited?

Procurement gate

Red-flag review

Decision record

What transparency duties apply from 2 August 2026?

Does every AI-generated business article or image need a label?

What does AI literacy require?

Identify AI users

Match training to context

Keep training records

Update after change

What should employers know about recruitment and workplace AI?

Vendor contracts and AI due diligence

Purpose and role

Data and outputs

Human oversight

Incidents and changes

Exit and continuity

How does the AI Act interact with GDPR and Romanian employment law?

AI Act

GDPR

Employment and sector law

Who supervises the AI Act in Romania?

What penalties can apply?

Practical AI Act compliance checklist for a Romanian operation

Create an inventory

Approve use cases

Train users

Review public outputs

Monitor change

Common mistakes made by foreign groups

“The parent handles it”

“The vendor is compliant”

“The deadline is 2027”

“A human checked it”

“A footer solves labelling”

“Only official AI tools count”

Frequently asked questions

Related Guides & Services

Need to assess AI use in a Romanian business?

Freelancing vs. Employment Contract in Romania: What’s Better Legally?

Key Takeaways

Understanding Legal Status in Romanian Labor Market

Defining Dependent Activities

Defining Independent Activities

Key Legal Framework Differences

Freelancing vs. Employment Contract in Romania

Legal Distinctions Between Contractors and Employees

Subordination Criteria