Romanian AI Act Compliance: Risk Classification & GPAI Rules for Investors

Updated 2026. This article has been reviewed to reflect the legal framework in force in 2026.

Introduction — The Problem / Why This Matters

Romania, as a rapidly developing technological hub within the European Union, is keenly affected by the EU Artificial Intelligence Act (Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 March 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending Regulations (EU) 2017/1128, (EU) 2018/1724 and (EU) 2019/881, published in the Official Journal of the European Union L, 2024/1689 on 21.03.2024). Foreign investors, multinational corporations, and international entrepreneurs establishing or expanding their AI operations in Romania face complex regulatory challenges. The AI Act is not merely a European directive; it is a directly applicable regulation that mandates significant changes to how AI systems are developed, deployed, and managed across all member states, including Romania. Understanding and complying with its provisions, particularly concerning AI risk classification and General-Purpose AI (GPAI) models, is paramount for market access, operational continuity, and avoiding substantial penalties.

For businesses looking to leverage Romania's skilled workforce and strategic location for AI development, the stakes are exceptionally high. Non-compliance with the AI Act can result in severe financial consequences, reputational damage, and even market exclusion. The Act imposes stringent obligations on providers and deployers of AI systems, especially those categorized as high-risk, dictating requirements from design and development to post-market monitoring. Navigating this new legal landscape requires a deep understanding of not only the European regulations but also their practical implementation and enforcement mechanisms within Romania's national legal framework, which is currently undergoing necessary adaptations.

Moreover, the rapid evolution of AI technology means that legal frameworks must be robust yet flexible. The AI Act attempts to achieve this balance by introducing a risk-based approach, distinguishing between unacceptable, high-risk, limited-risk, and minimal-risk AI systems. For foreign investors, correctly identifying the risk level of their AI applications is the foundational step for compliance. Furthermore, the provisions concerning General-Purpose AI (GPAI) models introduce a new layer of complexity, particularly for foundational models that can be adapted for various purposes. These models, previously less regulated, now face specific obligations regarding transparency, risk management, and computational resources, impacting a wide array of AI developers.

Our firm frequently advises international clients on these intricacies, emphasizing that proactive compliance is an investment in long-term business viability. The Romanian government, through its relevant ministries and regulatory bodies, is actively working on national legislation to complement and enforce the AI Act. Therefore, foreign entities operating in Romania must not only adhere to the directly applicable EU Regulation but also prepare for upcoming national supplementary rules. This article aims to demystify these requirements, offering a clear guide to AI Act compliance in Romania for sophisticated international players.

Legal Framework — Key Laws and Regulations

The central pillar of AI regulation in Romania, and indeed across the EU, is Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 March 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending Regulations (EU) 2017/1128, (EU) 2018/1724 and (EU) 2019/881, published in the Official Journal of the European Union L, 2024/1689 on 21.03.2024 (hereinafter referred to as the “EU AI Act”). As a Regulation, it is directly applicable in Romania without the need for national transposition. However, national legislation is required for designating competent authorities, establishing supervisory and enforcement mechanisms, and setting out specific penalties, which are left to the discretion of Member States.

While the national enabling legislation is still under development, several existing Romanian laws and regulations, coupled with other EU legislative acts, form a broader compliance landscape for AI companies:

• Legea nr. 190/2018 privind măsuri de punere în aplicare a Regulamentului (UE) 2016/679 al Parlamentului European și al Consiliului din 27 aprilie 2016 privind protecția persoanelor fizice în ceea ce privește prelucrarea datelor cu caracter personal și libera circulație a acestor date și de abrogare a Directivei 95/46/CE (Regulamentul general privind protecția datelor) , publicată în M.Of. nr. 651 din 26.07.2018, ensures the processing of personal data by AI systems adheres to GDPR principles. The EU AI Act complements, but does not replace, the obligations under GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), published in the Official Journal of the European Union L 119, 04.05.2016).

• Legea nr. 362/2018 privind asigurarea unui nivel comun ridicat de securitate a rețelelor și sistemelor informatice, publicată în M.Of. nr. 1 din 03.01.2019, transposes the NIS Directive (Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union, published in the Official Journal of the European Union L 194, 19.07.2016) and is relevant for the cybersecurity aspects of AI systems, particularly high-risk ones, which generally fall under critical infrastructure or essential services sectors. The new NIS2 Directive (Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS2 Directive), published in the Official Journal of the European Union L 333, 27.12.2022) is also highly pertinent and will be transposed into Romanian law in due course, further enhancing cybersecurity obligations for providers and deployers of AI systems.

• Legea nr. 287/2009 privind Codul civil, republicată, publicată în M.Of. nr. 505 din 15.07.2011, as amended, provides the general framework for liability, including potential civil liability for damages caused by AI systems. The EU AI Act introduces specific provisions related to liability for defective products, which will interact with national civil codes.

• Ordonanța de urgență a Guvernului nr. 119/2006 privind stabilirea unor măsuri pentru implementarea și aplicarea legislației comunitare în domeniul siguranței generale a produselor, publicată în M.Of. nr. 936 din 20.11.2006, transposes Directive 2001/95/EC on general product safety. This is relevant as AI systems, especially when embedded in products, fall under product safety regulations.

• Legea nr. X/2026 privind stabilirea autorităților naționale competente, a sancțiunilor și a altor măsuri de punere în aplicare a Regulamentului (UE) 2024/1689, publicată în M.Of. nr. YYY din [Data publicării] (hypothetical national law for EU AI Act implementation). While this law is not yet enacted as of April 23, 2026, it is anticipated to be adopted by the Romanian Parliament to designate specific national supervisory authorities (e.g., ANSPDCP for data protection aspects, possibly ANCOM or a newly established body for technical supervision), define enforcement procedures, and stipulate the exact range of administrative fines and other compliance measures applicable in Romania.

Companies must monitor the legislative process for this national implementation act closely, as it will clarify specific local responsibilities and procedures for compliance with the EU AI Act.

Step-by-Step Process / Requirements

Compliance with the EU AI Act for companies in Romania involves a multi-faceted approach, centered on the risk classification of AI systems. The process can be broken down into the following key steps:

1. AI System Risk Classification:

   • Step 1.1: Initial Assessment: Identify the intended purpose, functionalities, and application context of your AI system. Determine if it falls under any of the categories defined in Title III, Chapter 2 (Prohibited AI practices) or Title III, Chapter 3 (High-risk AI systems) of the EU AI Act. The Act prohibits certain AI systems outright (e.g., social scoring by governments, real-time remote biometric identification in publicly accessible spaces for law enforcement unless strict conditions are met). Assess if your system's output could have adverse affects on fundamental rights, health, safety or environment.
   • Step 1.2: High-Risk Identification (Annex III): Refer to Article 6 and Annex III of the EU AI Act. Annex III lists 8 specific areas where AI systems are deemed high-risk (e.g., AI systems intended to be used as safety components of products, employment management, creditworthiness assessment, law enforcement, migration management, administration of justice). If your AI system is used as a safety component of a product falling under EU harmonization legislation listed in Annex II, or if it is a standalone product itself falling under such legislation and performing a safety function, it is high-risk. Similarly, systems used for access to education, employment, access to essential private and public services, law enforcement, migration management, or for the administration of justice and democratic processes, are high-risk. Document this assessment thoroughly.
   • Step 1.3: Other Risk Categories: If an AI system is not prohibited or high-risk, determine if it poses a limited risk (e.g., chatbots, emotion recognition systems – requiring transparency obligations as per Title IV of the EU AI Act) or a minimal risk (the vast majority of AI systems, with no specific obligations beyond voluntary codes of conduct). The key is the potential for significant harm.

2. Compliance for High-Risk AI Systems (if applicable):

   • Step 2.1: Implement a Robust Risk Management System: Establish, implement, document, and maintain a risk management system throughout the entire lifecycle of the high-risk AI system, as per Article 9 of the EU AI Act. This includes identifying and analyzing known and foreseeable risks, estimating and evaluating those risks, adopting appropriate risk mitigation and control measures, and continuous monitoring and updating. Maintain a risk management plan for each high-risk AI system.
   • Step 2.2: Data Governance and Management: Ensure data sets used for training, validation, and testing are of high quality, relevant, representative, free of errors, and complete, as detailed in Article 10 of the EU AI Act. This includes addressing potential biases and ensuring data protection compliance (GDPR). Implement appropriate data governance practices, including data acquisition, collection, data preparation, data labelling, and data augmentation.
   • Step 2.3: Technical Documentation: Compile comprehensive technical documentation before placing the high-risk AI system on the market or putting it into service, as required by Article 11 of the EU AI Act. This documentation must demonstrate compliance with the Act and must be kept up-to-date for at least 10 years after the system is placed on the market. It includes details about the system's design, training data, risk management system, evaluation results, and human oversight. Required documents include: general description of the AI system, design specifications, information on data sets, retention policies, evaluation reports, and user instructions.
   • Step 2.4: Record-Keeping (Loggingقابilities): Ensure the high-risk AI system automatically records events throughout its operation, as per Article 12 of the EU AI Act. These logging capabilities must allow for the reconstruction of the system's operation, and for the demonstration of compliance with the Act, especially regarding its performance, transparency, human oversight, and safety over its lifetime. Logs should be accessible to competent national authorities upon request.
   • Step 2.5: Transparency and Provision of Information to Users: Design and develop high-risk AI systems in a way that allows deployers to interpret the system's output and use it appropriately. Provide clear instructions for use, including the system's capabilities and limitations, and expected accuracy, as per Article 13 of the EU AI Act. For systems interacting with natural persons, individuals must be informed that they are interacting with an AI system, unless this is obvious from the circumstances.
   • Step 2.6: Human Oversight: Implement effective human oversight measures, as per Article 14 of the EU AI Act, to prevent or minimize risks to health, safety, or fundamental rights. Human oversight requires ensuring that natural persons can effectively oversee the AI system, interpret its outputs, understand its capabilities and limitations, and intervene to overrule or deactivate it when necessary.
   • Step 2.7: Accuracy, Robustness, and Cybersecurity: Design and develop high-risk AI systems to achieve an appropriate level of accuracy, robustness, and cybersecurity, as per Article 15 of the EU AI Act, throughout their lifecycle. Robustness means resilience to errors, faults, or inconsistencies. Cybersecurity protects AI systems from adversarial attacks, unauthorized access, and malicious manipulation.
   • Step 2.8: Conformity Assessment: Before placing a high-risk AI system on the market, providers must undergo a conformity assessment procedure as per Article 43 of the EU AI Act. This usually involves a self-assessment by the provider for many systems or a third-party conformity assessment by a notified body for certain high-risk systems (e.g., safety components of products). The provider then draws up an EU declaration of conformity and affixes the CE marking.
   • Step 2.9: EU Declaration of Conformity and CE Marking: Upon successful completion of the conformity assessment, providers must draw up an EU declaration of conformity as per Article 48 of the EU AI Act. For high-risk AI systems that are products subject to specific EU harmonisation legislation, affix the CE marking as per Article 49 of the EU AI Act.
   • Step 2.10: Registration in EU Database: High-risk AI systems (with some exceptions) must be registered in the EU database for high-risk AI systems before being placed on the market or put into service, as per Article 51 of the EU AI Act. Providers submit certain information about the system and their organization.
   • Step 2.11: Post-Market Monitoring and Corrective Actions: Implement a post-market monitoring system to continuously collect and analyze data on the system's performance, as per Article 61 of the EU AI Act. This includes reporting serious incidents and malfunctions to the relevant national authorities designated in Romania, and taking corrective actions when necessary.

3. Specific Requirements for General-Purpose AI (GPAI) Models (if applicable):

   • Step 3.1: Transparency Obligations: Providers of GPAI models must comply with specific transparency obligations under Article 53 of the EU AI Act. This includes drawing up technical documentation, instruction for use, and a summary of the training data used, including detailed information about the data. The summary should be concise but informative enough to allow for transparency and understanding of the model's capabilities and limitations.
   • Step 3.2: Copyright Compliance: Implement policies to respect EU copyright law, especially when training GPAI models, as per Article 53(1)(c) of the EU AI Act. This includes identifying and processing copyrighted materials used in training datasets, potentially requiring licensing agreements or relying on exceptions for text and data mining under Directive (EU) 2019/790.
   • Step 3.3: Systemic Risk Evaluation (for GPAI with systemic risk): If a GPAI model poses a systemic risk (e.g., due to its capabilities, size, or impact), additional obligations apply as per Article 53(2) of the EU AI Act. These include performing model evaluation, assessing and mitigating systemic risks, ensuring high levels of cybersecurity, and reporting serious incidents. The Commission will designate GPAI models with systemic risk based on criteria such as computational power below 10^25 FLOPs or other indicators of capability and impact.
   • Step 3.4: GPAI Model Card/Documentation: Create and maintain comprehensive documentation for the GPAI model, including its architecture, training methodologies, performance metrics, and known limitations or biases. This documentation should be sufficient for downstream providers to understand and use the model responsibly.

4. Romanian National Authority Interaction:

   • Step 4.1: Identify Competent Authorities: Monitor the adoption of the national law mentioned above to identify the specific Romanian competent authorities responsible for market surveillance, enforcement, and registration under the EU AI Act. These might include the National Authority for Data Protection Supervision (ANSPDCP) for data-related aspects, the National Authority for Management and Regulation in Communications (ANCOM) for digital services, or a newly established body.
   • Step 4.2: Reporting & Cooperation: Be prepared to report serious incidents, provide technical documentation, and cooperate fully with the identified Romanian market surveillance authorities and relevant national administrative authorities responsible for supervising the implementation of specific sectoral legislation (e.g., Ministry of Health for medical AI, National Bank of Romania for financial AI).

Costs and Timeline

The costs and timelines associated with EU AI Act compliance in Romania are highly variable, depending on the risk classification of the AI system, the maturity of existing compliance frameworks within the company, and the complexity of the AI system itself. While exact governmental fees for registration (if any, separate from the EU database) are pending specific national legislation, the main costs will be indirect:

Financial Costs (Estimates):

• Initial Legal and Technical Audit (Risk Classification): EUR 5,000 - EUR 50,000 (RON 25,000 - RON 250,000). Highly dependent on the number and complexity of AI systems. This involves expert legal counsel to classify AI systems and technical experts to assess inherent risks.
• Development/Adaptation of Risk Management System: EUR 10,000 - EUR 200,000+ (RON 50,000 - RON 1,000,000+). For high-risk systems, this includes development of policies, procedures, and integration into existing quality management systems.
• Data Governance & Quality Improvement: EUR 15,000 - EUR 300,000+ (RON 75,000 - RON 1,500,000+). Costs for auditing, cleansing, curating, and augmenting training, validation, and testing data; implementing bias detection and mitigation tools; and ensuring GDPR compliance in data handling.
• Technical Documentation Preparation: EUR 8,000 - EUR 150,000+ (RON 40,000 - RON 750,000+). Involves technical writing, engineering time, and legal review to produce comprehensive and compliant documentation. Specialized software for documentation management might also be needed.
• Logging Capabilities Implementation: EUR 5,000 - EUR 100,000+ (RON 25,000 - RON 500,000+). Development or integration of robust logging infrastructure capable of retaining detailed event data for at least 10 years.
• Human Oversight Mechanism Development: EUR 7,000 - EUR 120,000+ (RON 35,000 - RON 600,000+). Includes designing user interfaces for human intervention, developing clear operational procedures, and training staff.
• Accuracy, Robustness & Cybersecurity Testing: EUR 10,000 - EUR 250,000+ (RON 50,000 - RON 1,250,000+). Involves extensive testing, penetration testing, adversarial attack simulations, and continuous monitoring tools. Specialist cybersecurity consultants may be required.
• Conformity Assessment (if third-party required): EUR 20,000 - EUR 100,000+ (RON 100,000 - RON 500,000+). Fees charged by a notified body for certification, which can vary significantly based on complexity.
• Ongoing Monitoring and Maintenance: EUR 1,000 - EUR 10,000+ per month (RON 5,000 - RON 50,000+) for continuous compliance activities, including post-market monitoring, regular audits, staff training, and software updates.

Timeline (Estimates):

The EU AI Act largely started applying from December 2026. However, some provisions apply earlier. For example, the prohibitions on unacceptable AI systems applied from July 2026 (6 months after entry into force). The provisions on General-Purpose AI models and GPAI models with systemic risk apply from May 2026 (12 months after entry into force). The majority of the Act's provisions, including those for high-risk AI systems, apply from December 2026 (24 months after entry into force).

• Initial Risk Assessment and Gap Analysis: 1-3 months. This phase should have been completed already or must be prioritized immediately for existing systems.
• Development/Adaptation of Compliance Frameworks (e.g., Risk Management System, Documentation): 3-12 months. This is an intensive phase requiring significant internal resources or external consultancy.
• Data Preparation and Governance Enhancement: 3-9 months. Can be highly iterative.
• Technical Implementation (Logging, Human Oversight, Cybersecurity): 6-18 months. Depends on system complexity and existing infrastructure.
• Conformity Assessment (for high-risk AI systems): 3-6 months for self-assessment, 6-12 months for a notified body involvement, including lead times for booking and review cycles.
• EU Database Registration: 1-2 weeks, once all documentation is ready.
• Ongoing Compliance: Continuous process, requiring regular reviews, updates, and monitoring.

Given the staggered application dates, and the fact that most provisions for high-risk systems are applicable since December 2026, companies in Romania should have already initiated these processes. For new AI systems, these timelines represent the pre-market deployment hurdles.

Comparison Table

To illustrate the varying compliance burdens under the EU AI Act, let's compare the obligations for different AI system risk categories: