Skip to main content

    AI by country · Central and Eastern Europe

    AI in Romania: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Romania know before starting with AI?

    Romania applies the EU GDPR, Law No. 190/2018 on measures to implement it, and the EU AI Act. A government memorandum proposes ANCOM as the AI Act market surveillance authority, but the national law that would allow checks and fines was still being drafted when we checked. A company should map where its AI makes decisions about people, check the extra Romanian rules on monitoring staff, and see whether any system is high-risk.

    At a glance

    Romania at a glance

    Key facts about Romania
    Data protection lawEU GDPR (applies since 25 May 2018) and Law No. 190 of 18 July 2018, in force
    RegulatorANSPDCP for data; ANCOM proposed for the AI Act
    AI policyNational AI Strategy 2024 to 2027 (Government Decision No. 832/2024). No national AI Act implementing law as of 29 October 2026
    Time zoneEET, UTC+2 in winter and UTC+3 in summer (India is 3.5 or 2.5 hours ahead)
    CurrencyRON (Romanian leu)
    Business languageRomanian, with English common in technology firms

    Why now

    Why Romania is worth watching

    Each point links to the document it comes from.

    • Eurostat reports that 5.21% of Romanian enterprises with 10 or more staff used AI in 2025, against an EU average of 19.95%.[1]

    • The government approved the National Strategy in the field of Artificial Intelligence 2024 to 2027 by Decision No. 832 of 11 July 2024, published in the Official Gazette on 25 July 2024.[9]

    • ANCOM said on 24 July 2026 that it has been proposed as the national market surveillance authority and single point of contact for the AI Act.[8]

    • ANCOM also said that authorities can only check and sanction AI Act breaches once the national implementing law, still being drafted, enters into force.[8]

    • The European Commission lists ANCOM as Romania's contact point, with the designation pending final adoption.[6]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    General Data Protection Regulation (EU) 2016/679

    In force2018People have a right not to be subject to a decision based solely on automated processing with legal or similarly significant effects, with exceptions for contracts, law and explicit consent (Article 22). High-risk processing needs a data protection impact assessment first (Article 35), and breaches go to the ANSPDCP within 72 hours where feasible. Fines can reach EUR 20 million or 4% of worldwide turnover.[2]

    Law No. 190/2018 on measures to implement the GDPR

    In force2018Article 5 allows electronic or video monitoring of staff for an employer's legitimate interests only if the interest clearly prevails, staff are told in advance, the union or staff representatives are consulted, less intrusive means have failed, and data is kept for no more than 30 days unless the law allows otherwise. This matters for AI tools that track or score employees.[7]

    EU Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744

    Phased2024Bans on certain AI practices have applied since 2 February 2025 and rules for general-purpose AI models since 2 August 2025. Most other rules, including transparency duties, apply from 2 August 2026. The Digital Omnibus on AI, adopted and in force since 27 July 2026, moved high-risk rules to 2 December 2027 for Annex III uses such as hiring and credit, and to 2 August 2028 for AI in regulated products.[4]

    National AI Act implementing law (in preparation)

    Draft2026ANCOM describes a framework that would set out the market surveillance authorities, their duties, cooperation and penalties. Under the memorandum, the Financial Supervisory Authority and the National Bank would cover high-risk AI in financial services, and the ANSPDCP high-risk biometric and justice uses. We found no published bill as of 29 October 2026.[8]

    Where AI fits first

    Where AI fits first

    Banking and insurance

    Document checks, fraud alerts and customer service in Romanian, with staff reviewing any refusal.

    The memorandum would give the Financial Supervisory Authority and the National Bank of Romania oversight of high-risk AI in financial services. Credit scoring is high-risk from 2 December 2027.[8]

    Software and IT services

    Code review support, test generation and internal knowledge search.

    A firm that places an AI system on the EU market under its own name is a provider under the AI Act and carries the provider duties.[3]

    Employers and shared service centres

    Ticket triage and drafting replies, without automated scoring of staff.

    Article 5 of Law 190/2018 sets strict conditions, including a 30-day storage limit, for monitoring employees electronically.[7]

    Your first steps

    Your first steps

    1. List every AI tool in use and note which ones make or shape decisions about people.
    2. Before any AI tool monitors staff, check the Article 5 conditions in Law 190/2018 and consult the union or staff representatives.
    3. Check each use against the AI Act bans and the Annex III high-risk list, and plan for the 2 December 2027 and 2 August 2028 dates.
    4. Run a data protection impact assessment before AI touches credit, hiring, health or monitoring of staff.
    5. Label chatbots and AI-generated content where the AI Act transparency rules require it.
    6. Follow ANCOM's announcements for the national implementing law and the final list of authorities.
    7. Keep a breach process that can reach the ANSPDCP within 72 hours.

    AI services for Romania

    AI consulting and development for teams in Romania

    We work remotely with companies in Romania, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Indian hours of 9:30 to 18:30 at UTC+5:30 are 04:00 to 13:00 UTC. In winter Romania is on UTC+2, so a 9:00 to 17:00 Romanian day overlaps from 09:00 to 15:00, about 6 hours; in summer, on UTC+3, the overlap is 09:00 to 16:00, about 7 hours.

    Questions

    Common questions about AI in Romania

    Does Romania have its own AI law?

    Not as of 29 October 2026. The EU AI Act applies directly. ANCOM said in July 2026 that a national implementing law was still being drafted, and we found no published bill.

    Can anyone fine my company under the AI Act today?

    ANCOM said authorities can verify and sanction AI Act breaches only after the national implementing law enters into force. GDPR fines from the ANSPDCP already apply to AI that uses personal data.

    When do the high-risk AI rules start?

    After the EU Digital Omnibus on AI, from 2 December 2027 for Annex III uses such as hiring, education and credit, and from 2 August 2028 for AI in regulated products.

    Is there a national AI strategy?

    Yes. Government Decision No. 832 of 11 July 2024 approved the National Strategy in the field of Artificial Intelligence 2024 to 2027.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Eurostat, 2026-06-15. Enterprises using artificial intelligence technologies (isoc_eb_ai), 20…(ec.europa.eu)
      Full title and what we used it for

      Enterprises using artificial intelligence technologies (isoc_eb_ai), 2025 data. Primary statistics, queried on 29 October 2026. Used for the 5.21% Romanian figure and the EU figure of 19.95% from the same dataset.

    2. [2] Official Journal of the European Union, 2016-04-27. Regulation (EU) 2016/679 (General Data Protection Regulation)(publications.europa.eu)
      Full title and what we used it for

      Regulation (EU) 2016/679 (General Data Protection Regulation). Primary text, read via the EU Publications Office because EUR-Lex blocked automated access. Used for Articles 22, 33, 35 and 83.

    3. [3] Official Journal of the European Union, 2024-07-12. Regulation (EU) 2024/1689 (Artificial Intelligence Act)(publications.europa.eu)
      Full title and what we used it for

      Regulation (EU) 2024/1689 (Artificial Intelligence Act). Primary text. Used for Article 113 application dates, provider duties and Article 99 fines.

    4. [4] Official Journal of the European Union, 2026-07-24. Regulation (EU) 2026/1744 (Digital Omnibus on AI)(publications.europa.eu)
      Full title and what we used it for

      Regulation (EU) 2026/1744 (Digital Omnibus on AI). Primary text. Used for the high-risk dates of 2 December 2027 and 2 August 2028.

    5. [5] European Commission, 2026-10-29. AI Act: regulatory framework for AI(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      AI Act: regulatory framework for AI. Primary. Used for the timeline and the AI Omnibus entry into force on 27 July 2026.

    6. [6] European Commission, 2026-09-07. Market surveillance authorities under the AI Act(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      Market surveillance authorities under the AI Act. Primary. Lists ANCOM for Romania with designation pending final adoption.

    7. [7] ANSPDCP (National Supervisory Authority for Personal Data Processing), 2018-07-18. Lege nr. 190 din 18 iulie 2018 privind masuri de punere in aplicare a R…(dataprotection.ro)
      Full title and what we used it for

      Lege nr. 190 din 18 iulie 2018 privind masuri de punere in aplicare a Regulamentului (UE) 2016/679. Primary text hosted by the regulator. Used for Article 5 on monitoring employees. English renderings are our own.

    8. [8] ANCOM, 2026-07-24. Artificial Intelligence Act in Romania: current state of the implementa…(ancom.ro)
      Full title and what we used it for

      Artificial Intelligence Act in Romania: current state of the implementation framework. Primary press release. Used for ANCOM's proposed role, the roles of ASF, BNR and ANSPDCP, and the statement that sanctions need the national law.

    9. [9] Euroavocatura (index of the Official Gazette), 2024-07-25. Monitorul Oficial nr. 730 din 25 iulie 2024, contents(euroavocatura.ro)
      Full title and what we used it for

      Monitorul Oficial nr. 730 din 25 iulie 2024, contents. Private index of the Official Gazette. Used for Government Decision No. 832 of 11 July 2024 approving the AI strategy. The official legislation portal could not be reached when we checked.

    This is general information, not legal advice. Romania's national AI Act law and the final list of authorities were not settled when we checked. Check with a qualified Romanian lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Romania?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score