Romania

The Romanian Constitution (1991, revised 2003) is the country’s fundamental law and guarantees the basic rights of its citizens. Although it does not contain references to artificial intelligence, several provisions establish the constitutional baseline against which AI systems must be assessed.

Article 1(3) sets human dignity and the free development of human personality as supreme values of the state — these shall be fundamental limitations on any legislative or administrative use of AI. Article 16(1) guarantees equality before the law without discrimination, thereby making constitutionally problematic any system that produces discriminatory outcomes in areas such as employment, credit, or public services. Article 26 requires public authorities to respect and protect private and family life, engaging directly with AI systems that process personal data. Article 28 declares inviolable the secrecy of communications, which is significant in the context of AI-powered surveillance technologies.

Romania has been a party to the European Convention on Human Rights since 1994, thereby acknowledging the authority of the European Court of Human Rights.

In Bărbulescu v. Romania (Application no. 61496/08, Grand Chamber, European Court of Human Rights, judgment of 5 September 2017), the court held that real-time monitoring of employees’ electronic communications by an employer, without providing adequate prior notice, violated Article 8 of the European Convention on Human Rights (ECHR). The same reasoning applies directly to AI-powered workplace monitoring systems, now classified as high-risk under Regulation (EU) 2024/1689.

In Buturugă v. Romania (Application no. 56867/15, Fourth Section, European Court of Human Rights, judgment of 11 February 2020), the court found a violation of Articles 3 and 8 of ECHR arising from technology-enabled surveillance in a domestic violence context and Romania was sanctioned because the authorities did not investigate seriously enough how privacy had been violated through technology. It is therefore a powerful example of why regulating intrusive technological tools through dedicated legal frameworks is not just useful, it is necessary.

Current national legislation lacks any explicit indication on whether granting a patent for an AI-related invention is possible or not. However, the general patentability framework under Law no. 64/1991 and its 2008 implementing Regulation applies to AI-related inventions without carve-outs.

On inventorship, only natural persons are recognised as inventors:

• the 2008 implementing Regulation (Article 26) requires the inventor designation to contain first name, surname, and full address, structurally presupposing inventor is always a natural person;
• no procedural basis exists for designating a software system as inventor, and the Romanian IP office has published no position on AI inventorship. The framework closes the question without requiring explicit prohibition.

Patentability criteria and the list of inventions that are generally excluded from registration are similar between national patents and the European patents granted under the European Patent Convention. However, non-EU applications for any AI-related inventions need to be substantially analysed by the Romanian IP office in reference to the Romanian national patentability requirements, even though the origin office would have initially granted an AI-related patent.

On computer-implemented inventions, Romanian law is not silent. The Regulation contains substantive provisions in this area, however these provisions are not AI-specific, although they may apply by analogy to AI-implemented inventions. An AI system that produces a defined, reproducible technical effect, for example, a measurable improvement in diagnostic accuracy attributable to a specific algorithmic step, would be assessed under this framework.

While Romanian law does not explicitly prohibit AI-implemented patents, lack of clear legislative guidance means that applicants ought to consider the European Patent Office standards on computer-implemented inventions to increase their chances of registering an AI-related patent in Romania. It is reasonable to assume by any applicant that Romanian examiners facing applications in these areas will refer to European Patent Office Guidelines, but only as a non-binding and practical benchmark.

Romanian legislation contains no regulation on recognising AI-generated works, and the courts of law have not been tested yet on this matter.

Romanian Law no. 8/1996 on copyright and related rights states that only human beings can be authors, meaning AI systems are not eligible for authorship under this law.

A work produced entirely by an AI system receives no copyright protection in Romania, as authorship under Romanian law is inherently personal. Legal persons and natural persons other than the original creator may benefit from author-equivalent protection, but “only in cases expressly provided by law”. This exception only applies to specific scenarios such as collective works, employer-owned works, or audiovisual productions, and it does not imply non-human creation. No explicit provision in Romanian law has extended this protection to AI-generated outputs so far.

Romania shares the originality criteria derived from EU copyright framework and ECJ case law, therefore a work is protected only if it constitutes the author’s own intellectual creation. However, Romania also shares the same legislative lack of clarity as every other EU Member State, in terms of copyright protection for AI-assisted works. A work produced by a human using AI as a tool may qualify for protection, provided the human’s contribution constitutes the author’s own intellectual creation, but this scenario is yet to be tested before Romanian courts as well before the ECJ.

For fully AI-generated works that would be protected in third countries, recognition in Romania is not available and enforcement of those works would be governed by Romanian law, which does not offer protection framework for works without a human author.

National legislation does not contain any provision specific to AI, and Romania has issued no administrative guidance on this topic. All scenarios must currently be resolved within the general legal framework, which is mainly a national transposition of Directive (EU) 2016/943 regarding undisclosed know-how and trade secrets.

Both companies developing AI systems and those using third-party AI platforms could protect proprietary model architectures, training datasets, source code and algorithms, fine-tuning methodologies, and even valuable prompt engineering know-how as trade secrets.

However, the most important barrier is the condition for the holders of information that they “have taken reasonable steps to maintain its secrecy”, otherwise information may not be qualified as a trade secret under national laws.

“Reasonable steps to maintain secrecy” may not be satisfied for all AI environments. Since it is unclear what measures suffice when using a third-party AI platform, stripping information of secret trade protection entirely may happen when:

• inputting confidential business data into external AI systems, where platform terms may permit use of that data for model training, or if such platforms incur an inherent risk of regurgitating user input;
• companies without internal policies governing AI tool usage may be found to have failed the “reasonable steps” measures; and
• training on third-party confidential data without authorisation, which may constitute unlawful acquisition under national legislation.

No relevant IP cases on the matter.

As Romania does not have any AI-specific data legislation yet, the use of personal data covering AI therefore falls under the General Data Protection Regulation (GDPR) framework, interpreted by Romania’s Supervisory Authority, ANSPDCP.

Furthermore, Romania transposed the EU Directive 2016/680 through Romanian Law No. 363/2018, governing data processing by authorities in criminal contexts which is relevant for AI tools used in law enforcement.

Additionally, Romanian Law No. 190/2018 supplements the GDPR domestically, in particular, governing the processing of certain categories of personal data, the use of the National ID Number, and the processing of data in the context of employment relationships.

Romania is directly subject to GDPR (Regulation (EU) 2016/679), the primary framework for personal data processing in all AI contexts. Main provisions include Article 22 on automated decision-making, Article 25 on data protection by design, and Article 35 requiring Data Protection Impact Assessments for high-risk processing. As mentioned above, ANSPDCP is responsible for domestic enforcement.

In Romania, the legal framework governing open data of public sector information is mainly regulated by Romanian Law No. 179/2022 on open data and the reuse of public sector information which transposes Directive (EU) 2019/1024 on open data and the reuse of public sector information. At the same time, access to information of public interest is regulated by Romanian Law No. 544/2001, which allows data to be requested and obtained from public authorities, thereby indirectly contributing to the data reuse ecosystem. In the context of AI system development, these mechanisms are relevant because open data provided by the public sector can serve as important sources for training algorithms and developing AI-based applications, while complying with data protection, intellectual property, and information security regulations.

The use of biometric data in AI systems is subject to strict legal safeguards under both European and Romanian law. Biometric data constitutes a special category under Article 9 of the GDPR, therefore subject to enhanced protection. Moreover, Article 3 of Romanian Law No. 190/2018 clearly states that biometric data processing for the purpose of automated decision-making or profiling can only be done based on explicit consent or based on express legal provisions.

The use of biometric data by authorities such as the police is governed primarily by Romanian Law No. 363/2018 on data protection in the field of law enforcement, as well as by normative acts concerning identity documents and passports, all of which are supplemented by the European framework on data protection and AI.

The main domestic legal framework is Romanian Government Ordinance No. 137/2000 on preventing and sanctioning all forms of discrimination (approved with amendments by Law No. 48/2002, republished). This act prohibits direct and indirect discrimination on grounds including race, nationality, ethnicity, language, religion, social category, disability, age, and sexual orientation. The National Council for Combating Discrimination (CNCD) operates as the enforcement authority, empowered to investigate complaints and apply sanctions.

While the mentioned legislation was not designed with AI systems in mind, its broader objective of preventing discriminatory disadvantage suffered by protected groups means it can, in principle, apply where an AI system produces discriminatory outcomes, even unintentionally. Nevertheless, the effective enforcement of this framework regarding AI-driven systems remains largely untested in Romanian courts or by the CNCD.

At EU level, Romania is bound by the Equal Treatment Directives, including the Employment Equality Directive (2000/78/EC), the Racial Equality Directive (2000/43/EC), and the Recast Gender Equality Directive (2006/54/EC), as well as by the EU AI Act (Regulation (EU) 2024/1689). The AI Act introduces a risk-based regulatory framework that is particularly relevant for addressing potential discrimination in AI systems. Under Annex III, AI systems used in employment, credit, education, and access to essential services are classified as high-risk and must meet requirements including the use of technical measures to minimise bias, and ongoing monitoring for discriminatory outputs.

Additionally, Article 22 of the GDPR provides individuals with enhanced protection against solely automated decisions that produce significant legal or practical effects on that individual, offering a solution to push back against harmful decisions made solely by automated systems.

Romania has not yet implemented dedicated legislation addressing algorithmic bias in AI systems, leaving a regulatory gap that domestic authorities have not filled. Coordination between CNCD and ANSPDCP will likely be necessary once AI-related discrimination complaints begin to emerge in practice.

The domestic implementation of the NIS2 Directive only implicitly addresses AI, requiring “proportionate technical and organisational measures” for systems in critical operations. AI technologies are expected to comply with these standards.

The domestic technical order for technology infrastructure requirements is still pending, leaving a gap in the current framework. Legacy security requirements remain in force for essential service operators identified before NIS2, until the DNSC releases updated orders. AI systems used by these entities must comply with legacy controls, such as logging, vulnerability management, and network segmentation standards, until new NIS2-aligned rules take effect.

There are domestic legal requirements with no EU-level equivalent:

• A nationally licensed body of DNSC-attested auditors. Security assessments of AI systems embedded in essential or important entities must be conducted by an attested auditor. An internal AI dedicated team exercise or an assessment by an unlicensed third party does not satisfy these requirements.
• Entities falling under domestic equivalent of EU NIS2 Directive must also submit to DNSC a yearly maturity self-assessment of their cybersecurity risk management. No explicit provisions are made for AI deployments in this respect; however, entities should factor in controls around model integrity, access to training data pipelines, and inference infrastructure.
• A designated security officer must operate independently from the operational Head of IT. For organisations where AI product and IT security functions are merged, this may likely create a direct organisational compliance gap.

One of the main concerns in relation to AI and competition law is algorithmic collusion. Pricing algorithms may react to competitors’ prices and adjust market strategies automatically, potentially leading to coordinated pricing outcomes even in the absence of explicit agreements between firms. In such circumstances, competition authorities may assess whether the use of algorithms facilitates collusive conduct falling within the scope of Article 101 of the Treaty on the Functioning of the European Union (TFEU) and national competition rules.

Another area of concern is related to dark patterns — interface design techniques that manipulate consumer’s choices through AI-driven personalisation. These practices raise concerns under both competition and consumer protection law, especially when they influence consumers’ choices in ways that limit informed decision-making and give dominant platforms even more advantage.

AI technologies also enable personalised pricing strategies, where an algorithm charges different users different prices for the same product based on their browsing history or location, may breach competition law when used by companies to exploit consumers and get higher profits than would be possible in a competitive market.

Romania’s primary competition framework is established by Romanian Competition Law No. 21/1996 and Romanian Unfair Competition Law No. 11/1991, which mirror Articles 101 and 102 of the TFEU and shall apply on acts that restrict, hinder or disrupt competition. The Romanian Competition Council (Consiliul Concurenței) acts as the competent enforcement authority and cooperates with the European Competition Network on cross-border cases. To date, the Competition Council has not issued dedicated guidance on algorithmic collusion or AI-specific market practices.

Romanian law does not recognise AI agents as legal persons. Legal personality under the Romanian Civil Code attaches exclusively to natural persons and legal persons.

Actions taken by an AI agent are treated as actions of the human or legal person who deployed or used it, effectively a principal-agent type of relationship applied to the deploying entity from a legal standpoint. A contract concluded by an AI agent acting within the scope of its authorisation binds the deploying principal. Liability for harm caused by an AI agent falls to the deployer under general tort rules.

Romanian criminal law contains no AI-specific provisions. General Criminal Code offences covering computer fraud, data integrity, and system disruption apply to AI-related conduct by attribution to the deploying entity. Under Article 135, corporate criminal liability arises where an offence is committed in the course of business activities, in the company’s name, or in its interest, and can arise from deficient internal organisation or inadequate oversight, even in the absence of intent. Deployers therefore bear primary exposure for acts carried out by their systems and agents in operation.

No Romanian statute specifically targets agentic AI in any sector. The only domestic legislative attempt to address autonomous AI decision-making was draft law PL-x 184/2025 (on the responsible use of artificial intelligence) and has been effectively rejected at every stage of the parliamentary process. Thus far, it sat formally at the Chamber of Deputies but is without realistic prospect of enactment in its current form.

Its provisions would have prohibited AI-driven administrative decisions without human intervention and barred AI from making judicial decisions, both drafted as absolute rules with no proportionality carve-out. Its rejection across all advisory bodies was justified primarily on the ground that the EU AI Act already occupies the field, leaving no room for divergent national legislation.

Beyond PL-x 184/2025, domestic sector-specific regulation is absent:

• Financial services. The BNR and ASF have issued no agentic-AI-specific guidance. General model risk management expectations apply by supervisory practice, but there is no domestic rule that specifically addresses autonomous AI agents in trading, credit, or insurance workflows.
• Healthcare. The Ministry of Health and the National Health Insurance House (CNAS) have issued no agentic-AI rules. Oversight runs through general medical device and product safety legislation, with no domestic layer addressing autonomous clinical AI specifically;
• Defence and intelligence. Autonomous systems in these contexts are governed by Law 58/2023 and sit entirely outside the civil regulatory framework. There are no publicly available domestic rules on autonomous weapons systems or AI-driven intelligence operations.

The existing domestic framework is primarily established by Romanian Law No. 240/2004 on producer liability for damage caused by defective products, together with Romanian Law (Government Ordinance) No. 21/1992 on consumer protection. Under this framework, liability is generally linked to tangible products placed on the market, which creates legal uncertainty in situations where harm results from AI software within a product or digital service.

This regulatory gap is addressed at EU level by the new Product Liability Directive (EU) 2024/2853, which upgrades the traditional product liability framework. The Directive expands the notion of “product” to include software, digital manufacturing files, related digital services integrated into a product, and broadens the range of potentially liable economic operators, including manufacturers, importers, and certain online platform providers. It also introduces procedural measures designed to facilitate the burden of proof for injured parties, particularly in complex cases involving AI systems.

As a result, products incorporating AI technologies, such as medical devices, autonomous vehicles, or smart appliances, may fall within the scope of product liability rules where defects in software or AI functionalities cause damage. Member States, including Romania, must transpose the Directive by 9 December 2026, at which point the current domestic liability framework, including Romanian Law No. 240/2004, is expected to be amended or replaced to reflect the new EU requirements.

Under both the existing and incoming framework, liability is strict, meaning that a victim does not need to prove that the manufacturer was at fault, only that the product was defective and caused harm. When assessing whether an AI-enabled product is defective, courts may consider facts such as its capacity to learn and evolve after it was sold, its interaction with other connected products or digital services, and whether it complies with relevant legal requirements, including the EU AI Act.

In Romania, product recall and safety measures governed by the same legislative framework mentioned above. These rules require manufacturers and distributors to ensure that products placed on the market are safe and to take corrective actions if risks are identified. Enforcement is carried out mainly by the National Authority for Consumer Protection, which can order corrective measures or withdrawal of unsafe products from the market.

Romania has not produced yet domestic case law on AI product liability. Litigation is expected to increase significantly once the new Product Liability Directive enters application in December 2026.

Two legislative proposals concerning artificial intelligence have been introduced in Romania to date, neither of which has been enacted. The first proposal, Draft Law Pl-x no. 336/2024 aimed to introduce a general regulatory framework. It was rejected by both the Senate in May 2024 and the Chamber of Deputies in May 2025, reflecting concerns about the need to align with the forthcoming EU AI Act.

The second, Draft Law Pl-x no. 184/2025 on the responsible use of artificial intelligence, was introduced on 31 March 2025 and rejected by the Senate on 2 June 2025; it is now pending before the Chamber of Deputies, the decisional chamber, with no realistic prospect of enactment. It sought to ensure transparency, protect fundamental rights, and prevent the misuse of AI in critical sectors. Key provisions included transparency obligations and periodic audits for AI systems used in public administration, restrictions on fully automated decision-making without human oversight, limitations on the use of AI in judicial decision-making, compliance and certification requirements for AI systems used by law enforcement authorities, and the requirement that AI-assisted medical diagnoses be validated by a qualified physician. The proposal also envisaged sanctions, including potential criminal liability in certain circumstances where AI systems are used in ways that violate fundamental rights or circumvent transparency requirements. Its rejection across advisory bodies rested primarily on the EU AI Act already establishing a harmonised and directly applicable framework, leaving no room for divergent national legislation (see section 7.2).

At the strategic level, Romania adopted a National Strategy on Artificial Intelligence (2024–2027), coordinated by the ADR and the Ministry of Research, Innovation and Digitalisation. The Strategy envisages the creation of a dedicated national authority responsible for AI governance and coordination.

Separately, Romania has notified the European Commission of the public authorities which supervise or enforce obligations protecting fundamental rights in the context of the AI Act (Article 77), including the Romanian Ombudsperson (Avocatul Poporului).

On 12 March 2026, the Romanian Government approved a memorandum which designated ANCOM, ASF, BNR and ANSPDCP as market surveillance authorities and ADR as notifying authority under the EU AI Act, with ANCOM also serving as the national single point of contact. The memorandum has administrative value; binding enforcement powers require subsequent national legislation.