Lagging RO Verified 21 Oct 2026

Romania

EU AI Act implementation, 2026

Romania has only a March 2026 government memorandum proposing ANCOM as market surveillance authority and single point of contact; no implementing law has been adopted, and ANCOM itself states that no Romanian authority can verify or sanction AI Act breaches until that law enters into force.

Implementing law
No bill yet
Penalty regime (Art. 99)
Not adopted
Regulatory sandbox
None
Readiness rank
26 of 27score 20 / 100

Key findings

  • Romania has no implementing law, no draft bill in public consultation, and no legally designated Article 70 authorities as of October 2026.
  • The only instrument is a non-binding government memorandum (12 March 2026) proposing ANCOM as lead authority and single point of contact.
  • ANCOM openly acknowledges that no Romanian authority can sanction AI Act breaches until national legislation is in force.
  • No regulatory sandbox or sandbox legal basis exists.
  • The 2024-2027 national AI strategy predates the AI Act's application and does not address enforcement architecture.

National authorities

Market surveillance

ANCOM - Autoritatea Națională pentru Administrare și Reglementare în Comunicații

Proposed (government memorandum, March 2026) as residual/general market surveillance authority and single point of contact; also for EMC and radio-equipment AI; not yet designated by law

ancom.ro (opens in new tab)
Market surveillance

ASF (Financial Supervisory Authority) and BNR (National Bank of Romania)

Proposed market surveillance authorities for high-risk AI in financial services

ancom.ro (opens in new tab)
Market surveillance

ANSPDCP (National Supervisory Authority for Personal Data Processing)

Proposed market surveillance authority for high-risk systems in biometrics, law enforcement, border/migration/asylum and justice; ANPC and the Labour Inspectorate to act in their fields

ancom.ro (opens in new tab)
Notifying authority

Autoritatea pentru Digitalizarea României (ADR) - proposed in the government memorandum per the artificialintelligenceact.eu tracker; not confirmed in ANCOM's own release

artificialintelligenceact.eu (opens in new tab)
Single point of contact (Art. 70(2))

ANCOM (proposed; not legally designated)

Implementing law, penalties and sandbox

Implementing law No bill yet

National law implementing Regulation (EU) 2024/1689 (under drafting by the designated authorities; no bill published)

No public text located
Penalty regime Not adopted

No national penalty rules under Article 99 are in force; regulators rely on existing powers.

Regulatory sandbox None

No AI regulatory sandbox and no sandbox legal basis were found in any Romanian source; the subject is absent from ANCOM's July 2026 status release and from press coverage. The EU deadline is 2 August 2027.

National AI strategy

Strategia Națională în domeniul Inteligenței Artificiale 2024-2027 (H.G. nr. 832/2024)

2024

economedia.ro (opens in new tab)

Notable developments

  1. National AI Strategy 2024-2027 adopted

    The government approved the national AI strategy by decision on 11 July 2024, creating an interministerial commission chaired by the research/digitalisation minister; critics argued it was already overtaken by EU developments.

    economedia.ro (opens in new tab)

  2. Government memorandum on designation of AI Act authorities

    On 12 March 2026 the government adopted a memorandum on designating national competent authorities and the single point of contact, proposing ANCOM for the lead role with ASF, BNR, ANSPDCP and sectoral bodies alongside - seven months after the EU deadline.

    digi24.ro (opens in new tab)

  3. ANCOM: no sanctions possible before national law

    In a 24 July 2026 press release ANCOM confirmed that the authorities are still drafting the national legislative framework (authorities, duties, cooperation, sanctioning procedure) and that non-compliance can be verified and sanctioned only after that law enters into force.

    ancom.ro (opens in new tab)

  4. Romania grouped among 'late - partial implementers'

    Deloitte Legal's July 2026 benchmarking, reported by Edupedu on 11 August 2026, placed Romania with Austria, Belgium, Bulgaria, Croatia, Estonia and Slovakia as states still relying on existing frameworks with no formally designated Article 70 authorities.

    edupedu.ro (opens in new tab)

  5. Press and parliament question an AI Act 'without teeth'

    Bursa (4 August 2026) reportedly described the national structure as existing 'on paper', and a written parliamentary question by MP Sebastian Burduja (cdep.ro reference i6258A, 14 September 2026) is reported by search snippets to argue that the memorandum has no binding legal force and confers no control or sanctioning powers; the cdep.ro PDF could not be fetched, so the Bursa article is the cited source.

    bursa.ro (opens in new tab)

Analysis

Romania is the furthest behind of the nine countries reviewed. Fourteen months after the Article 70 deadline, its AI Act governance consists of a government memorandum adopted on 12 March 2026 that proposes - but cannot legally establish - ANCOM as general market surveillance authority and single point of contact, with the financial regulators (ASF, BNR) and the data protection authority (ANSPDCP) taking the financial and rights-sensitive high-risk categories and the consumer and labour inspectorates acting in their fields. The artificialintelligenceact.eu tracker records ADR, the digitalisation agency, as proposed notifying authority.

ANCOM has been unusually candid about the consequences. Its 24 July 2026 release, issued days before the 2 August 2026 application date for transparency and most remaining obligations, states that the national law defining authorities, cooperation mechanisms and the sanctioning procedure is still being drafted and that verification and sanctioning can begin only after it enters into force. Romanian business press and at least one parliamentary question have since framed the AI Act as a law 'without teeth' in Romania, and Deloitte Legal's July 2026 benchmarking grouped the country among late, partial implementers.

The Digital Omnibus on AI softens the immediate exposure - standalone high-risk obligations now start on 2 December 2027 and the sandbox deadline is 2 August 2027 - but it does not change the fact that prohibitions (since February 2025), GPAI rules and transparency duties already bind Romanian operators with no domestic enforcer. Until a bill is published, the realistic path is a government ordinance or law in late 2026 or 2027; nothing in the sources suggests a timetable.

PDF edition

EU AI Act 2026 Q3 Report

All 27 member-state profiles including Romania, the readiness ranking, the Omnibus timeline and every source, as one print-ready PDF.

* You will also be subscribed to my newsletter. No spam, unsubscribe any time.

Sources

  1. ANCOM - Autoritatea Națională pentru Administrare și Reglementare în Comunicații (opens in new tab) ancom.ro
  2. Notifying authority: Autoritatea pentru Digitalizarea României (ADR) - proposed in the government memorandum per the artificialintelligenceact.eu tracker; not confirmed in ANCOM's own release (opens in new tab) artificialintelligenceact.eu
  3. Strategia Națională în domeniul Inteligenței Artificiale 2024-2027 (H.G. nr. 832/2024) (opens in new tab) economedia.ro
  4. Government memorandum on designation of AI Act authorities (opens in new tab) digi24.ro
  5. Romania grouped among 'late - partial implementers' (opens in new tab) edupedu.ro
  6. Press and parliament question an AI Act 'without teeth' (opens in new tab) bursa.ro