Romania - AI Legal Framework (B154/2024)

Overview

Draft Law B154/2024 (Senate file L255/2024; Chamber of Deputies PLX336/2024) is a national legislative proposal introduced on 19 March 2024 to regulate artificial intelligence in Romania. The legislative dossier (see the Senate file L255/2024) includes the sponsors' submission, an exposition of motives, committee reports and advisory opinions from the Consiliul Economic și Social and the Consiliul Legislativ. The bill aims to create a domestic framework covering AI development, deployment, protection, oversight and sanctions; it adopts a risk-based approach and references the European AI regulatory initiative as a background policy driver. Key procedural steps and official documents are available from the Senate legislative page and linked PDFs: sponsor submission and cover letter (adresa inițiatorului), exposition of motives (expunerea de motive), Consiliul Economic şi Social opinion (aviz CES), and Consiliul Legislativ opinion (aviz Consiliul Legislativ).

Definitions

The bill proposes explicit definitions intended to structure regulatory scope. Typical definitions include: 'artificial intelligence' and its variants (narrow/specialized AI, general-purpose AI, and 'superintelligence'), 'AI system' (software and hardware delivering automated decision-making or outputs), 'provider' (developer or organisation placing AI systems on the market or putting them into service), 'user' (legal or natural persons deploying the AI system), 'high-risk system' (categories identified by anticipated impact on safety, rights and public order), and 'personal data' as per GDPR cross-reference. These definitions aim to align with EU concepts while also proposing national-specific categories; advisory bodies raised concerns about novelty and national-level departures from EU terminology (see the Consiliul Legislativ opinion linked above).

Governance and Institutional Framework

The draft sets out a governance architecture that combines parliamentary oversight, sectoral committee roles and executive/administrative supervision. The Senate committee report documents that hearings included ANCOM (communications regulator), the national cyber bodies (the Centre for Cyberint within the SRI and the Directoratul Național de Securitate Cibernetică - DNSC) and national research institutes such as ICI Bucureşti (ICI Bucureşti). The bill contemplates either designating an existing authority or creating a new national supervisory body tasked with market surveillance, registration of certain AI systems, coordination of conformity assessments, and liaison with EU-level bodies. It requires interagency cooperation on cybersecurity, civil-protection and law-enforcement interfaces and foresees advisory and technical panels for methodology and standards. The legislative material indicates that the Government and relevant ministries would play roles in secondary regulation and that consultation with the Consiliul Economic şi Social and the Consiliul Legislativ is foreseen by procedure; both issued negative opinions, primarily on grounds of timing relative to EU harmonisation and the complexity of the subject.

Key Focus Areas

The bill concentrates on a set of cross-cutting areas: (1) risk classification and prohibitions — it proposes categories for systems that present unacceptable or high risk and, in some cases, limits on specific uses (the exposition of motives describes uses in military, judicial and biometric contexts and expresses intent to limit replacement of human labour); (2) transparency and disclosure — obligations to provide information to users and subjects impacted by AI outputs, labeling of AI-generated content where relevant, and documentation to enable audits; (3) conformity and registration — obligations to demonstrate compliance for high-risk systems through technical documentation, internal risk assessments and, in certain cases, independent conformity assessment and formal registration with a national registry; (4) data protection and privacy — cross-reference to GDPR compliance, special safeguards for biometric and sensitive data processing; (5) cybersecurity and model security — requirements for technical and organisational measures to ensure model integrity, availability and confidentiality; (6) safety, testing and evaluation — pre-deployment testing, validation and monitoring; and (7) market surveillance and enforcement — powers for administrative inspections, incident reporting obligations and sanctions. Committee hearings and the Consiliul Economic şi Social opinion flagged the breadth and prescriptive character of the proposed measures and recommended alignment with EU instruments and sector-specific rules.

Implementation Framework

Implementation is designed as a mix of primary law and delegated/secondary acts. The bill envisages that detailed technical rules, conformity procedures and registration mechanisms would be specified through Government decisions or ministerial regulations, with timelines for providers to comply after publication. It foresees capacity-building measures for public authorities and resources for market surveillance, including potential fees for registration or conformity procedures. The draft also anticipates cooperation with EU institutions (following the EU AI Act architecture) and proposes bilateral coordination between national cyber authorities and communications regulators for joint oversight of dual-use or critical AI systems. Several advisory opinions recommended postponement or narrowing of national implementing powers pending EU-level finalisation, and the Senate committee report highlights practical challenges for rapid nationwide enforcement without additional institutional capacity.

Monitoring and Evaluation

Monitoring mechanisms include mandatory reporting (periodic and incident-based) by providers and users, obligations to retain documentation that permits audits, and requirements to run post-market monitoring and continuous risk assessments. The bill sets out indicators and reporting templates to be adopted in secondary legislation and foresees public annual reporting by the supervising authority on compliance, market trends and enforcement actions. There is an expectation of cooperation with national cybersecurity bodies for incident handling and with statistical/regulatory agencies to evaluate economic and social impacts. Advisory opinions requested clearer metrics, resource estimates and planned administrative timelines for evaluation to avoid uneven application across sectors.

Penalties, Liability, and Appeals

Enforcement mechanisms include administrative sanctions (fines and corrective measures), orders to suspend or withdraw non-compliant systems from the market, and criminal or administrative liability where unlawful behaviour or negligence is established. The bill also contemplates civil liability provisions for harm caused by AI systems, with obligations to ensure remediation and access to redress for affected individuals. Affected parties would retain appeal rights in administrative courts against supervisory decisions. Committee reports and the Consiliul Legislativ opinion emphasise the need to calibrate penalties in proportion to risk and avoid duplicative liability regimes given existing consumer protection, labour and data protection laws.

Relationship to Other Instruments

The draft explicitly references EU legislative work on AI and related EU instruments. Advisory materials and committee reports repeatedly stress that the proposed national law must be read against the EU AI Act and existing Romanian legal instruments (GDPR, national cybersecurity laws, consumer protection, labour law). The Consiliul Legislativ's opinion highlights that EU-level harmonised regulation substantially constrains national measures where EU competence applies. The bill envisages amendments to or interplay with sectoral laws where AI systems interact with regulated sectors (healthcare, finance, telecommunications) and proposes coordination mechanisms to avoid regulatory overlap. The Senate committee record lists consultations with ANCOM and national cyber bodies to identify these interdependencies.

International Alignment

The exposition of motives and committee materials indicate the sponsors' aim to align Romania with EU-level AI regulatory objectives while also preserving national security and operational needs. The draft references the EU AI initiative and calls for Romania to harmonise domestic approaches with European norms. Advisory opinions caution against premature or unilateral national measures that could diverge from the EU AI Act (already the dominant legal reference for AI in EU member states). The bill's approach to international alignment includes provisions for cross-border enforcement cooperation, data-sharing protocols with EU bodies, and conformity evaluation frameworks that can interoperate with EU conformity assessment processes.

Implementation Timeline

Sources and References