Romania - Cooperation on AI and Cloud

Overview

The Memorandum of Understanding (MoU) signed on 15 July 2024 between the Government of Romania and Google creates a formal cooperation framework for: (a) modernising public-sector IT and adopting cloud-first architectures; (b) strengthening national cybersecurity posture and incident response capabilities; (c) piloting and responsibly deploying advanced technologies, including artificial intelligence (AI); and (d) supporting research, innovation and workforce development. The signing ceremony took place at Palatul Victoria and was publicly reported by the Government and national media; statements by the Prime Minister and the Minister for Research stressed an ambition to operationalise a government cloud and accelerate digital public services. Key public reporting may be consulted via official government communications and reputable press coverage such as Digi24 (15 July 2024) and the ministry/legal press reporting JURIDICE (15 July 2024).

Definitions

For the purpose of interpreting the MoU the following working definitions are used: "Government Cloud"—a technical and organisational programme to migrate public administration IT services to accredited cloud environments; "Advanced Technologies"—machine learning, AI systems, cloud-native services, data platforms and related automation; "Cyber Resilience"—the ability of public institutions to prevent, detect and respond to cyber incidents; "Joint Working Group"—the technical/strategic body established under the MoU to coordinate pilots and exchanges; and "Pilot Project"—any limited-scope technical implementation co-designed under the MoU. These definitions are used in public descriptions and are to be refined in implementation documents and project-level agreements.

Governance and Institutional Framework

The MoU establishes a bilateral governance architecture that typically includes: (1) a high-level strategic steering committee (senior officials from the Government and Google) to align objectives and review progress; (2) a joint working group of technical experts (cloud engineers, cybersecurity specialists, data protection officers and policy leads) to design pilots and co-develop operational roadmaps; and (3) designated contact points within the Ministry of Research, Innovation and Digitalization and relevant agencies. Government reporting indicated the involvement of the Prime Minister’s Office and the Ministry of Research, Innovation and Digitalization (MCID); national cybersecurity and data protection authorities will be consulted at project stage to ensure legal compliance. For background and official statements see the Government’s communications and media reporting such as Europa FM (15 July 2024). Implementation documents will specify membership, decision-making rules, and escalation mechanisms.

Key Focus Areas

The MoU identifies a set of priority focus areas: (a) Digital Infrastructure & Cloud — assess and accelerate the migration of public services to secure cloud platforms, explore a Google Cloud region or data centre investment and advise on network, power and resiliency requirements; (b) Cybersecurity & Resilience — share best practices, training and joint exercises to strengthen detection, response and supply-chain security; (c) AI & Advanced Technologies — pilot AI-enabled tools to improve administrative efficiency and citizen experience while adopting responsible AI principles; (d) Research & Innovation — support R&D collaborations with universities and local industry to scale innovation; (e) Skills & Capacity Building — deliver training for civil servants and technical teams; and (f) Policy & Standards Advice — exchange on regulatory approaches, alignment with EU digital objectives, and public procurement processes. Press coverage and official statements emphasised cloud operationalisation and tax system modernization; see reporting at Romania Insider (15 July 2024) and Business24 (15 July 2024). These focus areas will be elaborated in project-level scopes and feasibility studies.

Implementation Framework

Implementation follows a staged, non-binding approach: stage 0 — joint assessment and scoping (technical, legal, procurement and impact assessments); stage 1 — pilot design and proof-of-concept (small, time-limited projects that validate technical assumptions and governance); stage 2 — scaling subject to procurement, regulatory approval and risk assessment; stage 3 — long-term operational arrangements and investment decisions (including any data centre or cloud-region investment, which remain subject to due diligence and financing decisions). The parties committed to form a Joint Working Group and to prepare implementation roadmaps, data protection impact assessments (DPIAs) where necessary, and memoranda for each pilot specifying data flows, security controls and compliance obligations. The MoU explicitly leaves procurement, legal compliance and regulatory approvals outside its direct effect, requiring formal competitive processes when applicable.

Monitoring and Evaluation

Monitoring is structured around periodic reporting to the steering committee and technical dashboards maintained by the Joint Working Group. Metrics will track: project milestones, cloud migration readiness, training outputs, cybersecurity exercise outcomes, and evaluation of AI pilots using predefined safety and performance metrics. Independent or third-party technical reviews and DPIAs are foreseen for projects that process personal data or are security-sensitive. The MoU’s monitoring approach emphasises transparency of progress to government stakeholders and the need for alignment with national digital strategies and EU targets such as the Digital Decade.

Penalties, Liability, and Appeals

As an MoU the document does not establish administrative sanctions or statutory penalties; it is a cooperative, non-binding instrument. The MoU signals that any liability and appeals arrangements for concrete projects will be addressed in subsequent contractual agreements and procurement documents, which will set indemnities, warranties, limitation of liability, service-level obligations and dispute-resolution clauses. Where projects involve personal data, parties committed to respect applicable laws (e.g., GDPR) and to coordinate with the supervisory authority (ANSPDCP). For legal analysis and commentary see coverage at JURIDICE (15 July 2024).

Relationship to Other Instruments

The MoU complements existing national digital strategies, the government’s cloud programme and sectoral legislation. It is explicitly subordinate to: (a) national procurement and competition law; (b) EU law including GDPR and the proposed EU AI Act (to the extent applicable to future AI pilots); and (c) sectoral regulatory requirements for critical infrastructure (energy, health, finance). The MoU may be referenced in subsequent public procurement documentation and memoranda of understanding with other suppliers, but it neither replaces nor supersedes legal or regulatory requirements. Media reports suggest further MoUs or project agreements may follow if pilots are successful; see reporting in Curs de guvernare (15 July 2024).

International Alignment

The MoU frames the collaboration within broader European objectives including the Digital Decade 2030 goals and the EU’s regulatory trajectory for AI and data governance. Google stated alignment with EU targets and interoperability standards, and both parties committed to coordinate with EU institutions and to align pilots with applicable European standards and security expectations. Any investment in cloud regions or data centres would be subject to cross-border data transfer rules and EU state-aid and procurement scrutiny where relevant. See public statements by government and Google and coverage at Romania Insider and Business24.

Implementation Timeline

Sources and References