Romania AI Regulation Overview

Overview

Romania's approach to artificial intelligence regulation is characterized by a strong reliance on European Union harmonisation, non-binding national policy frameworks, and inter-agency coordination mechanisms rather than a standalone, prescriptive national statutory regime. The foundation of national policy is set out in programmatic documents, primarily the Cadru Strategic Național în domeniul Inteligenței Artificiale (CSN-IA), developed under the SIPOCA 704 project by the Authority for Digitalisation of Romania (ADR) in collaboration with the Technical University of Cluj-Napoca (UTCN) for the 2023–2027 horizon. This framework establishes strategic priorities around skills, research and development, public administration adoption, data governance, and regulatory capacity.

At the institutional level, governance is structured around consultative platforms and inter-ministerial committees. Key governance mechanisms include the Romanian Committee for Artificial Intelligence (Comitetul Român pentru Inteligență Artificială — CRIA), established in November 2022 under the patronage of the Prime Minister and operationalized by Ministerial Ordinance OMCID nr. 20.484/2023 with technical secretariat support from the Ministry of Research, Innovation and Digitalization (MCID). To prepare for EU-level instruments, the Government established an inter-institutional Coordination Committee in April 2024 to align interpretation and market surveillance across existing sectoral regulators.

Attempts to introduce broad, prescriptive primary statutes at the national level have faced procedural and substantive obstacles. A comprehensive parliamentary initiative, Draft Law B154/2024 (Senate file L255/2024; Chamber PLX336/2024), sought to establish national risk classifications, documentation duties, and fundamental rights safeguards. However, official advisory bodies including the Consiliul Economic și Social and Consiliul Legislativ issued negative opinions, cautioning against prematurely creating national rules that overlap with or diverge from the directly applicable EU Artificial Intelligence Regulation (EU AI Act). The bill was rejected by the Senate plenary in May 2024 and received subsequent negative reports in the Chamber of Deputies into 2025.

Regulatory Approach

Romania maintains a soft-law, governance-led, and internationally aligned regulatory posture for AI. The country has declined to implement a divergent binding domestic legal code for AI systems, positioning the directly applicable EU AI Act as the primary source of binding legal obligations. National efforts focus on creating institutional governance structures capable of facilitating technical advice, inter-agency cooperation, public-private partnerships, and future market surveillance.

To prevent administrative fragmentation, the Government Memorandum of 23 April 2024 institutionalized a national Coordination Committee for Data, Digital Services and Artificial Intelligence. Rather than creating a new standalone enforcement agency, this framework brings together sectoral regulators—including communications, cybersecurity, data protection, consumer protection, competition, and audiovisual authorities—to establish harmonized interpretations of EU digital regulations, coordinate market interventions where mandates overlap, and formulate unified national positions for EU working groups.

Targeted legislative initiatives focus on discrete societal concerns rather than horizontal system oversight. The most prominent example is the legislative proposal on deepfakes (PL-x No. 471/2023 / Senate L295/2023), which introduces mandatory labeling and transparency obligations for synthetic content disseminated in audiovisual and online media, assigning supervisory and enforcement authority to the existing audiovisual regulator, Consiliul Național al Audiovizualului (CNA).

Key AI Legislation

• Cadru Strategic Național în domeniul Inteligenței Artificiale (CSN-IA) (2023): Programmatic strategy document setting national policy priorities for 2023–2027 across six core objectives: education/skills, infrastructure/datasets, RDI, tech transfer, public sector adoption, and regulatory governance.
• Government Memorandum (11 November 2022) & OMCID nr. 20.484/2023: Policy instrument and implementing ministerial ordinance establishing the Romanian Committee for Artificial Intelligence (CRIA) under the patronage of the Prime Minister, establishing a Scientific and Ethics Council and an Education Council.
• Government Memorandum (23 April 2024): Establishes the inter-institutional Coordination Committee for Data, Digital Services, and Artificial Intelligence to harmonize administrative implementation and market surveillance under the EU AI Act, Data Governance Act, and Digital Services Act across key national regulators.
• Memorandum of Understanding with Google (15 July 2024): Non-binding policy agreement between the Government of Romania (represented by MCID) and Google to collaborate on public administration IT modernization, government cloud adoption, cybersecurity resilience, and public sector AI pilots.
• Draft Law B154/2024 (Senate L255/2024 / Chamber PLX336/2024) [Rejected / Under Review]: Broad parliamentary proposal that sought to establish domestic risk classification, technical documentation, and fundamental rights rules; rejected by the Senate plenary in May 2024 following negative advisory opinions regarding EU overlap.
• Law on the responsible use of technology in the context of the deepfake phenomenon (PL-x No. 471/2023 / Senate L295/2023) [Under Review]: Legislative proposal targeting synthetic audio, visual, and video content, establishing mandatory visual/audible disclosures, platform cooperation duties, and CNA enforcement.

Governance & Enforcement Bodies

Primary policy leadership and administrative coordination for artificial intelligence are vested in the Ministry of Research, Innovation and Digitalization (MCID) and the Authority for Digitalisation of Romania (ADR). MCID provides technical secretariat support, operational funding, and organizational structure for the Romanian Committee for Artificial Intelligence (CRIA). ADR acts as the main coordinating authority for executing the Cadru Strategic Național (CSN-IA) and advancing digital transformation across public administration.

Inter-agency administrative convergence is facilitated by the Coordination Committee created under the April 2024 Government Memorandum. This committee convenes key independent and executive supervisory bodies, including the National Authority for Management and Regulation in Communications (ANCOM), the National Supervisory Authority for Personal Data Processing (ANSPDCP), the National Cybersecurity Directorate (DNSC / DNS), the National Audiovisual Council (CNA), the National Authority for Consumer Protection (ANPC), the Competition Council, and the National Institute of Statistics (INS).

Expert advisory functions are structured through specialized substructures within CRIA, including a Scientific and Ethics Council tasked with providing normative guidance on responsible AI and safety, and an Education Council focused on continuous workforce development and academic curricula. Parliamentary oversight and debate involve specialized legislative committees, including the Senate Commission for Communications, IT, and Artificial Intelligence.

Penalties & Enforcement

The corpus holds no record of an enacted standalone national AI law containing general statutory penalty provisions or fine bands. Because broad legislative proposals like Draft Law B154/2024 were rejected by the Senate plenary, substantive administrative enforcement, market surveillance, and legal penalties remain anchored in sector-specific existing laws or will be established pursuant to future national implementing measures under the EU AI Act.

Specific administrative sanctions are contemplated in specialized draft legislation currently under parliamentary review. Under the proposed deepfake law (PL-x No. 471/2023), the Consiliul Național al Audiovizualului (CNA) is granted operational powers to order the immediate removal or broadcast suspension of non-compliant synthetic content and to issue administrative fines for labeling failures. Contested amendments considered during Chamber committee review also proposed penal sanctions and custodial sentences for malicious creation or repeated dissemination of deepfakes, though these provisions remain subject to ongoing legislative debate.

Data Protection Framework

Artificial intelligence systems operating in Romania are bound by the European General Data Protection Regulation (GDPR), enforced nationally by the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP). ANSPDCP participates as a core member of the national Coordination Committee established under the April 2024 Government Memorandum to ensure data protection compliance across AI and digital service interventions.

National strategic and legislative materials explicitly incorporate data privacy considerations. The CSN-IA strategic framework and the proposed Draft Law B154/2024 prioritize Data Protection Impact Assessments (DPIAs), special processing safeguards for biometric and sensitive personal data, and strict adherence to data governance principles. The non-binding MoU with Google similarly mandates DPIAs and privacy compliance prior to launching public sector AI pilots. The corpus holds no record of national AI data localization mandates outside standard EU data transfer rules.

Sector-Specific Rules

The corpus holds no record of enacted sector-specific statutes dedicated exclusively to AI applications in healthcare, financial services, employment, or autonomous driving. Sectoral adoption is primarily guided by programmatic policy under the CSN-IA, which identifies healthcare, transport, education, justice, public administration, and agriculture as priority fields for pilot projects and future operational roadmaps.

Sector-specific intervention is currently focused on the media and communications domain. The proposed deepfake bill (PL-x No. 471/2023) establishes clear obligations tailored to broadcasters and digital content distributors, requiring visual overlays covering a specified minimum share of screen area and mandatory audible notifications at the beginning and end of manipulated audio/video streams under CNA oversight. Additionally, strategic MoUs prioritize tax system modernization and public administration IT infrastructure via government cloud migration.

International Alignment

Romania aligns its national policy directly with the regulatory framework of the European Union. Official advisory bodies, including the Consiliul Legislativ and Consiliul Economic și Social, have consistently advised against creating conflicting or premature domestic statutes, recommending that national enforcement mechanics be designed strictly to implement directly applicable EU instruments such as the EU AI Act, the Data Governance Act, and the Digital Services Act.

In addition to EU alignment, Romania engages in international defense and technology policy frameworks. High-level policy documents emphasize cooperation with NATO initiatives (such as DIANA), alignment with Europe's Digital Decade 2030 targets, and technology partnerships with global market entities, illustrated by the July 2024 MoU between the Romanian Government and Google regarding secure cloud architectures and cybersecurity resilience.

Future Developments

Following the formal adoption of the EU AI Regulation, Romania is expected to enact national secondary administrative rules, ministerial orders, or statutory measures to formally designate national competent authorities, market surveillance frameworks, and penalty regimes aligned with the EU Act's phased implementation schedule.

In Parliament, the deepfake initiative (PL-x No. 471/2023) remains under review in the Chamber of Deputies, where committees continue to consider civil society feedback regarding criminal penalties, freedom of expression, and exemptions for artistic parody and research. Meanwhile, broad standalone proposals such as PLX336/2024 (B154/2024) continue to receive formal committee rejection reports, reflecting a sustained preference for unified EU-level statutory harmonization.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Comitetul Român pentru Inteligență Artificială (CRIA)	Consultative national body under the patronage of the Prime Minister for AI strategy, research, ethics, and education.	Proposes regulation, formulates national strategic recommendations, establishes advisory councils, and coordinates working groups.
Ministerul Cercetării, Inovării și Digitalizării (MCID)	State authority for research, innovation, and digitalization; technical secretariat for CRIA.	Manages RDI budgets, issues operational ordinances, enters strategic technology MoUs, and oversees national AI policy.	https://www.research.gov.ro/
Autoritatea pentru Digitalizarea României (ADR)	National agency for digital transformation and lead authority for the CSN-IA strategic framework.	Coordinates national AI strategic implementation, public sector digitalization initiatives, and inter-institutional strategy execution.
Consiliul Național al Audiovizualului (CNA)	Audiovisual sector regulatory authority; designated supervisor under proposed deepfake legislation.	Investigates complaints, issues content removal and broadcast suspension orders, and imposes administrative fines under proposed deepfake law.
Coordination Committee for Data, Digital Services and AI	Inter-agency coordination body for harmonized execution of EU digital and AI regulations.	Facilitates administrative convergence, coordinates market surveillance across member authorities, and drafts common guidance.
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)	National supervisory authority for personal data protection.	Enforces GDPR compliance, monitors data processing in AI systems, and participates in the inter-agency Coordination Committee.
Directoratul Național de Securitate Cibernetică (DNSC)	National cyber security authority.	Oversees cyber resilience, responds to infrastructure cyber incidents, and collaborates on AI system security oversight.
Autoritatea Națională pentru Administrare și Reglementare în Comunicații (ANCOM)	National communications management and regulation authority.	Regulates electronic communications and participates in inter-agency market surveillance coordination for digital platforms.