A company whose staff use ChatGPT, Microsoft Copilot or any other AI tool at work is within the scope of Regulation (EU) 2024/1689, the AI Act, whatever its size. The Regulation is not aimed only at technology companies; it applies to any organisation that uses AI in its activity. This article covers who has which obligations, the dates as amended in July 2026, the fines, and where enforcement stands in Romania.
What the AI Act is
The AI Act is the first comprehensive legal framework for artificial intelligence. It entered into force on 1 August 2024and applies directly in every Member State, Romania included, without national transposition. Its approach is that of product safety law: the closer an AI system comes to decisions that affect people's rights, health or safety, the stricter the rules.
In July 2026 the Regulation was amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, published on 24 July and in force since 27 July 2026. It postponed the high-risk deadlines, reworded the AI literacy obligation and added new prohibitions.
Provider or deployer
Obligations depend on the role. The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. The deployer uses an AI system under its authority in a professional activity. Importers and distributors have roles of their own.
A company that gives its staff ChatGPT or Copilot is a deployer. A company that builds a chatbot on top of a language model and offers it on its website under its own name is, for that chatbot, a provider. And a deployer becomes a provider of a high-risk system if it puts its own name on it, modifies it substantially, or uses it for a purpose that makes it high-risk (Article 25).
The Regulation applies to typical uses such as these:
- Staff use ChatGPT, Copilot, Gemini or other AI tools
- The company runs a chatbot on its website or in its app
- Recruitment, credit scoring or performance assessment tools with AI components
- Text, images or video generated with AI tools and published
- Systems that take or influence decisions about customers or employees
The risk categories
The Regulation is usually described in four tiers:
Practices banned in the EU (Article 5): social scoring, manipulation that causes significant harm, predicting criminal offences from profiling alone, emotion recognition at work and in education, untargeted scraping of facial images, and, from 2 December 2026, generating non-consensual intimate depictions of identifiable people.
Systems in regulated products (Annex I) and systems used in the areas listed in Annex III — biometrics, critical infrastructure, education, employment, access to essential services such as credit, and others. Providers need risk management, documentation, conformity assessment and registration; deployers have duties of their own.
Chatbots must tell people they are dealing with AI; generated content must be marked; deepfakes and certain AI-generated texts must be disclosed (Article 50).
Most everyday business uses. No specific obligations beyond AI literacy; voluntary codes of conduct are encouraged.
What a deployer has to do
- AI literacy (Article 4)
Take measures to support the AI literacy of the staff and others who operate or use AI systems on the company’s behalf. Since 27 July 2026 the text no longer demands a guaranteed level for each person, but the obligation to act remains. Training and written rules of use, with records of both, are the usual measures.
- Stay clear of prohibited practices (Article 5)
Applies to deployers as well as providers. Emotion recognition of employees is the case most likely to arise in an ordinary company.
- Transparency where it applies (Article 50)
Disclose deepfakes the company publishes, and AI-generated text published to inform the public on matters of public interest unless it has been through human editorial review. Inform people exposed to emotion recognition or biometric categorisation.
- High-risk duties, if such a system is used (Article 26)
Use it in line with the instructions, assign human oversight to competent people, monitor it, keep the logs, and — for employers — inform workers’ representatives and the affected workers before putting it into service. Applies from 2 December 2027 for Annex III systems.
Where an AI tool processes personal data of customers or employees, the GDPR applies at the same time. The two sets of obligations overlap rather than replace one another.
The dates
Fines, and who imposes them in Romania
The ceilings in Article 99 are higher than under the GDPR: up to 35 million EUR or 7% of worldwide annual turnover for prohibited practices; up to 15 million EUR or 3% for breaches of most other obligations; up to 7.5 million EUR or 1% for supplying incorrect information to authorities. For SMEs the lower of the two amounts applies, and since July 2026 the same rule covers small mid-caps for fines other than those for prohibited practices.
In Romania, a government memorandum of 12 March 2026 designated ANCOM as market surveillance authority and single point of contact, with ANSPDCP for biometric systems and ASF and the National Bank of Romania for financial services. A memorandum does not confer powers of inspection and sanction; those require a national law, which had not been adopted according to the most recent public information. The obligations apply regardless. Only the national enforcement mechanism is pending.
Where to start
- 1Make an inventory of AI systems
Every AI tool in use, including those staff adopted on their own: assistants, recruitment tools, chatbots, content generators, AI features inside existing software.
- 2Establish the role and the risk category
For each system: is the company provider or deployer, and does the use fall under Article 5, Annex III or Article 50? Most uses in small companies are minimal risk or carry transparency obligations only. A free classifier is available in Romanian on this site.
- 3Put literacy measures in writing
An AI use policy that says which tools are allowed, for what and with what data, and training that follows it. These are the measures Article 4 expects, and the evidence a supervisory authority will ask for.
If any system may be high-risk — recruitment, credit scoring, performance assessment — see high-risk AI systems. The classifier: AI risk classifier (in Romanian).
Frequently asked questions
Does the AI Act apply to a company that only uses ChatGPT or Copilot?
Yes. A company that uses an AI system in its professional activity is a deployer under the Regulation, whatever its size. Only purely personal, non-professional use is excluded. Most of the heavy obligations fall on providers, but deployers have their own, starting with AI literacy and, where relevant, transparency.
Which dates apply after the Digital Omnibus?
Prohibited practices and AI literacy since 2 February 2025; general-purpose AI models since 2 August 2025; most remaining rules, including the Article 50 transparency obligations, since 2 August 2026. Regulation (EU) 2026/1744, in force since 27 July 2026, moved high-risk systems under Annex III to 2 December 2027 and those under Annex I to 2 August 2028.
What does Article 4 require now?
Since 27 July 2026, providers and deployers must take measures to support the AI literacy of the staff and other people who operate or use AI systems on their behalf. The amended text states that this does not require them to guarantee any specific level of literacy for any individual. Training, written rules of use and records of both are the usual measures.
How large are AI Act fines?
Up to 35 million EUR or 7% of worldwide annual turnover for prohibited practices; up to 15 million EUR or 3% for breaches of most other obligations, including those on high-risk systems and transparency; up to 7.5 million EUR or 1% for supplying incorrect information to authorities. For SMEs the lower of the two amounts applies; since July 2026 the same rule covers small mid-caps for fines other than those for prohibited practices.
Who enforces the AI Act in Romania?
ANCOM was designated as market surveillance authority and single point of contact by a government memorandum of 12 March 2026, with ANSPDCP for biometric systems and ASF and the National Bank of Romania for financial services. Powers of inspection and sanction require a national law, which had not been adopted according to the most recent public information. General-purpose AI models are supervised by the European Commission.