Part of the AI Regulation News hub.
ANCOM states that Romanian authorities cannot verify or sanction AI Act breaches until the national implementing act enters into force
A regulator saying out loud that it cannot yet sanction anyone is unusual and useful. It is also not an invitation to stop preparing, and ANCOM says so in the same release.
Bottom line: A press release, not an instrument. It binds nobody. Its central factual claim is that Romanian authorities cannot verify or sanction breaches until a national law, still in drafting, enters into force.
Who this affects: Romanian technology and regulatory counsel, compliance leads at providers and deployers of AI systems in Romania, and general counsel at financial institutions supervised by ASF or BNR.
Issue date: 24 July 2026. No consultation deadline is given; the national implementing act is described as still in preparation.
What changed: ANCOM confirmed publicly that the designation of authorities has so far been made by Government Memorandum, and that powers of verification and sanction depend on a normative act that does not yet exist.
Analysis: The gap is procedural, not substantive. Regulation (EU) 2024/1689 applies in Romania regardless; what is missing is the national machinery for a Romanian authority to act on it. A firm that reads this as breathing room is misreading which risk it is exposed to, because obligations accrue during the gap and are assessed after it closes.
Primary sources: ANCOM press release, 24 July 2026 · Regulation (EU) 2024/1689 on EUR-Lex
- Instrument (EN)
- Press release: The Artificial Intelligence Regulation in Romania, current state of the implementation framework
- Authority
- ANCOM, Autoritatea Nationala pentru Administrare si Reglementare in Comunicatii
- Jurisdiction
- Romania
- Status
- Published statement of implementation status
- Bindingness
- None. A press release creates no obligation; the binding instrument is Regulation (EU) 2024/1689
- Issue date / next deadline
- 24 July 2026; national implementing act in preparation with no date given
- Designation route so far
- Government Memorandum proposing ANCOM as national market surveillance authority and single point of contact
- Other named authorities
- ASF and BNR for high-risk financial-services systems; ANSPDCP for biometrics in law enforcement, borders, justice and democratic processes, and for migration and asylum; ANPC and the Labour Inspectorate among sectoral bodies
- Primary source
- https://www.ancom.ro/despre-noi/media/comunicate-de-presa/regulamentul-privind-inteligenta-artificiala-in-romania-stadiul-actual-al-cadrului-de-implementare/
The gap ANCOM names
ANCOM's release makes one statement that a practitioner will care about above the rest: ANCOM and the other competent authorities will be able to verify and sanction non-compliance with obligations under the Regulation only after the national normative act currently being drafted enters into force.
That act is described as the vehicle that will establish the market surveillance authorities and their powers, the cooperation mechanisms between them, and the sanctioning procedure and the regime of penalties applicable to breaches.
None of that removes the underlying duties. ANCOM opens by noting that the Regulation is directly applicable in every member state, and that a national law is nevertheless needed for its implementation. Those two facts sitting together is exactly what an enforcement gap is.
Who is proposed for which slice
By Government Memorandum, ANCOM has been proposed for the role of national market surveillance authority and single national point of contact, alongside other bodies designated as market surveillance authorities.
The Financial Supervisory Authority and the National Bank of Romania are named for high-risk AI systems in financial services where placing on the market, putting into service or use is directly connected to the supply of those financial services. The National Supervisory Authority for Personal Data Processing is named for high-risk biometric systems used for law enforcement, border management, justice and democracy, and for high-risk systems in migration, asylum and border control, and in the administration of justice and democratic processes.
ANCOM identifies itself separately as the surveillance authority for electromagnetic compatibility and radio equipment, sitting beside other sector-competent bodies such as the National Consumer Protection Authority and the Labour Inspectorate.
The calendar as ANCOM restates it
ANCOM sets out the staged application under Article 113 of the Regulation, as amended by the digital omnibus regulation on AI which the release describes as published by the European Commission that same day.
On that account, the Regulation becomes applicable from 2 August 2026 with certain exceptions. Obligations for high-risk systems listed in Annex III start from 2 December 2027, and for systems classified as high risk under Article 6(1) and Annex I from 2 August 2028.
Prohibitions on unacceptable-risk systems have been in force since 2 February 2025. The omnibus adds two new prohibited practices applicable from 2 December 2026: AI systems capable of generating or altering realistic images, video or audio showing an identifiable person's intimate parts or an identifiable person engaged in sexually explicit activity, without that person's consent, and AI systems capable of generating or altering material constituting child pornography material or child pornographic performances.
Article 50 and the December tail
Among the obligations ANCOM flags as applying from 2 August 2026 are the Article 50 transparency duties on providers and deployers of certain AI systems, including providers of general-purpose AI systems.
The release groups them: systems that interact directly with natural persons or generate synthetic audio, image, video or text; systems that generate or alter audio, video or image content constituting a deepfake; and systems generating or altering text published to inform the public on matters of public interest.
There is a carve-out worth diarising. For AI systems, including general-purpose systems, that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026, the provider's obligation to mark generated content applies from 2 December 2026.
ANCOM points to two Commission products supporting this: the Code of Practice on transparency of AI-generated content, which it describes as voluntary, and the Guidelines clarifying the scope and application of the transparency obligations.
What a Romanian firm should take from it
ANCOM's own recommendation is the conservative one. It advises every entity that develops, places on the market or uses AI systems to analyse the requirements that fall on it under the Regulation and to continue the work needed to ensure conformity.
The release also describes ANCOM's present activity narrowly: participating in preparing the national framework alongside sectoral authorities, and informing the public. That is a regulator describing itself as not yet operational for AI purposes, which is a different posture from a regulator promising forbearance.
What we did not verify
We opened the ANCOM press release in full, in Romanian, and every designation, date and quotation above comes from it. The page carries 24 July 2026 as its date and we used that rather than any trade-press date.
We did not open the Government Memorandum, the draft national implementing act, Regulation (EU) 2024/1689, the digital omnibus regulation in the Official Journal, the Commission's Code of Practice, or the Commission's transparency guidelines. The release's page metadata shows a later modification date than its publication date, and we did not determine what was changed.
We do not claim that any Romanian designation is final, that the implementing act has a timetable, or that conduct during the gap is beyond later scrutiny. ANCOM says it cannot verify or sanction until the national act is in force; it does not say the Regulation's obligations are suspended, and neither do we.
Romania has designations by memorandum and no enforcement machinery, and its proposed lead authority has said so in writing. The Regulation still applies. Practically, that means an AI provider or deployer in Romania is accruing an evidentiary record now that will be judged under a sanctioning regime written later, so the sensible move is to document conformity work with dates rather than wait for a Romanian authority that cannot yet knock.
Source File
Open the ANCOM press release of 24 July 2026 and confirm the sentence stating that verification and sanction are possible only after the national normative act enters into force, the list of authorities proposed by Government Memorandum, and the dates 2 December 2026, 2 December 2027 and 2 August 2028.
ANCOM or the other competent authorities will be able to verify and sanction non-compliance with the obligations of the Regulation only after the entry into force of the national normative act which is in the process of being drafted. ยท ANCOM press release, 24 July 2026, translated from Romanian
FAQ
Does this mean AI Act obligations do not apply in Romania?
No. ANCOM states the Regulation is directly applicable in all member states. What is missing on its account is the national act establishing which authority verifies compliance and what penalties apply.
Which Romanian body is proposed as single point of contact?
ANCOM, by Government Memorandum, alongside its proposed role as national market surveillance authority. Other authorities are designated for specific slices, including ASF and BNR for financial services and ANSPDCP for biometric and justice-related high-risk systems.
What changes on 2 December 2026 under the release?
Two things. The two new prohibited practices added by the digital omnibus become applicable, and the marking obligation reaches providers of synthetic-content systems that were placed on the market before 2 August 2026.
Is the Code of Practice on AI-generated content transparency mandatory?
ANCOM describes it as a voluntary document offering practical recommendations to interested entities, published by the European Commission alongside guidelines on the scope of the transparency obligations.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.