Blog · What inspires us
The AI Act becomes applicable in Romania: what companies need to know about the new European legislation on Artificial Intelligence
Artificial intelligence has entered companies’ day-to-day work: texts, analyses, customer support. With it came rules. The European AI Regulation (AI Act) applies in stages and concerns not only developers, but also companies that use such tools.
What the AI Act is
The AI Act is Regulation (EU) 2024/1689, the first European legislative framework dedicated exclusively to artificial intelligence. It sets rules for the development and use of AI systems in the European Union and applies both to those who create them and to the companies that use them.
The stated aim: to protect users’ data and rights and to limit the risks created by uncontrolled use of AI.
Is it already in force
Yes. The regulation entered into force on 1 August 2024 and applies in stages. The first provisions (the ban on certain practices and the obligation of AI literacy for staff) apply from 2025, the rules for general-purpose models come later, and for many obligations the key date is August 2026. For some high-risk systems the deadlines are further away.
The practical conclusion is the same: there’s no point in waiting. It’s worth analyzing now how your company uses these tools.
Why it matters for an ordinary company in Romania
You don’t have to develop software to be on the regulation’s radar. If your employees use ChatGPT or other tools for e-mails, marketing copy, contracts, data analysis, translations or customer support, you use AI.
Questions that many companies can’t yet answer:
- what information employees are allowed to enter into these platforms;
- who has access to them and with which accounts;
- how the entered data is protected;
- who is responsible if something goes wrong;
- who checks the generated results.
The real risks of using AI in a company
The most common risk is mundane: copy-paste. An employee pastes a client’s data into an AI assistant, a manager asks for an analysis of an internal strategy, and the marketing department uploads a database to generate content. The data may be processed externally, and the company loses control over sensitive information.
When personal data is involved, GDPR issues arise too. That’s why the two regulations will work together: using AI must be treated like any other process involving sensitive data (customer names and addresses, financial information, medical data, databases).
High-risk systems
The AI Act divides systems by risk level, and the strictest rules target “high-risk” systems. Examples: recruitment and employee evaluation, financial scoring, critical infrastructure, medical systems and solutions in education. They require additional control, documentation and transparency.
Common-sense measures you can take
- an internal policy on the use of AI;
- employee training (this is actually an obligation under the regulation);
- limiting the data that can be entered into AI platforms;
- human review of automatically generated information;
- monitoring the tools in use.
The underlying idea: the company must be able to show that it uses AI in a controlled way.
What fines may apply
The regulation provides penalties that, for the most serious violations (prohibited practices), can reach 35 million euros or 7% of global annual turnover, whichever is higher. For other violations the thresholds are lower. Besides fines, investigations, GDPR problems, loss of customer trust and damage to your image also matter.
The first five steps
- Identify all AI platforms used in the company, including those employees use on their own initiative.
- Set clear rules for employees.
- Forbid entering sensitive data into unapproved AI tools.
- Create an internal AI usage policy.
- Consult a legal or data protection specialist.
AI as an advantage, not a danger
The AI Act doesn’t stop the development of AI. It asks for responsible and safe use. Companies that take the subject seriously gain productivity, automation, lower costs and faster marketing, without taking unnecessary risks. The key questions are simple: are we using AI correctly? Do we have rules? Are we protecting our data? Can we prove compliance?
If you also use AI in your marketing communication, see how we help with SEO and AI Visibility.
Frequently asked questions
Does the AI Act apply to a small company too?
Yes, insofar as it uses AI systems. The obligations differ depending on the company’s role (developer or user) and the system’s risk level.
Is using ChatGPT in a company forbidden?
No. It’s allowed, but it requires internal rules, employee training and care with the data entered, especially if it’s personal data.
Where do I start, concretely?
With an inventory of the AI tools used in the company and a short internal policy that all employees know.
Tell us about your project and we’ll come back with a proposal.
Let’s talkMore to read
Also read
SEO, AI Visibility and Digital Marketing for Businesses That Want to Grow
Why local businesses need to be visible in Google and in AI answers, and how local SEO, AI Visibility and conversion-oriented marketing fit together.
Read the article
SEO for ChatGPT: How to Optimize Your Content for Artificial Intelligence
How to write and structure content so it is understood and cited by ChatGPT and other AI models, complementing classic SEO.
Read the article
How to Build a Memorable Brand Identity in 2025
The five steps to build a coherent brand identity and the mistakes that weaken it.
Read the articleHave a project in mind?
Tell us about your business and we’ll see what we can do together.
Contact