AI Act Implementation

The AI Act entered into force on 1 August 2024, with its obligations applying in phases. In response to implementation challenges, the European Commission introduced targeted amendments through the Digital Omnibus on AI, adopted as Regulation (EU) 2026/1744 and entering into force on 27 July 2026. The amendments postpone certain obligations, primarily those concerning high-risk AI systems, but do not alter the AI Act’s general application date: 2 August 2026 remains the date from which most provisions started to apply.

Obligations already applicable before 2 August 2026

As of 2 February 2025

• providers and deployers must take measures to support the development of AI literacy among relevant staff and other people operating or using AI systems on their behalf
• the prohibitions on certain unacceptable-risk AI practices apply, including specified manipulative or exploitative practices, social scoring, and other prohibited uses listed in Article 5 of the AI Act.

As of 2 August 2025

• obligations for providers of general-purpose AI models apply, including requirements concerning technical documentation, information for downstream providers, policies to comply with Union copyright law and, where applicable, systemic-risk assessment and mitigation.
• the AI governance framework, including the designation of national competent authorities and the operation of the EU governance architecture established under the AI Act. In this context, through a Memorandum of the Romanian Government, ANCOM has been proposed to act as the national market surveillance authority and the national single point of contact, alongside other authorities designated as market surveillance authorities (such as the Financial Supervisory Authority, the National Bank of Romania and ANSPDCP).

Obligations applicable from 2 August 2026

The following transparency obligations apply:

• AI systems that interact directly with individuals must inform them that they are interacting with an AI system, unless this is obvious from the circumstances and context.
• providers of AI systems that generate synthetic audio, image, video or text content must ensure that the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, subject to limited exceptions (such as where the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof).
• deployers of systems that generate or manipulate image, audio or video content constituting a deepfake must disclose that the content has been artificially generated or manipulated.
• deployers that generate or manipulate text published to inform the public about matters of public interest must disclose that the content has been artificially generated or manipulated, subject to the applicable exceptions (e., for criminal investigations or where it undergoes human editorial review and a person/entity is responsible for publication).
• deployers of emotion-recognition or biometric-categorisation systems must inform individuals exposed to those systems, subject to the applicable exceptions and safeguards under the AI Act.

Non-compliance with such transparency obligations may lead to fines up to EUR 15 mil. or, if the offender is an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever is higher (or lower, in the case of SMEs, including start-ups and small mid-caps (SMCs)).

Transitional provisions

• providers of general-purpose AI models placed on the market before 2 August 2025 must take the necessary steps to comply with the AI Act by 2 August 2027.
• providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text content and were placed on the market before 2 August 2026 must take the necessary steps to comply with Article 50(2) (transparency obligations) by 2 December 2026.
• AI systems that are components of the Schengen Information System (SIS), the Visa Information System (VIS) or another large-scale IT system referred to in Annex X and that were placed on the market or put into service before 2 August 2027 must be brought into compliance with the AI Act by 31 December 2030, subject to the conditions in Article 111.

Future application dates

• From 2 December 2027: Certain requirements will apply to high-risk AI systems under Article 6(2) and Annex III. These cover AI used in areas such as critical infrastructure, education, employment, credit assessment, law enforcement, migration, justice and democratic processes. Such requirements are related to risk management, data and data governance, technical documentation and record-keeping, transparency and instructions for use, human oversight, accuracy, robustness and cybersecurity, as well as quality-management, conformity-assessment requirements, and registration.
• From 2 August 2028: The above requirements will apply to high-risk AI systems under Article 6(1) and Annex I. These concern AI systems that are safety components of, or constitute, regulated products such as toys, medical devices, machinery and vehicles.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.