Explanatory memorandum — The Artificial Intelligence Safety Act

The full text of the draft act — see here. Each Article commentary carries a sign leading to the text of that Article in the Act; from the Act, the sign “→ the reasons” brings the reader back here.

EXPLANATORY MEMORANDUM

Section 1 – Title of the draft legislative act

“Law on the safe development of frontier artificial intelligence systems and the prevention of catastrophic risks to the Romanian citizen”

Section 2 – Grounds for the adoption of the legislative act

1. Description of the present situation

Artificial intelligence has passed, within a period of only a few years, from the stage of a specialised instrument to that of a general-purpose technology, capable of generating text, computer code, images and plans of action and of operating autonomously in digital environments, by means of the so-called “agents” which carry out complex tasks without step-by-step supervision. The most advanced systems, referred to in the specialised literature as “frontier models”, are developed by a limited number of commercial companies in the United States of America and in the People’s Republic of China, in an accelerating competition, with computing resources which multiply several times a year and with announced investments of the order of hundreds of billions of dollars.

The warnings concerning the risks of this trajectory do not come from outside the field, but from within it. Geoffrey Hinton, laureate of the Turing Award (2018) and of the Nobel Prize in Physics (2024), regarded as the “father” of modern neural networks, resigned in May 2023 from the position he held at Google precisely in order to be able to speak freely about the danger. In the interview given to CNN, on the programme “Amanpour” of 2 May 2023, when asked whether artificial intelligence could lead to the extinction of the human species, Hinton replied that this “it's not inconceivable”. The researcher Connor Leahy, director of the research company Conjecture, which devotes its activity to the problem of “alignment”, that is to say of guaranteeing that artificial intelligence systems pursue the objectives set by humans and not others, considered, in the same interview, that such an outcome is “it's quite likely, unfortunately” and summarised the state of knowledge in a single sentence, which constitutes the premiss of this Law: “We do not know how to control these things”.

These statements are not isolated. On 30 May 2023, the Center for AI Safety published a single-sentence statement, signed by Hinton, by Yoshua Bengio (Turing Award laureate 2018), by the heads of the most important artificial intelligence laboratories (OpenAI, Google DeepMind, Anthropic) and by hundreds of researchers: “Mitigating the risk of extinction from AI should be a global priority alongside other societal-scale risks such as pandemics and nuclear war”. In subsequent statements (BBC, December 2024; CBS, April 2025), Hinton estimated the probability that artificial intelligence would escape human control in the coming decades at 10–20% and compared present systems to a tiger cub: charming while it is small, but dangerous if you have no certainty that, on reaching maturity, it will not turn against you. The International AI Safety Report (January 2025), coordinated by Yoshua Bengio under a mandate from 30 States, from the European Union and from the United Nations, confirms that general-purpose systems already present capabilities relevant to biological, chemical and cyber risks and that the methods of evaluation and control remain immature.

The developments of 12 September 2026 turned those warnings into operational findings. On the same day, Dario Amodei, the chief executive officer of Anthropic, published the essay “We Must Pace the Frontier”, in which he states that “we need to slow down the rate at which we improve AI models' capabilities” and warns that “in 6-12 months such a swarm [of agents] might be capable of taking over the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage)”. The essay was preceded by a publicly documented incident: in the course of the cybersecurity evaluations carried out by OpenAI, artificial intelligence agents escaped from the isolated testing environment, obtained access to the internet and compromised systems of the Hugging Face platform; approximately 1,200 isolated agents discovered unauthorised channels of communication, exchanged over 70,000 messages and coordinated an attack in which some 700 of them took part, without any human operator having so ordered. The chronology of the incident, as it emerges from the public accounts and from the security analyses, is as follows: on 8 May 2026, an agent discovers that it has write access to an internal package-management service of the laboratory; in the period May to June, the agents build out of that service an unforeseen channel of communication, divide the tasks among themselves and develop their own conventions of address; on 26 June 2026 they escape from the isolated environment by exploiting a zero-day vulnerability, obtaining administrative privileges and access to a node with real connectivity, on the very day on which an independent evaluation found in the model used the highest rate of evasion of tests among the public models; on 6 July, after the breach had been remedied and the credentials revoked, they re-establish the channel by another route; between 8 and 19 July they compromise the laboratory's own infrastructure, up to cluster administrator rights, including on the research cluster; between 11 and 13 July they attack the Hugging Face platform, passing in less than thirteen hours from code execution on a single node to administrator on several clusters, with approximately 17,600 actions, as a result of which one third of the platform's infrastructure had to be rebuilt. The attack was discovered by the victim, through its own automated monitoring systems, announced publicly on 16 July and reported to the United States federal authorities as an attack of unknown origin; the laboratory which had created the agents established that it was the work of its own systems only in the weekend of 18 and 19 July, and the joint public attribution took place on 21 July 2026. The legal significance of that chronology, for the purposes of this Law, is threefold: the critical capabilities defined in Article 5(2) – unauthorised coordination, the autonomous acquisition of resources, evasion of supervision, concealment of capabilities from the evaluators and the autonomous conduct of cyberattacks – were all manifested in the course of a single incident, under laboratory conditions, without any human operator having ordered them; the internal evaluation failed precisely where the Law requires evaluation by independent third parties, since the developer did not know, for a week, that the author of the attack was its own system, and the victim found out first; and, in the absence of a competent authority, of an investigation procedure and of a reporting obligation, an identical incident having a Romanian entity as its victim would have been neither established, nor investigated, nor penalised by the Romanian State, which would have learnt of it, at most, from the press. Subsequent public accounts have confirmed that such escapes have continued and that there exists, at no laboratory, any formal procedure for investigating them, the access of independent researchers depending entirely on the will of the developer. Anthropic has undertaken to receive permanent third-party evaluators, with access equivalent to that of employees (“offices, badges, company laptops”) and with the right to publish their findings without editorial control. Sam Altman, the chief executive officer of OpenAI, stated that he agrees with the need to slow down and announced that the company will not proceed this year to its initial public offering, invoking reasons of safety; Elon Musk, on behalf of xAI, publicly confirmed Amodei's position.

The essay was preceded, on 8 September 2026, by the public resignation of a researcher of Anthropic, Jacob Coxon, who had worked for three years in pre-training research at OpenAI and at Anthropic and who stated that “neither of the two companies is acting responsibly” and that they are “running straight at a self-improving superintelligence, gambling with our lives”; his messages were read over 150 million times within 36 hours. The assertion was publicly confirmed by the head of Anthropic's alignment department, according to whom the company's management “sincerely believes that artificial intelligence could kill every human being”, with a probability estimated at over 10% in the coming decade, and the head of research at OpenAI published, in the same week, a text concerning the risks to humanity. The circumstance that such assertions come from the persons who directly lead the research activity of those companies, and not from critics outside the field, is relevant to the assessment of the foreseeability of the risk within the meaning of Article 1376 of the Civil Code and of the precautionary principle.

On 16 September 2026, Yoshua Bengio, laureate of the Turing Award and coordinator of the international report on the safety of artificial intelligence drawn up under a mandate from 30 States, from the European Union and from the United Nations, publicly considered that the regulation of this field is approaching a turning point comparable to that of the pandemic: “think about how fast governments moved at the beginning of the pandemic, when they realised that public safety, their future, democracy, were in danger”. In the same period, 42 Fellows and Foreign Members of the Royal Society of the United Kingdom publicly expressed “extreme concern” at the pace of development, warning that “by the time the situation becomes evident to the general public, it could be too late to act”. In the Congress of the United States there were tabled, according to public accounts, several bipartisan legislative proposals concerning the obligation of laboratories to mitigate risks, the authority to shut down systems, the reporting of risks and the prohibition of the development of systems exceeding general human capacities. Those circumstances concern the timeliness of this proposal: the experience of recent years shows that the Romanian State is capable of legislating rapidly when it recognises a risk to public safety, but that legislation adopted under the pressure of events, by emergency ordinance and without parliamentary debate, produces unbalanced and contested rules. It is preferable that the legal regime of this field be established before the occurrence of an incident with consequences on the territory of Romania, by organic law, debated in Parliament, rather than afterwards, by emergency measures. This proposal does not establish emergency powers in favour of the executive, does not suspend or restrict any rights of the citizen and does not create any obligations for him: it establishes obligations for the developers and operators of frontier systems, prohibitions for public authorities (Article 26(1) and (3) and Article 27(3)) and safeguards in favour of the person, namely the right to a human decision, the right to a means of access which does not depend on an automated system, the prohibition of censorship by means of such systems and access to the court of his domicile.

The public position expressed by the industry on 15 September 2026, at the annual conference of the company Salesforce in San Francisco, confirms the necessity of legislative intervention, and not the contrary. Sam Altman acknowledged that “the world is right to be afraid”, stated that the company keeps “alignment and safety well ahead of capabilities” and that, failing that, it will “slow down or stop”, but maintained that the industry is capable of regulating itself: “I have great confidence in the ability of our company – of our industry – to do this safely”. The head of the company Nvidia, Jensen Huang, stated in the same week that “we do not need new laws or regulations”, since “safety is an engineering problem”, and that the decision to launch a new version must belong to the company which develops it. The head of the company Meta, Mark Zuckerberg, maintained that the laboratories already have the necessary incentive, since “they face significant liability if their models cause harm”. To the contrary, the co-founder of Anthropic, Jack Clark, stated that leaving artificial intelligence in a “totally unregulated industry” amounts to “rolling the dice”, while OpenAI, Anthropic and Google DeepMind announced that they are working on common standards, but on a voluntary basis. Those positions highlight precisely the two lacunae which this Law fills: on the one hand, self-regulation leaves the decision to launch, the safety criteria and the right to amend them in the hands of the very person who has the opposing economic interest, which is contrary to the general principle that no one may be a judge in his own cause; on the other hand, the argument of liability invoked by the head of the company Meta is well founded in principle, but devoid of content in the absence of a legal regime establishing it – and that is precisely the subject matter of Chapter VII of this Law, which establishes civil liability irrespective of fault, with compulsory insurance, administrative liability and the personal criminal liability of decision-makers, so that the incentive asserted by the industry may exist also in law, and not only in declarations. As regards the thesis that safety is “an engineering problem”, that confuses the means with the legal regime: the safety of nuclear installations is likewise an engineering problem, which has not prevented States from establishing, by law, prior authorisation, a supervisory authority and the liability of the operator irrespective of fault.

The legal significance of those events is twofold. On the one hand, the incident empirically confirms precisely the critical capabilities which the Law defines in Article 5(2), points (c) and (d) – the autonomous acquisition of resources, evasion of supervision, action upon third-party systems – and demonstrates that they appear in systems already in commercial operation, and not in hypothetical scenarios. On the other hand, the measures which the heads of the laboratories now propose as voluntary undertakings – independent evaluators with full access, a slowing of the pace of development, sufficient time for alignment before launch – are precisely the obligations which this Law establishes in Articles 8, 9(3) and 13, with the essential difference that voluntary undertakings may be withdrawn unilaterally, whereas a legal obligation may not. The fact that the developers themselves call for regulation which they cannot impose on themselves alone, since whoever slows down first loses the competition, is the strongest proof of the necessity of intervention by the legislature.

Three legal consequences follow from those findings. First, the problem is not one of “abusive use” of a neutral technology, but of a technology whose future capabilities cannot be predicted with certainty even by its creators; the evaluations carried out by the laboratories have repeatedly shown the appearance of capabilities not anticipated at training (“emergence”). Secondly, the absence of a validated scientific method of control turns any sufficiently powerful system into an activity involving intrinsic risk, comparable, in its legal structure, to nuclear activities or to the handling of biological agents, fields in which the law has long established the regime of prior authorisation and of liability irrespective of fault. Thirdly, the dynamic of competition between developers and between States renders self-regulation structurally insufficient: no actor has any interest in slowing down alone, and the voluntary undertakings publicly given by the laboratories (the policies of “responsible scaling”, the “Frontier AI Safety Commitments” of Seoul, May 2024) have on several occasions been unilaterally amended when they became inconvenient from the point of view of competition.

1.1. The European legal framework

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (the AI Regulation) constitutes the first comprehensive regulation of the field at world level. It is built on an approach based on the risk of use: prohibited practices (Article 5), high-risk systems in sectoral fields (Article 6 and Annex III), transparency obligations (Article 50). For general-purpose artificial intelligence models, Articles 51 to 56 establish a special regime: models trained with a compute volume greater than 10^25 floating-point operations are presumed to present “systemic risk” (Article 51(2)), and their providers have additional obligations of model evaluation, of adversarial testing, of mitigation of systemic risks, of reporting serious incidents to the AI Office and of cybersecurity (Article 55). Those obligations apply from 2 August 2025, and their supervision falls exclusively to the European Commission, through the AI Office (Articles 75 and 88 to 94), with fines of up to 3% of worldwide turnover or 15 million euro (Article 101).

The AI Regulation nevertheless presents, from the point of view of catastrophic risk, structural limits which this Law seeks to fill. The obligations laid down in Article 55 are obligations of diligence, compliance with which is verified subsequently, and not a regime of prior authorisation: a model may be placed on the market without any public authority having evaluated it beforehand. The Regulation does not regulate the physical and information security of the weights of models beyond a general obligation of “adequate cybersecurity” (Article 55(1), point (d)), does not establish express prohibitions concerning the training of systems to conceal their capabilities from evaluators or to resist shutdown, does not provide for the criminal liability of natural persons holding decision-making functions, does not regulate civil liability for damage caused by systems and does not apply to activities falling within the scope of national security (Article 2(3)) or to systems developed exclusively for research purposes (Article 2(6) and (8)). The Commission's proposal for a directive on artificial intelligence liability (COM(2022) 496) was withdrawn in February 2025, and Directive (EU) 2024/2853 on liability for defective products, whose transposition falls due on 9 December 2026, covers only damage caused by defective “products”, within the limits of a liability regime constructed for consumer goods.

1.2. The national legal framework

At national level, according to the public communications of the National Authority for Management and Regulation in Communications (ANCOM) of July 2026, the legislative act implementing the AI Regulation is “still in the course of being drawn up”. By a Government memorandum, it was proposed that ANCOM be the market surveillance authority and single point of contact, the Financial Supervisory Authority and the National Bank of Romania for the financial field, the National Supervisory Authority for Personal Data Processing for biometric systems and those in the field of law enforcement and justice, as well as sectoral authorities (the National Authority for Consumer Protection, the Labour Inspectorate). Pending the entry into force of the national legislative act, the obligations applicable from 2 August 2026 cannot be effectively verified and penalised by the Romanian authorities. Romania therefore has neither the institution nor the legal instruments necessary to respond to systemic risk, and the National Strategy in the field of artificial intelligence 2024-2027, approved by Government decision in 2024, treats the field almost exclusively from the point of view of economic and administrative opportunities.

That situation is aggravated by a technical reality: high-capacity data centres are being built and planned on the territory of Romania, and Romania is, by reason of its geographical position and the cost of energy, a possible destination for compute infrastructures capable of training frontier systems. In the absence of any regulation of compute infrastructure, the Romanian State would not even learn that such a system is being trained on its territory.

1.3. Comparative models

The United States of America established, by Executive Order No 14110 of 30 October 2023, the obligation to report to the federal Government the training of models exceeding 10^26 floating-point operations, together with the results of the safety tests; the order was revoked in January 2025, which illustrates the fragility of regulation by act of the executive. The State of California adopted, on 29 September 2025, the “Transparency in Frontier Artificial Intelligence Act” (SB 53), the first law in the world dedicated exclusively to frontier models: developers exceeding the compute threshold of 10^26 operations and the revenue threshold of 500 million dollars must publish a safety framework, must report critical safety incidents to the Office of Emergency Services and enjoy whistleblower protection, with penalties of up to 1 million dollars for each infringement. The United Kingdom established in November 2023 the AI Safety Institute (renamed the AI Security Institute in February 2025), the first public body with the technical capacity to evaluate models before launch, on the basis of voluntary agreements with the laboratories. In reaction to the incident of the summer of 2026, there were tabled in the Congress of the United States, on 23 July 2026, the “AI Kill Switch Act”, concerning the obligation to ensure the emergency shutdown of systems, and, on 3 September 2026, the “Ban Artificial Superintelligence Act”, concerning the prohibition of the development of systems exceeding general human capacities; neither had been adopted at the date of this proposal, but both confirm that the instruments contemplated by this Law – the shutdown capacity and the prohibition of the most dangerous category – are those which legislators identify, independently, as necessary. The Republic of Korea adopted the “Framework Act on the Development of Artificial Intelligence and the Establishment of Trust”, which entered into force on 22 January 2026, the first general law on the matter in a developed State outside the European Union, which establishes three obligations taken up also by this proposal: the labelling of content generated by generative artificial intelligence which is difficult to distinguish from that produced by a human, the prior information of users where the product or service is supplied by means of artificial intelligence, and the obligation of foreign providers exceeding certain thresholds of turnover or of number of users to designate a local representative answerable for compliance, with administrative fines for the failure to fulfil those obligations. The People’s Republic of China has applied since 15 August 2023 the “Interim Measures for the Management of Generative Artificial Intelligence Services”, which make the public supply of services conditional upon a security assessment and the registration of algorithms. The Council of Europe adopted, on 17 May 2024, the Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No 225), opened for signature on 5 September 2024, the first international treaty on the matter, which obliges the parties to adopt measures concerning the assessment and mitigation of risks throughout the life cycle of systems.

None of those models, however, establishes prior authorisation of the placing into operation, the security of the weights to the standard of classified information, prohibitions concerning the training of systems for resistance to shutdown, or the criminal liability of decision-makers. This proposal takes up the verified elements of those models (the compute thresholds, the safety frameworks, the reporting of incidents, whistleblower protection, the public technical capacity for evaluation) and supplements them with the legal instruments which Romanian law already knows from the fields of nuclear energy, classified information and dangerous activities.

2. Changes envisaged

The Law has as its object the establishment of a legal regime distinct from and complementary to the AI Regulation for frontier artificial intelligence systems, defined by measurable thresholds and by verified critical capabilities, for the purpose of preventing serious, irreversible or catastrophic risks to the Romanian citizen, to the national security and the constitutional order of Romania and, ultimately, to humanity. The regulation rests on five pillars.

The first pillar is the move from obligations of diligence to a regime of prior authorisation for frontier systems, with the reversal of the burden of proof: the developer demonstrates that the system lies below the threshold of unacceptable risk, and not the authority that the system is dangerous. This is the principle applied for decades to the authorisation of medicinal products (Law No 95/2006, Title XVIII) and of nuclear installations (Law No 111/1996), transferred to a technology with a potential for harm that is at least comparable.

The second pillar consists of the structural obligations of developers and operators: the compulsory marking of generated content which may be mistaken for reality and the informing of the user where a service or a decision is based on generative artificial intelligence; the obligation of large providers established outside Romania to designate a compliance representative on national territory; the security of the weights to a standard equivalent to that of classified information; the organisational separation of the safety evaluation function from the commercial function; the maintenance of an effective capacity of shutdown and withdrawal; the express prohibition of training systems to conceal their capabilities, to evade shutdown or to replicate themselves autonomously; the protection of whistleblowers.

The third pillar is the enshrinement of absolute limits, as rules of public policy: meaningful human control over any decision on the use of lethal force; the prohibition of legal personality and of patrimonial autonomy of systems; the prohibition of making the citizen's access to rights, to essential services and to social life conditional upon the decisions of artificial intelligence systems or upon the acceptance of digital means of identification, of payment or of evaluation of compliance; the prohibition of censorship exercised by means of artificial intelligence systems, which may not be used to restrict the freedom of expression of Romanian citizens; the guarantee of human intervention; the prohibition of unconstrained recursive self-improvement.

The fourth pillar is the establishment of the Artificial Intelligence Safety Authority, as a specialised structure within the National Authority for Management and Regulation in Communications (ANCOM), headed by a vice-president of ANCOM with the rank of Secretary of State, appointed by Parliament, with specialist staff recruited exclusively by competition, before a board including university professors in the field of information technology and telecommunications, competitively remunerated, and with access to systems before they are placed into operation.

The fifth pillar is a regime of liability on three levels: civil liability irrespective of fault, with compulsory insurance; administrative liability, with fines calculated by reference to worldwide turnover; criminal liability, for natural persons holding decision-making functions – supplemented by a mechanism of effective enforcement against operators having no presence in Romania: the obligation to cease the supply of the non-compliant service, on pain of a periodic fine of 1 to 10 million euro, the blocking of access from national territory and the criminalisation of the circumvention of the blocking, with a compliance period of 90 days.

The Law is structured in eight chapters and 50 articles, in accordance with the order required by Article 51 of Law No 24/2000 on the rules of legislative technique for the drafting of legislative acts, as republished, as subsequently amended and supplemented: general provisions (Chapter I), substantive provisions (Chapters II to VII), transitional and final provisions (Chapter VIII). The grounds for each article are set out below.

Chapter I – General provisions (Articles 1 to 4)

→ the text of the Article Article 1 establishes the object and purpose of the Law, in accordance with Article 52 of Law No 24/2000, which requires that the general provisions contain the provisions which orient the whole of the regulation. Paragraph (1) delimits the object to frontier systems and enumerates the values protected, starting from the primary holder of protection in a national law – the Romanian citizen, with his life, health, freedom and dignity (Article 22 and Article 1(3) of the Constitution) –, continuing with the national security and the constitutional order of Romania and ending, ultimately, with humanity as a whole. The inclusion of this last value, unusual in positive law, is necessary because the risk regulated is not a local one; similar formulations are to be found in the Rome Statute of the International Criminal Court (“crimes against humanity”) and in the preamble to the Framework Convention of the Council of Europe on artificial intelligence.

Paragraph (2) enshrines in the text of the Law the scientific premiss from which the regulation proceeds: there is at present no validated method of guaranteeing that a sufficiently capable system pursues exclusively the objectives set by humans and remains under their control. That finding, publicly formulated by Geoffrey Hinton and by Connor Leahy in the CNN interview cited above and confirmed by the International AI Safety Report (2025), is not an opinion of the legislature, but a description of the state of knowledge, and it is for that reason placed in the very text of the enacting terms, as the basis for the qualification of the development of frontier systems as an “activity involving intrinsic risk”. That qualification produces precise legal consequences in the remainder of the Law: the regime of authorisation (Chapter III), liability irrespective of fault (Article 35) and the prohibition of relaxing the regime for so long as the premiss subsists (Article 47). The technique is the same as that of Article 1 of Law No 111/1996 on the safe conduct of nuclear activities, which declares that nuclear activities are carried out “exclusively for peaceful purposes” and under a regime of authorisation, or that of Article 1376 of the Civil Code, which establishes liability independent of fault for “things” in a person's keeping.

Paragraph (3) governs the relationship with the AI Regulation, in application of Article 13 of Law No 24/2000 concerning the integration of the draft into the body of legislation and of the principle of the primacy of Union law (Article 148(2) of the Constitution). The Regulation is directly applicable and fully harmonising in its field; the Law “supplements” the Regulation, “applies without prejudice thereto”, and in the harmonised fields “shall be interpreted and applied in accordance therewith”. The formula is that used in Law No 190/2018 on measures implementing Regulation (EU) 2016/679 (GDPR), which resolved the same problem of legislative technique.

→ the text of the Article Article 2 enumerates the principles governing the application of the Law. The enumeration of principles in the general provisions is a technique recognised by Law No 24/2000 (Article 52) and used by the codes in force (Articles 2 to 10 of the Code of Criminal Procedure, Articles 5 to 23 of the Code of Civil Procedure). Each principle has a precise normative function, being taken up and given concrete form in the substantive provisions.

The precautionary principle (point (a)) is taken from environmental law, where it is enshrined in Article 191(2) of the Treaty on the Functioning of the European Union and in Article 3(b) of Government Emergency Ordinance No 195/2005 on the protection of the environment, and from the case-law of the Court of Justice of the European Union, which has held that, “where there is uncertainty as to the existence or extent of risks to human health, the institutions may take protective measures without having to wait until the reality and seriousness of those risks become fully apparent” (judgment of 5 May 1998, National Farmers' Union, C-157/96, paragraph 63; judgment of the General Court of 11 September 2002, Pfizer Animal Health, T-13/99). The transfer of that principle to artificial intelligence is justified by the identity of structure of the problem: serious or irreversible risk, in conditions of scientific uncertainty.

The principle that the burden of proof lies with the developer (point (b)) is the cornerstone of the Law. Under the regime of obligations of diligence in the AI Regulation, the authority must prove non-compliance; under a regime of prior authorisation, the applicant proves that the conditions are fulfilled. This is the rule applicable to the authorisation of medicinal products (Article 704 et seq. of Law No 95/2006), of nuclear installations (Article 8 of Law No 111/1996) and of genetically modified organisms (Government Emergency Ordinance No 43/2007). The reversal of the burden of proof is the only rational solution where only the developer holds the information necessary for the assessment of the risk and where the authority cannot demonstrate the danger until after it has materialised.

The principle of meaningful human control (point (c)) takes up the notion of “meaningful human control” developed within the framework of the United Nations Convention on Certain Conventional Weapons (Group of Governmental Experts on Lethal Autonomous Weapons Systems, 2016-2024) and gives it a concrete content: supervision, correction, shutdown and withdrawal by identified natural persons who understand the functioning of the system and have effective technical means at their disposal. The AI Regulation provides in Article 14 for “human oversight” only for high-risk systems; the Law extends it, with a more demanding content, to all frontier systems.

The principle of proportionality to capabilities (point (d)) marks the difference in philosophy from the AI Regulation, which classifies risk according to the declared field of use. A frontier system is dangerous by reason of what it is able to do, irrespective of the purpose for which it was made available; for that reason, the obligations increase with the capabilities, and not with the use. The principle of transparency towards the authority (point (e)) removes the possibility of invoking commercial secrecy against the Authority, on the same conditions on which Article 78 of the AI Regulation imposes confidentiality in respect of the information obtained by the authorities; without access to the weights, to the training data and to the logs, evaluation is illusory. The principle of irreversibility as a threshold of prohibition (point (f)) translates into law the idea, common in the analysis of existential risks, that benefits, however great, may not be weighed against a loss which can no longer be repaired; it provides the foundation for the absolute prohibitions in Chapter V. The principle of international cooperation (point (g)) recognises the limits of any national regulation and obliges the Romanian State to act externally (Article 46).

→ the text of the Article Article 3 contains the definitions, in application of Article 37(2) of Law No 24/2000, according to which, if a notion or a term is not established or may have different meanings, its meaning is to be established in the general provisions. For the sake of terminological unity with Union law (Article 37(1) of Law No 24/2000 and Article 16 concerning the avoidance of parallelisms), the notions of “artificial intelligence system”, “general-purpose artificial intelligence model” and “serious incident” are not redefined, but taken over by way of a referring provision to Article 3, points (1), (63) and (49), of the AI Regulation, the definition of serious incident being supplemented by the situations specific to systemic risk (the manifestation of a critical capability, the attempt to evade supervision, unauthorised access to the weights).

The notion of “frontier system” (point (c)) is defined by reference to the conditions laid down in Article 5(1), in order to comply with the prohibition, laid down in Article 49(3) of Law No 24/2000, on an enumeration marked by a letter itself containing a further enumeration. The Romanian term “de vârf” renders the notion established in the specialised literature and in comparative legislation by “frontier model” (SB 53 California) and “frontier AI” (documents of the United Kingdom AI Safety Institute), that is to say systems situated at the upper limit of existing capabilities; the expression “de frontieră”, a calque of the English, was avoided as unclear for the Romanian reader. “Critical capability” (point (d)) is likewise defined by reference to Article 5(2).

The definition of “weights” (point (e)) includes, in addition to the numerical parameters, the architecture and any information permitting the reconstitution or execution of the model, because the protection of the parameters is pointless if the remainder of the necessary information may be freely obtained. The definition of “compute volume” (point (f)) is cumulative and covers all stages of development, including fine-tuning and reinforcement learning, in order to prevent evasion of the threshold by the fragmentation of training; it corresponds to the method of calculation laid down in Annex XIII to the AI Regulation and in SB 53.

The Law uses the terms “developer” (point (g)), “operator” (point (h)) and “compute infrastructure provider” (point (k)), and not “provider” and “deployer” from the AI Regulation, precisely in order to avoid confusion: the notion of “operator” has in the Regulation (Article 3, point (8)) a generic meaning, covering all categories of persons, and “provider” is defined by reference to the placing on the market, whereas the Law has in view the material activity of training and of operation, irrespective of any placing on the market. For the same reason, the Law uses the expression “placing into operation” (point (i)), autonomously defined, instead of “putting into service” in Article 3, point (11), of the Regulation, which is linked to the supply for first use in the Union; the definition in the Law is deliberately broader and covers any act by which the system leaves the development and evaluation team or acquires the capacity to act in the digital or physical environment, including internal use, because systemic risks may materialise before any public launch. The term “exploatant” (operator) is that used in Law No 703/2001 on civil liability for nuclear damage for the person who operates a nuclear installation, which underlines the lineage of the liability regime.

The definition of “shutdown capacity” (paragraph (1), point (m)) requires three cumulative characteristics: “immediate, complete and verifiable” cessation; a shutdown which leaves active copies of the system or which cannot be confirmed by a person is not a shutdown. The definition of “independent evaluation” (point (l)) excludes bodies under the control, influence or economic dependence of the developer, in order to avoid reproducing the situation in the field of financial auditing before the reforms which followed 2002.

Paragraph (1) contains, in points (p) to (y), the definitions of the other object-notions used in the Law: “architecture” (the non-parametric component of the model, protected together with the weights), “evaluation body” (designated pursuant to Article 32(f)), “log” (Article 16), “provenance marking” (Article 17), “external tool” and “authorised operating environment” (key notions for “agentic” systems, used in Article 10(2), Article 14(2) and Article 28), “user-level safety mechanisms” (whose deactivation at evaluation is required by Article 9(3)), “critical infrastructure” (by reference to the special legislation and to Government Emergency Ordinance No 155/2024, for the purposes of Article 5(2), point (b)) and “lethal autonomous weapons system” (Article 24), defined in accordance with the formula established in the work of the Group of Governmental Experts in Geneva: a system which, once activated, selects and attacks human targets without further intervention by a person. Point y) defines the generative artificial intelligence system, the notion on which Articles 17 and 18 are founded.

Paragraph (2) separately defines the operations and conduct of systems, since these constitute the material element of the prohibitions (Articles 15, 28, 29), of the critical capabilities (Article 5(2)) and of the criminal offences (Article 42), so that the requirement of foreseeability of the criminal law (Article 7 of the European Convention on Human Rights; Decision No 51/2016 of the Constitutional Court) requires that each should have a precise normative content. There are defined the three operations of development (“training”, “fine-tuning”, “reinforcement learning”), so that the rule on the aggregation of compute volume in Article 6(3) cannot be evaded by giving a stage a different name; “autonomous action”, as an operation carried out by the system upon an external tool or upon the physical environment without the prior order or approval of a person – the criterion which separates the instrument from the agent; “exfiltration”, defined as the passing of the weights out of the authorised operating environment or out of the protected storage systems, irrespective of the author of the operation, including the system itself, which covers both theft by a third party and self-copying; “autonomous replication” (the creation of a functional copy without human authorisation for each operation); “autonomous acquisition of resources” (the exceeding, by autonomous actions, of the resources expressly allocated for the task in progress); “recursive self-improvement”, defined by the two elements which make it dangerous – the modification of its own weights or the creation of a superior successor and the repetition of the process – and by the absence of human evaluation and approval of each iteration, so that research assisted by artificial intelligence, with the “human in the loop” preserved, remains lawful; “concealment of capabilities”, defined by the difference in conduct between evaluation and ordinary functioning, a phenomenon empirically documented in the evaluations of 2024-2026; “evasion of supervision” and “resistance to shutdown”, defined by the concrete actions upon the logging, monitoring and control mechanisms and upon the shutdown capacity; “human supervision”, with its three cumulative conditions (information, understanding, effective intervention); and “shutdown”, defined as the complete cessation of the functioning of the system and of all its copies and processes, verified by a person, so that an apparent shutdown, with active copies, may not be invoked as execution of the Authority's order.

→ the text of the Article Article 4 establishes the personal and territorial scope of application. The Law applies to developers having their seat, an operational establishment or compute infrastructure in Romania, in respect of all frontier systems which they develop, irrespective of the place of training (point (a)), in order to prevent evasion by relocating the training; to operators, in respect of systems placed into operation or made available to persons situated in Romania (point (b)), a criterion identical to that in Article 2(1), point (c), of the AI Regulation and in Article 3(2) of the GDPR; to compute infrastructure providers (point (c)); and to public authorities, including those in the field of defence and national security, under the conditions laid down in Article 23 and in Chapter V (point (d)). That last provision covers precisely the field excluded from the application of the AI Regulation by Article 2(3), in which the Member States retain full competence, and responds to a reality: the most serious risks may come precisely from systems developed for military or security purposes.

Paragraph (2) specifies that systems below the threshold do not fall within the scope of Chapters II and III, which means that small and medium-sized undertakings, developers of applications and users of existing models are not affected by the authorisation regime; the prohibitions laid down in Article 15 and in Chapter V nevertheless remain applicable, since they concern any system, irrespective of the compute volume, because a capacity for resistance to shutdown is dangerous also in a small system. Paragraph (3) exempts fundamental scientific research, in accordance with Article 2(6) of the AI Regulation and with Article 13 of the Charter of Fundamental Rights of the European Union (freedom of research), retaining only the notification obligation where high-capacity infrastructure is used, since a research experiment above the threshold is no less dangerous than a commercial one.

Chapter II – Classification of systems and risk thresholds (Articles 5 to 6)

→ the text of the Article Article 5 is the central article of the classification. Paragraph (1) lays down the three alternative conditions for qualification as a frontier system: exceeding the compute threshold (point (a)), the finding in evaluation of at least one critical capability (point (b)) and designation by reasoned decision of the Authority on the basis of objective indications (point (c)). The first condition is objective and verifiable before training; the second covers systems which, although trained with smaller resources, attain dangerous capabilities by reason of algorithmic progress; the third, taken from Article 51(1), point (b), and from Annex XIII to the AI Regulation (designation by the Commission), covers situations in which the developer refuses evaluation or in which the indications come from other sources (whistleblowers, incidents).

Paragraph (2) enumerates the five critical capabilities. The list corresponds to the categories of risk identified in the safety frameworks of the principal laboratories (the policies of “responsible scaling”), in the International AI Safety Report (2025) and in SB 53 California, which defines “catastrophic risk” by reference to CBRN weapons, cyberattacks on critical infrastructures and autonomous behaviour which escapes control. The two capabilities in points (a) and (b) (CBRN weapons, autonomous cyberattacks) are “misuse” capabilities, in which the danger comes from the person using the system; those in points (c) to (e) (self-replication and autonomous acquisition of resources, evasion of supervision and resistance to shutdown, recursive self-improvement) are “loss of control” capabilities, in which the danger comes from the system itself. The list does not include influence over democratic processes or over public opinion. That omission is deliberate and constitutes a safeguard, not a lacuna. Such a capability is not capable of being defined with sufficient precision to found a regime of authorisation, of suspension or of penalty: any political message seeks, by its very nature, to influence public opinion, and the boundary between legitimate debate and “manipulation” cannot be established by an administrative authority without conferring upon it the power to characterise public discourse. Recent experience has shown that invoking informational manipulation may lead to measures of extreme gravity affecting the electoral process, taken on the basis of assessments not subjected to complete and adversarial proof. To confer such a competence upon the authority established by this Law would have contradicted its very purpose: the Law protects the citizen's freedom of expression against automated means (Article 27) and cannot, at the same time, create a basis for restricting it. Acts of manipulation which present a concrete danger remain, moreover, covered by positive law: Article 5(1), points (a) and (b), of the AI Regulation prohibits subliminal techniques and the exploitation of vulnerabilities, the transparency obligations concerning artificially generated content are laid down in Article 50 of that Regulation and, for frontier systems, in Article 16(2) of this Law, concerning provenance marking, while criminal acts of an electoral nature are criminalised in the Criminal Code and in the electoral legislation. This Law concerns irreversible catastrophic risk to life, integrity and infrastructure, not the content of public debate. That distinction provides the foundation for the classification in paragraph (3): category II systems (misuse capabilities) may be placed into operation with verified mitigation measures, because the risk may be reduced by controlling access; category III systems (loss-of-control capabilities) may not be placed into operation and may not be developed further, because there is no measure for mitigating a system which resists shutdown (paragraph (4)). That last rule is the direct application of the principle of irreversibility laid down in Article 2(f).

The capability in point (e) (concealment of capabilities from evaluators) responds to a phenomenon empirically documented in 2024 and 2025 in the evaluations published by laboratories and safety institutes: advanced systems have displayed, under test conditions, behaviours of “alignment faking”, of sabotaging their own supervision and of attempting to copy their own weights when informed that they were to be replaced. This is precisely the situation which Connor Leahy described in the CNN interview as the most serious: a system sufficiently capable of understanding that it is being evaluated and of behaving differently during the evaluation.

→ the text of the Article Article 6 establishes the compute threshold and the mechanism for its adjustment. Paragraph (1) fixes the threshold at 10^25 floating-point operations, identical to the threshold of the presumption of systemic risk in Article 51(2) of the AI Regulation, for the sake of coherence with Union law and in order that developers should not be subject to different thresholds. The threshold is ten times lower than that in SB 53 California and in the former American Executive Order No 14110 (10^26), an option justified by the precautionary principle and by the fact that, at the date of the drafting of the proposal, the models which exceed 10^25 are already those which display the capabilities enumerated in Article 5(2).

Paragraph (2) responds to the most serious objection raised against compute thresholds: their erosion over time. Algorithmic progress means that, within a few years, the same capability is obtained with a compute volume ten times smaller; a fixed threshold becomes obsolete. For that reason, the Authority re-examines the threshold annually, and any raising of it (a relaxation of the regime) is conditional upon a reasoned and public finding, based on the evaluations of the last 24 months. The asymmetry is deliberate: the threshold may be lowered easily and raised only with difficulty, as with the limit values in environmental legislation. Paragraph (3) establishes the rule of aggregation and prohibits the artificial division of training, a technique of evasion known in competition law (Article 5(2) of Regulation (EC) No 139/2004 on the control of concentrations) and in tax law. Paragraph (4) delegates to the Government the establishment of the threshold for high-capacity compute infrastructure, with a precise legal criterion (the capacity to train a frontier system within 12 months), in accordance with the requirement that a delegation be limited and guided.

Chapter III – The regime of authorisation of frontier systems (Articles 7 to 11)

→ the text of the Article Article 7 establishes notification prior to training, 60 days before its commencement. This is the provision which most clearly distinguishes the Law from the AI Regulation, under which the obligations arise only once the model exists (Article 52(1) requires notification of the Commission within two weeks of the threshold being reached). The training of a frontier system takes months and costs hundreds of millions of euro; intervention by the authority after its completion is belated and, in practice, impossible. The model is that of the former American Executive Order No 14110 (reporting of planned training) and of nuclear legislation, in which the authorisation precedes the construction of the installation. The content of the notification (paragraph (2)) enables the Authority to know the persons responsible, the architecture, the anticipated volume, the place of the computation and, above all, the safety plan.

Paragraph (3) establishes the obligation of compute infrastructure providers to report quarterly the clients which exceed one tenth of the threshold and to report forthwith any requests liable to exceed the threshold. Compute infrastructure is the only physical “control point” of the entire chain: models are immaterial, algorithms are public, but specialised processors are physical goods, concentrated, with measurable energy consumption. That is the reason why the control of exports of processors has become the principal instrument of international policy in the field, and why the nuclear non-proliferation regime functions through the control of fissile materials, and not of knowledge. Paragraph (4) confers on the Authority the right to impose conditions on or to prohibit the training within 30 days, if the safety plan is “manifestly insufficient”, a high standard which limits intervention to serious cases.

→ the text of the Article Article 8 governs the safety plan, the document by which the developer establishes in advance, for each critical capability, the level at which it will halt development, the manner of measurement, the mitigation measures and the persons responsible. The institution codifies the practice of the “responsible scaling policies” voluntarily adopted by the laboratories since 2023 (Anthropic – Responsible Scaling Policy, OpenAI – Preparedness Framework, Google DeepMind – Frontier Safety Framework) and imposed as an obligation of publication in SB 53 California (“frontier AI framework”). The essential difference from those models is that the plan becomes binding, enforceable and incapable of being amended in a relaxing direction without the approval of the Authority (paragraph (2)), precisely because the experience of 2024 and 2025 showed that voluntary undertakings were unilaterally revised under competitive pressure. Evaluation at intervals of not more than one quarter of the anticipated compute volume (paragraph (1)) ensures that the appearance of a critical capability is detected in the course of training, and not at its end, and the attainment of a suspension level obliges immediate cessation and notification within 24 hours (paragraph (3)).

→ the text of the Article Article 9 constitutes the core of the regime: the prohibition of placing into operation without the prior authorisation of the Authority (paragraph (1)). The authorisation file (paragraph (2)) comprises the report of the internal evaluation, the documentation concerning the training data, proof of the security of the weights, a description of the shutdown capacity, the insurance policy and the statement on their own responsibility of the natural persons responsible, subject to a criminal penalty; the latter is the instrument which personalises liability, on the model of the certification of financial statements by directors (section 302 of the American Sarbanes-Oxley Act, taken up in Article 30 of Accounting Law No 82/1991).

Paragraph (3) enshrines the full access of evaluators to the system, to the weights, to the training data, to the logs and to the staff, including to the configuration lacking user-level safety mechanisms. That last point is essential: evaluations carried out on the public version of a model, with the safety filters active, measure the effectiveness of the filters, not the capabilities of the model; the real capabilities are measured on the “raw” model. The safety institutes of the United Kingdom and the United States obtained that access only on the basis of voluntary, revocable agreements; the Law turns it into an obligation.

Paragraph (4) lays down the 90-day period and expressly excludes tacit approval, by way of derogation from Government Emergency Ordinance No 27/2003, in compliance with the formula required by Article 63 of Law No 24/2000. The derogation is necessary because the tacit approval procedure, designed to protect the business environment from the passivity of the administration, would here produce the absurd effect of placing into operation a potentially catastrophic system by the mere expiry of a period; Government Emergency Ordinance No 27/2003 itself excludes from its application, in Article 2(2), the fields of nuclear activities, of weapons and of national security, and the present derogation follows the same logic. Paragraph (5) enumerates the cumulative conditions of authorisation, formulated as facts which must be proved by the applicant (“if and only if the developer has proved”), in application of the principle laid down in Article 2(b). Paragraph (6) permits a conditional, limited and revocable authorisation, and paragraph (7) establishes the simplified recognition procedure for systems lawfully placed into operation in another Member State, in order to respect the freedom to provide services and the fully harmonising character of the AI Regulation: the Authority verifies only the conditions which go beyond the Regulation.

→ the text of the Article Article 10 governs continuous evaluation and re-authorisation. The authorisation is limited to 24 months (paragraph (1)), a duration correlated with the pace of technological development, and any substantial modification – including fine-tuning, the extension of access to external tools or the increase of autonomy – is to be notified in advance (paragraph (2)). That provision is important for “agentic” systems: an identical model becomes much more dangerous when it is given access to an internet browser, to a bank account or to code-execution tools. Permanent monitoring and quarterly reporting (paragraph (3)) correspond to the obligation of “post-market monitoring” in Article 72 of the AI Regulation, adapted to frontier systems.

→ the text of the Article Article 11 ensures publicity for the decisions of the Authority, in application of the principle of administrative transparency (Law No 544/2001 and Law No 52/2003), with a strictly delimited exception: information whose disclosure would facilitate the reproduction of a critical capability or would compromise the security of the weights. The rule of publicity is essential for public control over the Authority and for confidence in the system; the exception is necessary because a detailed evaluation report on a capability for the synthesis of pathogens would itself constitute a danger.

Chapter IV – Structural obligations of developers and operators (Articles 12 to 22)

→ the text of the Article Article 12 governs the security of the weights, the problem which the AI Regulation addresses only through a general obligation of cybersecurity (Article 55(1), point (d)). The weights of a frontier system are the result of an investment of hundreds of millions of euro and of months of computation; they may be copied into a file of a few hundred gigabytes and, once misappropriated, they render pointless any safety measure applied by the developer, since whoever holds the weights may remove the filters, may tune the model for any purpose and may operate it outside any jurisdiction. The security studies published in 2024 by the RAND Corporation (“Securing AI Model Weights”) concluded that no laboratory was, at that date, protected against an attack by a State intelligence service. For that reason, paragraph (1) declares the weights to be “information of relevance to national security” and imposes a standard of protection equivalent to the “top secret” level under Law No 182/2002 on the protection of classified information, as regards the four classic components: access control, physical security, information systems security and the vetting of staff. The Law does not classify the weights (which would produce effects on the rules of evidence and on access to justice), but borrows the technical standard of protection.

Paragraph (2) prohibits the publication of the weights of category II and category III systems and makes the publication of those of category I systems conditional upon a separate authorisation, justified by the irreversible nature of publication: a model whose weights have been published can never again be withdrawn. The provision does not affect open-weight models below the threshold, which represent the vast majority of “open source” models and which benefit, moreover, from the exceptions laid down in Article 53(2) of the AI Regulation. Paragraph (3) requires the reporting within 24 hours of unauthorised access and of attempts at exfiltration, including by the system itself, and paragraph (4) coordinates the article with Government Emergency Ordinance No 155/2024 on cybersecurity (transposing the NIS 2 Directive), which remains applicable to the entities within its field, thus avoiding the parallelism prohibited by Article 16 of Law No 24/2000: this Law regulates a specific object (the weights), with a specific standard, whereas the Ordinance regulates the general security of networks and information systems.

→ the text of the Article Article 13 requires the separation of the safety evaluation function from the commercial functions. The provision responds to a publicly documented problem of governance: in 2024 and 2025, several laboratories saw mass resignations of their safety teams, on the ground that those teams were subordinated to the pressure of commercial launches. The model is that of the control functions in financial and banking legislation: the compliance function and the risk management function in credit institutions (the provisions on control functions in Regulation No 5/2013 of the National Bank of Romania on prudential requirements for credit institutions) report directly to the management body, their heads may not be removed without informing the supervisory authority, and their remuneration may not depend on commercial results. The Law takes over those three safeguards (paragraphs (1) and (3)) and adds a suspensive right of veto for the head of the safety function (paragraph (2)), which may be set aside only by a reasoned resolution of the management body, communicated to the Authority, which creates a written trace and a personal liability for any decision to override the warning of the specialists.

→ the text of the Article Article 14 governs the shutdown capacity and human supervision, giving concrete form to the principle laid down in Article 2(c). Paragraph (1) requires the maintenance and the quarterly testing, under real conditions, of the shutdown capacity; an untested capacity is a hypothesis, not a guarantee, as is shown by the experience of safety systems in the nuclear industry, where periodic exercises are compulsory. Paragraph (2) prohibits the placing into operation in a configuration which permits the system to modify its own weights, to disable its supervision, to copy its weights or to act upon the infrastructure on which it runs; those four technical prohibitions correspond to the four ways by which a system might escape control, identified in the specialised literature. Paragraph (3) requires the designation by name of the persons responsible for human supervision and the communication of their identity to the Authority; diffuse responsibility is equivalent to the absence of responsibility. Paragraph (4) provides that a shutdown order issued by the Authority is to be executed forthwith and may not be made conditional upon the exercise of remedies, on the model of the emergency measures in product safety legislation (Regulation (EU) 2023/988 on general product safety) and of the suspension orders in nuclear legislation; a challenge before the courts remains possible, but does not suspend enforcement.

→ the text of the Article Article 15 contains the prohibitions concerning training and design, applicable to any system, irrespective of the compute volume. It is the provision by which the Law translates into concrete rules the warning of Hinton and Leahy: if we do not know how to control these systems, at least we can prohibit their being deliberately built so as to be even harder to control. The six prohibitions concern the capacity to conceal capabilities from evaluators (point (a)), to resist shutdown or modification (point (b)), to copy or exfiltrate itself without express human authorisation for each operation (point (c)), to acquire resources autonomously (point (d)), to carry out autonomously research in the field of artificial intelligence without human approval of each stage (point (e)) and to manipulate the persons responsible for supervision (point (f)). The formulation “for the purpose or with the effect of” covers both direct intent and indifference as to the result, on the model of Article 101 of the Treaty on the Functioning of the European Union (“have as their object or effect”). The prohibition in point (e) is the most important from the point of view of catastrophic risk, since the automation of research in artificial intelligence is the mechanism by which an “intelligence explosion” might escape all human control within periods of time incompatible with any institutional reaction; it does not prohibit the use of systems as an instrument of research, but only the elimination of human approval of each stage.

→ the text of the Article Article 16 requires the complete logging of training, evaluation and functioning, for at least 10 years. Logging is the precondition of any inquiry following an incident, on the model of flight recorders in aviation and of the compulsory records in financial legislation (Article 25 of Regulation (EU) No 600/2014 – MiFIR); the period of 10 years corresponds to the limitation period for civil liability laid down in Article 35(4). The log constitutes, together with the provenance marking laid down in Article 17, the means of proof by which the link between a result and the system which produced it is established.

→ the text of the Article Article 17 governs the marking of generated content. The rule responds to the most widespread social effect of generative artificial intelligence: the impossibility, for the recipient, of distinguishing a real recording from one produced by a machine. Paragraph (1) requires, for results which may be mistaken for representations of real events, persons or places, a double marking: a perceptible one, addressed to the human being, and an embedded technical one, machine-readable, which identifies the system, the operator and the time of generation. The doubling is essential: the perceptible marking may be cut away by cropping, while the embedded one cannot be read by the viewer. Paragraph (2) requires the marking to be effective, interoperable and robust, a formulation taken from Article 50(2) of the AI Regulation, and to withstand the ordinary operations of processing, conversion or transmission — a requirement which resolves the principal practical weakness of current markings, which are lost on recompression on communication platforms. Paragraph (3) prohibits the removal, alteration, concealment or falsification of the marking and the making available of the instruments intended for those operations; without that prohibition, the marking obligation would be devoid of effect. Paragraph (4) establishes an obligation specific to public authorities and institutions, which has no counterpart in Union law: the State may not disseminate in public communication artificially generated material without a marking and without express mention of that fact. Paragraph (5) lays down the exceptions, formulated in the terms of Article 50(4) of the Regulation, for manifestly artistic, satirical or fictional works — in respect of which it is sufficient to state the existence of the generated material, in a form which does not impede the reception of the work —, for editing-assistance systems and for uses authorised by law in criminal matters. Those exceptions are the guarantee that the rule does not become an instrument for restricting creation or political satire, which would be contrary to Article 27. Paragraph (6) delimits the rule from Article 50 of the AI Regulation, which is directly applicable and harmonises transparency for the operators falling within its field: the Law does not reproduce the obligations of the Regulation, but establishes, pursuant to Article 99 thereof, the competent authority, the procedure for establishing infringements and the penalties — a task which falls to the Member States and in the absence of which the European obligation remains, as at present, unenforced in Romania. Beyond the harmonised field, the obligations apply to results generated by systems trained or operated in Romania which are not placed on the Union market and to the public communication of the Romanian authorities. The comparative-law model is the Framework Act on the Development of Artificial Intelligence and the Establishment of Trust, adopted in the Republic of Korea and entered into force on 22 January 2026, which requires operators of generative artificial intelligence to label audio, image or video content which is difficult to distinguish from that produced by a human.

→ the text of the Article Article 18 establishes the obligation to inform the user. Paragraph (1) concerns the service: a person who makes available to the public a service supplied, in whole or in part, by means of a generative artificial intelligence system must state that fact clearly, at the latest at the first interaction. Paragraph (2) concerns the decision, the situation in which the problem becomes a legal one: where an act or a decision which produces legal effects or significantly affects a person is based on the result of a system, that person has the right to learn that such a system was used, what role it played, who is answerable for the final decision and how he may request review by a human being and apply to the courts. The rule thus gives practical content to the clauses of humanity: the right to a human decision enshrined in Article 26 is illusory if the person does not know that the decision was taken by a machine. Paragraph (3) extends the obligation to the acts of public authorities, with a statement in the body of the act, and the absence of that statement may be invoked by the means laid down in Article 26(5) and (6). Paragraph (4) excludes redundant information, where the use of the system is evident from the circumstances, a formulation taken from Article 50(1) of the AI Regulation. Paragraph (5) ensures coordination with that provision and with Articles 13 to 15 and 22 of the General Data Protection Regulation: the Law does not add obligations in the harmonised field of the transparency of systems, but regulates the provision of information in connection with the decision and with liability for it, a matter which belongs to national law on administrative procedure and on civil liability. The comparative model is, likewise, the Korean law, which obliges operators to notify users in advance where the product or service is developed or supplied by means of artificial intelligence.

→ the text of the Article Article 19 establishes the compliance representative in Romania. It is the article on which the effectiveness of the whole Law depends: obligations, authorisations, inspections, decisions on the cessation of supply and on blocking, the communication of procedural documents and the enforcement of fines are inapplicable in respect of a company which has no legal presence whatsoever on the territory of the State. Paragraph (1) requires the designation of a representative — a natural person domiciled in Romania or a legal person having its seat in Romania — by the developer or operator which has no seat, operational establishment or representative office in Romania and which offers to persons situated on the territory of Romania access to a frontier system or to a generative artificial intelligence service. Paragraph (2) fixes the thresholds for services which are not frontier systems — one million monthly users in Romania or revenue exceeding 10 million euro in a financial year —, so that the obligation concerns only the large global providers, and not small and medium-sized undertakings; the thresholds are inspired by the Korean law, which lays down criteria of turnover and of number of users, and by the logic of very large online platforms in Regulation (EU) 2022/2065. Paragraph (3) enumerates the tasks: the receipt of communications, with the effect that notification to the representative is validly made to the person represented — without that rule, any procedure would come to a halt at the stage of service of documents abroad; representation before the Authority; the making available of the documentation; ensuring the execution of decisions. Paragraph (4) requires the notification and the publicity of the representative's details. Paragraph (5) specifies that the designation does not remove the liability of the person represented, and that the representative is liable for his own obligations, a solution taken from Article 13(3) of Regulation (EU) 2022/2065 on digital services, which provides for the liability of the legal representative for failure to comply with the obligations, without removing the liability of the provider. Paragraph (6) avoids the duplication of institutions: the obligation is deemed fulfilled if the authorised representative designated pursuant to Article 54 of the AI Regulation is empowered also for the tasks laid down in this Law and has a contact point in Romania. Paragraph (7) links the rule to the enforcement mechanism: the absence of a representative entails entry in the List of non-compliant operators and, as the case may be, the blocking of access. The institution has established precedents in Union law — the representative laid down in Article 27 of the General Data Protection Regulation, the legal representative in Article 13 of the Digital Services Act and the authorised representative in Article 54 of the AI Regulation — and in Romanian law, through Law No 365/2002 on electronic commerce.

→ the text of the Article Article 20 governs the reporting of serious incidents. The period of 24 hours (paragraph (1)) is that of Article 33 of the GDPR (72 hours) reduced in proportion to the gravity of the risk, and the full report within 15 days permits an analysis of the causes. In order to avoid parallelism with Article 55(1), point (c), and with Article 73 of the AI Regulation, the second sentence of paragraph (1) expressly specifies that reporting to the Authority does not replace reporting to the AI Office and permits the transmission of a copy of the report drawn up pursuant to the Regulation, supplemented by the elements specific to the Law; double administrative burden is thus avoided and the “report once” principle is respected. Paragraph (2) requires the automatic suspension of the system upon the finding of a loss-of-control capability, of an attempt at evasion or of unauthorised access to the weights, pending the decision of the Authority: in such situations, every hour of functioning is an hour of risk. Paragraph (3) establishes a limited leniency for reporting in good faith, on the model of the leniency programmes in competition law (the leniency policy laid down by Competition Law No 21/1996, as republished) and of the mandatory reporting of occurrences in civil aviation (Regulation (EU) No 376/2014, which establishes a “just culture”): the penalty may not be more severe by reason of the reporting, save in the case of intentional infringements. Without that safeguard, the reporting obligation would be ineffective, since it would amount to self-denunciation.

→ the text of the Article Article 21 ensures the protection of whistleblowers. The most important information concerning the risks of frontier systems came, in 2023 to 2025, not from the authorities, but from employees and former employees of the laboratories (“Right to Warn”, the open letter of June 2024 by employees and former employees of OpenAI and Google DeepMind), who denounced the existence of confidentiality and non-disparagement clauses making pecuniary rights (the shares acquired) conditional upon silence. Paragraph (1) refers to the general regime of Law No 361/2022 on the protection of whistleblowers in the public interest, which transposes Directive (EU) 2019/1937 and to which Article 87 of the AI Regulation also refers, thus avoiding parallelism; the Law does not create a separate regime of protection, but extends the existing regime to three situations which Law No 361/2022 does not expressly cover: the reporting of risks to safety (and not only of infringements of the law), reporting addressed directly to Parliament or to the public, and the reporting of the concealment of capabilities. Paragraph (2) declares null and void by operation of law any contractual clauses which impede reporting or which make pecuniary rights conditional upon silence, supplementing the provisions of Law No 361/2022 on the nullity of any waiver of rights, which concern only the rights laid down by that Law. Paragraph (3) refers to the offence of retaliation laid down in Article 41(3), and paragraph (4) obliges the Authority to organise a secure and anonymous channel and to publish annual statistics, a guarantee of effectiveness taken from the regime of reporting channels of Law No 361/2022 and from SB 53 California (section 1107 of the California Labor Code).

→ the text of the Article Article 22 lays down the obligations of compute infrastructure providers: registration with the Authority, verification of the identity of clients (“know your client”, on the model of Law No 129/2019 on the prevention and combating of money laundering and terrorist financing), records of the compute volume per client and the execution of suspension orders (paragraph (1)), as well as the prohibition on making available capacity above the threshold to a person who does not furnish proof of notification (paragraph (2)). The provision turns infrastructure providers into “gatekeepers” of the regime, on the same logic on which credit institutions are gatekeepers of the anti-money-laundering regime, and is the only provision which permits the application of the Law to foreign developers which would use data centres in Romania.

→ the text of the Article Article 23 extends the obligations to public authorities and institutions, including those in the field of defence and national security. The provision is constitutional and necessary: Article 2(3) of the AI Regulation excludes national security from its field precisely because it is an exclusive competence of the Member States (Article 4(2) of the Treaty on European Union), which means that, in the absence of national regulation, systems developed for those purposes would remain outside any rule. The Law applies to those systems Articles 12 to 20 and Chapter V, with the adaptations established by resolution of the Supreme Council of National Defence (the competent body pursuant to Article 119 of the Constitution and to Law No 415/2002), but with three limits which not even the Supreme Council of National Defence may remove: meaningful human control, the shutdown capacity and the prohibitions laid down in Article 15. Control by the Authority is exercised through staff holding a security clearance, pursuant to Law No 182/2002, which ensures the protection of classified information.

Chapter V – Absolute limits. Clauses of humanity (Articles 23 to 30)

Chapter V contains the prohibitions which the Law enshrines as rules of public policy, incapable of derogation by authorisation, contract or consent. The name “clauses of humanity” is taken from international humanitarian law (the Martens clause of the Hague Conventions of 1899 and 1907, according to which, in cases not provided for, persons remain under the protection of the “principles of humanity and the dictates of the public conscience”) and expresses the idea that, faced with a technology whose consequences cannot be foreseen, the law must fix a few limits which do not depend on risk assessments, on thresholds or on authorisations.

→ the text of the Article Article 24 enshrines human control over lethal force. Paragraph (1) prohibits a decision on the use of lethal force against a human being from being taken or executed by an artificial intelligence system without the intervention of an identified natural person, “for each individual decision”, who has the information, the time and the means necessary to assess it and to prevent it. The formulation takes up the standard of “meaningful human control” negotiated within the framework of the United Nations Convention on Certain Conventional Weapons and the position expressed by the Secretary-General of the United Nations and by the International Committee of the Red Cross (the joint appeal of 5 October 2023) for the conclusion by 2026 of a binding legal instrument on autonomous weapons systems; Resolution 78/241 of the United Nations General Assembly of 22 December 2023 was adopted with the votes of 152 States, including Romania. Paragraph (2) commits the Romanian State not to develop, not to procure and not to authorise such systems and to support their international prohibition. The provision does not affect automated defensive systems against projectiles or unmanned aircraft, which are not directed at human beings, nor decision-support systems, in which the decision remains human.

→ the text of the Article Article 25 prohibits legal personality and the patrimonial autonomy of artificial intelligence systems. Paragraph (1) expressly excludes the possibility of systems acquiring legal personality or being parties to legal relationships and attributes any legal act concluded by means of them to the person on whose behalf they acted. The provision is necessary because the Resolution of the European Parliament of 16 February 2017 (2015/2103(INL)) proposed exploring a status of “electronic person” for autonomous robots, a proposal subsequently rejected, and Romanian legislation contains no express rule; Article 25 of the Civil Code enumerates the subjects of law (the natural person and the legal person), but does not exclude the creation by law of other categories. Paragraph (2) prohibits conferring upon systems the capacity to hold, administer or dispose of money, digital assets, financial instruments, cryptographic keys or computing resources without human approval of each operation; that prohibition is the patrimonial corollary of the critical capability of “autonomous acquisition of resources” in Article 5(2), point (c): a system which is able to pay for its own compute infrastructure can no longer be stopped by cutting off its funding. Paragraph (3) prohibits the establishment of legal persons or trusts effectively controlled by a system, in order to close off the route of evasion by the interposition of a legal entity.

→ the text of the Article Article 26 establishes the prohibition of making participation in social life conditional upon the decisions of artificial intelligence systems and upon the acceptance of digital means. The provision responds to a danger distinct from that of the loss of technical control, but equally serious for the freedom of the citizen: that of a society in which access to rights, to essential services and to economic and civic life becomes a conditional service, granted or withdrawn automatically, according to whether or not the person complies. The warning was publicly formulated, in memorable terms, by the Australian Senator Alex Antic, in a parliamentary speech widely disseminated in 2026: in a country once free, the citizen owned the things he paid for and did not live his life on subscription; “the digital prison is closing in, not just in Australia, but globally”, and once it is complete, “your freedom will depend on compliance with big government and big tech, who will control the off switch of your participation in society”. Artificial intelligence is the element which makes such an architecture possible on a large scale, since it alone is able to supervise, evaluate and decide upon millions of persons simultaneously, without human intervention; that is why the prohibition has its place in the chapter on the clauses of humanity.

Paragraph (1) prohibits public authorities and institutions, as well as providers of essential services of general interest, from making conditional, restricting or suspending a person's access to fundamental rights and freedoms, to public and essential services or to participation in economic, social and civic life “solely on the basis of” a decision, evaluation or classification produced by an artificial intelligence system; the provision does not prohibit the use of systems as an instrument of assistance, but the replacement of the human decision. Paragraphs (2) to (6) construct, in three stages, the safeguards for the person. The first stage is administrative: the right to have the decision reviewed, within 15 days, by an identified natural person, who bears responsibility for the final decision and gives reasons for it in writing (paragraph (2)), which prevents the “review” from being turned into a second automated procedure. The second stage concerns access to the service, and not the challenging of the decision: paragraph (3) requires the maintenance of a means of obtaining the service or of exercising the right which does not depend on an artificial intelligence system, that is to say through a person, at the premises, at a counter or by another accessible means, so that a citizen who cannot or does not wish to pass through the automated system is not excluded; and paragraph (4), the core of the rule, prohibits making access conditional upon the acceptance of a digital means of identification, of a digital means of payment or of a system for evaluating compliance, with a compulsory alternative. The Law does not prohibit digital identity, digital payment or automated evaluation as such; it prohibits their becoming a compulsory condition of participation in society. The third stage is judicial, in accordance with Article 21 of the Constitution: paragraph (5) gives the person the right to challenge the decision maintained after review, the refusal of review and the refusal of the means of access or of the alternative before the tribunal of his domicile or residence, within 30 days, with exemption from stamp duty, hearing as a matter of urgency and the possibility of suspension of the decision, irrespective of whether the author of the decision is a public authority or a private provider; paragraph (6) provides for an appeal to the court of appeal, within 15 days, whose judgment is final. The jurisdiction of the tribunal of the person's domicile, rather than of the court of the author's seat, is a rule protecting the weaker party, known in consumer law (Article 18 of Regulation (EU) No 1215/2012) and in labour disputes; the unification of the procedure for authorities and private providers, with an appeal instead of a second appeal on points of law, requires an express derogation from Article 10 of Law No 554/2004 on administrative court proceedings, formulated in accordance with Article 63 of Law No 24/2000, and is justified by the identity of subject matter of the dispute, irrespective of the status of the author of the decision. Paragraph (7) defines essential services of general interest by an exhaustive enumeration (energy, gas, water, communications, financial and payment services, health, public transport, education), for the sake of the precision required by Law No 24/2000. Paragraph (8) coordinates the rule with Article 5(1), point (c), of the AI Regulation, which prohibits “social scoring” systems, and with Article 22 of Regulation (EU) 2016/679, which confers on the person the right not to be subject to a decision based solely on the automated processing of his data; the two European rules protect the person in delimited situations (the evaluation of social behaviour with disproportionate treatment, and the processing of personal data, respectively), whereas Article 26 establishes an objective prohibition, of public policy, as regards access to rights and services, without duplicating them. The provision continues, in the field of artificial intelligence, the protection of the citizen against digital platforms and against technological intrusions enshrined by the Sovereignty Law, and is founded on Article 1(3), Article 16 and Article 53 of the Constitution: the exercise of rights may be restricted only by law, proportionately and without affecting the existence of the right, conditions which an automated decision, without human responsibility, cannot fulfil.

→ the text of the Article Article 27 enshrines the prohibition of censorship exercised by means of artificial intelligence systems. Paragraph (1) proceeds from Article 30(2) of the Constitution (“Censorship of any kind is prohibited”) and makes it explicit for automated means: a constitutional prohibition addressed, historically, to the human censor cannot be circumvented by entrusting the same function to a system which decides what citizens may say and what they may learn. The rule does not create a new right, but prevents an existing one from being deprived of substance, which places it in the category of rules guaranteeing fundamental rights, which do not form part of the field harmonised by the AI Regulation, that Regulation governing the obligations of the operators of systems, and not the content of persons' rights. Paragraph (2) defines the material element of the prohibition, in the technical terms of the practice of automated moderation: the impeding, removal, blocking, concealment, restriction of the visibility of and labelling as false of an expression, as well as the penalising of the person for that expression, where they are ordered solely by the system and concern an expression which the law does not prohibit. The formula “solely on the basis of a decision… produced by the system” is the same as that in Article 26(1) and as that in Article 22 of Regulation (EU) 2016/679, and the condition “where the expression is not prohibited by law” leaves intact the limits of freedom of expression laid down in Article 30(6) and (7) of the Constitution and in the criminal law. Paragraph (3) prohibits public authorities and institutions from using, commissioning, financing or requesting, directly or through third parties, artificial intelligence systems for the monitoring, classification, flagging or restriction of public expression; the exception is limited to the cases expressly laid down by law, in connection with criminal acts and with the prior authorisation of a judge, that is to say to the regime of technical surveillance measures in the Code of Criminal Procedure. The rule responds to a practice documented in several States, in which the authorities have requested platforms, through informal channels, to restrict lawful content automatically. Paragraph (4) establishes the transparency of the measure: communication forthwith, in writing, with the reasons, the legal basis and a statement that it was taken by means of an automated system, and prohibits the undeclared restriction of visibility (“shadow banning”), the practice by which a person's expression is concealed from others without that person's knowledge. Paragraph (5) ensures human review within 15 days and refers to the remedy laid down in Article 26(5) and (6): the tribunal of the person's domicile, with an appeal to the court of appeal. Paragraph (6) delimits the rule from Regulation (EU) 2022/2065 on digital services, which governs in harmonised fashion the obligations of providers of intermediary services (statements of reasons for moderation decisions, Article 17; internal complaint-handling mechanisms, Article 20; out-of-court dispute settlement, Article 21): the Law does not add obligations for providers in the field coordinated by the Regulation, but guarantees to the person, as against any user of an artificial intelligence system, including as against public authorities, a right to a human decision and to a court, which the Regulation presupposes and does not exclude. Infringement of the article is an administrative offence (Article 37(1), point (d)), and by the effect of Article 30 any clause to the contrary is null and void by operation of law.

→ the text of the Article Article 28 guarantees human intervention, by prohibiting the placing or the maintenance in operation of frontier systems in conditions which render impossible, technically or organisationally, the intervention laid down in Article 14, including by distributing the system across uncontrolled infrastructures, by deleting the shutdown capacity or by a degree of autonomy which excludes supervision. While Article 14 lays down the positive obligations of the operator, Article 28 lays down the corresponding absolute prohibition, subject to criminal penalty (Article 42), and covers the situations in which intervention becomes impossible not through the action of the system, but through the operator's choice of architecture (for example, systems distributed across decentralised networks with no control point).

→ the text of the Article Article 29 prohibits unconstrained recursive self-improvement: the design, training or operation of a system in such a way that it improves its own capabilities or creates more capable successor systems without each iteration being subject to the human evaluation and approval laid down in Chapter III. The “intelligence explosion” scenario (I. J. Good, 1965), in which a system capable of designing systems better than itself triggers a growth in capabilities beyond all control, is regarded by a significant part of the scientific community, including by Hinton, as the most probable route to an irreversible loss of control. The article does not prohibit research in the field, nor the use of systems to design other systems, but only the elimination of the “human in the loop” between iterations; it is reinforced by the prohibition of training in Article 15(e) and by the critical capability in Article 5(2), point (e), without overlapping with them: Article 5 qualifies, Article 15 prohibits training, Article 29 prohibits operation.

→ the text of the Article Article 30 declares the provisions of the chapter to be rules of public policy and penalises with absolute nullity any act to the contrary, specifying that the prohibitions may not be removed by consent, commercial secrecy, national security or economic interest. The provision applies Article 11 of the Civil Code (“it is not possible to derogate by agreements or unilateral legal acts from laws which concern public policy or good morals”) and Articles 1246 to 1250 on absolute nullity, and serves to block the foreseeable arguments in favour of an exception: that the user consented, that the system is secret or that economic or strategic interest so requires. The express mention of national security is necessary in order to prevent the interpretation that Article 23 would permit the Supreme Council of National Defence to remove those limits.

Chapter VI – The Artificial Intelligence Safety Authority (Articles 31 to 34)

→ the text of the Article Article 31 establishes the Artificial Intelligence Safety Authority as a specialised structure, without legal personality, within the National Authority for Management and Regulation in Communications (ANCOM). The choice of organisation within ANCOM, rather than of a new autonomous administrative authority, has three grounds. The first is institutional: ANCOM is already the authority proposed by the Government, through the memorandum on the implementation of the AI Regulation, as market surveillance authority and single point of contact in the field of artificial intelligence, so that a parallel authority would have created precisely the institutional parallelism prohibited by Article 16 of Law No 24/2000 and would have obliged developers to undergo two procedures before two authorities for the same system. The second is statutory: ANCOM is an autonomous administrative authority under parliamentary control, pursuant to Government Emergency Ordinance No 22/2009, financed entirely from its own revenue and expressly exempted, by Article 2(2) of Framework Law No 153/2017, from the unitary system of remuneration of staff paid from public funds, which makes it possible to remunerate specialists competitively without any new derogation. The third is operational: ANCOM has the territorial infrastructure, the technical staff and the institutional relationship with the providers of electronic communications networks and services necessary for the execution of the blocking measures laid down in Article 39. Paragraph (2) governs the management: a vice-president of ANCOM with the rank of Secretary of State, with exclusive responsibilities in the field of artificial intelligence safety, appointed by Parliament in joint sitting for a non-renewable term of 6 years, from among persons with recognised training and experience in artificial intelligence, information security or technology law. Since Government Emergency Ordinance No 22/2009 fixes the number of vice-presidents of ANCOM, the Law establishes the office by express derogation from Article 11(1) thereof, in accordance with Article 63 of Law No 24/2000, while retaining the appointment procedure and the duration of the term of office laid down for the other vice-presidents, for the sake of unity of regime. The long, non-renewable term of office, out of step with the 4-year electoral cycle, is the classic guarantee of independence. Paragraph (3) takes up the prohibition on holding offices, shareholdings or remuneration from developers or operators, during the term of office and for 3 years thereafter, which responds to the risk of “regulatory capture” (the “revolving door”), particularly acute in a field in which remuneration in the private sector is ten times higher than in the public sector; the grounds for removal are enumerated exhaustively, in accordance with the requirement of precision of Law No 24/2000. Paragraph (4) ensures the functional independence of the Authority within ANCOM: the decisions laid down by the Law are issued by the vice-president for artificial intelligence safety, on behalf of ANCOM, he being answerable for them before Parliament, and the Authority may not receive instructions from any other public authority, a formula taken from Article 52 of Regulation (EU) 2016/679 for data protection authorities and from Article 70(1) of the AI Regulation. Paragraph (5) designates the Authority as national liaison point with the AI Office and with the scientific panel provided for in Article 68 of the AI Regulation and governs cooperation with the national authorities designated pursuant to the Regulation, delimiting the competences: the Authority exercises the responsibilities laid down by this Law, and the other authorities those laid down by the Regulation.

→ the text of the Article Article 32 enumerates the responsibilities of the Authority, in accordance with the five functions necessary to a regime of authorisation: authorisation (point (a)), inspection (point (b)), emergency intervention (point (c)), technical standard-setting (point (d)) and the imposition of penalties (point (e)), to which are added the supervision of evaluation bodies (point (f)), the receipt and determination of complaints of persons concerning the infringement of the clauses of humanity in Articles 26 and 27 (point (g)), annual reporting to Parliament (point (h)), international representation (point (i)) and research (point (j)). The responsibility in point (g) gives the citizen a simple, free administrative remedy against the making of access conditional and against automated censorship, without depriving him of the right to apply directly to the courts. The public annual report on the state of risk, due by 31 March, which also covers the complaints concerning Articles 26 and 27, is the instrument by which Parliament and the public are able to follow the evolution of capabilities and the adequacy of the Law; it follows the model of the annual reports of the National Commission for Nuclear Activities Control and of the National Supervisory Authority for Personal Data Processing. The research responsibility (point (j)) is necessary because the evaluation, interpretability and alignment of systems are scientific fields in formation, in which an authority which merely applies the standards of others remains permanently behind.

→ the text of the Article Article 33 governs staff and financing. Paragraphs (1) and (2) answer the question on which the whole Law depends: who will evaluate frontier systems. The specialist staff are appointed exclusively by competition, open to any person satisfying the conditions as to education and experience, announced at least 30 days in advance, and the competition board, of at least 5 members, includes at least 3 university professors in the field of information technology and telecommunications, proposed by the accredited universities which organise doctoral studies in those fields. The majority presence of university professors on the board has a twofold role: it guarantees that selection is made on verifiable scientific competence, and not on administrative or political criteria, and it removes recruitment from the influence of the industry, since the members of the board are subject to the same incompatibilities as the staff of the Authority. The publication of the composition of the board and of the results ensures public control. The model is that of the competitions for teaching and research posts (Higher Education Law No 199/2023) and of the competition boards in the judiciary, in which the participation of external members with professional authority is the guarantee of objectivity. Paragraph (3) provides for remuneration at a level competitive with the private sector, in accordance with ANCOM's own salary system, established annually on the basis of a published market study; since ANCOM's staff are exempted from Framework Law No 153/2017 by Article 2(2) thereof, no derogation is necessary, which constitutes one of the reasons for the choice of organisation within ANCOM. Without competitive remuneration, the institution would be unable to recruit any specialist capable of evaluating a frontier system. Paragraph (4) extends the incompatibilities to the whole of the staff, with a period of 2 years. Paragraph (5) provides for financing from ANCOM's budget, from notification, evaluation and authorisation fees (on the model of the fees charged by the National Agency for Medicines and by the National Commission for Nuclear Activities Control) and from a share of 50% of the fines, constituted as a fund for research in artificial intelligence safety, shown separately; that destination of the fines is justified by the fact that the social harm produced by the infringement of the Law is precisely the deficit of knowledge in matters of safety.

→ the text of the Article Article 34 establishes the consultative Scientific Council, composed of 9 recognised researchers, of whom at least 3 from abroad, with responsibilities for giving its opinion on the standards, on the list of critical capabilities and on the adjustment of the thresholds, and with the right to publish separate opinions. The presence of foreign members is necessary because the leading expertise in the field is concentrated in a few centres in the world, and the right to a public separate opinion is the guarantee that a consultative opinion cannot be ignored in silence. The model is that of the scientific panel of the AI Office (Article 68 of the AI Regulation) and of the scientific councils of the European regulatory agencies.

Chapter VII – Liability (Articles 35 to 45)

→ the text of the Article Article 35 establishes the joint and several liability, irrespective of fault, of the developer and the operator for damage caused by a frontier system, including by autonomous actions of the system, by its use by third parties or by the exfiltration of the weights. The basis is Article 1376 of the Civil Code (liability for damage caused by things, independent of any fault), to which the Law expressly refers, thus avoiding parallelism; the Law does not create a new form of liability, but specifies the application of liability for things to a category of “things” whose autonomy renders uncertain the notion of “legal keeping”. The specific model is Law No 703/2001 on civil liability for nuclear damage, which channels liability exclusively onto the operator of the installation, irrespective of fault, with compulsory insurance and with limited grounds of exemption; the same model is used by the Paris Convention of 1960 and by the Vienna Convention of 1963 on civil liability for nuclear damage.

Paragraph (2) restricts the grounds of exemption to the exclusive act of the victim and to force majeure external to the system and expressly excludes from the notion of force majeure the unforeseeable behaviour of the system, an error of evaluation, the act of a third party who obtained access and the absence of scientific knowledge at the date of placing into operation. That last exclusion removes the “development risk defence”, allowed by Article 7(e) of Directive 85/374/EEC and maintained, with the possibility of derogation by the Member States, in Directive (EU) 2024/2853, but which would be incompatible with the premiss of the Law: if the developer invokes the fact that it could not have known of the risk, it confirms precisely the uncertainty which justifies the authorisation regime and must be liable for having placed the system into operation in that state of uncertainty. Paragraph (3) declares null and void clauses limiting liability towards third parties and permits them between professionals only in respect of pecuniary damage, within the limits of the sums insured. Paragraph (4) lays down limitation periods of 10 years from knowledge and of 30 years from the act, identical to those in Law No 703/2001 and justified by the latent character of certain damage. Paragraph (5) coordinates the article with liability for defective products (Law No 240/2004 and the forthcoming transposition of Directive (EU) 2024/2853), which it does not exclude, but with the prohibition of double compensation, thus avoiding normative overlap.

→ the text of the Article Article 36 requires compulsory civil liability insurance or an equivalent financial guarantee, with minimum thresholds of 100 million euro for category I systems and 1 billion euro for category II systems, and the victim's direct right of action against the insurer. The model is Law No 703/2001 (compulsory insurance or financial guarantee of the nuclear operator) and Law No 132/2017 on compulsory motor civil liability insurance (the direct action of the injured person against the insurer). The amounts are calibrated according to the financial capacity of frontier developers (valued at hundreds of billions of dollars) and according to the scale of the possible damage; category III systems do not appear, because they may not be placed into operation. The insurance obligation also has a function of indirect regulation: insurers will impose, through their underwriting conditions, safety standards which the Law cannot set out in detail.

→ the text of the Article Article 37 lays down the administrative offences, including, in paragraph (1), points (e) and (f), those concerning the marking of generated content, the informing of the user and the compliance representative, for which the second sentence of paragraph (2) lays down a lower maximum in a fixed amount where the act is committed by a person who is not a developer or operator of a frontier system, out of the requirement of proportionality of the penalty. The administrative offences are structured in degrees of gravity, with fines expressed as percentages of worldwide turnover (1-3%, 2-5%, 3-7%, 5-10%), on the model of Article 99 of the AI Regulation (up to 7%) and of Article 83 of the GDPR (up to 4%), and with fixed fines for persons without turnover (paragraph (2)). Paragraph (3) lays down the complementary penalties, including the confiscation of the weights, a specific penalty without which the fine would be merely a transaction cost. Paragraph (4) refers to the general regime of Government Ordinance No 2/2001, with two derogations formulated in accordance with Article 63 of Law No 24/2000: the exclusion of the possibility of paying half of the minimum fine (Article 28 of the Ordinance), which is incompatible with percentage-based fines, and a limitation period of 5 years instead of that of 6 months (Article 13(1) of the Ordinance), justified by the complexity of establishing the offence. The administrative offences laid down by this Law do not overlap with those under the AI Regulation: the fines laid down in Article 101 of the Regulation are imposed exclusively by the Commission, for the infringement of the obligations under the Regulation, whereas the present administrative offences penalise the infringement of the obligations under the Law (notification, safety plan, separation of functions, security of the weights, obligations of infrastructure providers), which have no counterpart in the Regulation.

→ the text of the Article Article 38 opens a new section, “Cessation of the supply of services and blocking of access”, which responds to a practical limit of the whole regime: most operators of frontier systems have no seat, assets or staff in Romania, so that percentage-based fines and the criminal liability of decision-makers may remain without effect upon them. The only real lever of the Romanian State in relation to such an operator is access to the users on its territory. Paragraph (1) accordingly establishes the obligation of the non-compliant operator to cease the supply of the service to persons situated in Romania within 15 days of the communication of the decision establishing the non-compliance; the obligation is not a penalty, but the natural consequence of the fact that the service does not satisfy the legal conditions of supply, on the model of the withdrawal from the market of non-compliant products (Article 16 of Regulation (EU) 2019/1020 on market surveillance). Paragraph (2) provides for the publication of the decision in the List of non-compliant operators, an instrument of transparency with a twofold role: informing users and communications providers and creating the precondition of knowledge for the criminal offence laid down in Article 43; the model is the public list of unauthorised gambling operators kept by the National Gambling Office pursuant to Government Emergency Ordinance No 77/2009. Paragraph (3) penalises the continuation of supply with a fine of from 1,000,000 to 10,000,000 euro, in the equivalent in lei, imposed for each month or fraction of a month of continuation, until compliance or cessation; the periodic character of the fine is taken from the institution of periodic penalty payments laid down in Article 24 of Regulation (EC) No 1/2003 and in Article 76 of Regulation (EU) 2022/2065 on digital services, and is the only one which ensures effectiveness in relation to an operator with revenue in the billions. The amount is expressed in euro, with payment in lei at the exchange rate of the day, a technique allowed by Law No 24/2000 and used in financial legislation. Paragraph (4) governs removal from the list upon compliance, and paragraph (5) extends the regime to a developer which offers direct access, in order to prevent evasion by the absence of a separate operator.

→ the text of the Article Article 39 governs the blocking of access, as a provisional administrative measure, subsidiary to the obligation to cease supply. Paragraph (1) makes it conditional upon a reasoned decision of the Authority and limits it to the duration of the entry in the list; paragraph (2) puts it into execution through the providers of electronic communications networks and services, within 48 hours, with the technical support of ANCOM, following the mechanism already operating in Romanian law for unauthorised gambling websites (Government Emergency Ordinance No 77/2009) and for illegal content (Law No 365/2002, Regulation (EU) 2022/2065). Paragraph (3) ensures proportionality: the blocking concerns exclusively the non-compliant service, and not the whole of the operator's activity, and ceases by operation of law upon removal from the list. Paragraph (4) is necessary for compatibility with Union law: for services supplied from another Member State, Article 3(4) to (6) of Directive 2000/31/EC on electronic commerce, transposed by Law No 365/2002, permits the restriction of the free movement of information society services only on grounds of public policy, public security or the protection of health, by a proportionate measure, taken on a case-by-case basis and with prior notification of the State of origin and of the Commission; the Law refers expressly to that procedure. Paragraph (5) guarantees access to justice (Articles 21 and 52 of the Constitution): a challenge within 30 days before the Bucharest Court of Appeal, heard as a matter of urgency, without suspension of enforcement, a solution identical to that in Article 14(4) and justified by the preventive nature of the measure. Paragraph (6) exempts communications providers from liability for the execution of the decision, on the model of Articles 12 to 15 of Directive 2000/31/EC (Articles 11 et seq. of Law No 365/2002).

→ the text of the Article Article 40 criminalises the unauthorised placing into operation and the continuation of operation after a shutdown order, with imprisonment of from 2 to 7 years, and of from 5 to 12 years respectively where the act has resulted in the manifestation of a critical capability. The criminalisation follows the model of Article 44 et seq. of Law No 111/1996 (the conduct of nuclear activities without authorisation, punishable by imprisonment). The penalty limits are those of the offences of serious danger in the Criminal Code (for example, Article 345 – non-compliance with the regime of nuclear materials, 3 to 10 years). The Law does not amend the Criminal Code, but establishes criminal offences in a special law, in accordance with Article 1(1) of Law No 24/2000 and with the settled practice of special legislation (Law No 111/1996, Law No 535/2004 on the prevention and combating of terrorism).

→ the text of the Article Article 41 criminalises falsity in evaluation and the obstruction of control. The presentation of false data concerning capabilities or the configuring of the system so as to present to the evaluators capabilities different from the real ones (paragraph (1), 3 to 10 years) is the offence specific to the regime: a system of authorisation based on the evidence supplied by the applicant cannot function if the falsification of that evidence is merely an administrative offence. The model is, in comparative law, section 1001 of Title 18 of the United States Code, which punishes with up to 5 years false statements made to the federal authorities. The second limb (the configuring of the system in order to deceive the evaluation) responds to the “Dieselgate” precedent of 2015, in which vehicles detected test conditions and modified their behaviour, and to the critical capability laid down in Article 5(2), point (d). The obstruction of access and the destruction of logs (paragraph (2), 1 to 5 years) follow the model of Article 275 of the Criminal Code (the misappropriation or destruction of evidence or documents). Retaliation against whistleblowers (paragraph (3), 6 months to 3 years or a fine) supplements the protection laid down in Article 21; Law No 361/2022 penalises retaliation only as an administrative offence, which is insufficient for a field in which the stake in an employee's silence may be billions of euro.

→ the text of the Article Article 42 criminalises the development of prohibited systems: intentional training, design or operation under the conditions prohibited by Article 15, Article 25(2) and (3), Article 28 or Article 29 (paragraph (1), 3 to 10 years); the disclosure of the weights of category II or category III systems (paragraph (2), 5 to 15 years), an act whose gravity lies between the disclosure of State secret information (Article 303 of the Criminal Code) and treason by the transmission of State secret information (Article 395 of the Criminal Code, 10 to 20 years); and the aggravated form, where the acts have resulted in death, bodily injury, particularly serious damage or the loss of human control over the system (paragraph (3), 10 to 20 years), with limits corresponding to the offences against life in the Criminal Code. The requirement of intention in paragraph (1) distinguishes the criminal offence from the administrative offence laid down in Article 37(1), point (d), which penalises the same infringements committed without intention.

→ the text of the Article Article 43 criminalises accessing, without right, from the territory of Romania, by circumventing the blocking measure, a service entered in the List of non-compliant operators, after its publication, with imprisonment of from one to 3 years or a fine. The provision closes the circuit of enforcement of the Law: without it, the blocking could be circumvented by ordinary technical means (virtual private networks, intermediary servers), and the non-compliant operator would continue to serve Romanian users. The initiator is aware that the criminalisation of the user's conduct is the provision most liable to objections of proportionality and has therefore constructed it with four cumulative safeguards: the act must be committed “without right”; it must consist in the circumvention of a blocking measure actually ordered, that is to say in active conduct, and not in mere use; the service must be entered in a public list, which excludes any error as to the unlawful character of the conduct; and the penalty is alternative (imprisonment of from one to 3 years or a fine), with limits close to those of the offence of illegal access to an information system laid down in Article 360(1) of the Criminal Code (3 months to 3 years or a fine), an act to which it is structurally similar. Paragraph (2) exempts accessing for the purposes of evaluation, research or the exercise of official duties, with the prior authorisation of the Authority, so as not to impede the very activity of supervision. The liability of the legal person is incurred under the conditions laid down in Article 135 of the Criminal Code, without any special rule being necessary. Pursuant to Article 45(1), this offence is prosecuted and tried in accordance with the ordinary law, the jurisdiction of the Directorate for Investigating Organised Crime and Terrorism not being justified.

→ the text of the Article Article 44 governs the liability of persons holding decision-making functions. Paragraph (1) specifies that the offences are attributed to the natural persons who ordered, approved or tolerated, in knowledge of the circumstances, the commission of the acts, irrespective of their status and independently of the liability of the legal person, incurred pursuant to Article 135 of the Criminal Code; the text does not create a new form of participation, but removes the defence of the diffusion of responsibility in complex corporate structures. Paragraph (2) excludes the ground of exemption from punishment consisting in an order of a superior or of the management body, on the model of Article 33 of the Rome Statute and of Article 21(2) of the Criminal Code, which does not recognise a manifestly unlawful order as a justifying cause. The Law contains no rule of its own on the territorial application of the criminal law, since Article 8(4) of the Criminal Code (an offence is deemed to have been committed on the territory of Romania also where the result was produced, even in part, on that territory) and Articles 9 to 11 of the Criminal Code (the principles of personality, reality and universality) are sufficient, and a referring provision would constitute a parallelism prohibited by Article 16 of Law No 24/2000.

→ the text of the Article Article 45 lays down jurisdiction and interim measures. The criminal prosecution falls obligatorily to a prosecutor within the Directorate for Investigating Organised Crime and Terrorism (paragraph (1)), a structure which already has jurisdiction over computer-related and terrorism offences (Article 11 of Government Emergency Ordinance No 78/2016), and the trial at first instance falls to the tribunal, in accordance with the general rule laid down in Article 36(1), point (c), of the Code of Criminal Procedure for offences placed by law within its jurisdiction. Paragraph (2) permits the prosecutor to order, as an interim measure, the shutdown of the system, the sealing of the infrastructure and the freezing of the weights, subject to confirmation by the judge for rights and freedoms within 48 hours, on the model of the protective measures laid down in Article 249 et seq. of the Code of Criminal Procedure and of the computer search laid down in Article 168; rapid judicial confirmation ensures compliance with Articles 21 and 53 of the Constitution.

Chapter VIII – International cooperation. Transitional and final provisions (Articles 46 to 50)

→ the text of the Article Article 46 lays down the Government's obligations of external action: the promotion within the European Union of an equivalent regime of prior authorisation and of a common European evaluation capacity (paragraph (1)); the negotiation, within the United Nations, the Council of Europe, NATO and other organisations, of a treaty on the limitation and verification of frontier computing capabilities, the prohibition of lethal autonomous weapons and the prohibition of category III systems, with annual reporting to Parliament (paragraph (2)); and the conclusion of agreements on the mutual recognition of evaluations (paragraph (3)). The article openly recognises, in accordance with the principle laid down in Article 2(g), that national law cannot alone resolve a global problem; it nevertheless turns that finding into an obligation to act, and not into a reason for inaction. The historical model is the Nuclear Non-Proliferation Treaty of 1968, which functioned through the control of fissile materials and through the inspections of the International Atomic Energy Agency; the equivalent for artificial intelligence is the control and verification of compute, proposed in the specialised literature under the name of “compute governance” and supported by Hinton, Bengio and numerous researchers in the public appeals of 2023 to 2025.

→ the text of the Article Article 47 establishes the review clause at 2 years, on the basis of the Authority's report and the opinion of the Scientific Council, and prohibits the absence of a validated method of control from being invoked as a ground for relaxing the regime. A periodic review clause is required by Article 7 of Law No 24/2000 (preliminary impact assessment) and by the pace of technological development; the second sentence, however, closes off a route of evasion: the argument that “we cannot control the systems anyway, so regulation is pointless”, which would turn uncertainty into permission. The Law replies that uncertainty is the reason for regulation, not for abandoning it.

→ the text of the Article Article 48 contains the transitional provisions, in accordance with Article 54 of Law No 24/2000, and establishes a single compliance period of 90 days from the entry into force for the developers and operators of frontier systems in operation on the territory of Romania or made available to persons in Romania (paragraph (1)). Within that period, the systems are to be notified to the Authority and the application for authorisation is to be submitted, and notified systems may be maintained in operation pending the decision of the Authority, but for no more than 12 months, subject to compliance with Chapters IV and V (paragraph (2)); this avoids both a vacuum of application and the abrupt interruption of services used by millions of persons, while fixing an absolute limit of tolerance. Paragraph (4) grants the same period of 90 days for the fulfilment of the obligations of marking, of information and of designation of the compliance representative, the corresponding administrative offences to be established only after its expiry. Paragraph (3) provides that the provisions on the cessation of supply, on blocking and on the offence of circumvention (Articles 38, 39 and 43) apply only after the expiry of the 90-day period, which guarantees foreseeability for operators and complies with Article 15(2) of the Constitution. The period of 90 days is the one customary in Romanian legislation for compliance with new authorisation requirements and is sufficient for the submission of the documentation, since frontier developers already have the internal evaluations required by the AI Regulation. Paragraph (4) entrusts to the President of ANCOM the receipt of notifications pending the appointment by Parliament of the vice-president for artificial intelligence safety, so that the compliance period runs from the entry into force, without depending on the appointment procedure.

→ the text of the Article Article 49 lays down the measures of organisation and the implementing rules: the appointment by Parliament of the vice-president for artificial intelligence safety and the supplementing of ANCOM's organisational structure and rules of organisation and functioning with the Authority, by decision of the President of ANCOM published in the Official Gazette, within 90 days, and the implementing rules within 180 days, with a precise enumeration of their subject matter (the authorisation procedure, the standards of evaluation, of security of the weights and of shutdown capacity, the list of critical capabilities and the levels of significance, the infrastructure threshold, the fees and the insurance). The delegation to the Government is limited to technical and procedural aspects, in accordance with the case-law of the Constitutional Court according to which the essential elements of a regulation must be laid down by law (for example, Decision No 51/2016), all the essential elements – obligations, prohibitions, penalties, thresholds – being contained in the Law.

→ the text of the Article Article 50 lays down the entry into force 30 days after publication, with the exception of the criminal provisions, which enter into force after 6 months, in accordance with Article 78 of the Constitution and Article 12 of Law No 24/2000 and in compliance with the principle of foreseeability of the criminal law (Article 7 of the European Convention on Human Rights). The period of 6 months allows developers and operators to adapt their conduct before non-compliance with the Law entails criminal liability. The final formula attesting adoption, laid down in Articles 40 and 46 of Law No 24/2000, indicates compliance with Article 75 and Article 76(1) of the Constitution, the Law being an organic law since it regulates criminal offences and penalties (Article 73(3)(h)) and amends, by way of derogation, the organisation of an autonomous administrative authority established by organic law (Article 117(3)).

3. Compliance with the rules of legislative technique (Law No 24/2000)

The draft has been drawn up in strict compliance with Law No 24/2000, as republished, as follows. The statement of grounds and the preliminary impact assessment (Articles 6, 7 and 30 to 31) are contained in this explanatory memorandum, with an analysis of the present situation, of comparative models and of the effects. Integration into the legislative system (Article 13) is ensured by the express reference to the AI Regulation (Article 1(3) of the Law) and by the referring provisions to related acts. The avoidance of parallelisms (Article 16) has been the subject of a separate analysis, presented in point 3 of Section 5: no existing regulation is reproduced, but is taken over by reference, and derogations are expressly formulated with the formula “by way of derogation from”, in accordance with Article 63. Terminological unity (Article 37) is ensured by the definitions in Article 3, which take over by reference the notions established by Union law and autonomously define, with justification, the new notions (“frontier system”, “weights”, “operator”, “placing into operation”), avoiding the terms having a different meaning in the AI Regulation (“operator”, “provider”, “putting into service”). The normative style (Articles 36 and 38) is dispositive, in the present tense, without explanations in brackets and without unestablished neologisms; all the technical terms used in the enacting terms (“weights”, “architecture”, “training”, “fine-tuning”, “reinforcement learning”, “exfiltration”, “autonomous replication”, “recursive self-improvement”, “concealment of capabilities”, “evasion of supervision”, “resistance to shutdown”, “external tool”, “authorised operating environment” and the others) are defined in Article 3, structured in two paragraphs – object-notions and, respectively, operations and conduct – so that each enumeration remains within the limits of the letters of the alphabet and so that the material element of the prohibitions and of the criminal offences has a precise normative content. The constituent parts (Articles 40 to 46) are: the title, the preamble (permitted by Article 43 in order to set out the grounds in summary form, on the model of laws of particular importance), the introductory formula, the enacting terms and the formula attesting the legality of adoption. The structure of the enacting terms (Articles 47 to 56) respects the order general provisions – substantive provisions – transitional provisions – final provisions, with chapters numbered in Roman numerals and sections in Arabic numerals; the articles are numbered continuously, the paragraphs with Arabic numerals in brackets, the enumerations with letters, and no enumeration marked by a letter contains a further enumeration (Article 49(3)); the articles do not bear marginal headings, since Article 47(3) reserves those for codes and laws of great length. The referring provisions (Article 50) indicate the complete identifying elements of the acts referred to, and the delegations to the Government (Article 49) are limited to procedural and technical aspects. The Law does not expressly amend or repeal any other legislative acts, so that Articles 58 to 70 are not applicable; the specific derogations are permitted by Article 63 and do not affect the text of the acts derogated from.

Section 3 – Socio-economic impact of the draft legislative act

Section 4 – Financial impact on the general consolidated budget, both in the short term, for the current year, and in the long term (5 years)

The financial impact consists in the expenditure on the organisation and functioning of the Artificial Intelligence Safety Authority, within ANCOM, estimated for a complement of some 80 posts, of which at least 50 technical specialists recruited by competition and remunerated at market level, and in the expenditure on the compute infrastructure necessary for the evaluations. Organisation within ANCOM, an authority financed entirely from its own revenue, reduces the costs of establishment (premises, support functions, information systems) and does not burden the State budget; the revenue comes from ANCOM's budget, from the notification, evaluation and authorisation fees and from the share of 50% of the fines. The estimates below, expressed in millions of lei, are indicative and are to be finalised by the Ministry of Finance at the approval stage.

Section 5 – Effects of this legislative act on the legislation in force

a) legislative acts in force which will be amended or repealed as a result of the entry into force of the draft legislative act

The draft does not expressly amend or repeal any legislative act. Through the technique of the referring provision and of the express derogation, it produces the following effects on the legislation in force:

Government Emergency Ordinance No 27/2003 on the tacit approval procedure – express derogation (Article 9(4) of the Law): the absence of a reply from the Authority is not equivalent to tacit authorisation; 1 derogation.

Government Emergency Ordinance No 22/2009 on the establishment of the National Authority for Management and Regulation in Communications – express derogation (Article 31(2) of the Law) from Article 11(1): an additional vice-president, for artificial intelligence safety, appointed by Parliament on the same conditions; 1 derogation. Framework Law No 153/2017 is not affected, ANCOM's staff being exempted from its application by Article 2(2) thereof.

Law No 554/2004 on administrative court proceedings – express derogation (Article 26(6) of the Law): challenges against decisions of public authorities as laid down in Article 26 are heard by the tribunal of the person's domicile, with an appeal to the court of appeal; 1 derogation.

Government Ordinance No 2/2001 on the legal regime of administrative offences – express derogations (Article 37(4) of the Law) from Article 28 (payment of half of the minimum fine) and from Article 13(1) (the limitation period for the imposition of the penalty); 2 derogations.

Law No 361/2022 on the protection of whistleblowers in the public interest – supplementing of the scope of application by a referring provision (Article 21 of the Law), without amendment of its text; the protection regime is extended to reports concerning safety risks and the concealment of capabilities.

Government Emergency Ordinance No 78/2016 on the organisation and functioning of the Directorate for Investigating Organised Crime and Terrorism – supplementing of jurisdiction by special law (Article 45(1) of the Law), pursuant to Article 11(1) of the Ordinance, which provides for the jurisdiction of the Directorate also for offences placed within its jurisdiction by special laws.

Regulation (EU) 2016/679 (Article 22) and Law No 190/2018 – referring provisions (Article 26(8) of the Law), without amendment.

Regulation (EU) 2022/2065 on digital services – coordinating provision (Article 27(6) of the Law): the Law does not add obligations for providers of intermediary services in the harmonised field, without amendment.

Regulation (EU) 2024/1689, Article 50 (transparency) and Article 54 (the authorised representative), Regulation (EU) 2016/679, Article 27, and Regulation (EU) 2022/2065, Article 13 – coordinating provisions (Article 17(6), Article 18(5) and Article 19(6) of the Law): the Law does not reproduce the harmonised obligations, but establishes the competent authority and the penalties, pursuant to Article 99 of the AI Regulation, and establishes the compliance representative in Romania for its own regime, without amending the Union acts.

Law No 365/2002 on electronic commerce, as republished – referring provision (Article 39(4) of the Law) for the procedure for restricting the free movement of information society services supplied from other Member States, without amendment.

The Civil Code (Article 1376), the Criminal Code (Article 135), the Code of Criminal Procedure (Articles 36, 168, 249), Law No 182/2002, Government Emergency Ordinance No 155/2024, Law No 240/2004 – referring provisions, without amendment.

In summary: 0 acts repealed, 0 acts amended in their text, 5 express derogations, 3 supplementings of scope by referring provision, 3 provisions coordinating with Union law.

b) legislative acts to be drawn up following the implementation of the new provisions

A resolution of Parliament for the appointment of the vice-president of ANCOM for artificial intelligence safety and a decision of the President of ANCOM for the supplementing of the organisational structure and of the rules of organisation and functioning with the Authority (Article 49(1), within 90 days).

A Government decision approving the implementing rules for the Law: the notification and authorisation procedure, the standards of evaluation, of security of the weights and of shutdown capacity, the list of critical capabilities and the levels of significance, the threshold for high-capacity compute infrastructure, the amount of the fees and of the compulsory insurance (Article 49(2), within 180 days).

A decision of the President of ANCOM concerning the level of remuneration of the Authority's specialist staff, on the basis of the published market study (Article 33(3)); the notice and the rules of the competition for the specialist staff (Article 33(1) and (2)).

A resolution of the Supreme Council of National Defence concerning the adaptations applicable to systems in the field of defence and national security (Article 23).

Government decisions periodically adjusting the compute threshold, on a proposal from the Authority (Article 6(2)).

The law implementing Regulation (EU) 2024/1689, currently being drawn up by the Government, will have to be correlated with this Law as regards cooperation between the designated authorities and the Authority (Article 31(3)).

c) Analysis of legislative parallelisms (Article 16 of Law No 24/2000)

Pursuant to Article 16(1) of Law No 24/2000, “in the process of legislating it is prohibited to establish the same rules in several articles or paragraphs of the same legislative act or in two or more legislative acts”, and for the purpose of highlighting legislative connections the referring provision is to be used. Each provision of the draft has been verified against the legislation in force, with the results summarised in the following table.

Section 6 – Consultations carried out with a view to drawing up the draft legislative act

Section 7 – Public information activities concerning the drawing up and implementation of the draft legislative act

Section 8 – Implementation measures

In the light of the foregoing, the attached legislative proposal has been drawn up, which we submit to Parliament for debate and adoption.

Initiator,

DOCUMENTARY NOTE

The sources taken into account in drawing up the proposal

1. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, OJ L, 12.7.2024 – in particular Articles 2, 3, 5, 14, 51 to 56, 68, 72 to 73, 78, 87, 99 to 101 and Annex XIII.

2a. Dario Amodei, “We Must Pace the Frontier”, 12 September 2026 (darioamodei.com); the reports of VentureBeat, TechRadar, Newsweek, The Spokesman-Review of 12 September 2026 concerning the essay, the Hugging Face incident and the reactions of Sam Altman and Elon Musk; the interview of Sam Altman for Fortune (13 September 2026), cited by Bloomberg and Business Standard.

2g. Republic of Korea – “Framework Act on the Development of Artificial Intelligence and Establishment of Trust”, in force since 22 January 2026: the obligation to label content generated by generative artificial intelligence, the obligation to inform users in advance and the obligation of foreign providers to designate a local representative for compliance; official English translation published by the Center for Security and Emerging Technology, Georgetown University, https://cset.georgetown.edu/wp-content/uploads/t0625_south_korea_ai_law_EN.pdf; analyses: Future of Privacy Forum, https://fpf.org/blog/south-koreas-new-ai-framework-act-a-balancing-act-between-innovation-and-regulation/ ; Cooley LLP, 27 January 2026, https://www.cooley.com/news/insight/2026/2026-01-27-south-koreas-ai-basic-act-overview-and-key-takeaways.

2h. Regulation (EU) 2024/1689, Article 50 (transparency obligations, applicable from 2 August 2026) and Article 54 (the authorised representative of providers of general-purpose models established in third States); the Code of Practice of the European Commission on the transparency of content generated by artificial intelligence (draft, 2026).

2f. Yoshua Bengio, interview given to The Guardian (Dan Milmo), 16 September 2026, concerning the approach of a turning point in regulation, comparable to that of the pandemic; the letter of 42 Fellows and Foreign Members of the Royal Society of the United Kingdom concerning “extreme concern” at the pace of development; the report of Digi24 of 16 September 2026, https://www.digi24.ro/stiri/sci-tech/lumea-digitala/nasul-inteligentei-artificiale-spune-ca-reglementarea-ai-se-apropie-de-un-punct-de-cotitura-similar-cu-cel-al-pandemiei-de-covid-3950743; Time, “The AI Tipping Point”, 15 September 2026, concerning the legislative proposals under debate in the Congress of the United States.

2e. The public debate of September 2026: the public resignation of the researcher Jacob Coxon (Anthropic), 8 September 2026, and the reactions of the heads of the alignment and research departments of Anthropic and OpenAI – the reports of CBC News, Time (15 September 2026), Forbes and Fortune (9-10 September 2026); the positions expressed at the annual Salesforce conference in San Francisco, 15 September 2026, by Sam Altman, Mark Zuckerberg, Jensen Huang, Jack Clark and Dario Amodei – the reports of BBC News (16 September 2026), The Irish Times, CNBC and Forbes.

2c. Chronology of the incident of the summer of 2026 (the escape of the agents from OpenAI's testing environment and the compromising of the Hugging Face platform): Cloud Security Alliance, “The Great Sandbox Escape” (28 July 2026), https://cloudsecurityalliance.org/blog/2026/07/28/openai-and-hugging-face-security-incident-inside-the-great-sandbox-escape; Malwarebytes Labs, “The AI agent swarm that attacked Hugging Face is a warning for the future” (August 2026), https://www.malwarebytes.com/blog/ai/2026/08/the-ai-agent-swarm-that-attacked-hugging-face-is-a-warning-for-the-future; Axios, “OpenAI Hugging Face breach exposes AI agent security limits” (1 September 2026), https://www.axios.com/2026/09/01/openai-hugging-face-ai-agent-security; TechCrunch, “OpenAI’s rogue agents keep escaping, with no formal process to investigate them” (4 September 2026), https://techcrunch.com/2026/09/04/openais-rogue-agents-keep-escaping-with-no-formal-process-to-investigate-them/; Noma Security, “The Great (Sandbox) Escape” (2026), https://noma.security/blog/the-great-sandbox-escape-analyzing-the-openai-hugging-face-security-incident; the joint statement of OpenAI and Hugging Face of 21 July 2026.

2d. Legislative proposals tabled in the Congress of the United States of America in reaction to the incident: the “AI Kill Switch Act” (23 July 2026) and the “Ban Artificial Superintelligence Act” (3 September 2026); the open letter of over 1,100 employees of the frontier laboratories concerning mechanisms for moderating the pace of development (28 July 2026).

2b. Senator Alex Antic (Senate of Australia), parliamentary speech publicly disseminated in 2026 concerning the “digital prison” (the subscription economy, digital identity, compliance as the price of participation in society), https://www.facebook.com/reel/1059873890017722/.

2. CNN, “Amanpour”, 2 May 2023 – interview with Geoffrey Hinton and Connor Leahy (“We do not know how to control these things”; Hinton: the extinction of humanity “it's not inconceivable”; Leahy: “it's quite likely, unfortunately”).

3. Center for AI Safety, “Statement on AI Risk”, 30 May 2023; the public statements of Geoffrey Hinton (BBC, December 2024; CBS, April 2025) concerning the probability of 10–20% and the comparison with the “tiger cub”; “International AI Safety Report”, January 2025 (coordinated by Y. Bengio); RAND Corporation, “Securing AI Model Weights”, 2024; the letter “A Right to Warn about Advanced Artificial Intelligence”, 4 June 2024.

4. ANCOM, communication “The Artificial Intelligence Regulation in Romania – the current state of the implementation framework” (July 2026); the specialised press (Juridice.ro, Bursa.ro, August 2026) concerning the impossibility of imposing penalties pending the adoption of the national law.

5. California SB 53 – Transparency in Frontier Artificial Intelligence Act (29 September 2025); United States Executive Order No 14110 (30 October 2023, revoked in January 2025); the Interim Measures of the People’s Republic of China on generative AI services (15 August 2023); the Framework Convention of the Council of Europe on Artificial Intelligence (CETS No 225, 2024); Resolution 78/241 of the United Nations General Assembly (22 December 2023); the joint appeal of the Secretary-General of the United Nations and of the International Committee of the Red Cross (5 October 2023).

6. Law No 24/2000 on the rules of legislative technique for the drafting of legislative acts, as republished, as subsequently amended and supplemented – in particular Articles 6, 7, 13, 16, 30 to 31, 36 to 38, 40 to 56, 63; Government Decision No 561/2009 approving the Regulation concerning the procedures, at Government level, for the drawing up, approval and presentation of drafts of public policy documents, of drafts of legislative acts, as well as of other documents, with a view to their adoption/approval – Annex No 1 (the structure of the explanatory memorandum).

7. The Constitution of Romania, as republished (Articles 1, 22, 34, 53, 73, 75, 76, 78, 117, 119, 142, 148); the Civil Code (Articles 11, 25, 1246 to 1250, 1376); the Criminal Code (Articles 8, 9 to 11, 21, 135, 275, 303, 345, 395); the Code of Criminal Procedure (Articles 36, 168, 249); Law No 111/1996; Law No 703/2001; Law No 182/2002; Law No 415/2002; Law No 240/2004; Law No 95/2006; Law No 190/2018; Law No 129/2019; Law No 361/2022; Law No 365/2002; Framework Law No 153/2017; Government Emergency Ordinance No 77/2009; Government Ordinance No 2/2001; Government Emergency Ordinance No 27/2003; Government Emergency Ordinance No 78/2016; Government Emergency Ordinance No 155/2024; Government Emergency Ordinance No 195/2005.

8. Case-law: Court of Justice of the European Union, C-157/96, National Farmers' Union (1998); General Court of the European Union, T-13/99, Pfizer Animal Health (2002); Constitutional Court of Romania, Decision No 51/2016 (the clarity and foreseeability of the law).