November 2025
What does this Digital Omnibus Package actually change for companies in Romania that develop or use AI, in terms of legal obligations and risks?
Ana-Maria Baciu, key highlights in an interview for Aleph Business media platform:
- It is important to underline that we are not looking at a change that will happen overnight. We are dealing with a proposal for a Regulation drafted by the European Commission, which will now be sent to the Parliament and the Council for adoption. This procedure takes time; we should not expect a change to occur within the next month or even the next two months.
- Secondly, the rules are being slightly relaxed for those who develop and use AI systems, particularly for those working with high-risk AI systems. A new transition period is being established: an additional 16 months before the Regulation begins to produce legal effects.
- As the European Commission has presented it, this is not simply a favour granted to these categories of systems. It is, in fact, a necessary timeframe to ensure that, once the legislation enters into force, both authorities and companies have the proper tools to implement its provisions effectively.
- According to the proposal, we are looking at August 2027, which would give both public authorities and private companies sufficient time to comply with the conditions set out in the legislation.
- When it comes to personal data, activists underline the risks, and it is indeed their role to do so, just as companies welcome the newly introduced amendments, as they are expected to ease operations within the new framework in which we will all function. Since AI development appears to be high on the European Commission’s agenda, and to avoid falling behind, the Commission has decided to balance rights and obligations. This is also why personal data protection rules are being relaxed, so as not to create barriers where innovation should be encouraged.
- There will be numerous discussions from now until the Regulation is adopted, and very likely even after its adoption. We will undoubtedly see both supportive and critical views, as we have seen on very few other topics.
- Once adopted, the Regulation will apply directly across national legal systems. Secondary legislation will be needed, but this will not delay its entry into force or its practical application. It will once again place in balance not only innovation and data protection, but also the position of companies that innovate versus the position of activists and consultants in the field of data protection.
The full interview is available (in Romanian) HERE.
More details about the Digital Omnibus Package are available HERE.
For more insights, please contact Ana-Maria Baciu or Adela Nuță directly.
Details about our Technology & Media practice are available HERE.
Details about our Data Privacy practice are available HERE.