Business 4 min read By Bethany Hadley
Romanian Firms Using AI Must Train Staff Under EU Rules
Article 4 of the AI Act requires companies using artificial intelligence systems to take measures to ensure AI literacy among their staff, an obligation directly applicable since February 2025.
Companies in Romania that use artificial intelligence in their daily activities already have concrete obligations, and these do not apply only to technology developers. Article 4 of the AI Act, the European regulation on artificial intelligence, requires firms that use these systems to take supporting measures so that their employees have an adequate level of AI literacy. The obligation applies directly from 2 February 2025, without waiting for national transposition.
According to analysis notes, the law through which Romania will establish its enforcement framework is still being prepared. The authority proposed for market surveillance is ANCOM, and until this framework is adopted, companies must take into account the European provisions that are already in force. Meanwhile, Regulation (EU) 2026/1744, known as the "Digital Omnibus", has reworded Article 4, so the current text emphasizes support measures tailored to each company, not a standard form of training.
The rule does not impose a specific format, a minimum number of training hours, or mandatory certification. The measures must be proportionate to the knowledge and experience of each employee, the role they hold, and the context in which they use artificial intelligence. However, the company must be able to show concretely what it has done, as the mere statement that staff were informed is not sufficient.
The article also identifies the practical risks that justify this attention. These include entering personal data or trade secrets into public chatbots, using AI-generated responses without verification, which may be inaccurate or invented, and fraud that uses deepfake voices or messages to impersonate managers. Another risk noted is the use of AI in recruitment or in evaluating employees. Recruitment and human resources systems are classified as high-risk, and specific obligations for them apply from 2 December 2027.
In addition to the AI Act, the General Data Protection Regulation, GDPR, applies in parallel, especially in cases of incidents involving personal data. For this reason, companies that properly manage data protection have an advantage in building their artificial intelligence policies.
The author of the material, Tudor Dumitrescu, a senior software engineer, proposes a practical five-step path for companies that want to meet their obligations. The first step is inventorying the artificial intelligence tools used by employees, including personal accounts, because many risks arise precisely outside official systems. The second step is a short policy that sets out which tools are approved and which types of data may not be entered into them.
The third step is role-based training, starting from real work situations rather than abstract theory. The fourth step is documentation: the firm must keep records of who received training, when, and with what results. The fifth step is a simple incident reporting channel, complemented by periodic refresher sessions.
For Romanian companies, the central message of the material is that the compliance deadline is no longer a distant prospect. The AI literacy obligation is already applicable, and the absence of documented measures may become a problem when authorities begin their inspections after the national law is adopted.
Source: economedia.ro
7
