1. AI Act: transparency obligations already apply
Since 2 August 2026, users must be clearly informed that they are interacting with an AI system (Article 50 of Regulation (EU) 2024/1689). In some cases, generated content must also be technically marked.
Also check whether your product comes close to the high-risk categories in Annex III: education, recruitment, credit, justice or alternative dispute resolution. For these, the obligations have been postponed to 2 December 2027, but the classification should be analysed from the start, as it shapes the product design.
2. GDPR: the real problem is the data you did not plan for
- Sensitive data. If users can write about their health, private life or beliefs, you need a special condition for processing (Article 9 GDPR), usually explicit consent, separate from accepting the terms.
- Record of processing activities (Article 30). The exemption for companies with fewer than 250 employees does not apply where processing is regular or includes sensitive data, which is the case for most apps.
- Data protection impact assessment (DPIA). AI applied to sensitive personal data is usually high-risk processing. The assessment must be done before launch.
- Your AI provider. Check the data processing agreement, transfers outside the EU, retention periods and whether your data may be used to train the model.
3. Terms and conditions: consumer protection is not negotiable
If you sell subscriptions to consumers, your terms must comply with the rules on pre-contractual information, automatic renewal, the 14-day right of withdrawal and the conformity of digital services. Since June 2026, contracts concluded online must also offer an easily accessible withdrawal function (Directive (EU) 2023/2673).
Clauses copied from US terms, such as mandatory arbitration or a full exclusion of liability, are not valid against consumers in the EU.
4. Cybersecurity: NIS2 and the CRA can surprise a start-up
- NIS2 (in Romania, Emergency Ordinance no. 155/2024). For providers of publicly available electronic communications services, the law applies regardless of company size. If your app allows users to communicate with each other, the classification must be checked.
- Cyber Resilience Act (Regulation (EU) 2024/2847). For installable apps, the obligation to report actively exploited vulnerabilities applies from 11 September 2026. The other requirements apply from December 2027.
5. Intellectual property: who owns the code?
If your app was written by freelance developers, the rights to the code do not automatically pass to your company. Under Romanian law (Law no. 8/1996), you need detailed written assignment agreements. This is the first thing an investor checks.
6. App stores
Apple and Google require, among other things, an accessible privacy policy and the option to delete the account directly in the app. Missing these is a frequent reason for rejection at review.
Conclusion
AI-generated documents are a useful starting point, but they are no substitute for a legal review based on your actual product. Done in good time, such a review is essential for your product's journey. It helps you prevent:
- personal data breaches and their consequences;
- penalties following inspections by the authorities (data protection, consumer protection, cybersecurity);
- user complaints and disputes;
- app store rejections;
- unpleasant surprises in a future due diligence.