GDPR and DORA compliance lands on you. The vendor’s fine did not.

Start with what is not true, because a competitor will say it and you should not repeat it. No Romanian or EU rule forbids a regulated firm from using cloud AI. GDPR Article 28 lets you appoint a processor. DORA Article 30 makes the location of processing a matter of disclosure, not prohibition. The National Bank of Romania’s outsourcing rules name jurisdictions and duties, not server rooms.

What the rules do is put the burden of proof on you, the financial entity or the controller. Three events show what that burden weighs.

May 2025: EUR 530 million, and a promise about servers

On 2 May 2025 the Irish Data Protection Commission fined TikTok EUR 530 million over transfers of European user data to China. The decision found that the transfers infringed Article 46(1) GDPR because TikTok “failed to verify, guarantee and demonstrate” that its safeguards gave the data an equivalent level of protection. CNBC reported the order to bring processing into compliance within six months, and TikTok’s intention to appeal.

One detail matters more than the number. The regulator’s press release records that TikTok had told the inquiry it did not store European data on servers in China, and then in April 2025 “informed the DPC of an issue that it had discovered in February 2025 where limited EEA User Data had in fact been stored on servers in China, contrary to TikTok’s evidence”. The controller believed its own architecture diagram. The diagram was wrong.

December 2024 to March 2026: a fine on the AI vendor, then not

On 20 December 2024 the Italian data protection authority fined OpenAI EUR 15 million. The Hacker News listed the grounds: processing users’ personal data to train ChatGPT without an adequate legal basis, failing to notify a March 2023 breach, and lacking age verification. On 19 March 2026 Reuters reported that a Rome court had cancelled the fine.

Read both ways, the lesson is the same. The vendor spent fifteen months in a legal process about how it handled the data your staff typed in. Whether the fine stood or fell, your firm’s data protection officer could not answer a single question about that processing from documents your firm controls.

January 2026: BaFin puts the LLM inside DORA

Germany’s financial supervisor BaFin published guidance on ICT risks in the use of artificial intelligence, version dated 23 January 2026. It states plainly that “many AI systems cannot be operated without the use of cloud services”, which is why ICT third-party risk applies, and it tells financial entities that “when using cloud services, the financial entity should also consider the risks of unauthorised data leakage, including to the cloud service provider.”

BaFin supervises German banks, not Romanian ones. But DORA is one regulation for the whole Union, and a national supervisor writing down how it reads DORA for LLMs is the closest thing to a preview a Romanian risk officer will get.

The fine goes to the vendor. The register row, the exit plan and the transfer assessment go to you. Only one of those parties can point at the server.

What lands on a Romanian bank or hospital, line by line

• DORA Article 28(8): the financial entity must have an exit strategy for each ICT service supporting a critical function, and it must be “sufficiently tested”. Not the vendor. You.
• DORA Article 30(2)(f): the contract must provide assistance at “no additional cost, or at a cost that is determined ex-ante” when an ICT incident occurs. A per-token API contract rarely says that.
• GDPR Article 46 and the TikTok decision: if the data crosses a border, you carry the burden of demonstrating equivalent protection. No AWS, Azure, Google Cloud or Oracle region has been announced in Romania, so every cloud answer today is a cross-border one.
• GDPR Article 9: a hospital’s prompts are health data by nature. The hardest category, and the one with the fewest excuses.