AY Prime
Polish training and HR company delivering KFS-subsidised courses in AI and automation, digital skills and management for companies with 10 to 5,000+ employees.
Jurisdictions · Poland · reviewed 2026-09-21
🇵🇱 AI regulation in Poland
In Poland the EU AI Act applies directly, and the Act on AI systems (ustawa o systemach sztucznej inteligencji, in force since 11 August 2026) builds the national machinery around it. It creates KRiBSI, the Commission for the Development and Safety of AI, as the supervisor.
From 28 October 2026 KRiBSI can inspect, on seven days' notice and remotely by default, covering documentation, procedures, internal logs, cloud systems and contractor agreements, and can impose the AI Act's fine tiers. For SMEs the lower of the fixed amount and the turnover percentage applies. Companies can request a binding individual opinion for 150 PLN.
Next date: KRiBSI inspections and fines begin, 28 Oct 2026 (in 23 days, upcoming).
KRiBSI tracker: what Poland's AI supervisor can do and has done, each entry with its source. Open the tracker · po polsku
Poland: obligations
| Date | Obligation | Status | Who | What and evidence |
|---|---|---|---|---|
| 11 August 2026 55 days ago | Polish AI Systems Act, main provisions in force Poland · Ustawa o systemach sztucznej inteligencji | In force | Companies and public bodies operating in Poland | National law implementing the EU AI Act. Creates KRiBSI (Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji) as supervisor, a binding individual-opinion procedure (150 PLN fee, 30 to 60 days) and a regulatory sandbox that is free for SMEs. Evidence: Register of AI systems, assigned roles, AI usage policy, vendor commitments. Source: KTZR, Polish AI act summary |
| 28 October 2026 in 23 days | KRiBSI inspections and fines begin Poland · Ustawa o systemach sztucznej inteligencji | Upcoming | Companies and public bodies operating in Poland | KRiBSI may inspect on 7 days' notice, remotely by default, covering documentation, procedures, internal logs, cloud systems and contractor agreements, and may impose the AI Act fine tiers. For SMEs the cap is the lower of the fixed amount and the percentage of turnover. Evidence: Inspection protocol, named contact, document index, trade-secret marking. Source: KTZR, Polish AI act summary |
EU AI Act obligations that also apply in Poland
| Date | Obligation | Status | Who | What and evidence |
|---|---|---|---|---|
| 2 February 2025 610 days ago | AI literacy duty, Article 4 EU · EU AI Act (Reg. 2024/1689) | In force | Providers and deployers of AI systems | Take measures to support the development of AI literacy of staff and others who operate or use AI on your behalf. The Digital Omnibus (July 2026) replaced the earlier duty to ensure, to your best extent, a sufficient level: no specific level has to be guaranteed and no certificate is required. The duty itself was kept, and national authorities supervise it. Evidence: An internal record of trainings and other measures (training register), the training programme and written AI usage rules; a short check of learning is good practice. |
| 2 February 2025 610 days ago | Prohibited AI practices, Article 5 EU · EU AI Act (Reg. 2024/1689) | In force | Providers and deployers of AI systems | Eight practices are banned: harmful manipulation and deception, exploiting vulnerabilities, social scoring, predicting crime from profiling alone, untargeted scraping of facial images, emotion recognition at work and in education (except for medical or safety reasons), biometric categorisation that infers sensitive characteristics, and real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions. Fines up to 35 million euro or 7% of worldwide annual turnover. The Commission's guidelines include recruitment in the workplace emotion ban. Evidence: Classification record showing that no system falls under Article 5; acceptable use policy that forbids the banned uses; vendors' written confirmation for tools with emotion or biometric features. Source: EU AI Act explorer, Article 5 |
| 2 August 2025 429 days ago | General-purpose AI model obligations EU · EU AI Act (Reg. 2024/1689) | In force | Providers of general-purpose AI models only | Technical documentation, copyright policy and a training-data summary for model providers, with extra duties for models with systemic risk. Companies that only use AI tools are not in scope. Evidence: Not applicable to deployers. |
| 2 August 2026 64 days ago | Transparency obligations, Article 50 EU · EU AI Act (Reg. 2024/1689) | In force | Providers of AI that talks to people or generates content; deployers of emotion recognition, biometric categorisation, deepfakes and AI-written public-interest text | Chatbots must disclose they are AI unless obvious. Generated audio, image, video and text must be marked as artificial in a machine-readable way. Deepfakes and AI-generated public-interest text must be disclosed. Disclosure must be clear and given at the latest at first interaction. Not deferred by the Omnibus. Evidence: Disclosure texts in place, marking mechanism documented, transparency checklist completed per system. Source: EU AI Act explorer, Article 50 |
| 2 December 2026 in 58 days | Machine-readable marking of generative AI output EU · EU AI Act as amended by Reg. 2026/1744 | Upcoming | Providers of generative AI systems and, in practice, companies publishing generated content | New obligation introduced by the Digital Omnibus: generated output must carry machine-readable marking. The same package bans generating non-consensual intimate imagery and child sexual abuse material, with penalties up to €35M or 7% of global turnover. Evidence: Marking mechanism in place for every generative system in the inventory. |
| 2 December 2027 in 423 days | High-risk obligations for stand-alone systems (Annex III) EU · EU AI Act as amended by Reg. 2026/1744 | Deferred | Providers and deployers of high-risk AI in employment, education, credit, essential services, law enforcement, migration and justice | Risk management, data governance, technical documentation, logging, human oversight, conformity assessment and registration. Deferred from 2 August 2026 by the Digital Omnibus. Evidence: Risk classification record, impact assessment, vendor documentation, oversight design. Source: Gibson Dunn, Omnibus agreement |
| 2 August 2028 in 667 days | High-risk obligations for AI in regulated products (Annex I) EU · EU AI Act as amended by Reg. 2026/1744 | Deferred | AI embedded in products under EU product law (machinery, medical devices, vehicles and similar) | Deferred from 2 August 2027 by the Digital Omnibus. Evidence: Product conformity files updated for AI components. Source: Gibson Dunn, Omnibus agreement |
What to do first
- List every AI system you use with the free inventory template.
- Check which rows above apply with the readiness scan.
- Put the disclosures in place with the disclosure generator.
- Hold the evidence. In the Compliance Kit the documents that matter most here are:
- 10 Inspection readiness protocol: seven-day-notice checklist, document index, trade-secret marking
- 03 AI inventory: the register an inspector asks for first
- 02 Acceptable use policy: with employee acknowledgment
- 07 Vendor questionnaire: verified vendor commitments
Terms you will meet
AI literacy · AI system · Annex I (AI in regulated products) · Article 50 (transparency obligations) · Biometric categorisation system · Deep fake · Deployer · Digital Omnibus on AI · Distributor · Emotion recognition system · Fine tiers and the SME rule · General-purpose AI model · High-risk AI system (Annex III) · Importer · KRiBSI · Machine-readable marking · Polish Act on AI systems · Prohibited practices · Provider · Serious incident · Substantial modification
The KRiBSI inspection checklist, and a reminder before each date
We send the one-page checklist now, then one email 30 days and one 7 days before each date in the markets you tick. Next: KRiBSI inspections and fines begin, 28 Oct 2026.
Vendors based in Poland
5 verified listings from the directory, each checked against the company's own website. Listing is free; paid placements are labelled.
DCMR Legal
Wrocław law firm selling a ready-to-implement internal AI policy template aligned with RODO/GDPR and the AI Act, delivered as a PDF.
EU AI ActGDPR
Kancelaria Prawna Skarbiec
Warsaw law firm offering AI Act implementation: AI system audits and classification, documentation, employee training, vendor contracts and human-oversight procedures.
EU AI ActGDPR
Kopeć Zaborowski Adwokaci i Radcowie Prawni (KKZ)
Warsaw law firm advising on AI Act system qualification, risk level assessment, value-chain roles and obligations, and documentation and oversight procedures.
EU AI ActGDPR
Sii Polska
One-day Polish-language EU AI Act training covering risk categories, deployer obligations, human oversight and GDPR interplay, with a completion certificate.
EU AI ActGDPR