Poland's AI Systems Act: How the EU AI Act Is Enforced in Poland

The EU AI Act is a regulation, so its obligations apply directly in every member state. What it leaves to each country is the machinery: which authority supervises the market, and how complaints, inspections, fines and appeals work. Poland answered those questions in the Act of July 3, 2026 on artificial intelligence systems (ustawa o systemach sztucznej inteligencji), published in the Journal of Laws (Dziennik Ustaw) on July 27, 2026 as 2026, item 1003.

The Polish act does not rewrite the obligations on providers and deployers. Those still come from Regulation (EU) 2024/1689. Article 1 of the Polish act lists what it covers: supervision of the market for AI systems and general-purpose AI models within the scope of the Regulation, proceedings for breaches, accreditation and notification of conformity assessment bodies, support for AI development, and administrative fines.

Key dates

Article 127 sets these stages as 14 days and 3 months after publication, with Article 125(4) taking effect the day after. The calendar dates above follow from the publication date.

Who enforces the AI Act in Poland

The act creates the Commission for the Development and Safety of Artificial Intelligence (Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji, KRiBSI). Under Article 5 it is Poland's market surveillance authority for AI systems under Article 70(1) of the EU Regulation, and the single point of contact under Article 70(2).

The Commission has a chair, two deputy chairs and four members nominated by the competition and consumer protection office (UOKiK), the financial supervision authority (KNF), the broadcasting council (KRRiT) and the electronic communications office (UKE). The Sejm appoints the chair for a five-year term with the Senate's consent. On September 18, 2026 the Sejm voted to appoint Pamela Krzypkowska as chair. The minister responsible for digital affairs is the notifying authority for conformity assessment bodies (Article 86), and the ministry's office provides the Commission's staff support (Article 43).

What it means for organisations operating in Poland

• A complaint route. Any person or organisation can file a complaint with the Commission (Article 59), electronically or, where that is not possible, on paper. A complaint can lead to proceedings if it points to a possible breach (Article 58).
• Inspections. The Commission can inspect compliance with the Regulation and the Polish act under an approved inspection plan or on the basis of information it receives (Article 48).
• Fines set by EU law, applied in zloty. The Commission imposes fines in the cases and amounts set by Chapter XII of the EU Regulation (Article 104). Euro amounts convert at the National Bank of Poland's average euro rate for January 28 of each year. A fine can be cut by 10 to 50 percent if the organisation completes the steps named in an earlier warning within three months, and the breach did not cause death or serious harm (Article 107).
• Settlements. A party that has stopped the breach and disclosed the relevant facts can ask for a settlement, which can reduce a fine by 20 to 70 percent (Chapter 5).
• Appeals. Fine decisions can be appealed to the Regional Court in Warsaw, sitting as the competition and consumer protection court (Article 109).

Binding individual opinions

An organisation covered by the Regulation, or one planning activity that will bring it into scope, can ask the Commission for an individual opinion on a single issue, about current facts or a planned step (Article 9). The fee is 150 zloty (Article 11). The Commission has 30 days to answer, or 60 days in especially complex cases. If it misses the deadline, the opinion is treated as agreeing with the position the applicant set out (Article 12). An opinion binds the Commission and the other state bodies it consulted on that case (Article 13). For compliance teams, this is a way to get a firm answer on a classification or obligation question before a launch rather than after it.

Regulatory sandbox

The Commission sets up the AI regulatory sandbox (Article 91). By decision, it can let selected participants depart from listed requirements while they test, including the risk management documentation, data, technical documentation, record-keeping, instructions for use and quality management system requirements of the Regulation, or give them support toward meeting those requirements. It can also run a sandbox jointly with other authorities, including the European AI Office.

What is outside the act

Article 2 excludes national defense, national security work of the special services and military intelligence, and scientific research and development, except testing in real-world conditions as the Regulation defines it.

What this means for GRC careers

Poland now has a named regulator, a complaint register, an inspection power and a binding-opinion process. Each of those becomes work for EU AI Act compliance and AI governance teams in Poland: tracking the Commission's opinions and explanations, which it must publish in anonymized form (Article 17), preparing for inspections, keeping an AI inventory that can answer a complaint, and deciding when an individual opinion is worth the 150 zloty. The obligations themselves are the EU ones, so the EU AI Act Readiness Companion remains the place to study them.

See also: open GRC jobs in Poland, the EU AI Act hub, with the current EU timeline and the running list of changes, and the glossary entry on conformity assessment.

Sources: Act of July 3, 2026 on artificial intelligence systems, Journal of Laws 2026, item 1003 (published July 27, 2026); Ministry of Digital Affairs announcement (July 27, 2026); Sejm transcript, 65th sitting (September 18, 2026); Regulation (EU) 2024/1689 (Artificial Intelligence Act).