EU AI Act Poland Implementation Guide

Poland’s EU AI Act Implementation Status

Poland is among the EU member states actively developing national implementing legislation for the AI Act. The Ustawa o systemach sztucznej inteligencji (Act on Artificial Intelligence Systems) has progressed through multiple drafts, with the Ministry of Digital Affairs (Ministerstwo Cyfryzacji) leading the legislative process.^[1]

Legislative Timeline

• October 16, 2024: First draft published by Ministry of Digital Affairs, opening public consultation
• February 11, 2025: Revised draft published following public consultation feedback
• June 2025: Updated legislative proposal unveiled with refined supervisory architecture
• August 2, 2025: EU deadline for member states to designate national competent authorities

The draft legislation focuses on three core areas: establishing the national oversight architecture, setting conformity assessment and registration rules for high-risk AI systems, and defining enforcement powers and penalties at the national level. Poland and Spain are notably among the member states that have chosen to create entirely new regulatory bodies rather than delegating authority to existing agencies.^[1]

Current Status Assessment

As of late 2025, Poland’s legislative process remains ongoing. The EU Commission’s August 2, 2025 deadline for designating market surveillance authorities found many member states—including Poland—still finalizing their governance frameworks. However, Poland’s proactive approach in publishing draft legislation demonstrates commitment to timely implementation.^[5]

National Competent Authority: KRiBSI

Poland’s Act on AI Systems establishes the Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji (Commission for AI Development and Security, abbreviated KRiBSI) as the primary national competent authority for AI Act enforcement.^[1]

KRiBSI’s Role and Responsibilities

The Minister for Digital Affairs serves as the notifying authority, responsible for designating and overseeing conformity assessment bodies (notified bodies) that will conduct third-party assessments of high-risk AI systems.^[1]

UODO’s Limited Role

A notable feature of Poland’s implementation architecture is the limited role assigned to the Urząd Ochrony Danych Osobowych (UODO, the Polish Data Protection Authority). Despite the AI Act’s explicit provisions mandating DPA involvement in AI governance, Poland’s draft legislation positions UODO as a "cooperating authority" without voting rights in KRiBSI decisions.^[6]

In July 2025, UODO sharply criticized this arrangement, arguing that enforcement of AI Act provisions related to personal data requires "meaningful participation in decision-making, not merely cooperation." UODO emphasized that relegation to advisory capacity is inadequate given the significant overlap between AI regulation and data protection law.^[6]

Fundamental Rights Protection Authorities

Under Article 77 of the AI Act, Poland has designated several authorities to protect fundamental rights in AI contexts:

• UODO — Personal data protection
• Rzecznik Praw Pacjenta (Patient Rights Ombudsman) — Healthcare AI systems
• Państwowa Inspekcja Pracy (National Labour Inspectorate) — Employment AI systems
• Rzecznik Praw Dziecka (Ombudsman for Children’s Rights) — AI affecting minors

Implementation Timeline

Polish organizations must comply with the EU AI Act’s phased implementation schedule. While Poland’s national law adds domestic enforcement mechanisms, the underlying obligations follow EU-wide deadlines.

Critical Path for Polish Organizations

The August 2026 high-risk compliance deadline is approximately eight months away. Building the required infrastructure—risk management systems, technical documentation, quality management systems, and logging capabilities—typically requires 6-12 months. Organizations that haven’t started compliance work face significant timeline risk.^[7]

Poland’s Digital Strategy Context

Poland’s AI Act implementation occurs within a broader national digital transformation strategy. Understanding this context helps organizations align compliance efforts with government priorities and available support mechanisms.

Policy for AI Development in Poland

In 2020, the Council of Ministers adopted the "Policy for the Development of Artificial Intelligence in Poland from 2020" (Polityka Rozwoju Sztucznej Inteligencji w Polsce), establishing strategic directions across six key areas: society, innovative companies, science, education, international cooperation, and the public sector.^[8]

The policy was updated in 2024, emphasizing administrative competence development and ethical AI implementation. Key priorities include:

• Building AI expertise within government agencies
• Supporting Polish companies in responsible AI development
• Positioning Poland as a significant player in European AI ecosystem
• Ensuring ethical implementation aligned with EU values

Baltic AI Gigafactory Initiative

The Ministry of Digital Affairs has announced plans for the Baltic AI Gigafactory, a major infrastructure project submitted to the European Commission. The initiative targets key sectors including financial services and banking, healthcare and pharmaceuticals, manufacturing automation, and transport/logistics—all areas with significant high-risk AI exposure under the AI Act.^[9]

AI Literacy Requirements

From February 2, 2025, the AI Act requires organizations to ensure staff operating AI systems have "sufficient AI literacy." Polish data shows only 34% of employees currently have access to approved AI tools (compared to 46% globally), with training levels at 35% versus 46% globally. This gap presents both compliance risk and opportunity for competitive differentiation.^[4]

High-Risk AI Sectors in Poland

Poland’s economy includes several sectors with significant exposure to the AI Act’s high-risk requirements. Understanding sector-specific considerations helps organizations prioritize compliance efforts.

Manufacturing

Poland’s manufacturing sector has embraced AI adoption, with 47% of manufacturing companies implementing AI solutions for quality control, customer service, and process automation. Key compliance considerations include:

IT Services and Software Development

Poland ranks among the top-5 globally for software development talent, with an IT market projected to reach $10.35 billion by end of 2025. Polish IT companies face dual exposure:^[3]

• As AI system providers: Obligations under Articles 16-22 for systems sold to EU customers
• As AI system deployers: Obligations under Article 26 for internal AI use
• As integrators of foundation models: Downstream provider obligations for GPAI integration

Poland’s position as a major IT outsourcing destination means compliance failures can have cascading effects across EU supply chains.

Financial Services

40% of Polish financial services firms leverage AI for financial analysis, predictive analytics, and HR processes. High-risk categories include:^[4]

• Credit scoring systems — Determining access to credit (Annex III Category 5)
• Insurance underwriting AI — Risk assessment and pricing (Annex III Category 5)
• Fraud detection systems — May require risk management documentation

Public Sector

Polish government agencies increasingly deploy AI for citizen services. UODO has already intervened in cases involving AI-based scoring in public aid decisions. High-risk exposure includes:

• Automated benefit eligibility determination
• Public service prioritization algorithms
• Administrative decision-support systems

Article 12: Logging Requirements

Article 12 of the EU AI Act establishes one of the most technically demanding requirements for high-risk AI systems: automatic, comprehensive event logging throughout the system’s lifetime. For Polish organizations, implementing robust logging infrastructure is prerequisite to demonstrating compliance with all other high-risk requirements.^[10]

Core Article 12 Requirements

High-risk AI systems must technically allow for automatic recording of events (logs) that enable:

• Risk identification: Detecting situations where the AI may present risk or undergo substantial modification
• Post-market monitoring: Supporting ongoing surveillance per Article 72
• Operation monitoring: Tracking system operation per Article 26(5) deployer obligations

What Must Be Logged

Regulators require logs that "reconstruct the who, what, when, and why for every decision and exception." Specifically:^[10]

Technical Implementation Standards

The draft standard ISO/IEC DIS 24970:2025 (Artificial Intelligence — AI System Logging) provides guidance for Article 12 implementation. Key requirements include:^[10]

• Comprehensive logging framework ensuring traceability and compliance
• Clear logging strategy defined for each AI system
• Tamper-evident storage with integrity verification
• Strict access controls limiting log modification
• Legal retention periods defined and enforced

Provider Obligations for Log Retention

Per Article 19, providers of high-risk AI systems must retain automatically generated logs "to the extent such logs are under their control." This creates ongoing obligations for log storage, protection, and accessibility that extend throughout the AI system’s operational lifetime and beyond.^[10]

Conformity Assessment Pathway

Before placing high-risk AI systems on the Polish market, providers must undergo conformity assessment to demonstrate compliance. The pathway depends on the AI system category and applicable EU harmonization legislation.

Internal Control Assessment

Most high-risk AI systems can use self-assessment (internal control) per Article 43. Providers must:

• Prepare technical documentation per Annex IV
• Implement quality management system (Article 17)
• Establish post-market monitoring plan
• Draw up EU declaration of conformity
• Affix CE marking

Notified Body Assessment

Third-party assessment is required for:

• Biometric identification systems (real-time and post)
• AI systems covered by EU regulations requiring notified body involvement
• Medical AI devices (Class IIa and above)

In Poland, the Minister for Digital Affairs designates notified bodies, which must be accredited per ISO 17065. Typical costs range from €10,000-€100,000 with timelines of 3-12 months.^[7]

Enforcement & Penalties

The EU AI Act establishes substantial penalties for non-compliance, and Poland’s implementing legislation incorporates these into national enforcement mechanisms administered by KRiBSI.

Penalty Structure

Critical note: "Global annual turnover" means worldwide revenue. For multinational corporations operating in Poland, 7% of global turnover could reach billions of euros. Whichever amount is higher applies—even startups face €35M maximum exposure.^[7]

KRiBSI Enforcement Powers

Poland’s national competent authority will have extensive investigatory powers including:

• Access to all documentation demonstrating conformity
• Access to training, validation, and testing datasets
• Access to source code and algorithms (protected as confidential)
• Power to require corrective action or market withdrawal

Compliance Roadmap for Polish Organizations

With eight months until the high-risk AI compliance deadline, Polish organizations need a structured approach to EU AI Act readiness. This roadmap prioritizes actions by deadline and impact.

Immediate Actions (Q1 2026)

Q2 2026: Implementation Phase

• Deploy logging infrastructure meeting Article 12 specifications
• Implement quality management system per Article 17
• Prepare technical documentation per Annex IV
• Establish human oversight mechanisms per Article 14
• Train staff on AI literacy requirements

Q3 2026: Validation and Conformity

• Conduct internal conformity assessment or engage notified body
• Draw up EU declaration of conformity
• Register in EU AI database per Article 71
• Affix CE marking
• Establish post-market monitoring per Article 72

How GLACIS Supports Article 12 Compliance

GLACIS provides the logging infrastructure Polish organizations need to meet Article 12 requirements:

• Automated event capture: Every AI action, decision, override, and system change recorded automatically
• Tamper-evident storage: Cryptographic signing ensures log integrity for regulatory inspection
• Instant retrievability: Audit-ready evidence accessible when KRiBSI or other authorities request it
• Framework mapping: Logs mapped to EU AI Act Articles 9-15, ISO 42001, and NIST AI RMF
• Continuous attestation: Ongoing proof that controls execute correctly, not just point-in-time audits

Frequently Asked Questions

References