AI Regulations in Polish: A Brief Guide to the Act on Artificial Intelligence Systems

The Act of 3 July 2026 on artificial intelligence systems establishes a framework in Poland for the enforcement of the EU’s Artificial Intelligence Act (AI Act). It introduces a new supervisory authority and control mechanisms, whilst providing businesses with practical compliance management tools, such as individual opinions, corrective warnings and regulatory sandboxes.

New Regulator: the Commission for the Development and Safety of Artificial Intelligence

A central element of the Act is the establishment of the Commission for the Development and Safety of Artificial Intelligence—a national market oversight authority within the meaning of the AI Act. The Commission serves as the point of contact with EU institutions and has been entrusted with a wide range of responsibilities: from conducting inspections and issuing decisions on violations, to developing educational publications and clarifications, to issuing individual opinions and establishing so-called regulatory sandboxes.

A Public Council on Artificial Intelligence—an advisory and consultative body—is to operate under the Commission. Of particular importance to the creative industry: candidates from foundations and associations active in the field of collective management of creators’ copyrights may be nominated to the Council.

Individual Opinions—Greater Legal Certainty for Businesses

Individual opinions have the potential to become one of the most practical tools for businesses. Entrepreneurs may submit a request to the Commission for an assessment of a specific AI system or a planned implementation.

The fee for the request is 150 PLN, and the Commission generally has 30 days to issue an opinion—in particularly complex cases, this period may be extended to 60 days. Failure to issue an opinion within the deadline is deemed to constitute an opinion in line with the applicant’s position. This mechanism is familiar from individual tax rulings under tax law and has now been extended to the field of AI.

The opinion is binding on the Commission and other state authorities with respect to the matter in question, and compliance with it may not prejudice the applicant.

Audits: How the Law Will Be Enforced

The Commission will be able to conduct audits both on its own initiative and upon request. As a general rule, inspections will be conducted remotely, with at least a 7-day notice period from the delivery of the inspection notice; however, in situations justified by a threat to life, health, or fundamental rights, the Commission may decide to conduct an on-site inspection at the entity’s premises without observing the 7-day notice period. The inspector may request access to documents and IT systems (including cloud-based systems) used by the entity being inspected, as well as record the proceedings via video or audio after first notifying the entity. Importantly from a legal perspective: the law explicitly protects attorney-client privilege—materials containing communications with a lawyer remain at the inspection site and may not be freely seized by the inspector.

If the audit reveals irregularities, the Commission issues post-audit recommendations with a deadline for rectification, which is generally a minimum of 30 days. Failure to comply may trigger formal proceedings.

Proceedings, Warnings, and Decisions

Proceedings may arise from an inspection, a complaint, or a request by an authorized entity. During the proceedings, the Commission may issue a warning specifying corrective actions, including restricting users’ access to the artificial intelligence system or requiring compliance with disclosure obligations.

If a direct risk to life, health, safety, or fundamental rights is identified, the Commission may order that an artificial intelligence system be used or withdrawn from the market or from use, including with immediate effect.

The Act also amends the Code of Civil Procedure, granting the Regional Court in Warsaw—the court responsible for competition and consumer protection—jurisdiction over appeals against decisions and complaints regarding the Commission’s rulings. An appeal suspends the enforcement of a decision regarding a monetary penalty.

Penalties and the Mechanism for Mitigating Sanctions—Risk Calculation

The Act refers to the penalty system provided for in the AI Act, under which the maximum fines may reach 35 million EUR or 7% of total annual global turnover. At the same time, mechanisms for mitigating these penalties are provided for. Depending on the circumstances—cooperation with the Commission, implementation of corrective measures, entering into a settlement agreement, or voluntary disclosure of a violation—the fine may be reduced by up to 90%.

Regulatory Sandboxes—Safe Testing and Compliance Support

Regulatory sandboxes, established by Commission decision, will enable the testing of AI systems under controlled conditions and with partial exemptions from selected requirements of the AI Act.

Participation is free for SMEs. Other entities pay a fee set by regulation, but not exceeding four times the minimum wage.

Selection takes place through a competitive process. The sandbox program lasts from 6 to 12 months, and after completing participation in the sandbox, a company may, within 90 days, submit a request for a free individual opinion regarding the tested system.

What does this mean for businesses?

The Act on Artificial Intelligence Systems establishes concrete enforcement frameworks for the AI Act in Poland; therefore, in practice, it is advisable to:

1. conduct an audit of the AI systems in use;
2. prepare procedures for handling inspections and protecting legally protected secrets;
3. consider seeking individual opinions;
4. incorporate mechanisms to mitigate sanctions when designing compliance procedures.

The Act entered into force on August 11, 2026, while some of the regulations concerning the organization of the AI oversight system will take effect on October 28 of this year.