Legal status as at: 21 October 2026, Marta Lampart, Attorney-at-Law
From 28 October 2026, the provisions of the Polish Act on Artificial Intelligence Systems relating to inspections, proceedings and penalties will come into force. From that date, the Commission for the Development and Safety of Artificial Intelligence (KRiBSI) will be able to monitor how companies use AI, receive complaints and impose penalties for breaches of the EU AI Act. The Act does not introduce any new obligations regarding the use of AI itself. Instead, it establishes a body to check whether you are complying with these obligations.
In this article, I explain who will carry out the inspections and how, how much breaches can cost, what rights a business owner has, and what steps a company should take even before the first inspections take place.
What is the Artificial Intelligence Systems Act?
This is the Act of 3 July 2026 on artificial intelligence systems (Journal of Laws of 2026, item 1003). Its main purpose is to organise the supervision in Poland of the implementation of the EU Regulation on artificial intelligence, known as the AI Act.
It’s worth understanding this properly – obligations relating to AI arise from the AI Act, which is directly applicable in all EU countries. It is this regulation that provides, for example, for the prohibition of certain practices, the obligation to ensure competence in the field of AI, and the labelling of deepfakes. The Polish Act states that, who enforces these obligations in Poland, and under what procedures: establishes a supervisory body, control and procedural rules, and rules on the imposition of penalties. Find out more about the Act at gov.pl.
Since when has the AI Act been in force?
The Act was promulgated on 27 July 2026, and its provisions come into force in stages:
- 28 July 2026 – an organisational provision which enabled work to begin on setting up the new Commission’s support structures.
- 11 August 2026 – the bulk of the Act, including the provisions on the establishment of KRiBSI and the regulatory sandbox framework.
- 28 October 2026 – inspections, infringement proceedings, administrative fines, complaints, individual opinions and settlements with businesses.
In addition to this, the deadlines set out in the AI Act itself apply. Prohibited practices and the obligation to ensure competence in the field of AI come into force on 2 February 2025, whilst transparency obligations – including the labelling of AI-generated content – come into force on 2 August 2026. I have written in detail about who is required to label content and when in an article Labeling AI-generated content starting August 2, 2026: Who is required to do it, who isn’t, and how is it done?.
What is KRiBSI and what can it do?
The Commission for the Development and Safety of Artificial Intelligence is a new AI market supervisory body in Poland. It is a collegial body. The Chair is appointed by the Sejm, with the consent of the Senate, for a five-year term. The Act allows two months from its entry into force (until 11 October 2026) for this to take place, and the Commission’s first meeting is to be held within three months (by 11 November 2026).
The main tasks of KRiBSI:
- overseeing compliance with the AI Act and Polish legislation,
- inspections, infringement proceedings and penalties,
- receiving complaints from individuals and businesses,
- issuing individual opinions and clarifications,
- operating a regulatory sandbox,
- cooperating with other authorities, including the President of the Personal Data Protection Office (UODO) and the Patent Office.
The Commission is also supported by the Public Council on Artificial Intelligence, an advisory and consultative body. It comprises between 9 and 15 members appointed by the Commission for a two-year term, including from among candidates nominated by ombudsmen and chambers of commerce.
What will the inspection involve?
An investigation may be initiated either on the authority’s own initiative or following a complaint. The key principles are:
- Remote inspections are the norm. They commence no earlier than 7 days after notification.
- An on-site inspection without waiting 7 days is possible where there is reasonable suspicion or a significant likelihood of harm to the life, health, safety or fundamental rights of individuals.
- Inspectors may request documents and electronic correspondence, gain access to IT systems (including those in the cloud), make copies, secure data and request explanations.
- Correspondence with a representative is protected. Disputes as to whether a particular document is protected are settled by the Regional Court in Warsaw.
- The report must be signed or objections raised within 14 days.
- Post-inspection recommendations must be implemented within at least 30 days.
Obstructing or thwarting an inspection constitutes an offence punishable by a restriction of liberty or a fine.
What happens when KRiBSI identifies a breach?
The Act provides for a graduated response rather than automatic penalties:
- Warning. Where the Commission suspects an infringement, it may first issue a warning. You then have 21 days to set out the corrective measures you intend to take.
- Decision. In its decision, the Commission orders the consequences of the infringement to be remedied within 14 days of its service and may impose a fine.
- Urgent procedure. Where an AI system poses a risk, the Commission initiates proceedings of its own accord and conducts them within a maximum of 7 days. In the event of an immediate threat to life, health, safety or fundamental rights, it may order the suspension or withdrawal of the system and make that decision immediately enforceable.
Proceedings should not last longer than 6 months. Decisions are published in the Public Information Bulletin, and systems on which penalties have been imposed are included in a public register. Appeals against decisions are heard by the Regional Court in Warsaw – the Court for Competition and Consumer Protection.
What penalties apply for breaching the AI Act?
The level of fines is set out in Article 99 of the AI Act, whilst the Polish Act specifies who imposes them (KRiBSI) and the procedure to be followed. The provisions set out maximum amounts. In the case of undertakings, the higher of the following two amounts applies: the amount in euros or a percentage of the total annual global turnover from the previous financial year.
| Infringement | The maximum penalty. |
|---|---|
| The use of prohibited practices (section 5 of the AI Act), such as manipulation or social evaluation | up to 35 million euros or 7 per cent of turnover |
| Breaches of other obligations, including those of entities using AI (Article 26) and transparency obligations, such as the labelling of deepfakes (Article 50) | up to 15 million euros or 3 per cent of turnover |
| Providing false, incomplete or misleading information to the authorities | up to 7.5 million euros or 1 per cent of turnover |
Small and medium-sized enterprises, including start-ups, They pay the lower of the two amounts: either the fixed sum or the percentage.
These are upper limits, not rates. When determining the amount of the fine, the Commission takes into account, amongst other things, the nature, gravity and duration of the infringement, the size of the undertaking and its market share, the benefits derived from the infringement, whether it was intentional, and the level of cooperation with the authority and the measures taken to mitigate the harm.
The fine must be paid within 30 days of the decision becoming final. An appeal to the court suspends enforcement of the part of the decision relating to the fine, unless the Commission has declared the decision immediately enforceable.
How can you reduce the penalty?
Polish law provides for several ways to mitigate penalties:
- Carrying out the measures specified in the warning. If, within 3 months of the penalty decision being served, you carry out the measures previously specified in the warning, the Commission may reduce the penalty by 10–50 per cent, provided that the infringement did not result in death or serious injury.
- A settlement with the Commission. This allows the fine to be reduced by 20–70 per cent, and in exceptional mitigating circumstances, the Commission may even waive the penalty altogether. The condition is that you cease the infringement and disclose all relevant facts. Accepting a settlement means waiving your right to appeal to the courts.
- Voluntary reporting of an infringement. If proceedings were initiated on the basis of your report, and you had already ceased the infringement prior to the proceedings, the reduction under the settlement may amount to 30–90 per cent.
- Deferral or instalments. Upon a justified request, the Commission may defer the payment deadline or allow the fine to be paid in instalments.
Who are the new regulations aimed at?
Not just tech companies. The AI Act covers both contractors, who develop AI systems, as well as enterprises applying, that is, any company, shop, agency or creator that uses AI in its operations. If your company uses a chatbot on its website, generates graphics for adverts, or uses AI in recruitment or customer service, it may be subject to scrutiny by KRiBSI.
Just because you’re using a tool from a well-known company doesn’t mean you’re off the hook. The provider is responsible for how the tool works, but you’re responsible for how you use it.
Who can lodge a complaint with KRiBSI?
Anyone – whether an individual, a company or another organisation – may lodge a complaint regarding a possible breach of the AI Act or Polish legislation. A complaint may be lodged by a customer, a job applicant rejected by an AI system, or even a competitor. As a rule, complaints are submitted electronically and should describe the AI system, the facts of the case and the nature of the breach.
A complaint does not automatically lead to a penalty or even to proceedings. It may, however, prompt the Commission to launch an investigation. In practice, this means that the source of the problem is more likely to be a dissatisfied customer than a random inspection.
Individual advice: how can you ensure you’re acting in accordance with the law?
This is one of the most interesting tools for entrepreneurs. From 28 October, you can ask KRiBSI for an opinion on a specific matter, such as whether your system is a high-risk system or whether a particular use of AI requires labelling.
- In your application, you describe a single matter and set out your own legal position.
- The fee is 150 zł.
- The Commission has 30 days to respond, or 60 days in particularly complex cases.
- If it does not respond within this time, it is assumed that it agrees with your position.
- The opinion is binding on the Commission, but only in relation to the facts you have described.
A well-prepared application is, in practice, a cost-effective way to achieve legal certainty, particularly for AI implementations intended to operate for many years.
A regulatory sandbox for innovative projects
Companies developing their own AI solutions may apply to take part in the regulatory sandbox. This is a controlled environment in which a system can be tested with the Commission’s support and, to a certain extent, with exemptions from certain obligations. Participation is awarded through a competitive selection process, lasts between 6 and 12 months, and is free of charge for small and medium-sized enterprises.
What needs to be done in the company before 28 October? A checklist
- List AI toolsused by the company and its employees, including those used ‘privately’ for work.
- Determine your role for each tool: are you using a ready-made solution or offering it under your own name?
- Check that you are not engaging in prohibited practices under Article 5 of the AI Act, e.g. manipulation or assessing people on the basis of social behaviour.
- Ensure your team has the necessary AI skills (Article 4 of the AI Act) and adopt an AI usage policy.
- Comply with transparency obligations: the chatbot must state that it is an AI, and realistic content generated by AI must be labelled as such.
- Organise your documentationso that you can produce it quickly during a remote inspection: a list of tools, policies, labelling rules and contracts with suppliers.
- Determine who in the company is responsible for liaising with KRiBSI , who signs the report, and which authorised representative you are working with.
FAQ: Frequently Asked Questions about the Artificial Intelligence Systems Act
Does the Act on Artificial Intelligence Systems introduce new obligations for businesses?
As far as the actual use of AI is concerned – essentially not. The obligations stem from the AI Act. The Act establishes a supervisory authority and procedures through which these obligations can be enforced in Poland.
Can KRiBSI inspect a small business or an online content creator?
Yes. The Act does not exempt small entities from inspection. However, lower maximum penalties are provided for small and medium-sized enterprises.
Can you also be fined for breaches that occurred before 28 October?
The obligations under the AI Act apply regardless of the Polish Act, so the date of 28 October does not ‘reset’ any previous breaches. It is safest to sort this out now, before a complaint is lodged.
Will KRiBSI impose a fine straight away?
Not necessarily. The Act provides for a warning with a 21-day deadline for remedial action, and compliance with the recommendations and cooperation may significantly reduce any potential fine.
Gdzie odwołać się od decyzji KRiBSI?
To the Regional Court in Warsaw – the competition and consumer protection court.
How much does an individual opinion cost?
150 zł. The Commission has 30 days to respond, or 60 days in complex cases.
Summary
From 28 October 2026, the AI Act will no longer be a ‘law without a regulator’ in Poland. KRiBSI will be able to carry out inspections, receive complaints and impose penalties, whilst at the same time offering businesses tools that provide legal certainty: individual opinions and a sandbox. Companies that already know which AI tools they are using and are able to demonstrate this in their documentation will have the greatest advantage.
If you wish to organise the use of AI within your organisation, draw up an AI policy or submit a request for an individual opinion, schedule a consultation or visit the website Artificial Intelligence. And if you’re creating content using AI, have a look at my e-book „Oznacz albo nie?”
__
About the author. Marta Lampart is a Attorney-at-Law and has been running her own law firm for many years. Her areas of expertise include intellectual property law and artificial intelligence law: she helps creators, influencers and entrepreneurs to protect their brands and content, and to use AI in accordance with the law. More about the author.
This article is for information purposes only and does not constitute legal advice on any specific matter.
