What does the AI Act mean for companies in Poland?

For companies in Poland, the AI Act means verifying whether the tools being used meet the definition of an AI system, determining the company's role, and assessing whether specific AI applications entail additional obligations.

‍

In practice, companies should:

• inventory the AI tools used within the organization;
• assess whether they are a provider, deployer, importer, distributor, or a manufacturer of a product with an AI component;
• check the risk level of a given system;
• organize contracts with technology providers;
• implement human oversight principles;
• train employees on the safe and lawful use of AI.

‍

The most important thing is not just using AI, but determining what the system is used for, what impact it has on people, and who is responsible for its implementation and oversight.

‍

The AI Act is an EU regulation that changes how companies can design, implement, and use artificial intelligence systems. For companies in Poland, this is not just a legal matter. It is also a question of risk management, documentation, technology providers, data, employee relations, and liability for the consequences of AI system operations.

‍

In practice, companies should treat the AI Act as a new organizational framework for using artificial intelligence. The regulation establishes harmonized rules for placing on the market, putting into service, and using AI systems in the Union, as well as prohibitions on certain practices, requirements for high-risk systems, transparency obligations, and market surveillance rules. At this stage, it may be helpful to consult a law firm in Warsawthat supports entrepreneurs in assessing regulatory obligations, analyzing risks, and preparing documentation in accordance with the new regulations.

‍

Why do the AI Act regulations also apply to Polish companies?

‍

Don't wait for national legislation

‍

The AI Act primarily means that Polish companies do not need to wait for a separate national law to begin preparations or implementation. EU regulations are binding in their entirety and are directly applicable in all member states. However, work is also underway on a national law on artificial intelligence systems (currently being processed in the Sejm). 

‍

Key dates

‍

In accordance with Article 113, the AI Act generally applies from August 2, 2026, although some provisions took effect earlier. Prohibited AI practices and obligations related to AI literacy began to apply from February 2, 2025, and provisions regarding governance and obligations for providers of general-purpose AI models apply from August 2, 2025.

‍

Planned delays

‍

Due to a political agreement on simplifying the implementation of the AI Act, the timeline for certain high-risk systems is set to be postponed. For standalone high-risk systems used in areas such as biometrics, critical infrastructure, education, employment, or migration, the indicated date is December 2, 2027, while for high-risk systems integrated into products, it is August 2, 2028. Until the legislative process is formally concluded, this change should be viewed as the result of a political agreement and a planned schedule.

‍

Who is covered by the regulations?

‍

For businesses, this means that the AI Act applies not only to the largest technology providers but also to entities that use AI systems in their business operations. The scope of the regulation includes, among others, providers placing AI systems on the EU market, deployers of AI systems based in the Union, importers, distributors, manufacturers of products with AI components, and entities outside the EU if the system's output is used within the Union. 

‍

Where should a company start its preparations for the AI Act?

‍

First and foremost, it depends on the company's role and the type of system being used. A company that develops and sells an AI system under its own brand will have different obligations than a technology importer. Furthermore, a different situation may arise when a company uses an AI system for recruitment, employee evaluation, or customer service automation. In such cases, it is essential to analyze not only the tool itself but also legal support for AI projects, which includes risk assessment, documentation, contracts with suppliers, and policies for the responsible use of technology within the organization.

‍

In any case:

• the first step should be to determine whether the solution in question is even an "AI system" within the meaning of the AI Act. Commission guidelines indicate that the Act does not cover all IT systems, but only those that meet the definition of an AI system. This definition includes a machine-based system designed to operate with varying levels of autonomy after deployment and that can exhibit adaptability after deployment, and that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations, or decisions that influence physical or virtual environments,
• next, the company should conduct a risk classification. The AI Act is based on a risk-based approach: some practices are prohibited, some systems will be high-risk, some will be subject to transparency obligations, and minimal-risk systems will not be subject to detailed requirements, although they may still be subject to other regulations, such as the GDPR, labor law, or consumer protection. 

‍

‍

What AI Act obligations might apply to Polish entrepreneurs?

‍

AI Act obligations for Polish entrepreneurs can be divided into several groups. 

‍

Inventory of AI tools

‍

First, a company must know which AI systems it uses and for what purposes. Without an inventory of AI tools, it is difficult to determine whether a company is merely a user of a simple tool, an entity using a high-risk system, or perhaps effectively becoming a provider because it modifies a solution and makes it available under its own brand.

‍

Assessment of the AI model's role

‍

Second, a company should assess the intended purpose of the system. In the AI Act, not only the technology but also the context of use is of key importance. The same model can be a neutral analytical tool in one department and a high-risk system in another if it is used, for example, to evaluate job candidates, assign tasks to employees, assess the creditworthiness of individuals, or support decisions in essential service sectors.

‍

Oversight, documentation, and risk response

‍

Third, a company must implement procedures for the oversight, monitoring, and documentation of AI use. The AI Act requires, among other things, that entities using high-risk systems use them in accordance with the instructions for use, entrust oversight to individuals with appropriate competence, training, and authority, and monitor the system's performance and respond to risks or serious incidents. 

‍

When can an AI system be considered a high-risk system?

‍

High-risk AI systems are those that have a significant impact on the lives of individuals or can substantially affect society. This particularly includes areas such as recruitment and employment, education (e.g., AI systems assessing student competence), healthcare, critical infrastructure management (e.g., AI systems used in energy or water supply), public services (e.g., systems granting social benefits), and the justice system. 

‍

It is important to note that classification as a high-risk system does not mean an automatic ban. Instead, it means that specific requirements must be met to ensure the system functions as intended, is supervised, and that risks to health, safety, and fundamental rights are assessed and mitigated. 

‍

AI Act compliance - what should a compliance program include?

‍

AI Act compliance should not be a one-time audit. It is a process that covers the entire lifecycle of an AI system: from selecting a provider, through implementation, user training, and performance monitoring, to responding to incidents and system changes. The entire process also depends on the role the business plays.

A practical AI Act compliance program may include:

1. a register of AI systems used within the company; 
2. an assessment of whether a given tool meets the definition of an AI system; 
3. risk classification; 
4. identification of the company's role: provider, deployer, importer, distributor, or product manufacturer; 
5. analysis of contracts with AI providers; 
6. a human oversight procedure; 
7. a policy for the use of generative AI; 
8. principles for documenting decisions and incidents; 
9. employee training; 
10. periodic review of systems and providers. 

Particular attention must be paid to the supply chain. The AI Act stipulates that the provider of a high-risk system and any third party providing AI systems, tools, services, components, or processes used in that system must regulate in a written agreement the information, technical access, and assistance required to fulfill their obligations. 

‍

What impact does the EU AI Regulation have on business? 

‍

AI Documentation

‍

Companies will need to know where a system comes from, what its intended purpose is, who is responsible for its configuration, what input data is used, and who oversees the outputs.

‍

Interdepartmental collaboration

‍

The role of legal, compliance, IT, HR, and security departments will grow. AI will no longer be just a technology project. Implementing AI systems in recruitment, customer service, scoring, marketing, user behavior analysis, or cybersecurity will require cross-functional collaboration within the organization.

‍

Vendor agreements

‍

Companies should require vendors to provide additional information, limitations, documentation, usage instructions, data quality standards, oversight mechanisms, and incident reporting procedures.

‍

Competitive advantage

‍

Companies that establish rules for using AI early on will be able to implement new tools faster, without stalling projects during the legal and risk assessment stages.

‍

AI Act requirements for companies in 2026

‍

Given the aforementioned postponement of certain provisions, for Polish companies, 2026 should definitely be treated as a time for operational preparation rather than just the beginning of the analysis phase.

‍

The most important actions for 2026 include: creating an AI use map, conducting risk assessments, updating security and data protection policies, reviewing supplier contracts, implementing human oversight principles, and preparing employees for the responsible use of AI systems.

‍

Companies using general-purpose AI models should also verify whether they are modifying or fine-tuning the models in a way that changes their role under the AI Act. 

‍

How to adapt your company to the AI Act

‍

It is best to start with a simple audit that answers four questions: where do we use AI, what do we use it for, who is responsible for the system, and what impact does it have on people? The way these questions are asked may vary depending on the role assigned.

‍

Next, it is worth implementing an AI policy within the company. It should specify which tools are approved, who can deploy them, what data may be entered into them, when a legal review is required, and when a risk assessment is necessary, etc. For generative tools, the policy should also cover rules for labeling content, verifying results, and protecting trade secrets.

‍

The next step is assigning responsibility. In a small company, this could be the owner, an IT person, or an external consultant. In a larger organization, a team including compliance, legal, IT, cybersecurity, HR, and business process owners will be needed.

‍

Implementing the AI Act in small businesses

‍

The biggest mistake would be to assume that a small company is not subject to the AI Act because it does not create its own AI models. If it uses AI in its professional activities—for example, for candidate selection, customer assessment, automated decision-making, generating marketing content, or analyzing personal data—it should check its obligations.

‍

A small company can start with a minimum set of actions: a list of AI tools, a description of the purpose of use, information about the provider, an assessment of whether the tool involves people or significant decisions, rules for human verification of results, and a ban on entering confidential data into unapproved tools.

‍

It is also worth remembering that the AI Act provides measures to support innovation, with a particular focus on SMEs, including startups. This is important because the goal of the regulation is not to block the development of AI, but to organize its use where the risks are greatest.

‍

What penalties does the AI Act provide for companies in Poland?

‍

Penalty amounts

‍

The AI Act provides for a tiered approach, with the penalty amount depending on the type of violation. The strictest sanctions apply to prohibited AI practices—in accordance with Article 99(3) of the AI Act, for violating the prohibitions in Article 5, providers and deployers can be fined up to 35,000,000 EUR or, in the case of a company, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher. 

‍

Assessment criteria

‍

When determining administrative fines, authorities must take into account, among other things, the nature, gravity, and duration of the infringement, its consequences, the number of affected persons, the size of the operator, annual turnover, market share, the degree of cooperation with authorities, intent or negligence, and actions taken to mitigate damage. 

‍

The importance of compliance

‍

For companies, this means that the compliance procedure itself can have practical significance. Well-documented activities, training, oversight, and a rapid response to incidents can help mitigate regulatory risk.

‍

AI Act compliance step-by-step - a practical guide for companies

‍

Such a practical guide can be broken down into seven steps:

1. Inventory all AI tools within the company. 
2. Determine which systems impact people, business decisions, employees, customers, safety, or other parties.
3. Check whether a given system qualifies as a high-risk system. 
4. Verify suppliers, contracts, and your company's role under the AI Act.
5. Implement principles for human oversight and output control. 
6. Train employees on the safe use of AI. 
7. Regularly update documentation, as AI systems, their applications, and regulatory guidelines will evolve. 

‍

The AI Act does not mean that companies in Poland should abandon AI. It means they should use it consciously, document decisions, control risks, and understand their own role in the chain of responsibility. Well-implemented AI Act compliance can be more than just an obligation; it can be a factor in building trust with customers, employees, and business partners.

‍

Need support with implementing the AI Act in your company?

‍

The AI Act does not mean giving up on artificial intelligence. It means the necessity of organizing the rules for its use, defining responsibilities, and limiting legal, organizational, and business risks.

‍

If you want to check whether your company is using AI in accordance with the new requirements, contact Lawmore. We will help determine which AI systems you use, what role your organization plays, and which actions should be implemented first.

‍

If your company uses AI tools in recruitment, customer service, data analysis, marketing, sales, or decision automation, it is worth checking what obligations may arise from the AI Act. Lawmore can assist with auditing AI tools, risk assessment, preparing an AI policy, analyzing supplier contracts, and implementing compliance procedures.

‍

FAQ – AI Act for companies in Poland

‍

Does the AI Act apply to small businesses?

‍

Yes, the AI Act can also apply to small businesses if they use AI systems in their business operations. It is not the size of the enterprise that matters, but the company's role and how a specific system is used.

‍

Does every company using AI have the same obligations?

‍

No. Obligations depend on whether the company is a provider, deployer, importer, distributor, or manufacturer of a product with an AI component, as well as the risk level of the given system.

‍

How do you start preparing your company for the AI Act?

‍

The best place to start is by taking an inventory of your AI tools and determining how they are being used. Next, you need to define your company's role, the risk level of your systems, and the necessary procedures, agreements, and training.

‍

Does the AI Act prohibit the use of artificial intelligence?

‍

No. The AI Act does not ban the use of AI as such, but it does introduce restrictions on practices deemed unacceptable, as well as additional obligations for high-risk systems and specific AI applications.

‍

What penalties does the AI Act impose on businesses?

‍

The highest penalties apply to violations of prohibited AI practices. In such cases, the sanction can reach up to 35,000,000 EUR or 7% of the company's total worldwide annual turnover for the preceding financial year, whichever is higher.

‍

How can you adapt your company to the AI Act step by step?

‍

A company should list its AI tools, define their purpose, determine its role, assess risk levels, verify vendors and contracts, implement human oversight, and train employees.

‍

Sources:

1. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (AI Act).
2. European Commission, Guidelines on Prohibited Artificial Intelligence Practices Established by Regulation (EU) 2024/1689 (AI Act).
3. European Commission, Guidelines on the Scope of the Obligations for General-Purpose AI Models Established by Regulation (EU) 2024/1689 (AI Act).
4. European Commission, Guide to Prohibited Artificial Intelligence Practices under the AI Act.
5. European Commission, Guidelines on the Scope of the Obligations for General-Purpose AI Models Established by Regulation (EU) 2024/1689.
6. European Commission, Commission Guidelines on the Definition of an Artificial Intelligence System Established by Regulation (EU) 2024/1689 (AI Act).
7. European Commission, Draft Guidelines on the Classification of High-Risk AI Systems under Article 6 of Regulation (EU) 2024/1689 – Annex III.
8. European Commission, Draft Guidelines on the Classification of High-Risk AI Systems under Article 6 of Regulation (EU) 2024/1689 – Annex I.
9. European Commission, Draft Guidelines on the Classification of High-Risk AI Systems under Article 6 of Regulation (EU) 2024/1689 – General Principles.

‍