From 28 October 2026 Poland’s Commission for the Development and Security of Artificial Intelligence (KRiBSI, from its Polish name) can inspect companies, take complaints and impose fines. Companies that only use AI — ChatGPT, Copilot, a supplier’s chatbot — then ask us not what the act says but: what will they ask me for, and what do I show them? There is no inspection practice yet, because the Commission’s powers are only now starting. The act does, however, say fairly precisely how an inspection runs and what the inspector may demand. That is what our list of six documents to have in the binder now is built on.
Legal position: the act has been passed and is in force — it is not a draft. The Act of 3 July 2026 on Artificial Intelligence Systems (Sejm print no. 2443) was published on 27 July 2026 in the Journal of Laws (Dz.U. 2026 poz. 1003) and entered into force on 11 August 2026. The chapters on inspections, proceedings, settlements, penalties and amendments to other acts, and the provisions on individual opinions (Articles 8–18), enter into force on 28 October 2026. We cite the articles from the Journal of Laws text; position as at 12 October 2026.
We write for the deployer: a company that uses an AI system in its business, including an off-the-shelf tool bought on subscription. If you build an AI system and sell it under your own brand, you are a provider with a wider set of duties — this article does not cover that. The company assesses the system’s classification, its own role under the AI Act (the EU regulation on artificial intelligence) and the legal risk with the help of its lawyer. The legal basis for processing personal data and any data protection impact assessment, where required, are the responsibility of the data controller. It is advised by its lawyer and by its data protection officer, if one has been appointed. A company processing data on the controller’s behalf assists it. We describe the technical and organisational side.
In brief
- The act has applied since 11 August 2026, and KRiBSI’s inspections, complaints, penalties and individual opinions from 28 October 2026.
- An inspection is announced and remote by default: it starts no earlier than 7 days after the notice is delivered and is carried out at a distance, with the exceptions in Article 49(4).
- The inspector may demand material related to the subject of the inspection, including electronic correspondence and access to systems — also cloud systems owned by another entity that the company has access to (Article 52).
- Anyone can file a complaint with KRiBSI — a customer, an employee, a competitor — electronically as a rule (Article 59). A complaint can lead to proceedings, a warning and a decision.
- The answer to an inspection and to a complaint starts from the same documents: the register of systems, the AI literacy file, the transparency record, the reporting path, the supplier file and the human oversight note.
What the Polish act adds to the AI Act
The AI Act, the EU Regulation 2024/1689, applies in Poland directly, and it sets the core duties relating to AI systems. The Polish act organises national supervision: it names who enforces the regulation, by what procedure, and what a company must do during an inspection and proceedings. The EU deadlines (prohibited practices, transparency, high-risk systems) are collected on the page about the AI Act technical compliance sprint, and a broader overview of the act is in the article the AI Act in Poland. Here, only what is Polish:
| What | Article of the act | From |
|---|---|---|
| KRiBSI as market surveillance authority and single point of contact | Art. 5 | 11 August 2026 |
| Inspections of compliance with the AI Act and the act | Arts. 48–57 (Chapter 3) | 28 October 2026 |
| Complaints and proceedings before the Commission: warning, decision | Arts. 58–69 (Chapter 4) | 28 October 2026 |
| Settlement on extraordinary mitigation of sanctions, i.e. an agreement with the Commission on a lower penalty once the breach is remedied | Art. 70 et seq. (Chapter 5) | 28 October 2026 |
| Individual opinions and explanations by the Commission | Arts. 8–18 | 28 October 2026 |
| Regulatory sandboxes, i.e. testing an AI system under the Commission’s supervision | Art. 91 et seq. (Chapter 7) | 11 August 2026 |
| Administrative fines under Article 99 of the AI Act | Arts. 104–111 (Chapter 8) | 28 October 2026 |
The full text of the act is on eli.gov.pl (in Polish), and the Ministry of Digital Affairs’ overview is on gov.pl (in Polish).
The Polish calendar: what has happened and what is ahead
- 3 July 2026 — the Sejm passes the act.
- 27 July 2026 — publication in the Journal of Laws (Dz.U. 2026 poz. 1003).
- 11 August 2026 — the act enters into force; KRiBSI is established (Article 125(1)).
- 18 and 24 September 2026 — the Sejm appoints the Commission’s Chair, and the Senate consents (Monitor Polski 2026, items 945 and 946).
- 28 October 2026 — the Commission can inspect, take complaints, issue warnings, decisions and individual opinions, and impose fines (Article 127, point 2).
- Within three months of the act entering into force — the Commission’s first meeting, called by the Chair (Article 125(3)).
By 28 October it is worth having the documents from the list below ready. From then on it is also worth following the Commission’s Public Information Bulletin: that is where anonymised individual opinions and explanations (Article 17) and decisions (Article 66) are to be published.
How a KRiBSI inspection runs under the act
Where it comes from. The Commission opens an inspection on its own initiative, at the request of the Chair, a Deputy Chair or a Commission member, or at the request of one of the national authorities protecting fundamental rights designated under Article 77 of the AI Act (Article 49(1)). It carries out inspections under an approved plan, on the basis of information it receives, or as part of monitoring compliance with the AI Act (Article 48(2)). A customer’s complaint is one such source of information.
Notice and form. An inspection starts no earlier than 7 days after the notice is delivered (Article 49(2)) and is in principle carried out remotely, by electronic means of communication (Article 49(3)). The Commission may order on-site activities, or an inspection without the 7-day period, where there is a justified suspicion or significant likelihood of harm to life, health, safety or fundamental rights resulting from placing the inspected system on the market, putting it into service or using it (Article 49(4)). The inspector acts on a personal authorisation that states, among other things, the scope of the inspection (Article 51). For a business, matters the act does not regulate fall under Chapter 5 of the Polish Entrepreneurs’ Law, except its Article 51(3a) (Article 48(3)) — how that affects your inspection is for your lawyer to assess.
What the inspector may demand. Article 52(1) lists, among other things:
- access to material, documents and electronic correspondence related to the subject of the inspection;
- access to data carriers, devices and IT systems — including systems and cloud owned by another entity, if they hold the inspected company’s data, to the extent the company has access to them;
- copies, extracts and summaries from documents and databases;
- oral or written explanations;
- recording of inspection activities, after informing the company.
The inspected company provides information and explanations, certifies copies as true to the original and ensures conditions for an efficient inspection (Article 52(2)). Special protection covers communication with an advocate or legal adviser created to obtain legal protection during the inspection, and documents prepared solely for that purpose. The company must declare that the material meets these conditions and bears the burden of showing it; if in doubt, a court decides (Article 54). Obstructing or preventing an inspection is punishable by restriction of liberty or a fine, decided under the procedure for petty offences (Articles 112 and 114). The exception covers supplying incorrect, incomplete or misleading information to a notified body or national competent authority in reply to a request — the AI Act provides an administrative fine for that (Article 112(3) of the act, Article 99(5) of the AI Act).
How it ends. The inspector draws up an electronic report. The company has 14 days from delivery to sign it and return it to the inspector, or to submit written objections to its content (Article 56(6)); failing to do so counts as a refusal to sign (Article 56(8)). If the inspection finds irregularities, the Commission issues post-inspection recommendations with a deadline to fix them — as a rule no shorter than 30 days (Article 57). Failing to implement them can open proceedings over a breach (Article 57(5)).
One thing is particularly worth noting: the act requires the Commission’s annual report to state, among other things, the general level of knowledge and competence of the inspected entities (Article 26(2), point 2), and the method of checking that level is set by an order of the Chair (Article 25, point 3). The rules therefore give grounds to prepare for questions about the knowledge and competence of the people using AI as well. They do not, however, settle the scope of every inspection.
What a complaint can trigger — an example from the company’s side
Any person and any company can file a complaint with the Commission (Article 59(1); the basis is Article 85 of the AI Act). The complaint must name the system concerned, describe the facts and the reasons the complainant sees a breach (Article 59(2)). It is filed electronically or, where that is not possible, on paper (Article 59(3)). The Commission keeps a register of complaints (Article 6, point 12).
An example. A customer writes to the Commission that an online shop’s chatbot discussed their complaint about an order and never said it was an AI system. The complaint alone does not establish a breach or who is responsible: the disclosure duty in Article 50(1) of the AI Act sits with the system’s provider, so the Commission must first establish the roles and any breach. Proceedings and measures may concern the provider, the shop or both — depending on whose duty was not met. What can happen:
- The Commission opens proceedings if it finds that a breach may have occurred (Article 58, point 1(b)), or first an inspection. Proceedings last no longer than 6 months from delivery of the order opening them (Article 60(3)).
- It may issue a warning naming corrective actions — for example fixing the notice or informing customers (Article 61(2)). The party the warning is addressed to has 21 days to report on carrying them out (Article 61(3)).
- If the warning is not complied with, the Commission may, among other things, publish that fact in its Public Information Bulletin (Article 61(4), point 3).
- A decision on the breach orders its effects to be removed within 14 days (Article 62(2)); the Commission takes timely compliance into account when setting a fine (Article 62(3)).
What answers such a complaint on the company’s side: the register row for that chatbot, a dated screenshot of its first message, and the supplier’s answer on how its system meets the disclosure duty in Article 50(1). Whether the supplier’s notice reaches the customer also depends on the greeting and script set up on the company’s side — these documents let you show quickly what happened.
A complaint to KRiBSI versus a complaint to UODO. These are two different routes. KRiBSI deals with breaches of the AI Act and the AI systems act; the President of UODO, Poland’s data protection authority, with breaches of the GDPR, the EU General Data Protection Regulation. The same chatbot can touch both if it processes personal data. The act expressly requires the two authorities to cooperate (Article 20(1), point 3 of the act and the new Article 59a of the Polish Personal Data Protection Act).
Six documents in the binder
The act contains no list of documents for an inspection — Article 52 ties the inspector’s demands to the subject of the specific inspection. The list below is a practical starting point: each document answers a question that may come up in such an inspection. The scope of each depends on the use, the data and the duties agreed with your lawyer.
1. Register of AI systems. A list of every AI tool in the company: system and supplier, who uses it, for what, what data goes in, the company’s role (deployer or provider), duties and the row’s owner. Owner: whoever is responsible for compliance, or IT. The AI Act does not require a register outright, but a register makes it easier to explain which AI systems the company uses. It is also the starting point for answering any complaint.
2. AI literacy file (Article 4). After the July 2026 changes, Article 4 requires the company to take measures that support the development of its team’s AI literacy, with no duty to guarantee a particular level. Minimal version: a list of measures with dates (instructions for using the tools, a short session, rules for the team) and a list of the people they cover. Owner: HR or the team lead. It is worth having to hand, given the Commission has to report the knowledge and competence level of those it inspects.
3. Transparency record (Article 50). For every system that talks to people or generates content: a dated screenshot or recording of the first notice, the supplier’s answer on disclosure and content marking, and a note of where the company itself discloses deepfakes (AI-generated or AI-altered images, audio or video that resemble existing people, objects, places, entities or events and that a person could wrongly take as authentic or truthful; Article 3(60) of the AI Act) or AI-generated text published to inform the public on matters of public interest (Article 50(4)). The second duty does not apply to text that has undergone human review or editorial control where a natural or legal person holds editorial responsibility for the publication. If the company uses emotion recognition or biometric categorisation (sorting people into categories based on features of their body or behaviour) — the notice for the people the system is used on (Article 50(3)). A lawyer checks such a use first, because emotion recognition in the workplace is as a rule a prohibited practice (Article 5 of the AI Act). Owner: whoever runs the channel (marketing, customer service).
4. Reporting and complaints path. One page: where a customer or employee can report a problem with an AI system, who receives it, where the report is recorded and who decides on the response. For most systems the AI Act does not require this — but when a complaint reaches the Commission, a company with such a path learns of the problem earlier and has a record of what it did. For high-risk systems listed in Annex III (from 2 December 2027, subject to the transitional rule described in point 6) there is also a duty to report a serious incident immediately: first to the provider, then to the importer or distributor and the relevant market surveillance authorities (Article 26(5) of the AI Act). Owner: customer service.
5. Supplier file. The contract and terms of service, the system’s instructions or documentation, the data processing agreement (if the supplier processes personal data on the company’s behalf), the supplier’s answers to the Article 50 questions, and a list of the admin panels the company has access to. That last item matters because Article 52(1), point 1 covers cloud systems of another entity to the extent the company has access to them. It is worth knowing in advance which event logs and settings can be exported from such a panel. Owner: whoever ordered the tool.
6. Human oversight note. For every use in which the system prepares something that concerns a customer or employee: who checks the output before it goes further, and when the decision belongs to a person. The formal human oversight duty applies to high-risk systems (Article 26(2) of the AI Act, for systems listed in Annex III from 2 December 2027), as does the duty to keep automatically generated logs for at least six months — to the extent the logs are under the company’s control and unless applicable law, in particular on data protection, provides otherwise (Article 26(6)). For a high-risk system listed in Annex III placed on the market or put into service before 2 December 2027, these duties apply only if its design is significantly changed after that date; such earlier systems intended for use by public authorities must comply by 2 August 2030 at the latest (Article 111(2) of the AI Act). Whether this transitional rule covers your system is for your lawyer to assess. For other systems the note shows the company controls how the tool is used. How to design that oversight is covered in our article on human-in-the-loop. Owner: the process lead.
Individual opinion: what your lawyer will need from you
From 28 October 2026 a company can ask the Commission how the rules apply to its specific situation — including a planned one (Article 9). The application fee is PLN 150 (Article 11(1)); the Commission issues the opinion within 30 days, or 60 days in particularly complex cases (Article 12(1)). If it misses the deadline, the applicant’s position is deemed accepted (Article 12(3)). The opinion binds the Commission and the authorities it consulted, in that case and only for the facts described in the application (Article 13(1)). No opinion is issued on matters already subject to proceedings before the Commission, another authority or a court, or already decided (Article 14), and the Commission may later change or revoke it, for example after a change in the law (Article 15). An opinion is not changed if issuing it caused or may cause irreversible consequences (Article 13(2)), and following it before it is changed, revoked or expires cannot harm the applicant (Article 15(5)).
The application concerns a single issue and must contain an exhaustive description of the facts and the applicant’s position on their legal assessment (Article 9(3)). It also needs a statement that the matter is not the subject of proceedings before another authority or court (Article 10). The same applicant can file another application after 30 days (Article 9(5)). The legal position is written by your lawyer. The description of the facts comes from your documents: the register row, the human oversight note and the supplier file. The more precise those three are, the less work goes into the description of the facts.
When the binder is thin
If you use two or three office tools, none of them talks to customers or generates published content, and nothing touches employment, credit or access to services — you can start with a short register and the list of Article 4 measures. You do not need a contractor for that. Supplier contracts belong in the file anyway, because office tools also process company data; the scope of the other documents grows once a system is in contact with people or prepares something that concerns them.
What next
If the register shows more systems, something talks to customers, or something prepares decisions about people, the technical side is the register of systems, notices and markings implemented in the scope your lawyer sets, tidy documentation and an AI literacy workshop. We have described it under the AI Act technical compliance sprint, and the limits of our role on the page what we don’t do. Tell us what you use. We will tell you where we would start — including when the answer is “write it up yourself”.
Sources and legal position as at 12 October 2026
- Act of 3 July 2026 on Artificial Intelligence Systems, Dz.U. 2026 poz. 1003 — Articles 5, 6, 8–15, 17, 20, 25, 26, 48–62, 66, 70, 91, 104, 112, 114, 123 (the new Article 59a of the Personal Data Protection Act), 125 and 127; the ISAP record with the entry-into-force dates (in Polish).
- Legislative process, Sejm print no. 2443 (in Polish).
- Sejm resolution of 18 September 2026 appointing the KRiBSI Chair, Monitor Polski 2026, item 945 and Senate resolution of 24 September 2026, Monitor Polski 2026, item 946 (in Polish).
- The Ministry of Digital Affairs’ overview of the act on gov.pl (in Polish).
- Regulation (EU) 2024/1689 — consolidated text on EUR-Lex — Articles 3, 4, 5, 26, 50, 77, 85, 99 and 111.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI) on EUR-Lex — the new wording of Article 4 and the high-risk deadlines.