TerraLex AI Guide

Yes. In Poland, AI is primarily regulated by the** EU Artificial Intelligence Act** (Regulation (EU) 2024/1689) (the “AI Act”).

The AI Act is entering into force in stages:

• prohibitions and general provisions: from 2 February 2025;
• governance, GPAI obligations, and penalties: from 2 August 2025;
• most substantive obligations: from 2 August 2026;
• certain high-risk system obligations: from 2 August 2027.

For further details, please refer to the EU chapter of this AI Guide.

The AI Act is directly applicable in all Member States and does not require national transposition, although it requires Member States to designate competent authorities and establish enforcement mechanisms at the national level. For this purpose, Poland is currently working on a draft law (commonly referred to as “UC71” – the Act on AI Systems), which is currently under legislative consideration and is expected to be adopted in the first half of 2026.

The key concepts are defined in the AI Act.

For further details, please refer to the EU chapter of this AI Guide.

The AI Act adopts a risk-based, horizontal regulatory approach.

For further details, please refer to the EU chapter of this AI Guide.

The AI Act applies broadly to all participants in the AI value chain, including providers, deployers (users), importers and distributors, manufacturers placing AI systems on the market under their own name or trademark, and authorised representatives of non-EU providers.

For further details, please refer to the EU chapter of this AI Guide.

Although, as mentioned above, a dedicated national AI Act has not yet been adopted in Poland, AI systems are already subject to a range of existing legal frameworks. The relevance of these frameworks depends on the specific AI use case. In particular: -General Data Protection Regulation (GDPR), where personal data is processed. This includes, among others, requirements relating to lawful basis for processing, transparency, automated decision-making (including profiling), data protection impact assessments (DPIAs), and data minimisation; -Product safety and market surveillance, including Regulation (EU) 2019/1020, where AI systems form part of or are embedded in products placed on the market, triggering obligations relating to product safety, conformity assessment, traceability, and cooperation with market surveillance authorities; -Copyright and related rights (authorship) regulations, which are relevant for AI-generated content. Under Polish doctrine and EU case law, copyright protection is granted only to works that constitute the result of human intellectual creation. This is particularly relevant for AI-generated content, as outputs generated without meaningful human creative input are generally unlikely to qualify for copyright protection;

• Labour law, where AI systems are used in the employment context, in particular in relation to employee monitoring, recruitment, and performance evaluation, as well as obligations concerning privacy and equal treatment / non-discrimination;
• Competition and consumer protection law, where AI systems are used in interactions with consumers or affect market dynamics. The President of the Office of Competition and Consumer Protection (UOKiK) may intervene where AI-driven practices mislead consumers, constitute unfair commercial practices, or otherwise distort competition;
• Sector-specific regulations, depending on the use case, including in particular:
  • medical devices (e.g., safety, performance, and conformity requirements),
  • financial services (e.g., risk management, outsourcing, and model governance),
  • telecommunications (e.g., electronic communications and network security).

In practice, compliance with AI-related requirements in Poland requires a multi-regulatory assessment, rather than alignment with the AI Act alone.

The AI Act applies across the European Union, including Poland, and has extraterritorial reach. It applies to entities established in the EU, as well as to entities outside the EU where the output of an AI system is used within the EU. For further details, please refer to the EU chapter of this AI Guide.

At the national level, Polish regulations apply within Poland. However, they do not establish a separate territorial scope for AI, as this is primarily determined by the AI Act.

The AI Act is cross-sectoral, but specific obligations apply to high-risk sectors, including:

• Biometric identification;
• Critical infrastructure;
• Education and vocational training;
• Employment and HR systems;
• Access to essential services (e.g., credit scoring, insurance);
• Law enforcement;
• Migration and border control;
• Administration of justice and democratic processes.

For further details, please refer to the EU chapter of this AI Guide.

In Poland, key impacted sectors include HR, fintech, the public sector, and healthcare.

Under the AI Act, each Member State must designate a notifying authority, and one or more market surveillance authorities.

In Poland, according to the draft Act on AI Systems:

• a new central body (provisionally referred to as the AI Development and Safety Commission) is expected to act as the market surveillance authority;
• the Minister of Digital Affairs is expected to serve as the notifying authority.

However, these arrangements are still subject to legislative finalisation.

In addition to the AI Development and Safety Commission (the “Commission”), the draft Act on AI Systems provides for cooperation with existing competent authorities, reflecting the cross-sectoral nature of AI regulation. In particular:

• the Polish Data Protection Authority (UODO) is expected to play a role in areas involving the processing of personal data and the protection of fundamental rights, and to participate in the Commission;
• other sectoral regulators may be involved within the scope of their respective mandates, including:
  • the Office of Competition and Consumer Protection (UOKiK),
  • the Polish Financial Supervision Authority (KNF),
  • the Office of Electronic Communications (UKE), and
  • other competent authorities, depending on the specific use case.

The draft does not establish separate AI-specific sectoral regulators. Instead, it relies on a centralised supervisory model supported by cooperation with existing authorities. As a result, the supervision of AI systems in Poland is expected to operate within a multi-regulator framework, combining a central AI authority with sector-specific expertise.

The AI Act provides for significant administrative fines:

• up to EUR 35 million or 7% of global annual turnover (for prohibited practices);
• up to EUR 15 million or 3% of turnover (for other violations);
• up to EUR 7.5 million or 1% of turnover (for providing incorrect information).

In addition, authorities may impose:

• orders to bring systems into compliance,
• market withdrawal or prohibition of systems,
• other corrective measures.

For further details, please refer to the EU chapter of this AI Guide.

Under the draft Act on AI Systems, decisions of the supervisory authority are expected to be subject to appeal before the Court of Competition and Consumer Protection in Warsaw, although the procedural framework is not yet finalized.