AI Act · Poland
EU AI Act enforcement in Poland
Poland built a new AI commission, KRiBSI. From 28 October 2026 it takes complaints and fines, and if it misses the deadline on your question, your answer stands.
Most member states in this series handed the AI Act to regulators they already had. Poland built a new one — and gave companies a way to put a question to it where the regulator's silence counts as agreement.
The Act on Artificial Intelligence Systems of 3 July 2026 (Journal of Laws 2026, item 1003) went through Parliament with wide support: 421 votes to 3 in the Sejm on 11 June, amended by the Senate on 25 June, and finalised on 3 July. The President signed it on 24 July and it was published on 27 July. It takes effect in three stages, and the one that matters to a deployer has not arrived yet.
Three dates, and the one to plan for
| From | What applies |
|---|---|
| 28 July 2026 | Organisational provisions — setting up the commission |
| 11 August 2026 | The core regulatory framework |
| 28 October 2026 | Individual opinions, complaints, inspections, proceedings, settlements and administrative fines |
In other words, Poland's AI law is already in force, but its enforcement tools are not. From 28 October, anyone can complain to the regulator about an AI system, and the regulator can inspect and fine.
A new kind of regulator: a committee of the existing ones
KRiBSI — Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji, the Commission for the Development and Safety of Artificial Intelligence — is Poland's market surveillance authority and single point of contact. Spain also built a new body, but AESIA is an agency with its own staff. KRiBSI is collegial: a committee that brings the relevant existing regulators into one room.
| Seat | Held by |
|---|---|
| Chair | Elected by the Sejm with the Senate's consent, for five years |
| Members | Representatives of UOKiK (competition and consumers), KNF (financial supervision), KRRiT (broadcasting) and UKE (electronic communications) |
| Administrative support | The Ministry of Digital Affairs |
| Advisory | A Social Council for Artificial Intelligence |
KNF and UOKiK keep their own powers in their regulated sectors. The data protection authority, UODO, has a cooperating and advisory role rather than a seat, and it has publicly objected to that.
The design question that follows it. KRiBSI's staff, budget and infrastructure come from the Ministry of Digital Affairs — the ministry whose digital policy it is meant to oversee independently. Oxford's Blavatnik School flagged this before the law passed. It will not change what you owe, but it may shape how aggressively the commission uses its powers in its first years.
The part without equivalent: silence is an answer
From 28 October, a company can describe its facts on one issue and ask KRiBSI for an individual opinion on how the AI Act applies to them.
| Feature | Rule |
|---|---|
| Fee | 150 zloty |
| Deadline | 30 days; 60 for particularly complex matters |
| If KRiBSI does not answer in time | The position the applicant put forward is treated as accepted |
| Scope | Binding only for the facts as described |
| Durability | KRiBSI can revoke an opinion or declare it expired |
Tax rulings work this way in many countries. For AI regulation it is unusual: everywhere else in this series, a company that wants certainty reads guidance and hopes. In Poland it can file its own reading of the law, and if the regulator is too busy to reply, that reading stands.
There are two caveats. First, an opinion only covers the facts you describe, so if the description is incomplete, so is the protection. Second, commentators have criticised how open-ended the grounds for revoking an opinion are, and an opinion can expire if the commission later publishes general guidance that conflicts with it. It gives you firmer ground, not immunity.
Why the facts are the hard part. An opinion protects the situation you described. A company that asks whether its recruitment agent is high-risk, without knowing which other agents share its credentials or what data they reach, gets a confident answer about a system that is only part of what it runs. To ask a useful question, you need to know what you actually operate.
Complaints, from anyone
Also from 28 October, Poland opens a national route for anyone to complain to KRiBSI about an AI system they believe breaches the Act. Germany built a central complaints office for the same reason: complaints from people outside a company are how a supervisor finds systems it would never have inspected. In Poland the complaints route and the fining power start on the same day.
Fines — and no exemption for the state
| Breach | Ceiling |
|---|---|
| Prohibited practices | €35m or 7% of worldwide annual turnover |
| Other operator and transparency obligations | €15m or 3% |
| False or incomplete information to the authority | €7.5m or 1% |
SMEs face lower thresholds. The notable choice is who else is covered: public bodies are reported to be subject to the same framework. Spain answers public-sector breaches with warnings and internal discipline. Ireland caps fines on public bodies at €1m. Poland, on the reported text, makes no such exception.
A sandbox, due by August 2027
- Must be operating by 2 August 2027.
- Participation lasts six to twelve months.
- Free for micro, small and medium-sized enterprises; local government fees capped at twice the minimum wage.
- About 35 million zloty for a central portal and secure testing infrastructure.
Spain's sandbox has a cohort history and published results. Poland's is a commitment with a budget, and the time to prepare an application is before it opens.
Where AI in hiring goes
| Member state | Who supervises AI in hiring | Institutional type |
|---|---|---|
| France | CNIL | Privacy regulator |
| Netherlands | AP | Privacy regulator |
| Ireland | Workplace Relations Commission (prohibited practices) | Employment body |
| Spain | AESIA | Purpose-built AI agency |
| Italy | ACN | Cybersecurity agency |
| Poland | KRiBSI | New commission made up of existing regulators |
Of the six states in this table, Poland is the only one where the data protection authority has no supervisory role of its own under the Act: UODO cooperates and advises, but has no seat. A group policy that assumes the data protection authority will be the first to ask about recruitment AI will be wrong in Warsaw.
Where Poland stands
| Item | Position |
|---|---|
| Instrument | Act on Artificial Intelligence Systems of 3 July 2026, Journal of Laws 2026 item 1003; signed 24 July, published 27 July |
| Article 70 designation | KRiBSI, as market surveillance authority and single point of contact |
| In force | 28 July (organisation) · 11 August (framework) · 28 October 2026 (opinions, complaints, inspections, fines) |
| Constitution | Chair elected by the Sejm with Senate consent, five-year term; members from UOKiK, KNF, KRRiT, UKE; supported by the Ministry of Digital Affairs |
| Individual opinions | 150 zloty; 30 or 60 days; silence means acceptance |
| Sandbox | Due by 2 August 2027; free for SMEs |
| High-risk obligations apply | 2 December 2027 (stand-alone) · 2 August 2028 (embedded) |
| Prohibitions in force since | 2 February 2025 |
What a Polish deployer should do now
- Draft your opinion requests before 28 October. Pick the classification questions you are least sure of — is this system high-risk, does this agent count as a deployer's system — and have them ready to file on the day the route opens.
- Describe the facts completely, or the protection is partial. An opinion is only as good as the description behind it. That means knowing which agents and machine identities exist, what each can reach and who owns it, before you write the question.
- Assume complaints will arrive. From 28 October anyone can complain. Know which of your systems a customer, candidate or employee interacts with directly, because those are the ones a complaint will name.
- If you are a public body, do not assume leniency. On the reported text, Poland has not given the state the exemption Spain did.
- Start the six-month log retention now. Article 26 requires deployers to keep system logs for at least six months. Logs you did not keep cannot be reconstructed for an inspection later.
Questions
Who enforces the EU AI Act in Poland?
KRiBSI, the Commission for the Development and Safety of Artificial Intelligence, created by the Act on Artificial Intelligence Systems of 3 July 2026. It is the market surveillance authority and single point of contact. It is a collegial body: a chair elected by the Sejm with the Senate's consent for five years, and members representing the competition authority UOKiK, the financial supervisor KNF, the broadcasting council KRRiT and the telecoms regulator UKE. Sector regulators such as KNF and UOKiK keep their own powers in their regulated areas.
When does Polish AI Act enforcement start?
In stages. Organisational provisions applied from 28 July 2026 and the core framework from 11 August 2026. Individual opinions, complaints, inspections, proceedings and administrative fines apply from 28 October 2026.
What is an individual opinion from KRiBSI?
A company can describe its facts on one issue and ask KRiBSI how the AI Act applies. The fee is 150 zloty and KRiBSI has 30 days, or 60 for complex matters. If it does not answer in time, the position the company put forward is treated as accepted. The opinion is binding only for the facts described, and the Act allows KRiBSI to revoke an opinion or declare it expired, which commentators have criticised as a source of uncertainty.
What are the fines in Poland?
Poland applies the AI Act's ceilings: up to 35 million euro or 7% of worldwide annual turnover for prohibited practices, 15 million euro or 3% for other operator and transparency obligations, and 7.5 million euro or 1% for false or incomplete information. Lower thresholds apply to SMEs. Unlike Spain, which exempts public administrations from fines, and Ireland, which caps them, Poland's reported framework applies to public bodies too.
Does Poland have an AI regulatory sandbox?
It must have one by 2 August 2027. Participation runs for six to twelve months, is free for micro, small and medium-sized enterprises, and local government fees are capped at twice the minimum wage. About 35 million zloty is set aside for a central portal and secure testing infrastructure.
Related
Agent Trust Cloud
We publish this because Poland gives deployers something rare: a way to get a regulator's position in writing, on a deadline. That only helps if the facts you submit are complete, and for most organisations the incomplete part is the list of agents and machine identities already running. Agent Trust Cloud is building a control plane for AI agents — identity, policy, evidence. The platform is in development and is not sold as a subscription today; what is available now is a fixed-scope assessment of the agents and machine identities you already have.