Blog · Published · Updated
AI Act in Poland: when it applies and what changes on 28 October
Short answer
The AI Act, Regulation (EU) 2024/1689, applies in Poland directly and in stages. AI literacy and the prohibitions apply from 2 February 2025 and transparency from 2 August 2026. From 28 October 2026 Poland's new AI supervisory body, KRiBSI, can inspect companies and impose fines. A company that uses ChatGPT, Claude or Copilot has three tasks: the team's AI literacy, a notice at the chatbot and respecting the prohibitions.
- net for implementation for a team of up to 10 people, paid once
- from €1,150
- from start to work of the entire team
- 2 weeks
- after this time, we measure the effect on the same tasks
- 30 days
- conversation with an engineer and a written plan within 2 business days
- €0
We belong to the OpenAI and Anthropic partner programmes and learn through their official courses. What this means ↓
Author: Artem Lisovtsov · Co-founder · Applied AI/ML Architect · 3 min read
Statistics
AI Act in Poland: statistics and dates 2026
28.10.2026
from this day Poland's Commission for the Development and Safety of Artificial Intelligence (KRiBSI) carries out inspections and imposes fines for AI Act breaches in Poland. Source: Dz.U. 2026 item 1003.
2.02.2025
According to article 113 of the AI Act (2026), chapters I and II, including the AI literacy duty in article 4 and the prohibitions in article 5, apply from 2 February 2025.
2.08.2026
According to the European Commission (2026), the transparency obligations in article 50 of the AI Act apply and are enforced from 2 August 2026.
2.12.2027
According to the European Commission (2026), the rules for high-risk systems listed in Annex III of the AI Act apply from 2 December 2027.
€35 million
According to article 99 of the AI Act (2026), using a prohibited practice can bring a fine of up to €35 million or 7% of worldwide annual turnover, and for SMEs the lower of the two applies.
95.9%
According to UODO, the Polish data protection authority (2026), 95.9% of surveyed Polish organisations do not consider themselves ready to roll out AI in line with the GDPR.
Figures checked: 22 October 2026
AI Act dates in Poland
- 012 February 2025AI literacy under article 4 and the prohibitions under article 5
- 022 August 2026transparency under article 50: chatbots and generated content
- 0328 October 2026the Polish act: supervision, inspections and fines in Poland
- 042 December 2026new prohibitions on non-consensual intimate content, and marking of older systems
- 052 December 2027high-risk systems listed in Annex III, including recruitment
- 062 August 2028high-risk systems in regulated products
The 2027 and 2028 dates were moved by Regulation (EU) 2026/1744, the Digital Omnibus on AI of 8 July 2026. The dates are confirmed by article 113 in the AI Act Service Desk and by the Commission's answer on enforcement.
What changes in Poland on 28 October 2026
Until now the AI Act applied in Poland, but there were no Polish rules on who inspects companies and how fines are imposed. The Polish act of 3 July 2026 on artificial intelligence systems came into force on 11 August 2026, and its provisions on supervision, proceedings and penalties apply from 28 October 2026. In Poland the supervisory body is the Commission for the Development and Safety of Artificial Intelligence (KRiBSI). Besides inspections, it issues individual opinions that help assess a use on the border of high risk.
What the AI Act means for a company that uses AI
A company that uses ready-made tools is a deployer of an AI system under the AI Act. For a typical SME, three duties matter.
- The team's AI literacy under article 4: a written training programme and a list of participants
- Transparency under article 50: the customer knows they are talking to a chatbot or a voicebot
- The prohibitions under article 5: no recognition of employees' emotions in the workplace
AI in recruitment and in assessing employees is a high-risk system under Annex III. The duties for such systems start on 2 December 2027, so it pays to prepare a planned use earlier.
The AI Act and the GDPR
The GDPR applies alongside the AI Act. Article 2(7) of the AI Act states that the regulation does not affect the rules on the protection of personal data, so a company that enters personal data into an AI tool meets the duties of both acts. The impact assessment under article 27 of the AI Act complements the data protection impact assessment under the GDPR and may refer to it. According to UODO, the Polish data protection authority (2026), 95.9% of surveyed Polish organisations do not consider themselves ready to roll out AI in line with the GDPR.
Fines for breaching the AI Act
Article 99 of the AI Act sets the upper limits of fines, and member states lay down the rules for imposing them. In Poland, the act on artificial intelligence systems does this.
| Breach | Upper limit of the fine |
|---|---|
| Prohibited practices under article 5 | €35 million or 7% of worldwide annual turnover |
| Other obligations, including transparency under article 50 and the deployer's duties under article 26 | €15 million or 3% of turnover |
| Incorrect or incomplete information given to authorities | €7.5 million or 1% of turnover |
For large companies the higher of the two amounts counts, and for SMEs and start-ups the lower. When setting a fine, the authority takes into account, among other things, the nature of the breach, cooperation with the authority and the steps the company took to limit the harm. The text of the article is published by the AI Act Service Desk.
What to do now: a checklist for a company
An inventory of AI tools on company and private accounts
a register of tools
within the audit from €700
An AI policy: approved tools and data
a document for the team
written by the company, €0
Training with a written programme and a list of participants
evidence of article 4 measures
from €1,150 a day
Labelling the chatbot and data processing agreements
transparency and the GDPR
within the audit
- AI Act and GDPR audit
- from €700 net
- Team training under article 4, one day
- from €1,150 net
Total from €1,850 net
Syntalith prices, net. The audit covers accounts, settings, contracts, the AI policy and the article 4 training.
We can go through this list with your team as part of the AI Act and GDPR audit. In Poland, AI training can receive public co-funding. This article collects the dates and duties, and we leave the assessment of a specific use to a lawyer.
„I already use AI.”
Your people too. Just no rules.
From our conversations with companies
5 na 10 employees paste sensitive data into private AI accounts: contracts, invoices, customer data.
In ESET survey (2026)
1 na 10 admits this in the survey.
Customer data pasted into a private AI account without an data processing agreement is a violation of the GDPR.
Don't worry, we won't tell anyone :)
What do we see in companies that "already use"
- Only ChatGPT or Claude accounts, without plugins, skills, integrations and MCP servers with company tools.
- Company programs are not connected to AI. People still click through systems and Excel, and enter chat data manually.
- Lack of company standards: everyone writes instructions in their own way, no one shares what works.
- No rules for personal data, GDPR and company secrets.
- No limits and no visibility: no one knows who uses AI, how much and for what.
62% Polish employees use AI at work · 27% companies have written rules for working with AI.
Source: ESET and DAGMA, Cyberportrait of Polish business 2026 (March 2026, 1,026 people) ↗
ChatGPT or Claude space review
Accounts, permissions, rules for working with data and 5 tasks set for the team. 1 day.
€450 net
Company accounts, rules of working with data and team training in 2 weeks, from €1,150 net.View implementation for the team →
„Is my data safe?”
Yes. You choose where they go: from your company account to the model on your server.
00Employee's private account
Customer and company data ends up in an account that the company cannot see or control. There is no data processing agreement, so it is a violation of the GDPR. When an employee leaves, the chat history goes with them.
01ChatGPT or Claude corporate account
The provider does not use your data to train models. A copy of the queries remains in his logs for up to 30 days.
02API with zero retention (ZDR)
The provider processes the request and does not save anything. It requires his consent, we prepare the application together.
03Processing in the EU
Queries are counted and stored in Europe: OpenAI in the EU region, Claude via clouds with the EU region.
04Model at your place
The open model runs on your server or in your cloud in the EU. The data does not go outside the company.
What we do with every implementation
- Confidentiality agreement and data processing agreement before we receive any data.
- You choose the cases for the prototype and we anonymize them upon request.
- The data stays in the EU and we delete it after the test.
- Corporate accounts with an administrator on your side.
When data cannot leave the company
The open model runs on your server or in your cloud in the EU. To choose from:
- White-tailed eagle
- Polish model, SpeakLeash and ACK Cyfronet AGH
- PLLUM
- Polish model, HIVE consortium commissioned by the Ministry of Digitization
- Qwen
- Alibaba
- GLM
- Zhipu AI
- DeepSeek
- DeepSeek
We select a model for the task and check it on your cases. We run it, tune it and maintain it.
Source: Bielik and PLLuM, ACK Cyfronet AGH ↗ · PLLuM, Ministry of Digitization ↗
Do you have a lot of your own data? We will fine-tune the small model.
- 1 Your examples
- 2 tuning
- 3 test on new cases
- 4 model at your place
When you have thousands of similar emails, documents or reports, we teach a small open model based on your examples. It works for you, responds quickly and costs less to maintain than a large model. We measure quality on issues that the model has not seen while learning.
Przemysław and Piotr did it in large programming and consulting companies. Artem did it before and does it today at Syntalith. It's about models on your own infrastructure, tuning and quality measurement.
You choose the protection level during the interview. We sign the data processing agreement before we see any data.Schedule a free analysis →
Price
Three packages. You know the price right away.
Team of up to 10 people
from €1,150
net, paid once · 2 weeks
Company, from 11 to 40 people
from €2,300
net, paid once · 3–4 weeks
Organization, over 40 people
from €4,600
net, paid once · 6–8 weeks
- The same packages once you have licenses. To start, an inspection of the space in 1 day is enough: €450 net.
- You buy Claude Team licenses directly from Anthropic, without our markup: USD 20 per person per month for annual payment or USD 25 for monthly payment, from 2 to 150 people.
From conversation to measurement
01 · 30 min
Free process review€0
An engineer picks 3 to 5 of your team's tasks with you. Written plan within 2 working days.
02 · 2 weeks
Rolloutfrom €1,150
Accounts and roles, rules for working with data, training on your team's tasks. You buy licences directly from the provider.
03 · after 30 days
Measurementincluded
We compare task times before and after. We name in writing the tasks worth handing to a system.
or call+48 888 78 48 78WhatsAppMon–Fri 9:00–17:00 CET
Worked example · Scenario
How we count the payback: a chatbot with an AI notice
We run the same count for your company in the free analysis.
€5,817
a month for answering 2,000 customer emails
Payback: 0.6 mo.
5 minutes to read an email and write a reply and checking in 15% of the old time are our assumptions. €34.90 an hour is the EU average hourly labour cost for 2025 according to Eurostat, for companies with 10 or more employees. Model cost: Claude Sonnet 5.5, about 3,000 + 600 tokens per message with a draft reply, at the ECB rate of 1.1205 USD per euro on 22 October 2026.
See the full calculation →Questions
Since when does the AI Act apply in Poland?
The AI Act applies directly and in stages. AI literacy under article 4 and the prohibitions under article 5 from 2 February 2025, transparency under article 50 from 2 August 2026, supervision and fines under the Polish act from 28 October 2026, and high-risk systems in Annex III from 2 December 2027.
Who enforces the AI Act in Poland?
The Commission for the Development and Safety of Artificial Intelligence (KRiBSI), set up in Poland by the act on artificial intelligence systems (Dz.U. 2026 item 1003). Its provisions on supervision, proceedings and penalties apply from 28 October 2026. The President of UODO, Poland's data protection authority, still supervises the GDPR.
Does the AI Act apply to a small company that uses ChatGPT?
Yes, within a narrow scope: measures supporting the team's AI literacy, a notice for customers at a chatbot and respecting the prohibitions in article 5. Most duties fall on providers of systems and on high-risk systems.
What are the fines for breaching the AI Act?
Up to €35 million or 7% of worldwide turnover for prohibited practices, up to €15 million or 3% for other obligations, including transparency, and up to €7.5 million or 1% for incorrect information given to authorities. For SMEs the lower of the two amounts applies.
How much does preparing a company for the AI Act cost?
At Syntalith the AI Act and GDPR audit costs from €700 net, and team training under article 4 from €1,150 net a day. The first call and a written summary cost €0.
