Almost two years after the first draft was published, Poland’s long-awaited Act on Artificial Intelligence Systems entered into force on 11 August 2026. The final act concludes a lengthy legislative process which included several revisions and more than 2,000 comments submitted during public consultations. It establishes the national framework for supervising and enforcing the EU AI Act in Poland, including a new regulator, enforcement procedures, individual opinions and regulatory sandboxes. 

Just two weeks earlier, on 27 July, the AI Omnibus introduced significant changes to the AI Act, including a revised timetable for the application of requirements for high-risk AI systems. At the same time, the gradual roll-out of the AI Act continues: on 2 August 2026, another important set of obligations started to apply, including the transparency requirements under Article 50. Businesses therefore need to keep track of multiple regulatory developments at both EU and national levels. 

Who will supervise AI in Poland? 

Some of the basic premises adopted in the Polish legislation have remained unchanged since 2024, but the details have evolved considerably. One visible example concerns the governance of the new regulator – the Commission for the Development and Safety of Artificial Intelligence (Polish: Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji, KRiBSI). Under the initial proposal, the head of the KRiBSI was to be appointed by the prime minister. Under the final Act, they will instead be appointed by the Sejm with the consent of the Senate. 

The KRiBSI will become Poland’s principal AI market surveillance authority and the single point of contact under the AI Act. Its tasks will include monitoring compliance, conducting enforcement proceedings, managing regulatory sandboxes, and issuing individual opinions and explanations. The KRiBSI will also include representatives designated by key existing regulators, including the Office of Competition and Consumer Protection (UOKiK), the Financial Supervision Authority (KNF), the National Broadcasting Council (KRRiT) and the Office of Electronic Communications (UKE), reflecting the cross-sectoral nature of AI supervision. The new authority is now being set up, with its first meeting expected no later than November. 

More legal certainty before launching AI 

One of the most practically relevant mechanisms for businesses may be the possibility of asking the Commission for an individual opinion. A company will be able to present either an existing situation or a planned AI deployment together with its own legal assessment and ask the KRiBSI to confirm whether that assessment is correct. Anonymized opinions will be published, which may gradually provide businesses with a useful body of practical guidance on how the AI Act is interpreted in Poland.  

This is also an area where the final Act goes further than the original 2024 proposal. While the first draft already provided for individual interpretations, their legal effect was more limited. Under the final Act, the opinion is binding, and if the KRiBSI fails to respond within the statutory deadline, the applicant’s position is deemed correct. Given the limited guidance currently available and the lack of established practice, a well-prepared presentation of the factual background and legal assessment will be crucial to obtaining an opinion that effectively protects the applicant’s position. 

Complaints, inspections and fines – the next date is 28 October 

A significant part of the enforcement framework will take effect from 28 October 2026. This includes provisions governing inspections, infringement proceedings and administrative fines. From that date, individuals, companies and other organizations will also be able to submit complaints concerning alleged infringements of the AI Act or the Polish Act. The Polish Act does not, however, create the substantive AI obligations themselves – these primarily arise directly from the EU AI Act. The national legislation provides the institutional and procedural machinery through which those obligations can be supervised and enforced in Poland. 

Regulatory sandboxes – compliance before enforcement 

The Act also introduces AI regulatory sandboxes, allowing businesses to develop and test AI systems in a controlled environment with the support of the regulator. Companies will be admitted through a competitive selection process for a period of generally six to twelve months, with participation free of charge for micro, small and medium-sized enterprises. For businesses, the main benefit will be the opportunity to address practical AI Act compliance issues before broader deployment. Preparations for the launch of the Polish sandbox are already underway, including the development of a central portal and a dedicated testing environment. 

What about the AI Act itself? 

The Polish Act comes just as the EU implementation timetable has been substantially reshaped by the AI Omnibus. Most importantly, the requirements for high-risk AI systems listed in Annex III – including certain systems used in employment, education, critical infrastructure or access to essential services – will now apply from 2 December 2027. For high-risk AI embedded in regulated products listed in Annex I, the corresponding date is 2 August 2028. The Omnibus has also introduced a number of other significant changes, including new prohibited AI practices, changes to the rules for AI systems integrated into regulated products, and an expanded supervisory role for the AI Office in relation to certain systems. 

Extended deadlines do not mean that businesses can put AI Act compliance on hold. The AI Act is being applied in stages, with a number of obligations already in force. Most recently, on 2 August 2026, the transparency requirements under Article 50 became applicable, including obligations to inform individuals when they interact with certain AI systems and to label certain AI-generated or manipulated content, including deepfakes. These requirements have already raised a number of practical concerns and, in many cases, require significant preparation on the part of businesses. Under the Omnibus, AI providers subject to the technical marking requirements under Article 50(2) benefit from a transition period until 2 December 2026 for systems already placed on the market. 

Taken together, these developments mean that businesses operating in Poland will need to navigate several regulatory tracks in the coming months: obligations under the AI Act that already apply, the gradual launch of the Polish supervisory and enforcement framework, and preparation for the high-risk regime under the revised timetable. At the same time, the focus will now shift from legislation to practice as the new Polish framework begins to operate.