Poland’s AI Act: What Changes on 28 October
Poland’s Act on Artificial Intelligence Systems is already in force, but its next major commencement date is just five days away. On 28 October 2026, Articles 8–18 and Chapters 3–5, 8, and 9 enter into force—a deadline that organisations developing or using AI in Poland should treat as an immediate compliance checkpoint.
What's changing
The Act of 3 July 2026 on Artificial Intelligence Systems establishes Poland’s national framework for implementing and enforcing the European Union’s AI rules. It is a national Act, not a regional measure, and its commencement has been staggered.
The Act was published on 27 July 2026 in Dziennik Ustaw, as Dz.U. 2026 poz. 1003. Article 125(4) entered into force on 28 July, and the Act’s general entry into force followed on 11 August, subject to exceptions. The October deadline therefore does not mark the start of the whole Act. It brings the specified articles and chapters into force after the general commencement date.
That distinction matters. Businesses should not treat 28 October as a grace period for obligations that already applied. Equally, they should distinguish requirements commencing next week from those already live, rather than treating the entire national framework as having one start date.
The framework focuses on providers—organisations or individuals developing AI—and deployers, which use AI systems. Its central compliance concerns include avoiding prohibited AI practices and establishing safeguards for high-risk systems. Those safeguards include conformity assessment, risk management, technical documentation, logs, human oversight and monitoring after a system reaches the market. Registration of high-risk systems in a national registry is also a key compliance item.
The Act establishes the Commission for AI Development and Safety, known as KRiBSI, as Poland’s central AI market-surveillance and enforcement authority. Its oversight framework includes powers to request documentation, require corrective measures, suspend system operations and impose administrative fines, alongside cooperation with other regulators, including the Personal Data Protection Office.
The precise commencement boundary is important: Articles 8–18 and Chapters 3–5, 8, and 9 are the provisions starting on 28 October. Before attributing a particular duty or enforcement power to that date, check its location in the Act and any relevant transition rules. The national commencement schedule also does not replace the EU regulation’s separate application timetable.
Who is affected
The practical audience is companies and individuals developing or using AI in Poland. This includes both organisations building systems and those introducing externally supplied AI into their operations. Buying a product from a vendor does not remove the need to understand the buyer’s own role and responsibilities.
The framework is not confined to technology businesses. Employers, financial-services firms, healthcare organisations and other users should screen their AI uses for relevance, rather than assuming their sector falls outside the rules. These are examples of where screening may be useful, not a claim that every system in those sectors is high-risk.
Risk classification is crucial. Not every AI tool attracts the same requirements, while prohibited practices demand a different response from permissible high-risk systems. Organisations should establish what each system does, who is responsible for it and which requirements apply before choosing a compliance route.
Smaller businesses should not assume that size alone puts them outside scope. The immediate questions are their role, the system’s use and its classification. Larger organisations face an additional coordination challenge: AI may be spread across procurement, product teams, human resources and operations, with no single owner holding the full picture.
Three things to do this week
1. Screen your AI inventory for prohibited practices. List systems being developed, purchased, tested or used, and assign an accountable owner to each. Prioritise uses involving biometric identification or social scoring for review: some such practices are prohibited, but the exact legal definition matters. Where a practice is prohibited, do not develop or deploy it. Escalate uncertain cases before further use.
2. Check the conformity-assessment position for high-risk systems. Identify which systems require assessment and gather the supporting evidence. Check risk-management records, technical documentation, logging arrangements and human-oversight instructions. Do not assume a vendor’s general assurance proves compliance. Ask for system-specific evidence and record what remains missing, who will obtain it and when.
3. Verify registration and readiness for oversight. For high-risk systems, check the applicable national-registration requirement, submission route and required information. Confirm responsibility between provider and deployer rather than assuming the other party has completed the task. Assemble an accessible compliance file and assign responsibility for regulatory requests, corrective actions and post-market monitoring. Check which relevant provisions commence on 28 October.
Related context
The Poland AI Regulation Overview provides broader context for Poland’s AI framework. The Roadmap for the Development of Artificial Intelligence in Poland offers policy background, but is not a substitute for the Act’s binding requirements.
For this week, the priority is narrower: confirm your systems, responsibilities and evidence against the provisions commencing on 28 October, without overlooking obligations already in force.
Note: this article was drafted by AI - OpenAI GPT-6.1