Poland - AI Systems Regulation (DAISPXX/2024)

Overview

The Draft Act on Artificial Intelligence Systems is a national implementing measure prepared to facilitate and operationalize the EU AI Regulation (Regulation (EU) 2024/1689) in Poland. It was prepared by the Ministry of Digital Affairs and first published on 16 October 2024 on the Rządowe Centrum Legislacji platform; a revised version following public consultations was published on 11 February 2025. The draft focuses on establishing a national oversight architecture, setting conformity assessment and registration rules for high‑risk AI systems, and defining enforcement powers and penalties at the national level. For the official draft and its supporting documents see the RCL project page: RCL - Draft Act on AI Systems (Projekt) and the Ministry information page: Ministry of Digital Affairs - Project (Feb 11, 2025).

Definitions

The draft adopts and cross‑references many definitions from the EU AI Regulation, including categories such as "model AI of general purpose", "provider", "user/deployer", "high‑risk AI system", and "prohibited AI practice". It supplements EU definitions where necessary for national procedural rules (for instance, defining national registration formats, responsible contact points, and the national approach to conformity assessment). Key definitional clarifications are used to set boundaries for when national authorities exercise oversight and how the national register of high‑risk systems is to be maintained.

Governance and Institutional Framework

The draft contemplates the creation or formal designation of a new collegiate supervisory body — the Commission for AI Development and Safety (Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji, KRiBSI) — to act as Poland's central market surveillance and enforcement authority for AI systems. KRiBSI's proposed composition includes representatives of relevant sectoral supervisors (e.g., health, transport, financial supervision) and expert members; the aim is to consolidate market surveillance, provide a national single point of contact for the European AI Board, and coordinate investigations and cross‑sector responses. The Ministry of Digital Affairs is responsible for administering policy, submitting the draft through the RCL process, and coordinating interministerial consultations. The draft also prescribes mechanisms for cooperation with other national authorities — including the Personal Data Protection Office (UODO) on data protection matters and sectoral regulators for domain‑specific controls — and sets out the Commission’s powers to order corrective measures, suspend system operation, require documentation, and levy administrative fines. For ministry statements and background, see Ministry - AI Act implementation.

Key Focus Areas

The draft addresses a set of priority regulatory areas consistent with the EU risk‑based approach: (1) prohibited AI systems and practices — the draft mirrors EU prohibitions for high‑risk abuses (such as certain biometric identification uses and social scoring practices); (2) high‑risk systems — obligations on providers and deployers to perform conformity assessment, implement risk management systems, maintain technical documentation and logs, carry out human oversight and post‑market monitoring; (3) transparency and disclosure — requirements that enable affected persons to understand when AI is being used in decision‑making or content generation; (4) data protection and privacy — explicit cross‑references to GDPR obligations and coordination with the Data Protection Authority for impact assessments; (5) cybersecurity and model security — mandatory baseline security controls, vulnerability management and supply‑chain considerations; (6) market surveillance and conformity assessment — national procedures for registering high‑risk systems and verifying compliance through notified bodies or national assessment schemes; and (7) innovation‑oriented measures — regulatory sandboxes, simplified procedures for certain test environments, and provisions to support research while respecting the EU derogations for bona fide research and testing. The draft also strengthens provisions for incident reporting and cooperation with EU and Member State authorities to respond to cross‑border risks.

Implementation Framework

Implementation relies on a multi‑pillar regulatory architecture: (a) primary obligations on providers and deployers (risk management, DPIAs, technical documentation, record keeping); (b) a national registry for high‑risk systems linked to EU registries; (c) a conformity assessment and notification regime that uses both internal checks and third‑party assessment where required; (d) market surveillance and enforcement powers for the Commission and cooperating authorities; and (e) special procedural rules for innovation tools such as sandboxes and authorisation mechanisms for certain uses. The draft sets timelines for transitional arrangements to align with EU deadlines (notably provisions referenced to the EU Regulation's entry into force dates), and specifies administrative procedures for inspections, requests for information, and appeals.

Monitoring and Evaluation

The draft requires national authorities to monitor compliance, publish periodic reports on market surveillance activities, and share information with the European AI Board. It includes mandatory post‑market monitoring by providers (incident reporting and corrective actions) and obliges the Commission to maintain a national register and to publish summaries of enforcement actions subject to confidentiality rules. The draft also envisages evaluation mechanisms to review regulatory effectiveness after specified timeframes and to coordinate with EU evaluations of the AI Regulation.

Penalties, Liability, and Appeals

Sanctions in the draft follow the EU approach: administrative fines for infringements (with references to the European AI Regulation’s scale), corrective orders (recalls, suspension, market withdrawal), and mandatory remedial measures. The draft distinguishes between administrative enforcement and criminal liability, reserving criminal sanctions for clearly defined intentional or negligent conduct where domestic criminal law applies. The bill also sets out administrative procedural guarantees, including rights of defence, timelines for appeals and judicial review routes, and mechanisms for mitigating sanctions where prompt remediation occurs.

Relationship to Other Instruments

The draft is expressly designed to operate in tandem with the EU AI Regulation (Regulation (EU) 2024/1689) and cross‑references key definitions and provisions. It also coordinates with the General Data Protection Regulation (GDPR) on data protection, national sectoral laws (health, transport, finance), and the national cybersecurity framework. The Government Legislative Council’s opinion recommended close textual alignment with the EU text where definitions are shared and advised harmonisation between art. 88 of the draft and EU timelines (see Rada Legislacyjna opinion of 25 October 2024: Rada Legislacyjna - Opinion (25 Oct 2024)).

International Alignment

The draft is explicitly framed to implement EU law consistently and to enable Poland to meet its obligations under the EU AI Regulation, including cooperation through the European AI Board and cross‑border enforcement. It also recognizes the need for alignment with international best practices on AI safety, model governance, and cybersecurity. The national provisions are therefore tailored to avoid fragmentation while permitting national procedural detail needed for enforcement and market surveillance.

Implementation Timeline

Event	Date / Note
Initial publication of draft on RCL	2024-10-16 (RCL publication of the draft)
Government Legislative Council opinion	2024-10-25 (opinion published)
Revised draft after consultations	2025-02-11 (Ministry published updated draft)
EU AI Regulation earliest applicable provisions	2025-02-02 (some EU rules begin application)
Main EU AI Regulation application date	2026-08-02 (principal provisions of the EU Regulation apply)
Expected national parliamentary and procedural steps	Subject to interministerial agreement, public consultations and parliamentary timetable (dates to be determined)

Compliance Checklist

Action for Providers/Deployers	Evidence / Documentation
Identify if system is prohibited/high‑risk	Classification memo, DPIA
Complete conformity assessment	Conformity certificate / internal verification records
Register high‑risk systems	Registration record in national/EU register
Implement risk management system	Risk management policy, logs, testing reports
Maintain technical documentation and logs	Technical dossier, version history, incident logs
Ensure cybersecurity and model security	Security assessments, patch and update records
Report serious incidents	Incident reports submitted to authority within required timeframe
Support inspections and provide data	Designated contact point and requested documents

Sources and References

Source	Type
Rządowe Centrum Legislacji — Draft Act on Artificial Intelligence Systems (project entry)	Primary Source
Ministry of Digital Affairs — Project (11 Feb 2025 announcement)	Primary Source
Government Legislative Council — Opinion (25 Oct 2024)	Primary Source