Poland AI Regulation Overview

Overview

Poland's approach to artificial intelligence regulation has evolved from strategic policy planning into a concrete, legally binding framework designed to implement European Union mandates. Early national foundations were established through strategic policy declarations, including the 2018 Assumptions to AI Strategy, the 2019 Roadmap and Inter-Ministerial Memorandum, and the landmark 2020 Policy for the Development of Artificial Intelligence in Poland from 2020 (adopted via Council of Ministers Resolution No. 196). These policy instruments established national R&D priorities, skills initiatives, public sector adoption pathways, and ethical standards aligned with international guidance.

In parallel, Poland has established binding statutory frameworks to govern data access, governance, and AI market surveillance. Key statutory pillars include the Act on Open Data and Re-use of Public Sector Information (enacted in 2021 to transpose the EU Open Data Directive), the Draft Act on Data Management (transposing the EU Data Governance Act), and the Draft Act on Artificial Intelligence Systems (prepared by the Ministry of Digital Affairs to operationalise the EU AI Regulation). Strategic orientation for national digital transformation is further defined by the draft Strategy for the Digitization of Poland to 2035, setting long-term targets across public administration, healthcare, and enterprise AI adoption.

Regulatory Approach

Poland follows a hybrid regulatory approach that combines horizontal statutory legislation with risk-based enforcement mechanisms derived directly from EU directives and regulations. National legislation transitions European requirements into procedural rules, institutional structures, and supervisory processes within the Polish legal administrative framework. Rather than enacting a standalone, divergence-focused national AI code, Polish authorities use legislative measures as complementary procedural instruments that enforce risk categories, conformity assessment standards, and transparency mandates defined at the EU level.

Under the primary national implementing measure—the Draft Act on Artificial Intelligence Systems—Poland operationalises the EU's risk-based scheme. This approach categorises AI practices into prohibited systems, high-risk systems requiring mandatory pre-market conformity assessments, registration, and human oversight, and lower-risk systems subject to targeted transparency obligations. Strategic policies encourage innovation through flexible measures, such as regulatory sandboxes and simplified testing environments, while maintaining strict coordination across domain-specific regulators and data protection authorities.

Key AI Legislation

• Act on Open Data and Re-use of Public Sector Information (2021): In-force statute transposing Directive (EU) 2019/1024. Mandates open, machine-readable formats, cataloguing of high-value datasets, API access for dynamic data feeds, and establishes the national data portal (portal danych) managed by the minister competent for informatization.
• Draft Act on Artificial Intelligence Systems (2024/2025 Draft): Proposed implementing bill designed to operationalise Regulation (EU) 2024/1689 (EU AI Act) in Polish law. Defines national market surveillance powers, designates KRiBSI as the single point of contact, and establishes high-risk registration and conformity assessment oversight.
• Draft Act on Data Management (2024/2025 Draft): Transposes Regulation (EU) 2022/868 (EU Data Governance Act). Regulates controlled re-use of protected public data, introduces notification and neutrality requirements for data intermediation services under UODO oversight, and sets rules for data altruism organisations.
• Policy for the Development of Artificial Intelligence in Poland from 2020: Adopted policy framework (Resolution No. 196) outlining short-term (to 2023), medium-term (to 2027), and long-term measures across six priority areas: society, innovative firms, science, education, international cooperation, and public sector adoption.
• Strategy for the Digitization of Poland to 2035 (2024 Draft): Comprehensive governmental strategy establishing cross-sectoral digital transformation targets, including 50% enterprise AI tool adoption and AI-assisted diagnostics across 100 disease units.
• Foundational Policy Declarations (2018–2019): Includes the Assumptions to AI Strategy (2018), Roadmap for AI Development (2019), and Memorandum for AI Development (2019), which catalyzed cross-ministerial cooperation and established initial framework goals.

Governance & Enforcement Bodies

Governance of AI in Poland relies on a multi-tiered administrative structure combining dedicated collegiate supervision, ministerial leadership, and expert advisory units. Under the Draft Act on AI Systems, the proposed central authority is the Commission for AI Development and Safety (Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji, KRiBSI). As a collegiate body comprising representatives from sectoral supervisors and domain experts, KRiBSI is designated to serve as Poland's market surveillance authority and national single point of contact for cooperation with the European AI Board and other EU Member States.

The Ministry of Digital Affairs (Ministerstwo Cyfryzacji) serves as the primary policy coordinator, managing national digitization strategies, preparing implementing legislation through the Government Legislation Centre (RCL), and administering the national data portal. Sectoral coordination is maintained through collaboration with established bodies, including the Personal Data Protection Office (UODO) for data privacy aspects, Statistics Poland (GUS) for technical data assistance, and high-level bodies such as the Committee on Digitisation and ministerial plenipotentiaries for informatization.

Penalties & Enforcement

Enforcement authority under Polish AI-related legislation is structured around administrative proceedings, corrective directions, and financial sanctions. The Draft Act on Artificial Intelligence Systems grants KRiBSI broad surveillance powers, including the ability to conduct remote and on-site inspections, order corrective measures, compel documentation, suspend system operations, and impose administrative fines aligned with standard EU AI Regulation limits.

Similarly, the Draft Act on Data Management empowers the President of UODO to initiate administrative proceedings, order the suspension or cessation of unlawful data intermediation services, and impose administrative fines expressed in euro-equivalents for non-compliance, unnotified intermediary operations, or unlawful onward transfers of non-personal data to third countries. While policy documents carry reputational and programmatic compliance expectations, formal statutory decisions and administrative fines are subject to administrative review and judicial appeal under standard Polish administrative court procedures. The corpus holds no record of specific statutory monetary minimums or maximums or criminal penalty figures.

Data Protection Framework

Data protection rules applicable to AI development and deployment in Poland are explicitly grounded in the General Data Protection Regulation (GDPR) and national enforcing legislation. Under both the Draft Act on AI Systems and national data governance measures, AI risk management, technical documentation, and record-keeping duties must strictly interface with data protection obligations, requiring providers and deployers to conduct Data Protection Impact Assessments (DPIAs) where personal processing is involved.

The President of the Personal Data Protection Office (Prezes UODO) acts as the supervisory authority overseeing data processing aspects of AI, as well as the registration and monitoring of data intermediation service providers and data altruism organisations under the Draft Act on Data Management. For public sector data sharing, the framework establishes controlled access mechanisms, utilizing pseudonymisation, anonymisation, and secure processing environments provided with technical assistance from Statistics Poland (GUS) to protect commercially sensitive data, intellectual property, and personal privacy. The corpus holds no record of national data localization requirements.

Sector-Specific Rules

Sectoral integration of AI in Poland is primarily operationalised through tailored policy targets and domain-specific oversight mechanisms. In healthcare, the Strategy for the Digitization of Poland to 2035 prioritises AI deployment by establishing a concrete benchmark to support AI-assisted medical diagnosis across 100 disease units, alongside pilot programs for testing algorithms in clinical settings.

For public administration and GovTech, the Act on Open Data mandates specific technical rules requiring public entities to provide real-time dynamic data via APIs and to publish metadata on the national data portal. The 2020 AI Policy further promotes the deployment of the Government Cloud (Rządowa Chmura Obliczeniowa) and trusted data spaces. Under the Draft Act on AI Systems, sectoral supervisors across finance, transport, and health interface directly with KRiBSI to ensure domain-specific controls align with horizontal high-risk system compliance requirements. The corpus contains no standalone regulations for autonomous vehicles or employment AI.

International Alignment

Poland's regulatory framework is structured to maintain direct alignment with European Union legislation and international standards. The national legislative agenda is driven by the formal transposition and operational enforcement of EU legal acts, specifically Regulation (EU) 2024/1689 (EU AI Act), Directive (EU) 2019/1024 (Open Data Directive), and Regulation (EU) 2022/868 (Data Governance Act).

At the international policy level, Poland's foundational strategies—including the 2018 Assumptions, 2019 Memorandum, and 2020 AI Policy—explicitly incorporate guidance from the OECD AI Principles and the European Commission's High-Level Expert Group (HLEG) Ethics Guidelines for Trustworthy AI. Polish authorities actively participate in EU coordination channels, designating central contact points to collaborate with the European AI Board and participate in broader EU data space initiatives.

Future Developments

The legislative trajectory in Poland centers on finalizing and enacting pending implementing statutes. Primary focus remains on the progression of the Draft Act on Artificial Intelligence Systems through inter-ministerial review and parliamentary proceedings, establishing the formal entry into force dates, procedural timelines, and operational structure for the Commission for AI Development and Safety (KRiBSI).

Additionally, full operationalisation of the Data Management Act and the adoption of the Strategy for the Digitization of Poland to 2035 will drive upcoming administrative rules. These frameworks will expand national data portal functionality, establish standardized offer templates and fee structures for protected data re-use, and roll out regulated sandboxes to support safe AI testing prior to broader commercial deployment.

Enforcement Bodies