The AI Act, or Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 establishing harmonised rules on artificial intelligence, prohibits subliminal manipulation, protects children from algorithms, and combats deepfakes. However, despite these prohibitions, there was no one to enforce liability for violations. The Act of 3 July 2026 on Artificial Intelligence Systems radically changes this situation: on October 28, 2026, provisions allowing for the enforcement of violations of the AI Act will enter into force.
Supervisory body and its competences
The body appointed to oversee compliance with these regulations will be the Commission for the Development and Security of Artificial Intelligence (KRiBSI). According to the act, it will serve as a market surveillance authority and a single point of contact with EU institutions. The Commission will also have an Artificial Intelligence Council, a consultative and advisory body composed of nine to fifteen members, whose opinions are not binding on the Commission.
For companies, the most important section of the Act is the one concerning compliance with artificial intelligence regulations. The Commission may inspect a business not only upon receiving information about an infringement, but also as part of an inspection plan or regular market monitoring (Article 48).
Inspectors have quite broad powers. They can request documents, electronic correspondence, and access to IT systems. They also have the right to take notes and copies, record the inspection using video or audio recording devices, and request clarification on matters related to the subject of the inspection.
However, it should be noted that an inspection generally begins no earlier than seven days after the notification of its initiation is served and is conducted remotely. There are exceptions to this rule. If there is a suspicion or significant probability of harm to the life, health, safety, or fundamental rights of natural persons, the KRiBSI may, in a separate decision, order the inspection to begin before the 7-day deadline expires and to be conducted in person at the company's registered office. Documents created during the company's communication with an attorney, legal counsel, or EU lawyer are subject to special protection. The inspectors leave such materials on-site, and in the event of any doubts as to the nature of the documents, the District Court in Warsaw – the Court of Competition and Consumer Protection – will decide.
What sanctions can KRiBSI impose on an entity that has committed a violation?
Sanctions for non-compliance include administrative fines, the amount of which is determined pursuant to Chapter XII of the AI Act (Article 104). However, the legislature has created a certain safety net for companies.
If the company has taken the actions indicated in the warning within three months of the date of delivery of the decision imposing an administrative fine, the imposed fine may be reduced by 10% to 50% (Article 107). There is also a second route to reducing the imposed fine: the violating entity may enter into an extraordinary leniency agreement, modeled on the leniency mechanism known from competition law. Under such an agreement, the KRiBSI may reduce the fine by 20% to 70%. It is also worth noting that if the entity that committed the violation voluntarily reports the violation to the KRiBSI, the imposed fine may be reduced by 30% to even 90%. Importantly, information and evidence obtained by the Commission, in the form of statements by the party, previously unknown to the Commission, cannot be used as evidence in the proceedings if an agreement is not reached (Article 72, paragraph 2).
Important regulations that can support entrepreneurs
An interesting aspect of the Act worth noting is the institution of individual opinions. A question submitted to the Commission may concern a factual situation or a future event within the scope of the AI Act. The opinion is binding on the Commission itself and other state bodies and organizational units whose opinions the Commission has consulted.
A new development, and an opportunity for AI companies, will be the creation of regulatory sandboxes. These are supervised testing environments where innovative AI systems can be tested, benefiting from the regulator's support and, to a limited extent, exemptions from certain requirements.
To sum up
Polish law still doesn't regulate the use of AI systems in recruitment and employee management. The nature of the cooperation between the National Recruitment and Information Security Agency (KRiBSI) and the President of the Personal Data Protection Office (UODO) also remains an open question, as AI systems often process personal data, and the law describes this relationship very superficially.
For companies using AI, this is the last moment to fully prepare for the implementation of the obligations arising from the AI Act, because from October 28, 2026, any violation will result in a potential sanction.
This article is for informational purposes only and does not constitute legal advice.
The law is current as of October 14, 2026.
