Guide: AI in business › AI law, risk and ethics
The AI Act is EU Regulation 2024/1689 on artificial intelligence, which applies directly in Poland and imposes obligations both on companies that develop AI and on those that use it. The Polish Act on Artificial Intelligence Systems, signed by the President in July 2026 and published in the Journal of Laws on 27 July 2026 (Dz.U. 2026 item 1003), adds a Polish supervisory authority and procedures to it. The provisions come into force in stages. Some have applied since 2025, the most important for marketing and PR since 2 August 2026, and the obligations for high-risk systems have been postponed to 2027 and 2028.
In 60 seconds The AI Act in a few sentences
- What the rules are about: risk-based EU AI law, ranging from prohibited practices and high-risk systems to transparency obligations.
- Who it covers: almost every company that uses AI, including a marketing team with an image generator or a chatbot on its website.
- Cost of compliance: mainly a tool inventory, an AI policy and training, while fines can reach EUR 35 million or 7% of turnover.
- First step: an inventory of all uses of AI in the company, with each one assigned to a risk category.
- Next major deadline: recruitment and employee assessment using AI are high-risk, with full obligations from 2 December 2027.
What is the AI Act?
The AI Act (in the European Union also known as the EU AI Act) is Regulation (EU) 2024/1689 of the European Parliament and of the Council, the first law on artificial intelligence of such broad scope. As a regulation, it applies directly in Poland without needing to be transposed into national law, and you can find the full text of the AI Act in Polish, including as a PDF, on EUR-Lex (link in the sources), which is the only binding source of the text. Everything else is commentary.
The regulation does not govern the technology as such, but how it is used, depending on the level of risk. There are four tiers: prohibited practices (Article 5), high-risk systems (for example recruitment or creditworthiness assessment), systems subject to transparency requirements (chatbots, deepfakes, AI-generated texts; Article 50) and everything else, i.e. ordinary tools with no additional obligations. Separate rules apply to providers of large general-purpose models, such as the language models behind popular chatbots.
This is not legal advice. We describe the regulations based on public sources, as at September 2026; when implementing them in a specific company, consult a lawyer. If the AI Act is one of several AI-related topics you now need to get in order, start with our guide to artificial intelligence in business, in which law is one of the sections.
When the AI Act applies: the 2024–2028 timeline
There are different answers to the question of when the AI Act comes into force, because the provisions apply in stages. The regulation entered into force on 1 August 2024, but individual obligations apply from different dates, and the table takes into account the Digital Omnibus changes from July 2026.
Najwięcej pytań o AI Act 2026 dotyczy dwóch dat z tej tabeli: 2 sierpnia (przejrzystość) i 2 grudnia (koniec okresu przejściowego na znakowanie). Jeśli masz czas przeczytać tylko dwa wiersze, przeczytaj te.
| Date | What takes effect |
|---|---|
| 1 August 2024 | the regulation enters into force |
| 2 February 2025 | prohibited AI practices (Article 5) and the obligation to support employees' AI literacy (Article 4) |
| 2 August 2025 | obligations of providers of general-purpose models (such as large language models), provisions on supervisory authorities and penalties |
| 2 August 2026 | general date of application, including transparency obligations (Article 50): chatbots, labelling deepfakes and texts on matters of public interest |
| 2 December 2026 | end of the transition period for machine-readable marking for generative tools placed on the market before 2 August 2026; new prohibitions added by the Digital Omnibus |
| 2 December 2027 | high-risk systems listed in Annex III, e.g. AI in recruitment, employee assessment, creditworthiness |
| 2 August 2028 | AI built into products covered by separate legislation, e.g. medical devices |
What the Digital Omnibus changed in the AI Act in 2026
The Digital Omnibus is a package of changes simplifying EU digital law. The part concerning AI was published on 24 July 2026 and entered into force on 27 July. The AI Act has not been suspended — the Omnibus merely postponed selected deadlines and relaxed some requirements.
What has changed? Obligations for high-risk systems listed in Annex III have been moved from 2 August 2026 to 2 December 2027, and for AI in separately regulated products to 2 August 2028. The Article 4 obligation has been softened: a company must take measures to support its employees' AI literacy, but the provision no longer requires it to ensure a specific level of knowledge for each person. The European Commission explains that no certificate is needed and that a company may keep an internal record of training. New prohibitions have been added, including for apps that create intimate images without consent. Some of the simplifications for small and medium-sized enterprises have also been extended to small mid-cap companies.
Who the AI Act applies to
Almost every company that uses AI, not just those that develop it. The regulation distinguishes between providers (who develop and sell an AI system) and deployers (who use it in their business). A marketing team that uses an image generator, a website chatbot or a candidate screening tool is a deployer and has its own obligations. Company size does not exempt anyone from the rules, although small and medium-sized enterprises face lower fines and have easier access to regulatory sandboxes.
| Role | Example in a company | Main obligations |
|---|---|---|
| Provider | a software house that sells a customer service chatbot | system compliance, documentation, marking of generated content |
| Deployer | a marketing team with a video generator and a chatbot on its website | team AI literacy, labelling deepfakes, disclosing the chatbot, human oversight |
| Deployer of a high-risk system | HR with a CV screening tool | human oversight, use in line with the instructions, information for candidates, event logs |
| Importer and distributor | a company bringing a tool from outside the EU to the Polish market | checking whether the provider has met its obligations |
Jak Commwork®AI porządkuje zgodność z AI Act w firmie
Najtrudniejsze w AI Act nie są przepisy, tylko brak wiedzy, kto w firmie i do czego używa AI. Commwork®AI zbiera korzystanie z modeli w jednej firmowej bramie z dziennikiem zapytań, a zespół Commplace® pomaga przełożyć to na politykę AI i szkolenia. O każdym użyciu wysokiego ryzyka decyduje człowiek.
- Zwykłe narzędzia 61%
- Wymagające przejrzystości 27%
- Wysokiego ryzyka 9%
- Do wyjaśnienia z prawnikiem 3%
- 2.02.2025Zakazy z art. 5 i obowiązek z art. 4 obowiązują
- 2.08.2026Przejrzystość z art. 50: czaty, deepfake’i, teksty z AI
- Week 4Spis narzędzi gotowy, trwa klasyfikacja ryzyka
- Listopad 2026KRiBSI ma rozpocząć działanie (zapowiedź ministerstwa)
- 2.12.2026Koniec okresu przejściowego na znakowanie maszynowe
- 2.12.2027Pełne obowiązki dla systemów wysokiego ryzyka, m.in. w HR
- 01Inventory of AI use
- 02Klasyfikacja ryzyka
- 03Polityka i szkolenie
- 04Firmowa brama do AI
- 05Quarterly review
- Łączy dostęp do modeli AI w jedną bramę: klucze zostają po stronie serwera, każdy użytkownik ma uprawnienia, a każde zapytanie trafia do dziennika.
- Pokazuje mapę licencji AI w firmie, czyli co zostawić, co połączyć, a z czego zrezygnować, co daje gotowy punkt wyjścia do spisu użyć.
- Zatrzymuje się tam, gdzie potrzebny jest podpis człowieka: nie publikuje, nie wysyła i nie podejmuje decyzji o ludziach. Jak to działa w rekrutacji, opisaliśmy w tekście o AI in HR and recruitment.
The view reproduced is modeled after the dashboards provided to customers. The names, numbers, and terms are examples and show the way the system works, not the results of a specific company.
What the AI Act means for marketing and PR
We set out the details of Article 50 (what to label, how to do it and what exempts you from the obligation) in our guide to labelling AI content from 2 August 2026. Risks that the law does not cover directly, from data leaks to invented facts, are discussed in our article on what a company using AI actually risks, and in the article on the causes of AI hallucinations.
- Team AI literacy (Article 4, from 2 February 2025): a company must help ensure that people using AI understand its capabilities and risks, and have evidence of this, for example a record of training.
- Prohibitions (Article 5 of the AI Act, from 2 February 2025): among other things, subliminal manipulation that harms the recipient, exploiting people's vulnerabilities (for example age), and emotion recognition in the workplace and in schools (with medical and safety exceptions).
- Transparency (Article 50 of the AI Act, from 2 August 2026): a chatbot on a website must disclose that it is a program; deepfakes must be labelled; AI-generated text on matters of public interest must be disclosed unless it has undergone human editorial control.
- Recruitment and employee assessment is a high-risk area. Full obligations apply from 2 December 2027, but it is a good idea to start preparing now.
High-risk systems under the AI Act and the FRIA assessment
High-risk systems are uses of AI that can significantly affect people's lives: recruitment and employee assessment, access to education, creditworthiness assessment, pricing of life and health insurance, and some public services. Marketing and PR most often come into contact with them through HR, i.e. tools for CV screening, interview assessment or performance reviews. What already works in recruitment today and what is prohibited is described in our article on AI in HR and recruitment. Sam dobór kandydatów to jednak więcej niż narzędzie: o tym, jak ustawić selekcję pracowników zgodną z celami firmy, zanim w ogóle pojawi się w niej AI, piszemy osobno.
FRIA (fundamental rights impact assessment, Article 27) is an analysis of how a system may affect people's rights and how to prevent this. Before using a high-risk system, it must be carried out by, among others, public bodies, private companies providing public services, and companies that assess creditworthiness or price life and health insurance. A typical marketing team does not carry out a FRIA. But it should know whether HR or the credit department does.
Kupujesz albo odnawiasz narzędzie, które dotyka ludzi, na przykład do selekcji CV czy oceny rozmów? Zadaj dostawcy pięć pytań i poproś o odpowiedzi na piśmie. Ich brak to sygnał, że ryzyko zostanie po Twojej stronie.
- Czy narzędzie jest systemem wysokiego ryzyka według załącznika III i jak dostawca to uzasadnia?
- Jaką dokumentację i instrukcję użycia dostaniesz przed wdrożeniem?
- Gdzie są przetwarzane dane kandydatów lub klientów i czy trafiają do trenowania modelu?
- Jak w narzędziu wygląda nadzór człowieka: kto może zmienić albo zatrzymać wynik?
- Jakie zdarzenia system zapisuje w rejestrze i jak długo je przechowuje?
The Polish Act on Artificial Intelligence Systems and KRiBSI
The Act implements the AI Act in Poland. Most importantly, it establishes the Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji (KRiBSI, the Commission for the Development and Safety of Artificial Intelligence) as the national supervisory authority, supported by the Ministry of Digital Affairs, with a chair appointed by the Sejm with the consent of the Senate for five years. Its members are to include representatives of the Komisja Nadzoru Finansowego (Polish Financial Supervision Authority), the President of UOKiK (the competition and consumer protection authority), the Krajowa Rada Radiofonii i Telewizji (National Broadcasting Council) and the President of UKE (the electronic communications regulator). The President signed the Act in July 2026, and on 27 July 2026 it was published in the Journal of Laws as the Act of 3 July 2026 (Dz.U. 2026 item 1003).
According to the Ministry of Digital Affairs, the chair is to be selected in October 2026 and the commission is to start work in November. KRiBSI will handle reports of irregularities and issue individual opinions to companies, which provides legal certainty for unusual deployments. It will also run regulatory sandboxes, i.e. a safe testing environment with advice from the supervisor (free of charge for micro, small and medium-sized enterprises), as well as educational activities. Its decisions can be appealed in court.
W wyszukiwarce i w rozmowach zarządów ta instytucja pojawia się też pod skrótem Komisja Rozwoju i Bezpieczeństwa AI. Chodzi o ten sam organ, więc przy piśmie do nadzorcy używaj pełnej nazwy z ustawy.
How to implement the AI Act in your company, step by step
AI Act compliance doesn't start with a lawyer, but with knowing where AI is used in the company and who uses it, which is why we have arranged the six steps below in an order that makes sense for a medium-sized company.
Najtrudniejszy bywa krok pierwszy, bo część narzędzi działa na prywatnych kontach pracowników. Spis robi się łatwiej, gdy zespół korzysta z modeli przez jedną firmową bramę. Tak działa Commwork®AI system: klucze zostają po stronie serwera, a każde zapytanie trafia do dziennika, więc wiesz, kto, kiedy i do czego używał AI.
Przykład poglądowy, nie historia klienta. Tak zwykle wygląda implementacja AI Act w firmie na około 150 osób, która korzysta z AI w marketingu, sprzedaży i HR. W pierwszym miesiącu zespół zbiera spis narzędzi, także tych na prywatnych kontach, i przypisuje każdemu właściciela. W drugim klasyfikuje użycia według ryzyka, pisze politykę w ośmiu punktach i konsultuje ją z prawnikiem. W trzecim prowadzi szkolenie z listą obecności, ustawia informację przy czacie na stronie i zasady oznaczania grafik. Po 90 dniach firma ma dokumenty, które pokaże audytorowi, klientowi w przetargu albo nadzorcy. Narzędzia HR zostają na osobnej ścieżce, bo tam pełne obowiązki zaczną się dopiero w grudniu 2027 roku.
- STEP 01Inventory of AI use
All tools and uses: marketing, HR, sales, customer service, finance. Including those the IT department didn't buy but employees use on their own initiative.
- STEP 02A risk category for each use
Prohibited, high-risk, subject to transparency requirements or ordinary? If in doubt, ask a lawyer or request an individual opinion from KRiBSI.
- STEP 03AI policy
A single document with the rules: what is allowed, what isn't, who approves, how we label. You will find an 8-point template below.
- STEP 04Team training
Short, practical, with a list of participants, because it is this list, together with the programme, that serves as evidence of the measures under Article 4.
- STEP 05External transparency
A notice next to the chatbot, labelling of deepfakes, a sign-off rule for texts on matters of public interest.
- STEP 06Review and audit
Review the policy at least once a year. And whenever a new tool is introduced. Using AI in HR? Carry out an internal AI Act audit before the 2 December 2027 deadline.
An AI policy template in 8 points
Dobra polityka AI jest krótka i konkretna. Zasady etyczne, które i tak obowiązują w komunikacji (o nich więcej w tekście o tym, czy etyka w public relations wciąż istnieje), trzeba w niej tylko przełożyć na narzędzia AI. Wystarczy osiem punktów.
- Purpose: why the company uses AI and what it does not want to achieve with it.
- Tool inventory: name, what it's used for, who has access, where the data goes.
- Prohibited data: what must not be pasted into external tools (customers' personal data, trade secrets, results before publication).
- The human rule: what AI prepares and what a person approves. Publication, sending, and decisions about people and money always require approval.
- Labelling: when the company discloses that content was created with AI (deepfakes, chatbots, texts without editorial control).
- Sign-off and accountability: who checks and signs off external materials.
- Training: who has been trained, when and on what (Article 4).
- Review: who updates the policy and how often (at least once a year and whenever a new tool is introduced).
How much AI Act compliance costs and when you need a lawyer
There is no single price for AI compliance, i.e. compliance with AI regulations. The budget depends on whether the company only uses typical tools or applies AI in high-risk areas, where documentation, human oversight set out in procedures and often a fundamental rights impact assessment are required. A lawyer is always needed for high-risk systems, when developing your own AI solutions and when in doubt about the prohibitions under Article 5. With ordinary marketing tools, you can do a lot in-house, with a short legal consultation at the end.
Gdzie leży próg decyzji? Jeśli żadne z Twoich użyć nie trafiło do kategorii wysokiego ryzyka, a wszystko, co wychodzi na zewnątrz, zatwierdza człowiek (tak jak w zasadzie human in the loop), zwykle wystarczy praca własna i jedna konsultacja prawna na końcu. Gdy choć jedno narzędzie ocenia ludzi albo tworzysz własny system, kary z AI Act i koszt błędu rosną na tyle, że doradztwo prawne w AI compliance przestaje być opcją. Masz już spis narzędzi, a brakuje przeszkolonego zespołu? Zacznij od szkolenia z pracy z AI w Akademii PR, które od razu zostawia zapis potrzebny do artykułu 4.
| Item | What drives the cost | Who usually does it |
|---|---|---|
| AI use inventory and risk classification | number of departments and tools | internal team, adviser |
| AI policy | complexity of the organisation, number of channels | internal team + review by a lawyer |
| Training (Art. 4) | number of people and level of knowledge | trainer, agency, HR department |
| AI Act audit and FRIA | whether the company uses high-risk systems | law firm, specialist adviser |
| Provider documentation | whether the company is developing its own AI system | law firm + technical team |
When to deal with the AI Act and which signals speed up the decision
If a company uses AI in its communications, the matter cannot be put off, because the prohibitions and Article 4 have applied since 2025, and Article 50 since 2 August 2026. Speed up if HR is testing candidate screening tools, if you are planning a campaign with generated images of people, or if business clients start asking about your AI policy in tenders. You can take a more relaxed approach if AI is used only for internal drafts and everything that goes out is checked by a person who then signs off on it.
Przed pierwszym przeglądem odhacz pięć rzeczy: spis narzędzi z właścicielami, kategorię ryzyka przy każdym użyciu, podpisaną politykę AI, listę osób po szkoleniu i gotowy tekst informacji przy czacie. Jeśli zespół korzysta z kilku czatów naraz, porównanie planów firmowych i ich ustawień prywatności znajdziesz w tekście ChatGPT, Gemini or Copilot for business, a program przeszkolenia ludzi opisujemy w poradniku o AI training for companies.
If you are introducing AI in your marketing team from scratch, you will find a plan in the article AI implementation in marketing and PR: a 90-day plan. We have written about how consistent rules within a company translate into its image in our article on how internal communication builds organisational success.
We train marketing and communications teams in working safely with AI, including with regard to Articles 4 and 50, as part of PR Academy. We implement rules for working with AI in communications through our service PR AI. The first conversation is free of charge. Write to us.
Where companies most often misread the AI Act
A company that only uses tools also has obligations: team knowledge, labelling, human oversight. Lack of preparation usually shows up with the first deepfake in a campaign or a question in a tender.
It was mainly the deadlines for high-risk systems that were postponed, while the prohibitions and Articles 4 and 50 apply with no change to the timetable. Anyone who put everything off ‘until 2027’ has a gap today.
A document full of generalities doesn't tell an employee whether they can paste a client contract into a chatbot. The rules stay on paper. Everyone does their own thing.
Employees often have private accounts. An inventory of purchased licences alone misses the biggest risk of data leaks.
Training without a list of participants and a programme is hard to prove to the supervisor. Keeping a record takes minutes.
Questions about the AI Act we hear from communications teams
What penalties does the AI Act provide for?
For prohibited practices, up to EUR 35 million or 7% of total worldwide annual turnover. For breaches of most other obligations, including the transparency obligations under Article 50, up to EUR 15 million or 3% of turnover. For supplying incorrect information to authorities, up to EUR 7.5 million or 1% of turnover. Small and medium-sized enterprises pay the lower of the two amounts.
Does a small company have to comply with the AI Act?
Yes, if it uses AI in its business, because the obligations depend on how AI is used, not on the size of the company. Small and medium-sized enterprises face lower fines and have free access to regulatory sandboxes.
Where should you start preparing for the AI Act?
With an inventory of the AI tools used in the company and a check of which category each use falls into: prohibited, high-risk, subject to transparency requirements or ordinary. Then it's time for an AI policy, team training and the rule of human approval.
When does the AI Act apply?
The regulation entered into force on 1 August 2024, but it applies in stages: the prohibitions and Article 4 from 2 February 2025, the rules for general-purpose models from 2 August 2025, most provisions, including Article 50, from 2 August 2026. High-risk systems from 2 December 2027 and 2 August 2028.
Jakie obowiązki ma firma, która używa systemu AI wysokiego ryzyka?
Jako podmiot stosujący musi używać systemu zgodnie z instrukcją dostawcy, zapewnić nadzór człowieka, poinformować osoby, których system dotyczy (na przykład kandydatów), i przechowywać rejestry zdarzeń. Podmioty publiczne, firmy świadczące usługi publiczne oraz te, które oceniają zdolność kredytową lub wyceniają ubezpieczenia na życie i zdrowotne, robią też ocenę skutków dla praw podstawowych (FRIA). Po zmianach Digital Omnibus obowiązki dla systemów z załącznika III stosuje się od 2 grudnia 2027 roku.
Where can I find the text of the AI Act in Polish?
The official text of Regulation 2024/1689 is on EUR-Lex, in HTML and PDF, in all EU languages. Remember that the Digital Omnibus of July 2026 changed some of the deadlines, so check the consolidated version.
Who supervises the AI Act in Poland?
The Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji (KRiBSI, the Commission for the Development and Safety of Artificial Intelligence), established by the Act on Artificial Intelligence Systems. According to the Ministry of Digital Affairs, it is to start work in November 2026, with administrative support provided by the ministry.
Do you need a lawyer to implement the AI Act?
For high-risk systems, your own AI solutions and doubts about the prohibitions, yes. For typical marketing tools, you can prepare the inventory, policy and training in-house and ask a lawyer to review the finished rules.
Sources
- SOURCEEUR-Lex: Regulation (EU) 2024/1689 (AI Act), text in Polish · accessed 24 September 2026
- SOURCEAI Act, Article 113 — entry into force and application (amended version) · accessed 24 September 2026
- SOURCEAI Act, Art. 5 — prohibited practices · accessed 24 September 2026
- SOURCEAI Act, Article 99 — penalties · accessed 24 September 2026
- SOURCE
- SOURCEMinistry of Digital Affairs: the Act on AI Systems · 27 July 2026
- SOURCE
- SOURCE
- SOURCE
- SOURCE
- SOURCEEUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI), Polish text · of 8 July 2026, OJ EU of 24 July 2026, accessed 24 September 2026
- SOURCEISAP (Sejm): Act of 3 July 2026 on artificial intelligence systems, Journal of Laws 2026, item 1003 · published 27 July 2026, accessed 24 September 2026
- SOURCEEuropean Commission: AI literacy — questions and answers (Article 4 of the AI Act) · updated 27 July 2026
Read next
Dostaniesz szkolenie oparte na przykładach z codziennej pracy Twojego działu i zapis, który dokumentuje działania z artykułu 4. Pierwszy krok to krótka rozmowa o tym, z jakich narzędzi AI korzystacie.
Sebastian Kopiej, President of Commplace®. In public relations since 1996. Text prepared with the help of AI tools and fact-checked by the author. Data current as of September 29, 2026.