Poland's AI complaint, inspection and fine rules take effect, with the KRiBSI commission due by November

On Wednesday, October 28, the next batch of provisions of Poland's act on artificial intelligence systems took effect: those on complaints, inspections and penalties. From that day, the Commission for the Development and Safety of Artificial Intelligence (KRiBSI) can accept complaints about AI systems, carry out inspections and impose administrative fines. The commission itself is still being set up, and its first meeting is due no later than November.

What has changed

The president signed the act on July 24 and it was published on July 27. Most provisions took effect on August 11, while the rules on inspections, proceedings launched on the basis of complaints, and penalties only start to apply now, as Rzeczpospolita (a Polish national daily) reports.

KRiBSI is meant to be the national market surveillance authority for AI systems. Administrative support is provided by the Ministry of Digital Affairs. The commission does not take over all oversight: sectoral regulators such as the KNF (financial supervisor), UOKiK (competition and consumer protection office), UKE (electronic communications office), KRRiT (broadcasting council) and UODO (data protection authority) remain active.

Complaints and inspections

A complaint can be filed by an individual, a legal entity or an organizational unit. It must identify the AI system, describe the key facts and explain why the complainant believes the AI Act or the Polish act has been breached. A complaint is meant to trigger oversight, not to serve as a claim for damages.

According to the description of the commission's powers, an inspection may cover documentation, how the system is used, human oversight, input data and incident response. Where there is a risk to health, safety or fundamental rights, the system's availability can be restricted or the system withdrawn.

Infor.pl, citing ADP Polska, says the commission can demand documents and data, secure evidence and gain access to companies' IT systems. Complaints could concern, for example, AI used in recruitment or employee evaluation.

Fines and individual opinions

The fine ceilings come from EU law: up to EUR 35 million or 7% of worldwide turnover for prohibited practices, up to EUR 15 million or 3% for breaches of operator and transparency obligations, and up to EUR 7.5 million or 1% for providing incorrect information to the authority. For SMEs, the lower of the two values applies. Fines are not automatic, and the authority takes into account, among other things, the gravity of the breach, cooperation and corrective action.

Companies can also request an individual opinion on deployed or planned AI systems. The commission has 30 days to respond, or 60 in complex cases. According to an expert cited by Rzeczpospolita, the opinion binds the commission and the bodies whose views were sought, and following it before any later change cannot harm the business. Forsal, however, notes that an opinion applies to the facts as presented, so later changes to a system may lead to a different assessment.

Interestingly, a lack of response within that deadline will mean acceptance of the position presented by the applicant. - dr Gabriela Bar, legal counsel (radca prawny), in an interview with Rzeczpospolita

What it means for companies

Experts point out that the AI Act applies directly, so there was never a period without rules. Rzeczpospolita does cite a caveat, though: one-off breaches committed before the national penalty mechanism started may go unpunished, while continuing breaches are not protected. Other regimes, such as GDPR, consumer law or labor law, may have applied earlier.

Infor.pl advises companies to inventory the AI tools they use, adopt a usage policy, train staff and check whether any system is high-risk. It counts recruitment and scoring algorithms, among others, as high-risk. For small firms, regulatory sandboxes are planned, and participation is free for micro, small and medium-sized enterprises.

The commission's first session is to be convened within three months of the act taking effect, meaning November at the latest. Only the practice of the first complaints and inspections will show how broadly KRiBSI uses its new powers.