Polish Authorities Unsure Whether They Use Systems Covered by the EU AI Act

Poland's public administration is less than a month away from the EU AI Act's full entry into force, yet a significant share of public offices still cannot clearly say whether they use systems covered by the new regulation at all. That's according to a report by the Sieć Obywatelska Watchdog Polska (Citizens Network Watchdog Poland), which spent several months asking public administration bodies about their use of artificial intelligence.

The problem starts at the level of definitions. Some offices classify even simple OCR software for reading text from scanned documents as an AI system, while others take a narrow view and consider only generative tools like ChatGPT to be artificial intelligence. Many institutions refuse to disclose information about advanced analytical models, arguing that they don't meet the definition set out in the regulation.

Concrete Examples in Administration

The report points to the Zakład Ubezpieczeń Społecznych (ZUS, Poland's social insurance institution), which uses scoring models to analyze sick leave but doesn't classify the system as AI, allowing it to avoid a mandatory risk assessment. A similar situation applies to the STIR system run by the Krajowa Izba Rozliczeniowa (National Clearing House), used to analyze financial fraud risk and block bank accounts, where transparency about the underlying technology remains limited. The Agencja Bezpieczeństwa Wewnętrznego (ABW, Poland's Internal Security Agency) declined to comment, citing operational security concerns.

Definitional disputes often serve as a pretext to avoid transparency - Michał Zemełka, author of the Sieć Obywatelska Watchdog Polska report

Who Is Accountable

Lawyers point out that the regulation itself places the burden of self-assessment on each institution individually. There is no single central mechanism to resolve definitional doubts on behalf of public offices, which in practice opens the door to diverging interpretations among different administrative bodies.

Every entity must independently assess whether a given system meets the AI Act's criteria, determining its role - provider or user - which decides its compliance obligations - Paweł Dymek, lawyer

What the EU Regulation Requires

The AI Act defines an artificial intelligence system as a machine learning-based mechanism capable of operating with varying levels of autonomy after deployment, able to adapt and infer outputs such as predictions, content, recommendations or decisions that affect physical or virtual environments. Institutions using high-risk systems will have to ensure compliance with provider instructions, implement competent human oversight, carry out continuous monitoring and conduct fundamental rights impact assessments. The regulation provides for financial penalties for non-compliance, imposed after verification by a supervisory authority.

Recommendations and Next Steps

Watchdog Polska proposes standardizing an operational definition of AI for public administration, creating a central registry of public AI applications, and establishing an independent mechanism for reviewing appeals in cases where information requests are denied. The organization stresses that a system's classification should be based on its actual function, not on the declarations of the institution that deployed it.

For Polish companies and local governments, this means there is little time left to put their own AI tool registries in order before the regulation's full requirements take effect. Institutions that today avoid a clear classification of their systems risk finding themselves under scrutiny from the supervisory authority after August 2 without compliance documentation in place.

Sources: "The AI Act Is Almost Here, and Offices Still Don't Know If They Use AI" (prawo.pl), "The AI Act Has Taken Effect. Polish Companies Still Don't Know They're Breaking the Law" (rp.pl)