Polish Companies Are Breaking EU AI Act Rules Before National Law Exists

Polish companies are assuming that the EU's artificial intelligence regulation will only start applying to them once the national implementing law is passed. That's a mistake, and one that already exposes them to fines running into millions of euros. As an EU regulation, the AI Act applies directly, regardless of what stage the legislative work has reached in the Sejm (the lower house of Poland's parliament).

What already applies

Since February 2, 2025, the EU's AI regulation has been directly applicable law in all member states, including Poland. That means a ban on certain practices classified as unacceptable, such as emotion recognition of employees and students, subliminal techniques aimed at influencing people's decisions, social scoring, and biometric categorization based on ethnicity, political views, or sexual orientation. Also banned is the mass scraping of facial images from the internet to build recognition databases.

The same date brought the so-called AI literacy requirement: companies must ensure that employees using AI systems have adequate competence and understanding of how those tools work, and must implement internal rules governing their use. This is the obligation most often ignored, since companies don't associate it with the AI Act at all, treating it instead as part of general internal training, or skipping it altogether.

Businesses wrongly assume the obligations will only kick in once the Polish law is passed - Krzysztof Rożko, legal counsel

Where the confusion comes from

The mistake stems from how the AI Act enters the Polish legal system. It's an EU regulation, not a directive, so it applies directly, without the need for a national transposing law. The Polish law currently being worked on in the Sejm is only meant to designate the national supervisory authority and clarify enforcement procedures. The substance of the obligations for companies already comes from the text of the regulation adopted by the European Union.

Lawyers compare the current situation to the early days of GDPR implementation, when companies also waited for national implementing rules before adjusting their processes to the EU's data protection regulation, even though it too was fully in force from the start.

Next phase begins in August

On August 2, 2026, a further, more significant part of the AI Act takes effect, covering high-risk systems. Companies using such systems will need to ensure compliance with the provider's instructions, implement human oversight carried out by competent personnel, continuously monitor how the system performs, and in some cases carry out an assessment of the impact on fundamental rights.

According to Dr. Judyta Latymowicz, the biggest challenge for businesses won't be implementing the AI Act's requirements themselves, but the step before that: figuring out where artificial intelligence is even being used within the organization. Many companies keep no inventory at all of the AI tools used by employees, HR and recruitment systems, office software with built-in AI features, CRMs, or monitoring cameras with image analysis.

What companies should check

Experts recommend companies answer five questions: do they know which AI tools their employees use; is artificial intelligence used in HR and recruitment processes; do internal rules for AI use exist; have contracts with providers of such solutions been reviewed; and have people been designated to oversee these systems.

The data shows the scale of the readiness problem. According to the estimates cited, 42.2 percent of companies in Poland report using automation and artificial intelligence, most often in trade and services, and as many as 77 percent already use AI in cybersecurity. Despite this, most of them cannot clearly identify exactly which processes their AI systems are used in, a prerequisite for meeting the regulation's obligations.

Penalties for AI Act violations are among the harshest in EU business law: up to 35 million euros or 7 percent of a company's global annual turnover, whichever is higher. The supervisory authority will also be able to order immediate implementation of full requirements for high-risk systems, along with corrective measures, before any financial penalty is even imposed.

What's next

For Polish companies, this means that waiting for the final shape of the national law does not exempt them from obligations that have already been in force for nearly a year and a half. Little time remains before August 2, 2026, to review the AI tools in use, complete employee training, and prepare compliance documentation, especially at companies using systems classified as high-risk.