Sejm Finalizes AI Law, New Commission Gains Power to Fine Companies

Poland is completing the build-out of its national enforcement apparatus for the EU AI Act. After a vote in the Sejm on July 3, 2026, in which lawmakers approved 24 of 25 Senate amendments, the law on artificial intelligence systems has been sent to the president's desk. This is the final step before a new regulator is established, one that will get real tools to control and penalize companies that break EU AI rules.

A New AI Oversight Body

At the heart of the law is the creation of the Commission for the Development and Security of Artificial Intelligence, known by its Polish acronym KRiBSI. It is meant to serve as an independent market surveillance authority over AI systems operating in Poland and the sole point of contact for EU institutions on matters related to the AI Act. The commission's chair will be appointed by the Sejm with the Senate's consent for a five-year term.

The commission's membership will include representatives from key sectoral regulators, among them the Office of Competition and Consumer Protection (UOKiK), the Polish Financial Supervision Authority (KNF), the National Broadcasting Council (KRRiT), and the Office of Electronic Communications (UKE). This structure is meant to ensure KRiBSI does not operate in isolation from the institutions that already oversee individual industries.

Fines and Investigative Powers

The new authority will get the standard administrative toolkit: it will conduct proceedings, issue decisions, demand information from companies, and be able to restrict or revoke approval for specific AI systems. The scale of the fines mirrors the ranges set out in the EU regulation. Using banned AI practices carries a fine of up to 35 million euros or 7 percent of global annual turnover, whichever is higher.

Violating obligations imposed on providers and users of AI systems can bring a fine of up to 15 million euros or 3 percent of turnover. Misleading the authority with false information carries a penalty of up to 7.5 million euros or 1 percent of turnover. Smaller companies are set to face lower fine ceilings, though the law does not exempt them from oversight.

Sandboxes and Citizen Complaints

The law also introduces regulatory sandboxes, controlled testing environments in which companies, especially micro, small, and medium-sized enterprises, will be able to develop AI solutions before bringing them to market. Participation in the sandbox is meant to be free for the smallest entities.

Citizens will gain the right to file complaints about AI systems that violate their rights. Appeals against the commission's decisions will go to a specialized competition court at the Regional Court in Warsaw. KRiBSI is also expected to issue individual opinions at the request of businesses, giving companies certainty that their solution meets legal requirements before it even reaches the market.

Division of Powers with the Data Protection Authority

Not every AI system will fall under the new commission's purview. In the public sector and among law enforcement agencies, direct oversight of high-risk systems will remain with the President of the Personal Data Protection Office (UODO). If a complaint concerns personal data processing, UODO, not KRiBSI, will remain the proper authority to address it.

Lawyers commenting on the bill note that the practical effectiveness of the new system will depend on how smoothly the two authorities exchange information. Experts from the Lewiatan Confederation urged during the legislative process that the new commission's powers not be too broad and not duplicate the authority of existing regulators.

The provisions of the law on artificial intelligence systems introduce procedures that protect users while also ensuring safe conditions for the development of new technologies. - Krzysztof Gawkowski, Minister of Digital Affairs

What's Next

The law now awaits the president's signature. Only after publication in the Journal of Laws (Dziennik Ustaw) and the expiry of the vacatio legis period will the provisions formally take effect, though the EU AI Act itself already partly applies directly in Poland regardless of the national law. The key date is August 2, 2026, when the European Commission will start requiring member states to have their AI oversight systems fully operational.

For Polish companies developing or deploying AI systems, this marks the end of a period in which they could count on the absence of a national body capable of meaningfully penalizing violations. Until now, enforcement of EU rules in Poland relied mainly on declarations; now there will be an authority with investigative powers and financial sanctions comparable to those known from GDPR.