AI inspections and fines in Poland from 28 October. Three steps your company can take tomorrow
The situation. A notice arrives at the company's front office: in a week, the Commission for the Development and Security of Artificial Intelligence will carry out an inspection. The CEO asks: “Do we even use AI?”. Sales writes offers in ChatGPT, accounting translates invoices with a free translator, and marketing makes graphics in an image generator. Nobody has ever written any of this down.
What the law says
- The Polish Act on Artificial Intelligence Systems of 3 July 2026 has applied since 11 August. The provisions on inspections, complaints and fines apply from 28 October.
- Who is covered: every company and institution that uses AI at work, not only AI developers. Only private individuals using AI for purely personal purposes are excluded.
- Who inspects: the Commission for the Development and Security of Artificial Intelligence (KRiBSI), according to its own inspection plan.
- Fines follow the EU AI Act: up to EUR 35 million or 7% of global turnover for prohibited practices, up to EUR 15 million or 3% of turnover for other infringements. SMEs pay the lower of the two amounts.
- Complaints: anyone, including a customer or an employee, can file a complaint about an AI system with the Commission.
- The AI Act from 2 August 2026: customers must know they are talking to a bot, and AI-generated content must be labelled. Companies must also take measures so that their staff know how to use AI (Article 4).
What to do
- Check which tools people really use. Not the ones the company bought, but the ones open in their browsers. A short anonymous survey and a talk with team leaders are enough. The result is a list: tool, who uses it, for what, and what data goes into it. It is the first document an inspector will ask for.
- Write simple rules on one page. Which tools are allowed, what must never be entered (customer data, contracts, code, trade secrets), who is responsible for the result and how AI-generated content is labelled. You can start from our AI use policy template.
- Give people a safe company tool and train them. A ban solves nothing: anyone who has seen how much time AI saves will not go back to working without it. What you need is a tool that runs inside the organisation, controls what goes outside and records who used what.
This is how our SAIE ecosystem works. TWIN:DESK is a Digital AI Desk with assistants that know the company's knowledge. PROXY:AI checks every query before it reaches a model and keeps a usage log that will come in handy during an inspection. The CDF methodology guides the deployment from the initial assessment to oversight.
Frequently asked questions
We only use ChatGPT. Does this apply to us?
Yes. The act covers everyone who uses AI in their business, including an off-the-shelf subscription tool.
Does an inspection mean an immediate fine?
No. The Commission gives at least 7 days' notice of an inspection and at least 30 days to remedy irregularities. Whether a company quickly remedied the effects of an infringement is taken into account when the Commission decides on a fine.
Wouldn't it be enough to ban AI for employees?
No. According to KPMG, 54% of working Poles already use AI at work, and 55% of them do so quietly (so-called shadow AI). A ban only hides the problem. We wrote more about it in AI use policy: the cost of allowing private AI at work.
Is AI training mandatory?
A company must take measures so that its people know how to use AI. The simplest proof is AI Act training confirmed by an attendance list. Today only 29% of Poles have had any AI training.
What if we are not sure whether our case complies with the law?
You can ask the Commission for an opinion on your case. It costs PLN 150, the Commission has 30 days to issue it, and the opinion is binding on it.
The opportunity
According to the World Bank, AI could raise Poland's GDP by up to 12% by 2035, and the pace of adoption will decide the outcome. At the LW Bogdanka coal mine we deployed AI so that no data leaves the company, and it took two months (case study). 28 October is a good day to start.