SAIE (Sovereign AI Ecosystem) is three software layers that form one AI workspace: TWIN:DESK — everyday work with documents, knowledge and assistants, PROXY:AI — control, security and costs, CDF — the deployment and compliance methodology. In one place you know who is working, on which data, with which model — and what it costs
SAIEFor organisations that must know where their data goes — because a regulator, a contract clause or a risk assessment requires it: banks, public authorities, energy, hospitals, telecommunications and defence. Our industry offer describes 19 deployment paths. If you are looking for a simple website chatbot, there are cheaper solutions — we will gladly point you to them
Who it is forIndustry offerYou get a complete platform from day one, without stabilising open-source components and without moving your data to a hyperscaler. You decide where your data is located, local and cloud models can be changed without restriction, and the software code and training stay with the client. The CDF methodology guides you step by step to regulatory compliance. The full comparison across 13 categories is on the SAIE page
SAIE compared with alternativesWe launch the environment within 2 weeks. The length of the full deployment depends on its scope: a Proof of Value on one process usually takes 4–8 weeks, and a full programme follows the stages of the CDF methodology
CDF methodologyThere are three starting points: a demonstration, a Proof of Value on your data or configuring an offer in the Offer builder. If you are mainly interested in how to deploy AI in your organisation, we start with the Initial assessment (CDF-Eval) — a one- or two-day diagnosis at your premises
Contact formOffer builderWhere to startYes. TWIN:DESK, PROXY:AI and the CDF methodology are in use at LW Bogdanka (Enea Group) — the case study is publicly available
LW Bogdanka deployment reportTwo service lines: CDF methodology consulting (from the Initial assessment through stages F0–F6 to an independent audit) and six WDR operational documents that remain in the organisation after the project. You can order the full programme, selected stages or ongoing CogOps support
How to deploy AIAll features in the “All SAIE capabilities” catalogue (141 features in 13 categories) are available today. Planned changes appear only in the Roadmap — 97 items across four quarters
All SAIE capabilitiesRoadmapYes. Custom features are part of our offer, and you can submit your own requirement in the Roadmap
RoadmapIt is the new SAIE release for 2026/Q3, the first one with its own name. It brings 13 new TWIN:DESK and PROXY:AI features, including recording transcription, translation on local models, Agentic RAG, verified calculations, an AI cost dashboard for the board and models that run without the internet. Every feature is shown in a video. The next releases will be named after big cats: Tygrys arrives in 2026/Q4
SAIE PanteraWherever you decide. SaaS — in the service provider's data centre in Poland or the EU, On-Premises — in your organisation's server room, Air-Gap — in infrastructure cut off from the public network, with local models only. Every deployment is a separate, fully isolated environment
Deployment optionsOnly to the extent you define. Model selection is decided by your organisation's policy in PROXY:AI, not by the user. Documents marked confidential are blocked for cloud models, the AI Firewall masks personal data before it leaves the network, and the EU-only switch restricts processing to the EU
PROXY:AIAll traffic to AI models passes through one point — PROXY:AI. Employees get an environment in TWIN:DESK that is better than public chatbots, and the organisation can see who is using which tool and with which data
ProblemThe AI Act and the Polish Act on Artificial Intelligence Systems, GDPR, DORA, NIS2 and the Polish National Cybersecurity System Act, the National Interoperability Framework (KRI) and the Cyber Resilience Act. The CDF methodology selects requirements for your organisation's profile, and the platform continuously collects evidence for auditors
Strategy and complianceSeven standards in one integrated management system: ISO 9001, ISO 14001, ISO 22301, ISO/IEC 27001, 27017, 27018 and 42001 — all certified by Bureau Veritas. ISO/IEC 42001 is the first such certificate issued by Bureau Veritas in Poland, and the audit ended with no nonconformities
CertificatesQuality policyYes. The platform integrates with DLP and SIEM solutions, lets you build your own data classifiers and apply industry extensions
Deployment optionsNo. The software code and training stay with the client, and the model is changed in PROXY:AI settings without rewriting applications — you can choose from more than 100 cloud and local models
Zero-Code SwitchSAIE compared with alternativesWe deliver SAIE as Docker container applications that can be deployed on Kubernetes, with a relational database (e.g. PostgreSQL) and a vector database as the RAG engine. The platform runs on-premises or in the client's private cloud, including offline with local models
Architecture and platformTWIN:DESK includes a Prompt Assistant that helps formulate instructions in line with the CRISPE-CDF prompt engineering standard
MechanismsA document can be marked confidential immediately. The system then permanently blocks its use in conversations with external cloud AI models
Feature catalogueNo. It is a multimodal AI workspace supporting voice commands, attachment analysis and “computer mode”, where AI agents perform tasks on the user's behalf
More than a chat windowIt reveals features progressively: beginners see a simple chat, while experts have full access to a terminal and workflow automation. At first sign-in a role-aware guide leads the way, and the administrator sees progress and can restart it
More than a chat windowEZD RP and EZD PUW, e-Doręczenia, KSeF 2.0 and ePUAP authentication
IntegrationsIt is an everyday workspace that builds institutional memory: it securely handles internal documents and knowledge bases (RAG) and includes tools for automating tasks and processes
More than a chat windowCompany knowledge (RAG)A question goes to up to five selected models in parallel. The platform collects and compares their responses, then prepares one final answer — with greater confidence in the result
MechanismsThe virtual accounting unit Twin:Coin hides complex token price lists and makes it easier to report and limit team costs
Feature catalogueIt can work proactively: using email, task management and calendar integrations to prepare daily plans or meeting summaries
MechanismsInstead of inventing an answer, TWIN:DESK records the gap in the Knowledge Gap Register. Managers get a concrete indication of which procedures and instructions need updating
Company knowledge (RAG)Yes. Dedicated workspaces provide their own avatar, system-prompt guidelines and assigned tools, such as a code interpreter for the IT department
Domain assistantsA personal AI agent that learns how a user works and uses their knowledge, documents and activity history. It helps automate repetitive tasks and prepare recommendations — within the oversight boundaries set by the organisation
MechanismsIt enables use of the user's personal knowledge sources: local folders, Outlook email, Microsoft Teams and calendars. AI works with them locally, without copying sensitive data into a central RAG knowledge base. The agent also moves meetings from Outlook Calendar into Asana tasks and shows, in the “AI usage” panel, the tokens and API equivalent of local tools such as Codex
Company knowledge (RAG)ChatGPT Enterprise and Microsoft 365 Copilot run in the vendor’s cloud. TWIN:DESK can run as SaaS, on-premises or air-gapped, answers from your organisation’s documents with source citations, matches the model to the confidentiality of the task — including several models at once in the Model Council — and integrates with Polish systems such as EZD RP and KSeF 2.0
Deployment and securityChatGPT Enterprise, Copilot or your own AIYes. TWIN:DESK connects to EZD RP and EZD PUW through its integration layer, and documents from SharePoint and Microsoft 365 can serve as a knowledge source for assistants — with user permissions preserved
IntegrationsThe price depends on the number of users, the deployment option (SaaS, on-premises or air-gapped) and the scope of integrations. Model usage is accounted for in Twin:Coin, with limits for teams. The Offer Builder prepares an initial quote
Offer BuilderYes. The transcription module takes a live or uploaded recording and turns it into text with labelled speakers and timestamps. AI analysis draws findings and tasks with an owner and a deadline from the conversation, and the result can be exported to PDF, Word, TXT and JSON or saved to the knowledge base
Video: recording transcriptionYes. The translation workspace runs on local models (CPU or GPU). The translator works in a segment editor with a translation memory and the organisation's glossary, the DOCX file comes back with its layout intact, and the finished translation goes to the knowledge base in one click
Video: translation workspaceIt runs Agentic RAG. The mechanism judges what is missing from the material it has gathered, creates follow-up queries and searches again in another round, while TWIN:INDEX guides the search through the chapters of long documents. Diagnostics show every round, query and source, so the answer can be checked
Video: Agentic RAGNo. The model interprets the task while a dedicated decimal calculator computes the amounts. Every result has a calculation card with the arguments, the rounding rule and the engine version, and a report whose figure does not match the card will not be published
Video: verified calculationsYes, under human control. In the agentic loop the agent proposes a plan that can be checked and approved before it runs, then consults the knowledge base and calls tools itself, for example to create a Word document. The run history shows every step and the source of each decision. Tasks with a fixed course run from a published plan (DAG)
Video: agentic loopAn AI assistant answers questions, prepares content and suggests what to do next, while a person decides on every step. An AI agent plans and carries out the next steps of a task itself, using tools and systems. In TWIN:DESK both work in one environment: domain assistants support everyday work, and the agent takes over a whole task, such as a consolidated report, following a plan approved by a person. More in the AI Glossary: AI agent
It is the central control layer — one router for different AI models. It addresses shadow AI and protects the organisation against sensitive data leaks and uncontrolled costs
ProblemFinOps and Anti-DoW mechanisms set tenant and user limits, including protection against denial-of-wallet attacks
Platform modulesPROXY:AI supports human-in-the-loop oversight: a critical process pauses until the appropriate person authorises it
Request lifecycleThe immutable WORM audit log records the complete operational history: model, configuration, invocation cost and data needed to reconstruct the decision. In a bank and at an insurer, this log is evidence for KNF supervision and the basis for ICT incident analysis under DORA
WORM registerThe MCP Gateway lets agents use only explicitly assigned tools, such as Jira, and records an audit trail of their actions
Platform modulesYes. Model responses are scanned again for sensitive data and dangerous instructions
Request lifecycleYes. The dry-run panel allows ABAC rules to be tested on simulated traffic before production deployment
Feature catalogueYes. The AI Firewall analyses data in under 50 milliseconds and neutralises items such as Polish national ID and tax numbers and email addresses before they leave the organisation's network
Request lifecycleSemantic caching serves repeated questions with similar meanings from the cache, without querying an expensive model again
Platform modulesReal-time guardrails filter requests and block attacks such as prompt injection and jailbreaks
Request lifecycleZero-Code Switch: change the primary model in PROXY:AI settings without rewriting business application code
Zero-Code SwitchIt does not admit requests blindly. For every request, it evaluates who is asking, from which environment, using which data and at what risk — then allows, restricts or blocks the operation
Platform modulesAzure API Management and Cloudflare AI Gateway are gateways tied to a single vendor’s platform, and LiteLLM is open-source routing software that the organisation extends and maintains itself. PROXY:AI runs in the cloud, on-premises and air-gapped, and beyond routing it adds an AI firewall with data masking in 12 languages, ABAC evaluation, an MCP gateway for agents, a WORM register with evidence packs and budgets
ModulesYes. PROXY:AI supports local models, including Bielik and PLLuM, alongside cloud models. A policy decides which model is used — for example, requests containing confidential data go only to a local model
Zero-Code SwitchBielik and PLLuMYes. AI Cost Forecast & Optimizer compares each user's subscription with the API-equivalent forecast and recommends keeping, downgrading or upgrading the plan, and when the work needs an API integration it advises keeping the API. The Executive AI Dashboard shows the board the forecast, the scenario budget and items needing attention on one screen
Video: AI Cost ForecastWith the Offline Model Registry. Model Manager starts from your infrastructure profile (processor, memory, GPU cards), rates the compatibility of catalogue models, an advisor suggests candidates for a business need, and the deployment plan points to the exact package in Harbor. Model Agent on a server in a network cut off from the internet checks compatibility, starts the model and passes a test via Master
Video: Model ManagerData security in AI means control over what data reaches models, which models it reaches and who can check this afterwards. PROXY:AI provides it through three mechanisms: it detects and masks personal data before a query leaves the organisation; it records every query in a WORM register that cannot be changed; and it allows only models that meet the policies, for example those running locally or in the EU, and can send queries with confidential data only to a local model. In organisations covered by the amended KSC Act, the query log helps show oversight of AI tools
No. The Adaptive Configuration Engine (ACE) selects legal requirements and controls for the organisation's profile — differently for a bank and a public authority
DiscoveryIt is a proprietary deployment framework combining legal requirements, such as the AI Act, with technical practice. Compliance is built in before solution development starts, not afterwards
Before transformationTen stages — from discovery (F0) to ongoing operations (F6). The seven main stages F0–F6 are complemented by F0.K (knowledge audit), F0.L (legacy systems assessment) and F1.5 (compliance). The whole path is preceded by the Initial assessment (CDF-Eval) and concluded by an independent audit (CDF-AUD)
F0–F6 pathAn indicator in the AI Quality Dashboard that continuously checks whether the knowledge used by a production model is up to date
CogOpsThe platform uses a local AI Advisor model, so the documents it analyses never leave the organisation's infrastructure
DiscoveryNo. The methodology is deployed once, and the platform generates evidence and artefacts for different regulations. New rules may require updates to controls or templates, but not a new deployment
Strategy and complianceYes. It provides ready-to-use registers and operational evidence for AI system management and auditing against the standard
Strategy and complianceIt supports a model SBOM (Software Bill of Materials) and ready-made reporting of compliance with CRA requirements
Strategy and complianceThere is a firm “scale or stop” decision gate at the end of a pilot. Projects without a production prospect end before they consume the budget
Cognitive sprintYes. The automated AIMS evidence pack continuously prepares artefacts for auditors, including the AI System Register and data protection impact assessments (DPIAs)
OversightWith three-tier Cognitive SLA indicators that assess decision quality, hallucination levels and knowledge freshness — not just server availability
CogOpsWith the Initial assessment (CDF-Eval) — a one- or two-day diagnosis at the client's premises involving more than 100 employees. The result is a recommendation: deploy, deploy under conditions or do not deploy — before you spend any money on the project
Initial assessmentYes, if you need one. We can use your template or provide ours — mutual, without exclusivity clauses or restrictions on your contacts with other providers. Many initial conversations take place without an NDA: we discuss architecture, regulations and our approach, rather than your data. When we move on to documents, processes or access to environments, an NDA is a requirement — on our side too
Yes — this is one of the deployment patterns SAIE was designed for. Language models, the knowledge base, logs and agent orchestration run in your server room or an isolated network; model updates and patches are brought in on physical media under an agreed procedure. We use open models, including Polish models, so there is no dependency on an external API or telemetry sent to a provider. We use this approach in classified environments, defence and critical infrastructure — whether you need it depends on data classification and regulatory requirements, not trends
Deployment optionsYes, and we treat it as a substantive project stage, not a formality. We respond to RFIs and RFPs, participate in technical and competitive dialogues, and map contracting authorities’ requirements to SAIE capabilities and obligations under the AI Act and the Polish Act on Artificial Intelligence Systems — so that the procurement specification can be drafted without the risk of invalidation. If you represent a contracting authority, we help formulate technology-neutral criteria for sovereignty, security and business continuity. We know the Ministry of Digital Affairs’ model clauses for AI procurement and structure our responses accordingly
Usually 4–8 weeks, covering one jointly selected process and using your data — not demonstration data. We start by defining measurable success criteria (handling time, accuracy, the percentage of answers requiring correction) and finish by measuring them. You receive a report comparing results with the criteria, an assessment of risks and regulatory requirements for production deployment, an estimate of operating costs and a recommendation: scale up, change the scope or stop. “Stop” is an equally valid result — it saves a budget that would otherwise go towards production without evidence of benefits
Industry offerYes — Polish open models are our starting point, not an optional extra. We run the entire Bielik family locally (SpeakLeash and ACK Cyfronet AGH; 1.5B, 4.5B and 11B, Apache 2.0 licence), PLLuM models from the HIVE AI consortium led by NASK (PLLuM-12B and Llama-PLLuM 8B and 70B, including versions permitted for commercial use), and, where clients require them, Qra (OPI PIB and Gdańsk University of Technology) and Trurl (Voicelab). We also support international open models (Llama, Mistral, Qwen, Gemma) and, where data classification permits, commercial models accessed through APIs. We select models for the task and security requirements — different models for classifying correspondence, talking to employees or analysing documents — and test them on your data, not rankings. SAIE architecture lets you replace a model without rebuilding the rest of the system, so the decision is not permanent
PROXY:AIYes. We deliver open and dedicated training — from two-hour management workshops (“what the AI Act and the Polish Act on AI Systems mean for our organisation”) to programmes for teams using AI every day: safe use of tools, assessing whether deployment is justified using the Ministry of Digital Affairs’ Guide, and preparing an AI policy. Our materials draw on applicable regulations and what you will actually encounter in your institution or company, rather than examples from abroad. Dedicated training is delivered at your premises or remotely, with the option to procure it under Polish public procurement law
TrainingUse the contact form and select the “Demonstration” topic. The meeting takes place in MS Teams
Contact formWe deliver software and services to a business / enterprise standard with full support, and tailor the scope of service to your needs. For organisations that want to maintain AI quality on an ongoing basis, we offer CogOps ongoing support: a monthly AI quality report, a compliance review and an up-to-date agent register
How to deploy AIYes — the software code and training stay with the client, which ensures continuity without vendor lock-in. The form and scope of the handover are agreed in the contract
SAIE compared with alternativesYou complete the form on the page: requester details, institution name and the selected courses with dates and number of participants. After submitting, you receive a copy of the registration and a proforma invoice (for paid training) at the e-mail address provided. Three days before the first day of training we send participants the link to the course
OrderAny person from the institution may submit a registration from a business e-mail address. For paid orders, please pay the proforma invoice you receive before the training date — this is a condition of participation
OrderFor September and October dates, the first 5 people from one institution attend each course free of charge. The only condition: the requester subscribes to the allclouds.pl newsletter (one consent per registration, not every participant). Consent can be withdrawn at any time, including after the training. The newsletter contains information about upcoming dates, new materials and changes in regulations on AI in public administration — with no advertising of third-party products
Training pricesPlaces from the sixth onwards are charged according to the November and December 2026 price list. For a group of 6–10 people the rate is PLN 170 net per paid place. Example: 8 people on one course in September cost 5 × PLN 0 + 3 × PLN 170 = PLN 510 net. The total number of people from one institution in a group may not exceed 18
Training pricesYes. The limit of 5 free participants applies to each course separately, so one institution can train up to 40 person-courses free of charge, including the same person on several courses. The only limit is the number of places in a group — registrations are accepted in order of submission
Training calendarAfter submitting the form you receive a confirmation of your registration at the e-mail address provided. For paid orders, the same e-mail includes a proforma invoice to be paid before the training. Three days before the first day of training we send participants the link to the course
OrderYes, free of charge. A participant can be replaced by another person from the same institution up to the start of the training. Moving to another date from the calendar is possible up to 5 business days before the training, provided there are free places on the new date. Just send an e-mail to office@allclouds.pl
Training calendarCancellation is possible up to 5 business days before the first day of training; after that we offer a change to another date or another participant instead of charging a fee
Yes — the form lets you add any number of items, each with its own date and number of participants (e.g. 01 Foundations for 5 people in September and 03 Security for 3 people in October). The price is calculated automatically, and everything goes onto one confirmation and, for paid orders, one invoice
OrderIt is best to prepare such an order by selecting the courses one by one in the registration form. This lets you choose convenient dates for each course
Module orderWe issue a proforma invoice after receiving the registration. After receiving payment we issue a VAT invoice. On request, we split the VAT invoice by organisational unit
We show net and gross prices on the page. Training financed entirely from public funds (Article 43(1)(29)(c) of the VAT Act) or at least 70% from public funds (§ 3(1)(14) of the Minister of Finance Regulation of 20 December 2013) is VAT exempt — in that case the gross price equals the net price. In practice, an institution financing training from its own budget selects the 100% option. The declaration template you receive with the order confirmation includes both options. If this applies to you, please complete, sign and return the declaration to office@allclouds.pl
Training pricesYes. A team of 6–10 people on the complete path pays PLN 1,280 − 15% = PLN 1,088 net per person; a team of 11–18 people pays PLN 1,280 − 25% = PLN 960 net. Discounts are calculated from the number of people from one institution on a given course, not from the total number of people in the order
Training pricesWhatever you need to carry out the procurement in line with your institution's procedures, for example: an offer, the training programme with a schedule, an order template, a template declaration of public funding, a GDPR information notice and — on request — company information (KRS, NIP, ISO 9001, ISO 14001, ISO 22301, ISO/IEC 27001, 27017, 27018 and 42001 certificates)
OrderYes. We usually deliver training under an order or contract from the institution below the threshold of the Polish Public Procurement Act (PLN 170,000 net from 1 January 2026) — in line with your procurement rules. We accept the institution's contract templates after review; we also have our own one-page template
OrderTraining pricesSessions take place online in MS Teams. A browser and the link we send before the training are enough; no accounts or software installation are needed. For exercises we use AI tools available in the browser. If your institution's security policy blocks certain services, please let us know when registering — we will choose an option that works on your network
Three 80-minute blocks on consecutive business days (always 10:00–11:20) are a deliberate choice: employees are not away from work for a whole day, and between blocks they have time to apply the material to their own tasks and come back with questions. The blocks form one whole and end with a shared document, so we do not sell individual days. If a participant misses a block, they can make it up on the next date of the same course at no extra cost
Training calendarA group has 8 to 18 people — small enough for the instructor to work with every participant, large enough to share experience between institutions. If fewer than 8 people are registered 3 business days before the date, we offer the nearest other date or — for registrations from one institution — a closed session. We never cancel a course without offering an alternative
Training calendarWe do not record sessions. Participants discuss examples from their own institutions freely, which requires certainty that the conversation stays within the group. Instead of a recording, participants receive materials, templates and a summary of each block
Yes, groups on open dates are mixed — deliberately, because sharing experience between institutions is one of the most highly rated parts of the training. The instructor makes sure protected information is not discussed; exercises use anonymised examples or examples we prepare. If you prefer a group made up only of your own institution, please order a closed course
Each participant receives: course materials in PDF, templates of the documents developed during the workshop (e.g. task map, checklist, tool register, pilot charter) and a named certificate of attendance listing the programme
Training programmeExercises use browser-based tools, our products and various large language models, including the Polish models PLLuM and Bielik. The institution does not need to buy any licences — we provide access to the exercise environment for the duration of the training
No. Exercises use examples we prepare or anonymised materials, and one of the first things we teach is what must not be entered into AI tools. The allclouds exercise environment runs on infrastructure in Poland, and the company holds ISO/IEC 27001, 27017, 27018 and ISO/IEC 42001 (AI management system) certificates. Registration data is processed solely to deliver the training
Each course ends with a concrete working document that participants complete during the workshop for their own institution — e.g. a task map and checklist (01), a source catalogue (02), draft rules for using AI (03), a pilot charter (04). The documents follow the structure of the Ministry of Digital Affairs' guide and are prepared so that they can become an annex to an internal order, procedure or pilot request. The institution receives them in an editable format and may modify them freely; they require no licence or reference to allclouds
Training programmeArticle 4 of the AI Act requires deployers of AI systems to ensure a sufficient level of AI literacy among their staff, taking into account the context of their work. The training programme covers the three competences indicated in the Ministry of Digital Affairs' guide: understanding the limitations of AI, critical evaluation of results and formulating instructions. Documentation consists of a named certificate listing the programme, the training programme and the document developed during the workshop. We are not a law firm — the final assessment of whether the scope is sufficient for a specific role is made by the institution, but we prepare the materials to make that assessment easier
Training programmeThe training is delivered by people who have designed and implemented AI solutions in institutions from regulated sectors and co-created the CDF methodology and the ISO/IEC 42001-certified AI management system
InstructorsYes. We deliver closed courses online on a date agreed with the institution (group of 8–18 people). In the closed version, exercises are based on your institution's processes and documents (after anonymisation), and the resulting document refers directly to your structure. Pricing is individual — please write to us through the form, marking “closed course”
OrderOn open dates the programme is fixed, but we choose examples to match the group (municipalities, districts, regional offices, central administration) and ask about the type of institution in the form. Course 06 has a separate variant for regional and central offices (internal assistant), and course 08 is designed for groups from several institutions. Full tailoring (your own processes, your own documents) is available in closed courses
Training programmeYes, at three levels: 30 days of e-mail consultation included in the price, paid implementation consultations (e.g. a review of a draft internal order or pilot charter with the instructor) and a pilot following the CDF methodology in the SAIE environment for institutions that want to test the solution on their own documents. Attending the training does not oblige you to take any of these options — the documents you develop belong entirely to you
CDF methodologyOnly if the office has approved them: it has a contract with the provider, knows where the data goes and has trained its staff. A public chatbot on a private account does not meet these conditions, and the office is responsible for the data entered. It is safer to give civil servants a tool that runs in the office’s infrastructure or in a controlled cloud in Poland or the EU
Public administration (local and central government)Shadow AIPersonal data may go only to tools covered by a data processing agreement and control over data location. PROXY:AI masks personal data before a query reaches the model and records every query in a log. TWIN:DESK can run entirely in the office’s infrastructure
Public administration (local and central government)The civil servant who used it, and the office as the deployer of the AI system. That is why every TWIN:DESK answer includes a citation from the source, and the AI use policy sets out who checks the output before a letter is sent
Public administration (local and central government)AI use policy — templateWith an inventory of tools, an AI use policy and training for civil servants. Then a pilot on one process, e.g. draft replies in EZD (electronic document management system)
Public administration (local and central government)AI use policy — templateBy answering only from approved documents, with a source citation, and through human oversight of the decision. TWIN:DESK answers based on the organization’s documents with a citation, and PROXY:AI lets you route tasks to models proven in a given use case
Finance and insuranceBy being able to swap the model without rebuilding the process. PROXY:AI provides a single gateway to more than 100 models, both cloud and local. Changing a model is a configuration change, not a new deployment
Finance and insuranceBielik and PLLuMLike any ICT service provider supporting important functions: with a risk assessment, an exit plan and information on data location. The WORM log in PROXY:AI documents which models processed data and when
Finance and insuranceThe doctor who makes the decision, and the facility as the deployer of the system. AI in SAIE prepares summaries and draft documents with a source citation, and a human always approves the decision
HealthcareYes. TWIN:DESK and PROXY:AI run on-premises, in the facility’s infrastructure, with local models
HealthcareThe director is responsible for the deployment decision and the policy, the DPO (data protection officer) for the legal bases for data processing, the CISO for security and compliance with the KSC Act, and the provider for system documentation and support. The CDF methodology includes templates for these roles and registers
HealthcareNot unless the firm decides so. TWIN:DESK runs on-premises or in a cloud with data located in Poland or the EU, and PROXY:AI lets you allow only models that run locally or in the EU
Law firmNo, if the firm uses local models or providers whose contracts exclude training on client data. PROXY:AI lets you allow only such models and masks personal data before a query is sent
Law firmThe assessment is up to the firm. SAIE gives it the basis for one: control over data location, case-level permissions, a log of who processed documents and when, and documentation to demonstrate due diligence
Law firmThe AI Act, the amended KSC Act (NIS2) and an internal AI policy linked to the information security management system. The CDF methodology guides you through the Initial Assessment, the classification of use cases and documents you can show an auditor
Energy companyFor critical infrastructure data — on-premises. At LW Bogdanka, TWIN:DESK runs entirely in the client’s infrastructure, with no data going outside, and the deployment took two months
Energy companyStart with the documents people search for most often, e.g. operating and emergency procedures, and assign permissions by department. At LW Bogdanka, about 80% of the knowledge base consisted of scans, which TWIN:DESK processed for search with citations
Energy companyYes. Every query and answer goes to the WORM log in PROXY:AI, and TWIN:DESK answers include a source citation
Military and defense industryYes. Models run locally, code and configuration stay with the client, and the list of approved models and components is under the operator’s control
Military and defense industryYes. PROXY:AI with local models runs in air-gap mode, without an internet connection. We carry out deployments in classified environments together with integrators authorized for such work
Military and defense industryNot with a ban, but with a safe tool, a policy and training. PROXY:AI routes traffic to approved models, masks data and records queries, and training teaches staff what must not be entered
Uniformed servicesShadow AIBy answering only from service documents, with a source citation, and by checking the output before use
Uniformed servicesFor summaries, searching procedures, and drafting notes and reports — always with human verification. Not for autonomous decisions concerning individuals
Uniformed servicesThis is decided by the definition in Article 3(1) of the AI Act: a system that infers from the input it receives how to generate outputs. The Initial Assessment in the CDF methodology classifies each use case and documents the rationale
Supervisory and audit institutionAI Act classifierIn the institution’s infrastructure or in a chosen cloud in Poland or the EU. The WORM log in PROXY:AI shows who processed data, when and with which model
Supervisory and audit institutionBy separating roles: the language model searches and summarizes with citations, and calculations are performed by deterministic tools. Every result can be reproduced from the log
Supervisory and audit institutionAI that serves as a safety component in the management of water supply is listed in Annex III to the AI Act. The Initial Assessment in the CDF methodology settles this for each use case
Water utilitiesSAIE provides the documentation needed to assess the supplier: data location, a processing log, the manufacturer’s ISO/IEC 27001 and 42001 certificates and an exit plan
Water utilitiesThe AI policy becomes part of the ISMS: the same roles, asset register and review. Templates for the policy and registers are in the WDR documents
Water utilitiesThrough a single gateway: PROXY:AI replaces scattered API keys and provides team budgets and a WORM log of every query
Data centers and telecommunicationsTWIN:DESK and PROXY:AI run on the operator’s infrastructure and can serve customers as a service
Data centers and telecommunicationsA ready-to-use AI work environment with evidence of compliance — in the allclouds.pl partner program
Data centers and telecommunicationsThe draft Annex 22 allows it in non-critical applications, under human oversight, and excludes it from quality-critical applications. Until the final text is published, working with documentation, summaries and search with citations is safe
Biotechnology and pharmaceuticalsBy defining its intended use, testing it on reference data and keeping a full trail: who processed data, when and with which model (the WORM log in PROXY:AI)
Biotechnology and pharmaceuticalsThrough an inventory and a single gateway to models. Traffic routed through PROXY:AI shows who uses AI and for what
Biotechnology and pharmaceuticalsShadow AITools without a data processing agreement and control over data location should not receive personal data, identification numbers, clients’ financial data or documents covered by professional secrecy. The AI use policy template includes a catalog of such data
Accounting firmAI use policy — templateThe accounting firm, toward its client. AI prepares a proposal citing the relevant provision, and the accountant approves it
Accounting firmBased on the AI use policy template: approved tools, a data catalog, responsibility for the output and training
Accounting firmAI use policy — templateOnly into approved tools, with a contract and control over data location, and only to the extent permitted by the contract with the client. In SAIE, each client’s data sits in a separate area with its own permissions
Business consultingAI use policy — templateThe consulting firm, toward its client. AI prepares material with a source citation, and the expert is responsible for the conclusion
Business consultingYes, if you decide so: on-premises or in a cloud with data located in Poland
Business consultingManufacturers, importers and distributors of products with digital elements placed on the EU market, including controllers and devices with software
Electronics and automationYes. Local models in SAIE are used within the company’s infrastructure, so code and documentation do not go to external services
Electronics and automationWith a list of products and components, a reporting procedure and access to documentation in one place. TWIN:DESK answers with citations from technical documentation, which shortens the time needed to establish which products a vulnerability affects
Electronics and automationFrom 2 August 2026 (Article 50 of the AI Act). For systems placed on the market before that date, machine-readable marking is required by 2 December 2026
Media and communicationsAI Systems ActText published to inform the public on matters of public interest does not need to be labeled if it has undergone editorial review and a person or newsroom holds responsibility for the publication (Article 50(4)). It is worth documenting this review
Media and communicationsThe entity that publishes the content, as the deployer of the AI system. It is worth setting out the scope in the contract with the agency
Media and communicationsOnly into a tool that runs in the university’s infrastructure or guarantees that the data is not stored or used for training. PROXY:AI lets you use local models, including Bielik and PLLuM
Science and higher educationBielik and PLLuMThrough a university policy that sets out the disclosure of AI involvement in student work, grading rules and approved tools
Science and higher educationAI use policy — templateA shared gateway to local and cloud models with budgets for faculties and units, and for administrative staff — an assistant that answers from internal regulations with a citation
Science and higher educationWith one process with a measurable loss, e.g. time spent searching for instructions or manual reporting. The Initial Assessment in the CDF methodology selects the use case and sets the criteria for the decision after the pilot
Industry and engineeringDocuments are enough to start: instructions, standards, service reports. TWIN:DESK also processes scans
Industry and engineeringA human makes the decision. AI points to the source and proposes steps, and every action is recorded
Industry and engineeringFrom 30 December 2026 for large and medium-sized companies, and from 30 June 2027 for micro and small companies. You need geolocation data and documents from suppliers — TWIN:DESK organizes them and answers with citations
Agriculture and environmentMost often data on emissions, the origin of raw materials and EUDR compliance. It is worth collecting it in one place from which you can quickly prepare a response for the customer
Agriculture and environmentDocument agents in TWIN:DESK read data from documents and prepare it for the system, and a human approves the result before it is saved
Transport and automotiveThrough a single gateway to models with personal data masking (PROXY:AI) and permissions by branch
Transport and automotiveWherever the outcome affects a customer or a driver: accepting a complaint, contractual penalties, carrier evaluation
Transport and automotiveTWIN:DESK answers advisors’ questions from technical documentation, bulletins and warranty terms with the source cited, and agents prepare warranty claims and complaint responses. A human decides whether to accept a warranty claim
Transport and automotiveIt can prepare a draft. TWIN:DESK reads the case file in EZD (the electronic document management system) and points to the source of every sentence, and the civil servant checks the draft, corrects it and signs it. The decision and responsibility stay with the office
Yes, if the company has approved it as a tool: with a contract, control over data location and a usage register, because the amended KSC Act requires securing the supply chain of ICT services. Data from critical infrastructure should not, however, go to public chatbots. The best option is to give staff access to models through PROXY:AI, which masks data and records every query, or to run AI in the company’s server room
Yes. SAIE runs in a network completely cut off from the internet, including the isolated operational networks of nuclear facilities: Offline Model Registry matches the model to the hardware and starts it from an installation package, and the knowledge base and event log stay in the operator’s server room. It is the same L4 sovereignty level we use in critical infrastructure
The most recent are the recommendations of UKNF (Office of the Polish Financial Supervision Authority) of 22 July 2026 on the impact of Frontier AI models on cybersecurity. They build on DORA and recommend, among other things, taking AI-enabled attacks into account in ICT risk analysis, assessing whether ICT providers manage AI risk, and reducing the risk of over-dependence on a single ICT or AI provider. UKNF has announced that it will verify their implementation as part of supervision. PROXY:AI helps meet them: the WORM register records every model call as evidence for the supervisor, and a single gateway to more than 100 models reduces dependence on one provider. Since 17 January 2025, DORA has replaced Recommendation D and the earlier KNF IT guidelines
Yes, as a draft for review. However, the rules of professional ethics for advocates (§ 23e ZZEA) require the advocate to assess and verify the result personally and to remain personally responsible for the content of the pleading, and the recommendations of KIRP (National Chamber of Legal Advisers) warn legal advisers against over-reliance on AI. TWIN:DESK prepares the draft from the case files, timeline and correspondence, so the lawyer starts with a substantive review, not a blank page
Yes, for general questions and fully anonymised material, if used deliberately. Case data, however, should not go into a consumer service: § 23e ZZEA (Code of Ethics for Advocates) and the recommendations of KIRP (National Chamber of Legal Advisers) protect professional secrecy, and such an account offers neither a data processing agreement nor a record of who processed the data and when. In SAIE the best models remain available, but behind the PROXY:AI gateway, which does not let confidential data out to the cloud. We write more about this in the article “Does a lawyer need sovereign AI?”
Not in a public AI chat: health data is a special category of personal data (Article 9 GDPR), is covered by medical confidentiality, and the facility does not control where it goes. Yes, if the AI chat for doctors runs in the facility’s infrastructure: TWIN:DESK and PROXY:AI from the SAIE ecosystem run on-premises with local models, PROXY:AI with the Healthcare sector profile masks a patient’s identifying data before every query, and a human always approves the decision
In SAIE, logistics and freight forwarding are supported by, among others, three tools in TWIN:DESK: an AI agent for freight forwarding that reads orders and CMR documents and prepares the data for the TMS, a complaints assistant that prepares a draft reply, and reports for clients and carriers generated on a schedule. PROXY:AI masks drivers’ and clients’ data, and a human approves order data before it is saved in the TMS
Railways, yes: rail infrastructure managers and railway undertakings belong to the transport sector in Annex I of the NIS2 Directive, alongside air and water transport. In road transport the directive covers road authorities responsible for traffic management and operators of intelligent transport systems, not every haulage company; courier companies are in Annex II. As a rule, it applies to medium-sized and large enterprises. In Poland NIS2 is implemented by the amended KSC Act, and entities in the transport sector must implement the security measures by 3 April 2027. The PROXY:AI query log helps show oversight of AI tools
SAIE turns the session recording into text with labelled speakers and statement times, which becomes the draft minutes and the captions for the BIP recording. The speech recognition model runs in the office’s infrastructure. Details and the captions deadline: AI transcription of council sessions
The Commission for the Development and Security of Artificial Intelligence (KRiBSI), Poland’s AI market surveillance authority. From 28 October 2026 it can carry out inspections, handle complaints and impose fines
AI Systems ActUp to €35m or 7% of turnover for prohibited practices, up to €15m or 3% of turnover for other obligations and up to €7.5m or 1% of turnover for incorrect information. SMEs pay according to the lower of the two amounts
AI Systems ActYes. A public body that uses AI systems at work is a deployer under the AI Act — it must ensure staff AI literacy, transparency and, from 2.12.2027, the obligations for high-risk systems, including a fundamental rights impact assessment. The act sets no separate fine rules for public bodies — fines are imposed on any entity obliged to comply with the AI Act (Art. 104)
AI Systems ActList the AI systems used in your organisation, check them against prohibited practices, adopt an AI use policy, train your staff and decide how you label AI-generated content
AI Systems ActYes — at work the deployer is the organisation, not the employee. That is why the tool should be in the inventory and covered by the policy and training. An employee’s statement that they use AI “at their own risk” transfers nothing
AI Systems ActThe AI Act does not name such a document, but it requires deployers to ensure, among other things, staff AI literacy (Art. 4) and transparency (Art. 50). ISO/IEC 42001 requires an AI policy. Whether it is called a policy or AI usage rules does not matter; what counts is the content and the tools behind it. Without written rules these obligations are hard to prove during an inspection
AI use policyA ban with no company alternative usually moves usage to private phones and accounts, i.e. into shadow AI. It is more effective to approve a safe tool with data controls and logging
AI use policyIt should. Labour law does not cover them, but the AI Act, GDPR and ISO standards apply to the organisation in the same way, whatever the form of engagement. The rules are worth including in contracts
AI use policyIt depends on the tool and the contract with the provider. Tools without a data processing agreement and control over data location should not receive personal data, trade secrets, client data or information protected by law. The template includes a list to tailor
AI use policyThe management board or head of the organisation, after consulting the DPO, information security and — where one exists — employee representatives
AI use policyThe use of AI tools that the organisation has not approved and does not oversee, most often public chatbots on employees’ private accounts
Shadow AIIt depends on the version and the contract. On a private account the organisation has no contract with the provider, no say over data retention and no access to chat history. A tool approved by the organisation, with a contract, data controls and logging, is safe
Shadow AIA block with no company alternative moves usage to private devices. It is more effective to approve a safe tool and route traffic through an AI gateway
Shadow AITowards the client and the supervisory authority — the organisation: it is the data controller under GDPR and the deployer under the AI Act. An employee’s statement that they use AI “at their own risk” transfers nothing
Shadow AIWith an inventory and a policy. Then a safe tool and training for staff — before a ban turns into a workaround
Shadow AIFor letters and official matters PLLuM is trained deliberately (Monitor Polski, the Journal of Laws, transcripts) and already runs in mObywatel and city halls. For general tasks — summaries, classification, chat — Bielik under Apache 2.0 has no licence restrictions. Behind a gateway you can have both and choose per task
Bielik and PLLuMBielik — yes, all versions under Apache 2.0. PLLuM — it depends on the variant: the new models from May 2026 are under licences allowing commercial use, the older “‑nc” variants are non-commercial only. The licence is checked on the model card and entered in the system register
Bielik and PLLuMNot always. Models up to 12 bn parameters run on one 24 GB card, Minitron 7B on a 6–8 GB card. Larger ones (PLLuM 70B) need a server with several cards — or a model at an operator in the EEA, available through the same gateway as local models
Bielik and PLLuMNo. The deployer’s duties (register, literacy, prohibited practices, transparency) concern the use of the system, not its licence. An open model makes documentation easier — there is a model card and training data — but the register entry and the use policy are on the organisation’s side
Bielik and PLLuMIn general multilingual tasks — usually yes, because it is smaller. In Polish official and legal language PLLuM and Bielik often answer more accurately than global models of the same class, and the data does not leave the organisation. In practice both approaches are combined behind one gateway
Bielik and PLLuMThe AI Act does not certify assistants. The deployer’s duties — system register, literacy, content labelling, no prohibited practices — rest with the organisation regardless of the chosen service. The provider can help with documentation, but the organisation gathers the evidence
ChatGPT, Copilot or your ownProcessing takes place in the provider’s cloud, within the organisation’s tenant and under the provider’s contract terms (region, no training). For an organisation with an on-premises requirement, or one that cannot entrust data to an external processor, this criterion decides before the price does
ChatGPT, Copilot or your ownNo. Your own environment is a ready platform — a model gateway, an assistant on documents, a log — deployed in the organisation’s infrastructure or at an operator in the EEA. It differs from open source in service, contract and methodology; from provider services in that the data and processes stay in the organisation
ChatGPT, Copilot or your ownOver the same horizon (3 years) and the same components: licences or models, infrastructure, maintenance, competences, deployment time and exit cost. The licence price per user is one of six elements
ChatGPT, Copilot or your ownBy the lack of a source. A language model answers fluently even when it has no data — hence non-existent articles of law and dates. An assistant working on the organisation’s documents (RAG) gives a citation and the place in the document; no source, no answer. The quiz in section 06 shows this on five pairs
ChatGPT, Copilot or your ownYes, if officials use AI tools — including private ones — with the office’s documents. As a deployer, the office is responsible for citizens’ data (GDPR) and for staff training (Art. 4 of the AI Act). The same template only needs adapting: the office’s document types, the approved tools and the person who approves the output
AI use policyPublic administration60 seconds, 4 waves of 15 s. The game runs in a browser on a computer, tablet or phone, in Polish and English. No sign-up or installation needed
No. All data on the cards is fictional and the game sends nothing. Your score, and the daily ranking in booth mode, stay in the browser on that device
Because blocking everything is a failure too: work stops and people go back to private accounts. A good gateway protects data and lets the rest through, so tapping an ordinary request costs 20 pts
Yes. The demo works best for a presentation, training mode and the game for a training session, and booth mode with a daily ranking for an event. Contact us and we will help prepare the game for your event
The principle is the same, but at work the gateway decides, not a person: it masks data and blocks attacks in under 50 ms, in 12 languages, and records every decision in a WORM log
5 puns, about 2 minutes in Junior mode and 3 minutes in Expert mode. The game runs in a browser on a computer, tablet or phone, in Polish and English. No sign-up or installation needed
In Junior mode all 4 answers are shown and you pick 3; the top score is 400 pts. In Expert mode the answers are hidden and you type them in your own words, with 3 misses per question; the top score is 425 pts
The game has a dictionary of over 2,300 words and phrases: word stems with their forms, synonyms, Polish equivalents and common typos. Excluding words make sure a random word does not score
No. Answers are judged by the dictionary in your browser and the game sends nothing. On that device it only remembers the language and game mode you chose
Yes. Junior mode works best as a warm-up, a webinar works with the pun on screen and answers in the chat, and a booth with both modes. Contact us and we will help prepare the game for your event
Yes, the best known are two families of Polish language models: Bielik (the SpeakLeash Foundation and ACK Cyfronet AGH), available at chat.bielik.ai, and PLLuM (the HIVE AI consortium led by NASK), available in PLLuM Chat. In a company or public body, what matters more than the chat itself is where the data goes: in SAIE you work with Bielik and PLLuM in TWIN:DESK, with answers from the organisation’s documents and a source citation, and the model runs in the organisation’s own infrastructure
PLLuM (Polish Large Language Model) is a family of Polish language models from the HIVE AI consortium led by NASK, funded by the Ministry of Digital Affairs. The models have 4, 8, 12 and 70 bn parameters and are trained on texts including Monitor Polski, the Journal of Laws and parliamentary transcripts, which is why they handle official language well. The licence depends on the variant: Apache 2.0, the Llama 3.1 licence or CC BY-NC 4.0 (non-commercial use only). In SAIE, PLLuM is available in PROXY:AI and TWIN:DESK
It is an assistant in the mObywatel app based on the PLLuM model, available since 31 December 2025. It answers questions about official matters and helps find applications and forms. It works anonymously and does not store chat history. It shows that PLLuM handles official matters well - in a public office the same model works in TWIN:DESK on the office’s own documents and inside its infrastructure
The simplest way is Ollama: once it is installed, the command ollama run hf.co/speakleash/Bielik-11B-v3.0-Instruct-GGUF:Q4_K_M downloads Bielik 11B v3 in 4-bit quantisation (a file of about 6.7 GB) and starts a chat on the computer. For team use, the model runs on a server, for example in vLLM, and access is provided by PROXY:AI with access policies, data masking and a query log. In a network without internet access, installation is handled by the Offline Model Registry in SAIE Pantera
The creators publish the PLLuM model weights on Hugging Face, so an organisation can run the model itself, for example in vLLM, which provides an API compatible with the OpenAI API. In SAIE, API access to PLLuM is provided by PROXY:AI: the model is one of the entries in the model catalogue, with the same access policies, data masking and query log as global models
OpenAI sells ChatGPT to businesses in two plans billed per user: Business and Enterprise. The Business plan price list is on the OpenAI website, and the Enterprise price is set in the contract. The licence price, however, is only one of six cost components: a comparison with your own environment adds infrastructure, maintenance, skills, deployment time and exit cost, calculated over a 3-year horizon. When an organisation already has subscriptions, AI Cost Forecast in SAIE Pantera compares each user’s subscription with the API equivalent, and we prepare the full calculation for your organisation in the Initial Assessment
Since 2025 Gemini has been part of the Google Workspace business plans (Business and Enterprise) rather than a separate add-on, so its cost is included in the per-user price of the office suite. Google publishes the price list. As with ChatGPT and Copilot, the licence price is one of six cost components over a 3-year horizon, and the data is processed in the provider’s cloud
Essential and important entities. These are companies and institutions in the sectors listed in Annexes 1 and 2 to the Act, if they are at least medium-sized. Regardless of size, the Act covers, among others, public entities, DNS service providers, top-level domain name registries, domain name registration service providers and qualified trust service providers
Apply without delay through the S46 system, with a statement by the head of the entity. The entry is made when the application is submitted. The authority may also enter the entity ex officio. The Act provides for a fine for failing to apply on time, which can be imposed only after 3.04.2028
The head of the entity is responsible. Where the head is a collective body and no responsible person has been named, all its members are responsible. The head faces a fine of up to 300% of their monthly remuneration, or up to 100% in a public entity. An essential entity faces a fine of up to €10 m or 2% of revenue, and no less than PLN 20,000; an important entity up to €7 m or 1.4%, and no less than PLN 15,000. If an infringement causes a serious cyber threat, the fine is up to PLN 100 m
The Act does not ban the use of AI chats. It requires every tool, including an AI chat, to be covered in risk assessment, in the access control policy and in the supply chain assessment. In practice, the ISMS must therefore set out who may use which models and with what data
The location of processing is not banned in itself. The supply chain assessment must, however, take into account the supplier’s vulnerabilities, the quality of its services, assessments by the NIS Cooperation Group and decisions designating high-risk suppliers. After such a decision, no new products from that supplier are introduced, and existing ones are, as a rule, phased out within 7 years (within 4 years for critical functions in telecommunications)
Yes, if it meets the criteria for a significant incident. The early warning must be sent within 24 hours, the notification within 72 hours and the final report within a month, to the competent CSIRT. To meet these deadlines, you need to know who sent what data to the model and when
The AI Act does not replace the GDPR: when an AI system processes personal data, both apply at the same time (Art. 2(7) AI Act). The GDPR determines whether and on what legal basis data may be processed, and the AI Act how to use an AI system safely and transparently. For high-risk systems, information from the provider is used for the impact assessment under Art. 35 GDPR
It can prepare a draft. Transcription with labelled speakers is the basis for the minutes, and the council office checks their content and prepares them for adoption in line with the municipality’s statute
As before, in line with the municipality’s statute: they are usually signed by the chair of the session and the minute-taker, and the council adopts them at the next session. AI does not change this procedure, it only shortens the work on the draft
Yes, in an on-premises deployment. The speech recognition model then runs in the office’s infrastructure, so the recording does not have to leave its network
Yes. The text with statement times is exported as captions for the recording in the BIP and on the municipality’s website, which helps meet the 14-day deadline of the Digital Accessibility Act
Yes, just like sessions. The law does not require committee meetings to be broadcast or recorded, but their minutes are public (Art. 11b Local Self-Government Act)
The AI Act has been in force in Poland, and directly applicable, since 1 August 2024, and its provisions apply in stages: from 2.02.2025 AI literacy (Art. 4) and the ban on prohibited practices (Art. 5), from 2.08.2025 the obligations of providers of general-purpose AI models, from 2.08.2026 transparency (Art. 50) among others, from 2.12.2027 the obligations for high-risk systems in Annex III. In Poland, KRiBSI carries out inspections and imposes fines from 28.10.2026
Regulation (EU) 2026/1744 (Digital Omnibus on AI) postponed the obligations for high-risk systems: for Annex III to 2.12.2027 and for Annex I to 2.08.2028. Generative systems placed on the market before 2.08.2026 have until 2.12.2026 for machine-readable marking of content. From 2.12.2026, new prohibited practices are also added to Art. 5
The official Polish text is on EUR-Lex: Regulation (EU) 2024/1689. The changes made by Regulation (EU) 2026/1744 (Digital Omnibus on AI) are in a separate act, also available in Polish on EUR-Lex
Yes. An AI model used through an API, in the cloud or as part of software is an ICT service. The institution enters the provider in the register of information and signs a contract with the clauses of Art. 30, and where AI supports a critical function it also prepares an exit strategy
No. KNF repealed it with effect from 17 January 2025, together with the IT guidelines for insurers, fund management companies, investment firms and market infrastructure, and UKNF withdrew its cloud communication. DORA has taken their place
Yes, if it is at least a medium-sized enterprise, but DORA takes precedence in ICT risk management and incident reporting. From the KSC Act a bank applies, among others, the provisions on entry in the register of essential and important entities
The regulations do not ban any specific tool. Each one, including an AI chat, does however require a contract with DORA clauses, an entry in the register of information and a risk assessment. An employee’s private account does not meet these conditions, so a tool approved by the institution is needed, such as TWIN:DESK from the SAIE ecosystem
Yes, if it assesses natural persons. From 2 December 2027 the bank must ensure human oversight, monitor how the system works and assess its impact on fundamental rights before deployment. The same applies to pricing of life and health insurance
KNF supervises institutions, including on DORA and ICT risk. From 28 October 2026 the application of the AI Act can be inspected by KRiBSI, which includes a member designated by KNF
Street poll takes about 3 minutes, Phone about 5. The game runs in a browser on a computer, tablet or phone, in Polish and in English. No registration or installation needed
From street polls, reports and accounts in the Polish press, and from recordings released by the police or described in decisions of UOKiK (Polish competition and consumer protection authority). We checked every quote at its source, and after the reveal the game shows the source with a link to it
SAIE generates them on our infrastructure, for the same question and at a similar length. On Easy, the AI answers like an assistant; on Hard, it pretends to be human
No. The game does not collect personal data or the content of your answers. Only anonymous data about the course of the game goes into the statistics: mode, level, topic or call, correct guesses, decisions, chosen question cards and score
In a real call, what you do matters more than who is speaking. A scammer may be a human and a helpline a machine; the safe behaviour is the same in both cases
Because people also speak smoothly and in general terms. This is deliberate: style alone is not enough to recognise a machine. That is why the game teaches a procedure, not just listening
https://www.allclouds.pl/en/faq/
