The AI Act in practice: what a Polish company has to do in 2026

After the latest changes to EU rules, many boards breathed out: "it's been postponed, so we have time." That is only partly true. One block of obligations was moved, an important one, but the rest either apply already or are just starting to. Below we set out where things stand in October 2026 and leave a concrete list of steps.

This is an informational text, not legal advice. Talk to a lawyer who knows your sector before you make compliance decisions.

What is certain: the timetable

The AI Act (Regulation 2024/1689) entered into force in August 2024 and applies in stages. Here is what actually applies, and from when.

• 2 February 2025: prohibited practices (Art. 5) and the AI literacy obligation (Art. 4).
• 2 August 2025: obligations for providers of general-purpose AI models (GPAI), meaning large language models, plus the rules on penalties and oversight.
• 2 August 2026: transparency obligations under Art. 50, including telling people they are talking to a chatbot and labelling AI-generated content. One exception: technical marking of content (Art. 50(2)) for systems already on the market before that date has a transition period until 2 December 2026.
• 2 December 2027: high-risk systems from Annex III (recruitment, credit scoring, education, employee evaluation and similar). The original date was August 2026.
• 2 August 2028: high-risk systems built into regulated products (Annex I), such as machinery or medical devices. The original date was August 2027.

The delay is no longer just an announcement. The Digital Omnibus on AI package, proposed by the Commission in November 2025, got a political agreement in May 2026, a Parliament vote in June and Council adoption on 29 June. According to available sources it was published in the Official Journal of the EU on 24 July 2026 and entered into force three days later. Publication is what makes the new dates binding, and that formality is now behind us.

What changed in the obligations themselves

The Omnibus is more than a calendar. For Polish companies, three changes matter.

First, Art. 4 was softened in its wording. Providers and deployers must take measures to support the AI competence of their staff, instead of guaranteeing a "sufficient level" for every person. The obligation stays, though: an earlier idea to shift it onto Member States and the Commission did not pass.

Second, there is a new prohibition in Art. 5: AI systems that generate non-consensual intimate content and child sexual abuse material (so-called nudifiers). This mostly concerns providers of such tools, but if you give staff image generators, check that the tool has sensible safeguards. The transition period ends on 2 December 2026.

Third, there is relief for smaller players. Under the Commission's proposal it covers companies of up to 250 people (SMEs) and up to 750 people (small mid-caps): simplified technical documentation and lighter quality management requirements. The exact scope in the published text needs checking, because the sources we rely on mostly describe the draft.

Prohibited practices: what is not allowed

Art. 5 bans, among other things, manipulative techniques that influence people's decisions, exploiting vulnerabilities (age, disability, economic situation), social scoring, emotion recognition at work and in schools, and scraping facial images from the internet to build recognition databases.

In a typical Polish company the most common risk is not "social scoring" but tools that arrived through the back door. A call-centre module that analyses the emotions of the employee on the line, or an HR feature that "rates team mood" from cameras or recordings, may fall under the ban. Better to find them before someone from outside does.

Deployer or provider: who is responsible for what

Most firms we talk to are deployers: they use someone else's system in their own operations. You become a provider if you build a system or rework it under your own brand. The line is thinner than it looks: if you build a candidate-evaluation app on a language model in-house, you are the provider of your own system.

For a deployer of a high-risk system, the obligations (from December 2027) include using the system according to its instructions, human oversight by competent people, control of input data quality, keeping logs for at least six months, and informing employees and the people affected by decisions. The provider is responsible for the conformity assessment, technical documentation, the risk management system and CE marking.

A real-world case: the HR department of a trading company uses a recruitment platform that "ranks" CVs. The vendor called it a search engine, but the feature automatically orders candidates by suitability, so it is a textbook Annex III system. The deployer is then responsible for human oversight and for informing candidates, and the contract should give it a right to the documentation. Better to settle that now than in 2027 during a renegotiation.

For both sides, Art. 4 (competence), Art. 5 (prohibitions) and Art. 50 (transparency) count already.

Poland: the act and the supervisory body

Here is the good news: the act on artificial intelligence systems has been passed. The Sejm adopted it in June 2026, took up the Senate's amendments in early July, and the President signed it on 24 July. According to most sources it entered into force on 11 August 2026.

The market surveillance authority is the Commission for the Development and Safety of Artificial Intelligence (KRiBSI). It has seven members: a chair, two deputies and four representatives nominated by the heads of UOKiK, KNF, KRRiT and UKE. It handles complaints, examines whether systems comply, issues individual opinions, runs regulatory sandboxes (free for micro, small and medium-sized companies) and can impose sanctions. During the parliamentary work, the power to order a system withdrawn from the market was removed.

What is still moving? The dates for appointing and launching the body. Sources give different dates (chair by October, first meeting in November 2026), so it is better to follow the actual start of inspections as it happens. We expect that in the first year most cases will come from third-party complaints rather than spot checks.

Penalties

The AI Act sets three bands. For prohibited practices: up to EUR 35 million or 7% of annual worldwide turnover. For breaching the obligations of providers, deployers and transparency rules: up to EUR 15 million or 3%. For giving false information to authorities: up to EUR 7.5 million or 1%. For SMEs the lower of the two values applies. These are ceilings, but they explain well why a board should know what is running in the company.

Checklist for the next few weeks

1. Inventory. Put everything that uses AI in one table: purchased tools, AI features in existing systems (CRM, HR, ERP, call centre), your own models and "quiet" use, such as ChatGPT accounts staff set up themselves. For each item: owner, purpose, data, vendor. In our projects this is usually the longest step and the most revealing.
2. Risk classification. For each system, answer: is it a prohibited practice, high risk (Annex III), does it need a transparency notice, or is the risk minimal? Most items will land in the last group, and that is worth documenting.
3. AI use policy. One short document: which tools are allowed, what data must not be pasted in, who approves new ones, how to label generated content.
4. Training. For everyone: the basics and rules for safe use. For HR, customer service, analysts and IT: versions fitted to the risks of their role. Keep attendance lists and materials, because they are your evidence under Art. 4.
5. Transparency. The chatbot on your site says it is a bot. AI-generated or AI-edited content in external communication is labelled wherever Art. 50 requires it. Start preparing for technical marking, which takes effect on 2 December 2026 for older systems.
6. Documentation and logs. A register of systems, classification decisions, test results, incidents. For future high-risk systems, plan log retention from the start.
7. Human oversight. Name the people who can stop or change a system's decision, and make sure they understand its limits. "A human clicks approve" is not oversight.
8. Vendor contracts. Add: the vendor's classification of the system, access to instructions and documentation, notice of significant model changes, cooperation on incidents and audits, and information about training data and where processing happens.

Assign each step an owner and a deadline. AI Act compliance rarely fails for lack of legal knowledge. More often, nobody owns the topic.

What we still don't know

Some things remain open. The Commission's guidelines on classifying high-risk systems and the harmonised standards are still being worked on, so many details of conformity assessment will only be clear in 2027. KRiBSI's practice is only now taking shape. The scope of relief for SMEs and small mid-caps needs confirming in the final text. As for the national act, some sources differ on when inspection powers start.

Our advice: don't wait for December 2027. An inventory, a policy and training bring you into line with what already applies, and tidy up AI in the company along the way. If you want to go through the first two steps with someone who has done it in several organisations, write to us.

Sources

• Digital Omnibus Adopted: AI Act High-Risk Delayed to 2027 (aiacto.eu)
• EU AI Act Omnibus Agreement, Postponed High-Risk Deadlines and Other Key Changes (Gibson Dunn)
• EU Lawmakers Reach Provisional Agreement to Delay Key EU AI Act Obligations (Sidley)
• EU AI Act omnibus: the new high-risk deadlines explained (VerifyWise)
• The AI Act implementation timeline: What changes under the AI Omnibus? (FPF)
• The AI systems act and KRiBSI: what changes (Chronofy)
• The Sejm passed the artificial intelligence act (Rzeczpospolita)
• Government bill on artificial intelligence systems (Sejm)
• Regulation (EU) 2024/1689, full text (EUR-Lex)