What changes today under Poland’s AI systems law? Inspections, complaints and penalties switch on
A three-month commencement clause now activates the regulator’s inspection, complaint and sanction procedures. The legal powers are real, but the public complaint form is still being built and the commission’s first enforcement record does not yet exist.
The short version
- What happened
- Poland’s law was published on 27 July; today’s news is the scheduled start of articles 8–18 and chapters 3–5, 8 and 9, not a newly published act.
- Who it affects
- People who believe an AI system breached the law now have a national complaint route, while organisations operating covered systems face document, system-access and remediation demands. The unfinished online form may make the first step harder until the commission publishes a working service.
- What remains unproven
- Statutory commencement rather than a new publication
Keep in mind
Statutory commencement rather than a new publication
Primary legal and government sources only
No inspection, complaint or penalty outcomes yet
Electronic complaint form still in development
Full commission operations were expected in November
EU AI Act obligations retain their own phased application dates
Multi-source analysis · 4 linked sources. Primary analysed source date: 28 October 2026. Earliest linked supporting source: 27 July 2026.
Read the full report · 5 min The evidence, methods, implications and limitations
The enforcement machinery starts today
Poland’s national machinery for enforcing the EU AI Act has gained its operative inspection, complaint and penalty provisions. The underlying law was published on 27 July and mostly entered into force on 11 August. Its final clause delayed articles 8–18 and chapters 3–5, 8 and 9 for three months, making 28 October the material date for individual regulatory opinions, market-supervision procedures, settlements, administrative fines, criminal provisions and the court rules used to challenge commission decisions.
For providers, deployers and other organisations, the immediate change is procedural rather than a new class of prohibited system. The Commission for the Development and Safety of Artificial Intelligence, known as KRiBSI, may inspect compliance on its own initiative, from information it receives or as part of monitoring. The default is at least seven days’ notice and remote work, but the commission may order an on-site inspection without that notice when it reasonably suspects significant harm to life, health, safety or fundamental rights.[1][2]
Inspectors can demand evidence, while affected people gain a complaint route
The official text lets inspectors request documents, electronic correspondence, storage media and access to relevant IT or cloud systems. A written protocol follows, with evidence attached and 14 days for the inspected party to sign or object. If irregularities are found, the commission can recommend corrective steps and deadlines; failure to comply can lead to formal proceedings. During a case it can warn a party and identify measures such as blocking access to a system or restoring compliant operation.
Article 59 also lets an individual, company or other organisation complain about a possible breach. A complaint should name or describe the system, explain the relevant facts and may include supporting material. Electronic filing is the default, but paper is permitted when electronic submission is not possible. That right is clearer than the current public service around it: KRiBSI’s complaint page says the electronic form is still being developed. The gap does not erase the statutory route, but it is a practical access problem the commission needs to resolve.[2][3]
The distinction that matters
How a suspected breach can move through the new procedure
The law separates information gathering, a formal case and review of the outcome.
Trigger
Complaint, monitoring information or commission initiative
Inspection or formal proceeding may begin
Evidence
Request records, correspondence and relevant system access
Protocol, objections and corrective recommendations
Decision
Warning, settlement or administrative sanction
Court appeal remains available
The powers are consequential, but enforcement capacity is still untested
KRiBSI can impose administrative fines in the cases, amounts and conditions set by the EU AI Act. The Polish procedure requires payment within 30 days after a final decision, allows the commission to estimate the financial basis when necessary data are withheld and provides for appeals to the competition and consumer protection court in Warsaw. A settlement route can reduce sanctions when specified conditions are met, while criminal provisions cover obstruction and failure to carry out certain decisions.
None of that shows yet how quickly, consistently or independently the new body will act. The ministry said the full commission was expected to begin operating in November, and the public pages currently show basic institutional information rather than case statistics. The assessment would change with a working accessible complaint form, published inspection plans, transparent decisions and appeal outcomes, response-time data and evidence that people facing harmful AI systems can secure timely remedies. Until then, today marks legal capability—not proof of effective enforcement.[2][3][4]