PolandUstawa o systemach sztucznej inteligencji, Act on Artificial Intelligence Systems
Ustawa z dnia 3 lipca 2026 r. o systemach sztucznej inteligencji (Dz.U. 2026 poz. 1003)
In force since .
An AI governance rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- periodic
- Who audits it
- Regulator
What it requires
- If the Committee inspects you, give the inspector all the information and explanations needed, confirm that copies of materials, documents and other data you prepare or make available at the inspector's request conform to the original, and give access to materials, documents and other data or devices that may constitute evidence and to IT data carriers, devices and systems for the data held on them, including electronic correspondence (Article 52(2)).
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Art. 112: obstructing or frustrating an inspection under Chapter 3 or the proceedings under Chapters 4 and 5 is punishable by restriction of liberty or a fine, and Art. 113 applies the same penalty to failing to carry out a Committee decision under Art. 63(2); both are petty offences tried under the Code of Procedure in Petty Offences cases (Art. 114). Breaches of the EU AI Act itself are met only by the Chapter 8 administrative fines.
Who enforces it
Enforcement body
Komisja Rozwoju i Bezpieczenstwa Sztucznej Inteligencji (Committee for the Development and Security of Artificial Intelligence), served administratively by the office of the minister responsible for digitalization.
Settledness
- As of
- Open questions
- Does the inspected party's duty in Article 52(2) to give access to 'materiałów, dokumentów i innych danych lub urządzeń mogących stanowić dowód w sprawie' extend to a high-risk system's model weights, training data or source code, or only to the documentation the EU AI Act requires the provider to keep?
- Does the exclusion in Article 2(1)(4) for research and development 'w zakresie, który nie obejmuje testów w warunkach rzeczywistych' leave a university team's testing of a system before any real-world test outside the Committee's inspection powers under Article 48?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 52(2) obliges the inspected party to give the inspector all information and explanations needed, confirm that copies of materials, documents and other data it prepares or makes available at the inspector's request conform to the original, and provide access to materials, documents, other data, devices or IT systems that may constitute evidence, mirroring Article 52(1)'s list of what the inspector may demand. That is the family's own implicit shape: a duty to produce records and information to the authority on its request that cannot be met without something already kept. It states no content requirement of its own for what an operator must record day to day; the EU AI Act's own Article 12 event-recording and Article 19 log-retention duties are the EU Regulation's own, and Article 91(3) names them only as items within the regulatory sandbox's subject-matter scope, not as a duty this Act imposes. Article 69's ten-year retention of the Committee's own case files is the regulator's internal record, not an operator duty.
- Kind
- Implicit
- As of
- Provision
- Art. 52(1)-(2)
What this law does
The Act creates the Komisja Rozwoju i Bezpieczenstwa Sztucznej Inteligencji, the Committee for the Development and Security of Artificial Intelligence, as Poland's market-surveillance authority for AI systems under the EU AI Act and the single point of contact the Regulation requires. The Act makes the minister responsible for digitalization the notifying authority referred to in Chapter III, Section 4 of the Regulation.
The Committee imposes administrative fines in the cases, amounts, and on the conditions Chapter XII of Regulation (EU) 2024/1689 itself sets, rather than under a separate national fine schedule. Fines are paid within 30 days of a final decision. Fines go to the state budget. The Committee may reduce a fine by 10 to 50 percent where, within 3 months of the decision, the fined party carries out the actions set out in a prior warning and the violation did not lead to death or serious injury.
Under a settlement the Committee may reduce a fine by 20 to 70 percent, or by 30 to 90 percent where the party itself first brought the violation to the Committee's attention. A decision imposing a fine may be appealed to the Regional Court in Warsaw acting as the competition and consumer protection court.
The Act does not itself apply to matters of national defense, national security including the special services, or academic research and development work that does not involve real-world testing under the Regulation's own definition.
The Act's general provisions took effect , once 14 days had passed after promulgation, and Articles 8 to 18 and Chapters 3 to 5, 8, and 9, which hold the compliance-control, proceedings, settlement and fines provisions, take effect , three months after promulgation.
The Committee's Chairperson is to be appointed within 2 months of the Act's entry into force, the Committee is to hold its first meeting within 3 months, and the Committee's supporting organizational unit is to begin operating within 2 months.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or generates content with AI.
Back to the example · Lint your app
Page updated .