Poland

Article 202 section 4b criminalizes producing, distributing, presenting, storing, or possessing pornographic content that depicts a generated or digitally processed image of a minor participating in a sexual act, reaching a fabricated or digitally processed image, so a wholly AI-generated image can fall within it without any real child appearing in it. Section 4c extends the same penalty to a person who, for sexual gratification, participates in the presentation of such content.

Section 4b was added to the Code by the Act of 24 October 2008. Section 4c was added by the Act of 4 April 2014, so the two sections came into force on different days.

General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category.

Poland's own Act Article 107(2) independently names biometric data processed for unambiguous identification as one of the aggravating categories that raises the criminal penalty ceiling for unlawful processing from two to three years' deprivation of liberty, alongside racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, health data, and sexual life or orientation data.

Article 107(2) took effect with the rest of the Act on 25 May 2018 (Article 176). For employees specifically, Kodeks pracy Article 22(1b) lets an employer rely on consent to process an employee's biometric data only where the employee supplied the data on their own initiative.

It also permits an employer to process an employee's biometric data where that is necessary to control access to particularly important information whose disclosure could harm the employer, or to premises that need special protection. Only persons holding the employer's written authorization may process such data, and they must keep it confidential. Article 4 of the Act of 21 February 2019 (Journal of Laws 2019, item 730) inserted Article 22(1b) into Kodeks pracy. That Act entered into force on 4 May 2019, the day after the 14 days that run from its announcement on 19 April 2019.

A controller must notify UODO without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and must notify the affected individual without undue delay where the breach is likely to result in a high risk. The Act contains no Poland-specific derogation from this timeline or threshold.

Poland gives the General Data Protection Regulation (GDPR) domestic effect through the Act of 10 May 2018 on the Protection of Personal Data. It makes the Prezes Urzedu Ochrony Danych Osobowych (President of the Personal Data Protection Office, UODO) the supervisory authority under the Regulation. Chapter 9 gives the President inspection powers. Chapter 10 provides a civil-liability venue for GDPR Article 79 and 82 claims at the sad okregowy (district court).

Chapter 11 sets a two-track administrative-fine regime that distinguishes public-finance-sector bodies from other controllers. Article 107 makes unlawful processing of personal data a criminal offense. Article 108 makes obstructing an inspection of compliance with data protection law a criminal offense.

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. The Act contains no Poland-specific derogation from this framework.

General Data Protection Regulation (GDPR) Article 22 gives a person in Poland the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

The Act of 10 May 2018 adds no rule of its own on automated decisions.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Poland can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.

The Act of 10 May 2018 adds no restriction on these requests but sets the court route for a claim under GDPR Article 79 or 82: the regional court hears it, it is stayed while the President of the Personal Data Protection Office has proceedings open on the same infringement, the Civil Code applies to what the Regulation leaves open, and a final finding of infringement by the President or an administrative court binds the court hearing a damages claim.

UODO is Poland's supervisory authority. Article 101 lets UODO fine any controller other than a public-finance-sector unit, research institute, or the National Bank of Poland under ordinary General Data Protection Regulation (GDPR) Article 83 terms. Article 102 caps fines on public-finance-sector units under Article 9 points 1 to 12 and 14 of the Public Finance Act, research institutes and the National Bank of Poland at 100,000 PLN.

Article 102 caps fines on public-finance-sector units under Article 9 point 13 of the Public Finance Act at 10,000 PLN. GDPR Article 82 arms an individual with a direct private right of action. Article 98 gives UODO its own standing to bring or join a data subject's civil claim, with that person's consent, at any procedural stage.

Article 267 criminalizes obtaining unauthorized access to information not intended for the accessor by opening a sealed letter, connecting to a telecommunications network, or bypassing or circumventing an electronic, magnetic, IT, or other special safeguard protecting it, and separately criminalizes unauthorized access to the whole or part of an IT system, planting or using an eavesdropping, visual, or other device or software to obtain information, and disclosing information obtained that way.

Article 268 and 268a criminalize destroying, damaging, deleting, or altering a record of significant information or IT data, or hindering a person's or a system's ability to use it. Article 269 raises the penalty where the IT data affects national defense, communications security, or government or local-government functioning.

Article 269a criminalizes materially disrupting an IT system's or network's operation through unauthorized transmission, destruction, deletion, damage, hindrance, or alteration of data.

Article 269b criminalizes producing, obtaining, selling, or making available a device or computer program adapted to commit the offenses in Articles 165(1)(4), 267(1) to (3), 268a, 269, 269a, 270, or 270a, or a password, access code, or other data enabling unauthorized access to an IT system or network, with an exemption at Article 269b(1a) for a person acting solely to secure a system or to develop a securing method.

Article 269c exempts from punishment under Article 267(2) or Article 269a a person who acts solely to secure a system or to develop a securing method, promptly notifies the system's operator of the threats found, and neither harms a public or private interest nor causes damage. The Code took effect on 1 September 1998. The Act of 18 March 2004 inserted Article 268a. That Act set out Article 269 anew. That Act also inserted Articles 269a and 269b. That Act took effect on 1 May 2004.

The Act of 24 October 2008 set out Article 267 anew. That Act also set out Article 269a anew. That Act took effect on 18 December 2008. The Act of 23 March 2017 inserted Article 269c. That Act took effect on 27 April 2017.

Article 26², added by the Act of 26 July 2024 transposing the EU Digital Single Market Copyright Directive, lets a cultural-heritage institution or a body covered by Article 7(1)(1), (2), or (4) to (8) of the Law on Higher Education and Science reproduce a work to text-and-data-mine it for scientific research, without a rightsholder opt-out, so long as the activity is not carried out for direct or indirect financial gain; the reproductions may be retained only under access controls limited to authorized persons, and the rightsholder may apply only the measures necessary to keep the network or database where they are stored secure.

Article 26³ lets anyone reproduce a disseminated work for text-and-data-mining, unless the rightsholder has reserved that use. A reservation must be express, and for a work made publicly available so that anyone can access it at a place and time of their choosing, it must be in a machine-readable format together with metadata. Reproductions made under Article 26³ may be retained only as long as necessary for the mining purpose.

A database's producer, the person bearing the investment risk of making it, holds an exclusive and transferable right to extract or reuse the whole or a substantial part, by quality or quantity, of its contents, running 15 years from the year the database was made, or from the year it was first made available to the public if that happens within the initial term, restarting on any subsequent substantial new investment.

A lawful user may extract or reuse an insubstantial part for any purpose without the producer's permission, but Article 8(2) separately bars repeated and systematic extraction or reuse, of even an insubstantial part, that conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests, and a contract term contrary to the lawful user's Article 7 rights is void.

On infringement, the producer may seek an injunction, removal of the infringement's effects, damages on general principles or as a statutory multiple, restitution of profits, and a court order for publication of the judgment.

Article 8a, added in 2024, lets anyone reproduce a disseminated database for text-and-data-mining unless the rightsholder has reserved that use, and Article 8b gives cultural-heritage institutions and research bodies a corresponding exception for non-commercial scientific research.

The Ustawa z dnia 25 czerwca 2025 r. o zmianie niektórych ustaw w związku z zapewnieniem operacyjnej odporności cyfrowej sektora finansowego oraz emitowaniem europejskich zielonych obligacji (Act of 25 June 2025 amending certain acts in connection with ensuring the digital operational resilience of the financial sector, Journal of Laws 2025 item 1069) entered into force on 7 August 2025. Article 20 of the Act provides that it enters into force on the day after its promulgation.

It inserts into the Act on financial market supervision a chapter 2c, Articles 18za to 18zz, that gives the Komisja Nadzoru Finansowego (Polish Financial Supervision Authority) its supervisory role over the financial entities that Regulation (EU) 2022/2554 (DORA) covers. Article 18zb lets the Authority require a financial entity to provide information, documents or explanations within the scope of DORA, and Article 18zc lets it inspect a financial entity's compliance with DORA.

Article 18zg requires a financial entity to notify the Authority of a major ICT-related incident, by an initial notification, and to submit the reports that DORA Article 19(4) requires, and the Authority passes them to the competent national computer security incident response team (CSIRT). Article 18zj requires a financial entity to notify the Authority when it joins or leaves cyber-threat information-sharing arrangements under DORA Article 45.

Article 18zk has the Authority decide by decision which financial entities must carry out advanced threat-led penetration tests under DORA Article 26, and requires the entity so designated to submit its assessment of the functions to be tested to the Authority for approval.

Article 18zl requires a financial entity to tell the Authority how it has taken into account the risk identified in a recommendation addressed to a critical ICT third-party service provider it contracts with, in particular any change to the contract.

Article 133(2b) of the Banking Law, inserted by Article 3, lets the Authority call on persons to whom a bank has outsourced functions or activities, including external ICT service providers, to supply the information needed for its supervision during an inspection.

Article 8 requires an essential entity or an important entity to implement an information security management system in the information system used in the processes affecting its provision of the service, covering fourteen baseline categories of technical and organisational measure: risk-assessment and information-security policy, secure system acquisition and development, physical and environmental security, personnel security, ICT supply-chain security, business continuity and disaster-recovery planning, continuous monitoring, effectiveness evaluation, cybersecurity training, basic cyber-hygiene, cryptography, secure communications and multi-factor authentication, asset management, and access control, transposing NIS2 Article 21.

Załącznik nr 2 names an online-marketplace provider, an internet search-engine provider and a social-networking-service-platform provider among the digital service providers this duty reaches expressly. The Act entered into force on 3 April 2026, but Article 33(1) of the amending Act gives an entity that already meets the essential-entity or important-entity criteria on that date twelve months, until 3 April 2027, to carry out this duty.

An entity already regulated as an operator usługi kluczowej (essential service operator) under the pre-amendment Act continues applying the prior Article 8 regime until it has deployed the new system.

Article 398(1) bans using automatic calling systems and telecommunications terminal equipment, in particular in the use of interpersonal communications services, to send commercial information, including direct marketing, to a subscriber or end user who has not consented in advance.

Commercial information is information meant directly or indirectly to promote the goods, services or image of an entrepreneur or of a person in a regulated profession, as the Act on the Provision of Services by Electronic Means defines it. A subscriber is a user who is party to a contract for electronic communications services with a provider of such services. An end user is an entity that uses a publicly available electronic communications service, or asks for one, to meet its own needs.

A recipient may give the consent by providing the electronic address that identifies them, for the purpose of receiving commercial information at that address. Using these means to send commercial information, including direct marketing, may not be at the cost of the end user or subscriber. Article 398(4) makes the act an act of unfair competition under the Act on Combating Unfair Competition.

Article 444(1) point 81 subjects a person who uses automatic calling systems or terminal equipment to send commercial information without the subscriber's or end user's prior consent to an administrative fine. For breach of article 398 the President of UKE imposes by decision a fine of up to 3 percent of the entity's revenue in the previous calendar year or up to 1,000,000 zloty, whichever is higher.

Article 448 separately makes it a petty offence (wykroczenie), punishable by a fine and prosecuted at the injured party's request, to send commercial information by means of electronic communication without the prior consent of the subscriber or end user.

Article 9(1) requires commercial information to be clearly set apart and marked so that there is no doubt that it is commercial information.

Article 9(2) requires commercial information to name the entity on whose behalf it is distributed and give its electronic addresses, to describe promotional offers such as price reductions and free benefits clearly together with the conditions for taking them up, and to carry any information that may affect the allocation of responsibility between the parties, in particular warnings and reservations. Article 9(3) leaves the Act on Combating Unfair Competition and the Gambling Act unaffected.

Article 9 appears in the chapter headed duties of the service provider providing services by electronic means. A service provider is a natural person, a legal person or an organizational unit without legal personality that provides services by electronic means in the course of a business or professional activity, even if ancillary.

Article 399(1) allows storing information on, or gaining access to information already stored on, a subscriber's or end user's telecommunications terminal equipment only on the condition that the person is first informed, clearly, unambiguously and understandably, of the purpose of the storage or access and of the possibility of setting its conditions through the software settings or the configuration of the service.

The person must also consent after receiving that information, and the stored information or the access must not cause configuration changes in the terminal equipment or the software installed on it. The person may give that consent through the settings of the software installed on the terminal equipment or the configuration of the service.

The conditions do not apply where the storage or access is necessary to carry out the transmission of an electronic message over a public telecommunications network or to provide a telecommunications service or a service provided by electronic means that the subscriber or end user requested.

A provider of telecommunications services or services by electronic means may install software on the terminal equipment for use of those services only if the user is told directly beforehand, clearly and understandably, the purpose of the software, how the provider uses it and how to remove it, and consents to its installation and use.

Article 444(1) point 82 subjects a person who stores or accesses information on a user's terminal equipment, or installs software on it, contrary to article 399 to an administrative fine. Article 444(2) point 8 also lists a failure to meet the consent obligations of article 399 among the breaches for which the President of UKE may impose a fine where the character or scope of the breach warrants it.

The President of UKE imposes that fine by decision at up to 3 percent of the entity's revenue in the previous calendar year. Where the entity's revenue in the previous calendar year was nil or no more than 500,000 zloty, the fine is based on its average revenue over the three preceding calendar years, and where that period also shows no revenue or revenue of no more than 500,000 zloty the fine may not exceed 15,000 zloty.

Article 386(2) bans processing the electronic message, transmission data, location data and data on connection attempts that fall within the secrecy of electronic communications by persons other than the sender and recipient of the electronic message.

The ban does not apply where the processing is the subject of the service or necessary to perform it, takes place with the consent of the sender or recipient to whom the data relate, is necessary to record messages and related transmission data under a lawful commercial practice to provide evidence of a commercial transaction or for communications in business activity, or is necessary for other reasons provided by statute or separate provisions.

An electronic message is any information exchanged or conveyed between determined users through publicly available electronic communications services. Article 387(3) obliges a person who, using radio or terminal equipment, has read an electronic message not meant for that person to keep it secret.

Article 444(1) subjects a person who breaches the duty to keep electronic communications secret, or who processes data covered by that secrecy or users' data without a legal basis, to an administrative fine. The President of UKE imposes that fine by decision at up to 3 percent of the entity's revenue in the previous calendar year.

Article 22(1) treats a provider of online content-sharing services that gives the public access to a work a user posted as itself communicating that work to the public.

Article 22(2) makes the provider liable for copyright infringement where it communicated the work without the rights holder's consent, unless it shows it made best efforts to obtain consent, made best efforts to prevent access to the work where the rights holder gave it the relevant and necessary information, and acted promptly on a duly substantiated request to block or remove the work and, where the rights holder gave it that information, made best efforts to prevent access to the work in the future.

A provider whose services have been available in the European Union or the European Economic Area for less than three years and whose annual turnover does not exceed 10 million euro must show only best efforts to obtain consent and prompt action on a request to block or remove, with the further duty, once its average monthly visitors in the previous calendar year exceed 5 million, to show best efforts to prevent access where the rights holder gave it the information.

An online content-sharing service provider is a service provider whose main purpose is storing and giving the public access to a large number of works posted by users, organized and promoted for profit, and the definition excludes non-profit online encyclopedias, scientific and educational repositories, open-source software platforms, electronic communications providers, online marketplaces, and business cloud and cloud computing services that let users upload content for their own use.

The provider must let users complain by electronic means when access to a work is blocked or the work is removed. A complaint is free of charge and is decided without undue delay on the basis of the information in it and the rights holder's requests. A complaint may not be rejected as unfounded by automated means. Article 22(7) imposes no general duty to monitor whether the public communication of a work a user posted is lawful.

Article 22(8) withholds the liability exclusions from a provider whose main purpose is to carry out or facilitate copyright infringement. Paragraph 3 of article 22(1) now excludes article 14 of the Act on the Provision of Services by Electronic Means, the hosting exclusion, from that public communication. From 6 November 2026 that paragraph excludes Article 6 of Regulation (EU) 2022/2065 instead.

Article 449[1](1) of the Civil Code makes whoever produces a dangerous product in the course of its business activity (the producer) liable for damage the product causes to anyone. Article 449[1](2) defines a product as a movable thing, even where it has been joined to another thing, and treats animals and electricity as products. Article 45 of the Code defines things as material objects only.

A product is dangerous under Article 449[1](3) if it does not provide the safety that can be expected given normal use of the product. Article 449[1](3) makes the circumstances when the product was put into circulation decisive, in particular how it was presented on the market and the information given to the consumer. Article 449[2] limits liability for damage to property to things normally intended for personal use that the injured person mainly used that way.

Article 449[3](1) excludes liability where the producer did not put the product into circulation, or put it into circulation outside its business activity. Article 449[3](2) excludes liability where the dangerous properties appeared after the product was put into circulation, unless they arose from a cause already in the product.

Article 449[3](2) also excludes liability where the dangerous properties could not be foreseen in light of the state of science and technology when the product was put into circulation. Article 449[3](2) also excludes liability where the properties resulted from applying legal rules. Article 449[4] presumes that a dangerous product that caused damage was made and put into circulation in the course of the producer's business activity.

Article 449[5](1) makes the maker of a material, raw material or component liable like the producer, unless the design of the product or the producer's instructions were the sole cause of the damage. Article 449[5](2) makes liable like the producer whoever presents itself as the producer by putting its name, trade mark or another distinguishing mark on the product. Article 449[5](2) also makes the importer of a product of foreign origin into the domestic market liable like the producer.

Article 449[5](3) makes the producer and the persons named in the earlier paragraphs jointly and severally liable. Article 449[5](4) makes the seller liable where the producer is not known, unless within a month of notice of the damage the seller names the producer, or for imported goods the importer, to the injured person. Article 449[7](1) excludes damage to the product itself and the benefit the injured person could have gained from using it.

Article 449[7](2) denies compensation under Article 449[1] where the damage to property does not exceed the equivalent of EUR 500. Article 449[8] sets a limitation period of three years from the day the injured person learned, or with due care could have learned, of the damage and the person obliged to repair it. Article 449[8] also provides that the claim is in any case time-barred ten years after the product was put into circulation.

Article 449[9] provides that liability for damage caused by a dangerous product cannot be excluded or limited. Article 449[10] leaves liability on the general rules, for non-performance of an obligation, and for statutory warranty and quality guarantee untouched.

Article 35(1) gives a consumer the right to complain to an economic operator that a product or service does not meet the accessibility requirements. Article 35(2) provides that the importer, manufacturer, authorized representative or service provider examines the complaint. Article 36(3) provides that a complaint that lacks the required information is left unexamined. Article 37(2) requires the economic operator to examine the complaint and answer within 30 days of receiving it.

Article 37(3) allows a longer period in especially complicated cases, but not more than 60 days from receipt. Article 37(4) provides that if the deadline is missed the complaint is regarded as examined in line with the complainant's demand. Article 37(4) requires the economic operator to carry out the demand within six months of receiving the complaint. Article 67(1) lets anyone notify the PFRON President that a product or service does not meet the accessibility requirements.

Article 68(1) requires the PFRON President, within 30 days of a notification, to examine it or to forward it to the competent market surveillance authority, telling the person who made it of the forwarding where the notification gives the contact details of Article 67(3).

Article 42(1) requires the PFRON President or the market surveillance authority, at a consumer's request, to pass on within 30 days the information it holds on whether a product or service meets the accessibility requirements, or on the assessment the economic operator made.

Article 29 requires an importer to place on the market only products that meet the accessibility requirements. Article 29 requires an importer, before placing a product on the market, to ensure that the manufacturer has performed the duties of Article 23(2) to (4), (6) and (7) and Article 26. Article 29 requires an importer not to place on the market a product about which it has reasonable doubt.

Article 29 requires an importer to keep a copy of the declaration of conformity for five years from placing the product on the market. Article 30 requires a distributor to check that the CE marking is on the product. Article 30 requires a distributor not to make available a product about which it has reasonable doubt. Article 31 treats an importer or distributor as a manufacturer if it places a product on the market under its own name or trademark.

Article 5 point 7 defines an importer as a person established in the European Union who places on the market a product from outside the European Union and the European Free Trade Association states that are party to the EEA Agreement.

Article 2 makes it the duty of manufacturers, authorized representatives, importers and distributors to ensure that products meet the accessibility requirements, and of service providers to ensure the same for services. Article 23(1) requires a manufacturer to ensure that the products it places on the market meet the accessibility requirements. Article 23(2) requires a manufacturer to assess the conformity of the product with the accessibility requirements by internal production control.

Article 23(5) requires a manufacturer to keep the technical documentation for five years from placing the product on the market. Article 23(6) requires a manufacturer whose assessment shows conformity to draw up the declaration of conformity and affix the CE marking before placing the product on the market. Article 24(7) requires a manufacturer to keep the declaration of conformity for five years from placing the product on the market.

Article 25(1) requires a manufacturer to ensure procedures that keep series production in conformity with the accessibility requirements. Article 26(2) requires a manufacturer to give its contact details in Polish. Article 27(1) requires a manufacturer with reasonable doubt about conformity to take the necessary corrective action without delay or withdraw the product.

Article 28(3) requires an authorized representative to perform at least the duties of Article 23(5), Article 24(7) and Article 27(4) and (5). Article 34(1) requires every economic operator to identify, on request, the operators that supplied it with a product or that it supplied. Article 34(3) requires those details to be kept for five years from the delivery.

Article 17 requires e-book distribution services to synchronize text and audio where an e-book contains audio as well as text. Article 17 requires the e-book file to be interoperable so that assistive tools remain compatible and functional with it. Article 17 requires information on the accessibility features of the e-book content to be given through metadata.

Article 5 point 33 defines e-book distribution services as services that supply the consumer with e-book files together with the software for accessing and using them, excluding the software of e-readers.

Article 18 requires e-commerce services to give information on the accessibility of products or services where the obligated economic operator supplied it. Article 18 requires the functions and methods of identification, security, payment and electronic signature to be perceivable, functional, understandable and compatible.

Article 5 point 32 defines e-commerce services as services offered or provided at a distance through websites and mobile devices, electronically and at the individual request of the consumer, in order to conclude a contract.

Article 38(2) makes the PFRON President, the market surveillance authorities and the customs authorities the market surveillance system. Article 38(3) names the President of the Office of Electronic Communications as the authority for consumer computer hardware systems and operating systems, terminals, consumer terminal equipment, telecommunications services, audiovisual media access services, e-readers and e-book services.

Article 38(3) names the minister responsible for digitalization as the authority for e-commerce services and the Financial Ombudsman as the authority for retail banking services. Article 38(3) names the voivodeship road transport inspectors, the President of the Railway Transport Office and the President of the Civil Aviation Authority as the authorities for the services accompanying bus and coach, rail and air passenger transport.

Article 38(3) names the maritime office directors and the Director of the Inland Navigation Office in Bydgoszcz as the authorities for the services accompanying waterborne passenger transport. Article 43 lets the PFRON President or the market surveillance authority inspect a product or service where it has reasonable doubt that a requirement is not met.

Article 52(1) lets the authority call on an operator to take corrective action or withdraw a non-compliant product within a period not longer than 120 days and ban its availability for not more than 180 days. Article 56(1) lets the authority order by decision that a product be made to meet the requirements, be withdrawn or not be made available, or that consumers be notified.

Article 62(1) lets the authority call on a service provider to take corrective action or stop offering a non-compliant service within a period not longer than 120 days and ban the service for not more than 180 days. Article 65(1) lets the authority order by decision that a service be made to meet the requirements, be no longer offered, or that consumers be notified.

Article 73(1) subjects a manufacturer to a monetary fine for placing on the market a product that does not meet the requirements of Articles 7 to 11 or Article 19, and for the other breaches it lists. Article 73(1) subjects a service provider to a monetary fine for failing to ensure that the services it offers meet the requirements of Articles 12 to 19, and for the other breaches it lists.

Article 73(2) subjects an importer to a monetary fine for placing on the market products it knows, or has reasonable doubt, do not meet the requirements without informing the manufacturer and the authorities, and for the other breaches it lists. Article 73(2) subjects a distributor to a monetary fine for making available products about which it has reasonable doubt without informing the manufacturer, the importer and the authorities, and for the other breaches it lists.

Article 73(1) also fines a manufacturer that does not give in time, or gives false or misleading, information or documentation requested under Article 27(4), does not present evidence within the period of Article 52(1) point 1, does not assess conformity under Article 23(2) or does not inform the authorities under Article 27(2).

Article 73(1) also fines a service provider that does not give in time, or gives false or misleading, the information requested under Article 32(2) point 7, does not present evidence within the period of Article 62(1) point 1, does not assess conformity under Article 32(1) or does not inform the authority under Article 32(2) point 6.

Article 73(2) also fines an importer that does not inform the authority under Article 29 point 10, does not give in time the information or documentation of Article 29 point 12, or does not present evidence within the period of Article 52(1) point 1.

Article 73(2) also fines a distributor that does not inform the authority under Article 30 point 6, does not give in time the information or documentation of Article 30 point 7, or does not present evidence within the period of Article 52(1) point 1.

Each fine under Article 73(1) and (2) is up to ten times the average monthly wage in the national economy for the previous year, as announced by the President of Statistics Poland, but not more than 10 % of the turnover achieved in the financial year before the year in which the fine is imposed. Article 73(3) provides that the PFRON President or the market surveillance authority imposes the fines by the decisions of Article 56(1) or Article 65(1).

Article 73(4) provides that the amount of a fine takes account of the extent and seriousness of the breach, the number of non-compliant products or services and the number of persons adversely affected. Article 73(7) provides that the proceeds of the fines are revenue of the Accessibility Fund. Article 88 brings Article 6 points 1, 2 and 5 to 9 and Article 39 point 6, into force 14 days after promulgation, ahead of the rest of the Act.

Article 69 applies Chapter 5 of the Entrepreneurs' Law to inspections, and Article 70 applies the Code of Administrative Procedure to the proceedings and to notifications, in matters the Act does not regulate. Article 72(1) requires the PFRON President to prepare a report on the functioning of the market surveillance system for each period of five calendar years.

Article 15(1) requires the services accompanying bus, coach, waterborne, air and rail passenger transport to give information on the conditions available to persons with special needs, including their current state, for vehicles, aircraft, vessels and rolling stock. Article 15(1) also requires information on the premises and public-use buildings used to offer the service and the infrastructure around them.

Article 15(1) requires information on the assistance given to persons with special needs and its current state, on electronic ticketing systems and on real-time travel. Article 3(2) lists the delivery of information on the transport services, including real-time travel information, and of information through interactive self-service terminals located in the European Union.

Article 20(2) deems services that meet the accessible-information requirements of the EU passenger rights regulations to meet the corresponding accessibility requirements. Article 5 point 8 defines real-time travel information as information on timetables, onward connections, transfers, cancellations, delays and disruptions given before or during the journey through dynamic passenger information systems.

Article 3(1) applies the Act to consumer general purpose computer hardware systems and their operating systems. Article 3(1) applies the Act to payment terminals, being devices whose main purpose is to make payments with payment instruments at a physical point of sale.

Article 3(1) applies the Act to self-service terminals for services within the Act: cash machines and deposit machines, ticketing machines, check-in devices and interactive information terminals, except terminals installed as integrated parts of vehicles, aircraft, vessels and rolling stock.

Article 3(1) applies the Act to consumer terminal equipment with interactive computing capability used to offer or provide telecommunications services or access to audiovisual media services, and to e-readers. Among the conditions of Article 7(1) for meeting the product information requirement is that labels, instructions and warnings on or in the product are made available through several sensory channels.

Article 8 requires a product, including its user interface, to meet the minimum accessibility requirements it lists. Article 9(1) requires a terminal to be equipped with speech synthesis technology in the language of the user interface. Article 10 requires an e-reader to be equipped with speech synthesis technology in the language of the user interface. Article 19 requires an economic operator to apply functional criteria to the features of a product that Articles 7 to 18 do not cover.

Article 20(1) presumes that a product conforming to harmonized standards or technical specifications meets the accessibility requirements to the extent they cover. Article 21(1) applies the accessibility requirements only so far as compliance needs no fundamental alteration of the product or service and imposes no disproportionate burden. Article 84 provides that the Act does not apply to products placed on the market before it entered into force. The Act implements Directive (EU) 2019/882.

Article 16 requires retail banking services to make consumer identification, electronic signature, security and payment services perceivable, functional, understandable and compatible. Article 16 requires information to be given in Polish or, with the consumer's consent, in another language at level B2 of the Common European Framework of Reference for Languages.

Article 5 point 30 defines retail banking services as the banking and financial services offered or provided to consumers that it lists. Article 5 point 30 includes consumer credit agreements and mortgage credit agreements. Article 5 point 30 includes payment services within the Payment Services Act. Article 82 provides that the Financial Ombudsman is a market surveillance authority within the meaning of the Act.

Article 80 adds the Financial Ombudsman, to the extent necessary for its statutory tasks, as a new point of Article 12(1) of the Payment Services Act. Article 12(1) of the Payment Services Act lists the cases in which passing on information covered by professional secrecy does not breach the duty of professional secrecy.

Article 3(2) applies the Act to services offered or provided to consumers. Article 3(2) lists telecommunications services, with the exception of transmission services used for machine-to-machine services, and access to audiovisual media services. Article 3(2) lists the services accompanying bus, coach, waterborne, air and rail passenger transport as regards websites, mobile services, electronic tickets and electronic ticketing services.

Article 3(2) lists retail banking, the distribution of e-books and e-commerce. Article 4 point 1 excludes services offered or provided by microenterprises from the Act. Article 4 point 2 excludes content that is not financed or created by the economic operator and is not under its control. Article 4 point 3 excludes urban transport services and municipal, metropolitan, county, county-municipal and voivodeship passenger transport, except the services of Article 3(2) point 3(e).

Article 12(1) requires products used to offer or provide services to meet the accessibility requirements of Articles 7 to 11. Article 12(2) requires information about the services offered and provided to be given on paper or electronically. Article 12(2) requires the uniformity of websites and mobile applications to be ensured by making them perceivable, functional, understandable and compatible.

Article 32(1) requires a service provider to assess the conformity of the service with the accessibility requirements. Article 32(2) requires a service provider to state in its terms of service or an equivalent document how the service meets the accessibility requirements. Article 32(2) requires a service provider to inform the market surveillance authority without delay of non-compliance of the service.

Article 33(1) requires the information on the service to state either the current state of accessibility of the premises used or the accessibility certificate the provider holds, if one was issued. Article 21(10) requires a provider that relies on the disproportionate-burden limit to repeat its assessment at least every five years. Article 85(1) lets service contracts concluded before the Act entered into force continue unchanged until they expire, but not beyond 28 June 2030.

Article 85(3) lets non-compliant terminals used for services before the Act entered into force be used until the end of their economic useful life, but for no longer than 20 years from the start of their use. Article 86 excludes from the Act pre-recorded time-based media and document files published before it entered into force, and archived content not updated or edited since.

Article 14 requires services giving access to audiovisual media services to make electronic program guides and information on facilities for persons with disabilities perceivable, functional, understandable and compatible. Article 14 requires those services to pass on the facilities for persons with disabilities that the audiovisual media service provider supplies, with quality that allows proper display and synchronization.

Article 5 point 31 defines services giving access to audiovisual media services as services transmitted over a telecommunications network and used to identify media services, excluding radio programs, to select them and receive information about them and to display them.

Article 13 requires telecommunications services to carry voice communication together with real-time text communication. Article 13 requires telecommunications services to carry full conversation where video transmission is available. Article 5 point 19 defines full conversation as communication ensuring simultaneous transmission of video of a resolution that allows communication in Polish Sign Language and of voice, synchronized with real-time text communication. Article 3(2) excludes from the Act transmission services used for machine-to-machine services.

Article 5(2) requires a body other than a public entity that carries out, under a contract with a public entity, a task financed with public funds to ensure accessibility for persons with special needs to the extent specified in the contract.

Article 4(3) requires a public entity that commissions public tasks financed with public funds, or awards public contracts, to non-public bodies to set in the contract the conditions for ensuring accessibility, taking account of the minimum requirements of Article 6. Article 6 point 2 sets as the minimum requirement for digital accessibility the requirements of the Act of 4 April 2019 on digital accessibility of websites and mobile applications of public entities.

Article 100(1) provides that, for contracts intended for use by natural persons, including the contracting authority's employees, the description of the subject matter takes account of accessibility requirements for persons with disabilities and design for all users, unless the nature of the subject matter does not justify it. Article 100(2) provides that where those requirements derive from an act of European Union law, the subject matter is described by reference to that act.

Article 116(1) lets the contracting authority require contractors to meet the requirements of quality management standards, including on accessibility for persons with disabilities. Article 3(3) of the Act of 26 April 2024 provides that the accessibility requirements that Act sets for products and services are the requirements on accessibility for persons with disabilities or design for all users referred to in the Public Procurement Law.

Article 242(2) point 1 lets the quality criteria for choosing the most advantageous tender relate to functional characteristics such as accessibility for persons with disabilities.

Broadcasting a programme or other transmission that endangers a minor's physical, psychological, or moral development is prohibited, in particular one carrying pornographic content or unjustifiably exposing violence. A programme or other transmission carrying scenes or content that could negatively affect a minor's proper physical, psychological, or moral development, other than the content the outright ban already covers, may be broadcast only between 23:00 and 06:00.

A broadcaster must classify and label such a programme or transmission with an appropriate graphic symbol throughout its television broadcast, indicating that its content could negatively affect a minor's development. Paragraphs 5a, 5b and 6, on classifying and labeling such content, were put in their present wording by the Act of 11 August 2021 amending the Act on Radio and Television Broadcasting. Those paragraphs took effect on 1 November 2021.

A video-sharing platform provider must create and operate effective technical safeguards, including parental-control systems or other appropriate measures, protecting minors from programmes, user-generated video, or other content that could harm their proper physical, psychological, or moral development, in particular pornographic content or content unjustifiably exposing violence, and must let a platform user classify the programmes, user-generated video, or other content they upload and apply those same technical safeguards to it.

Personal data of minors collected or otherwise generated by a video-sharing platform provider for this child-protection duty may not be processed for commercial purposes such as direct marketing, profiling, or behaviourally targeted advertising, or otherwise used for those purposes in supplying that platform, another video-sharing platform, or a media service.

A press publication's publisher, established in Poland or in an EU or EFTA/EEA state, holds the exclusive right to reproduce the publication for online use and to make it available online, without prejudice to the underlying authors' and other rightsholders' own rights, per Article 99(7). The right does not reach an individual's private, non-commercial use, a hyperlink to the publication, or single words or very short extracts of it, per Article 99(7)(3).

The right lasts two years from the calendar year following the publication's first dissemination, per Article 99(8). Authors of works contained in the publication are entitled to 50 percent of the remuneration due to the publisher for exercising the right, paid within 30 days of the publisher's own receipt, per Article 99(9).

Where the publisher and a service provider fail to agree remuneration within three months of an offer to contract, either side may apply to the President of the Office of Electronic Communications for mediation, per Article 99(12).

Article 25 lets the press, radio, and television redistribute, for informational purposes, already-disseminated reports on current events, articles on current political, economic, or religious topics unless expressly reserved against further distribution, current statements and reporters' photographs, short extracts of the reports and articles just named, reviews of disseminated publications and works, and short summaries of disseminated works.

The author is entitled to remuneration for the reproduced articles and reporters' photographs, and the same rules apply to making a work available online in a way that lets anyone access it at a place and time of their own choosing.

Article 29 permits quoting excerpts of disseminated works, and reproducing a disseminated visual, photographic, or other short work in its entirety, within works that form an independent whole, to the extent justified by the purposes of explanation, polemic, critical or scientific analysis, teaching, or the rights of the genre of creativity.