Poland AI Act Enforcement: What KRiBSI Can Do From Oct 28

Since October 28, 2026, Poland's AI regulator can inspect companies, take complaints and fine breaches of the EU AI Act. The Commission for the Development and Safety of Artificial Intelligence (KRiBSI) held its first meeting the same day, approved electronic forms for complaints and opinion requests, and said its first guidance will cover Article 50: telling people they are dealing with AI and labelling AI-generated content. That is the AI Act duty most small teams with a chatbot or an image generator already have. Fines follow the AI Act's caps: up to EUR 15 million or 3% of worldwide turnover for an Article 50 breach, and for an SME, whichever of the two is lower.

Event date: October 28, 2026 (enforcement chapters in force; KRiBSI's first meeting in Warsaw). First report: KRiBSI's own release on gov.pl, published the same day.

Screenshot: KRiBSI release "Pierwsze posiedzenie Komisji Rozwoju i Bezpieczeństwa Sztucznej Inteligencji," gov.pl, text licensed CC BY-SA 4.0. Captured October 29, 2026.

What changed on October 28

Poland's Act of 3 July 2026 on artificial intelligence systems was published in the Journal of Laws on July 27 as item 1003. Most of it applied from August 11. Article 127 held back the parts with teeth: Articles 8 to 18 (individual opinions) and Chapters 3 to 5, 8 and 9 (inspections, proceedings, settlements, fines) entered into force three months after publication.

Screenshot: Dziennik Ustaw 2026, item 1003, Article 127. Captured October 29, 2026.

The Polish act doesn't add new duties. As the Chambers and Partners summary puts it, the substantive obligations "primarily arise directly from the EU AI Act." What Poland adds is the regulator and its procedure. The key dates:

Krzypkowska ran research and innovation at Poland's Ministry of Digital Affairs, where she was responsible for the national language model PLLuM, and worked at Microsoft before that. Four other regulators sit on the Commission: the heads of the competition and consumer office (UOKiK) and the telecoms office (UKE), a member of the broadcasting council (KRRiT) and a deputy chair of the financial supervisor (KNF). "We are starting the Commission's work today," she said at the meeting.

Does it reach a company outside Poland?

Usually, if Poles use your product. Article 2(1) of the AI Act covers providers placing AI systems on the EU market "irrespective of whether those providers are established or located within the Union or in a third country," and non-EU providers and deployers "where the output produced by the AI system is used in the Union." That was true before October 28. What changed is that a Polish regulator now has the procedure to act on it, and a user in Poland now has somewhere to complain.

Article 59 of the Polish act lets any natural person, company or organisation file a complaint. It must name or describe the system and say what happened and why the complainant thinks the AI Act was broken. A complaint is one of the ways KRiBSI opens proceedings (Article 58); an inspection is the other.

Complaints and inspections

Complaints go in electronically, with paper allowed only when that isn't possible (Article 59(3)). KRiBSI said the forms would be published on October 29. At 02:42 UTC that day, both its complaints page and its opinions page still read "electronic form being prepared."

Inspections follow an approved plan, information the Commission receives, or its own market monitoring (Article 48(2)). The default is gentle. An inspection starts no earlier than 7 days after notice is served (Article 49(2)), and it is carried out remotely (Article 49(3)). The Warsaw firm Graś i Wspólnicy notes the exception: where life, health, safety or fundamental rights may be at risk, KRiBSI can order an in-person inspection at your office before the 7 days run out. Inspectors can request documents, electronic correspondence and access to IT systems.

If KRiBSI finds a breach and there's no settlement, its decision orders the effects removed within 14 days (Article 62(2)), and doing so in time counts when it sets the fine.

Fines, and the ways to shrink one

Article 104 sends the amounts back to Chapter XII of the AI Act. In the consolidated text as of July 27, 2026:

The Polish act then adds discounts. This is the part worth reading twice:

Screenshot: Dziennik Ustaw 2026, item 1003, Article 70(6). Captured October 29, 2026.

The settlement route is closed if the conduct caused one of the serious incidents defined in Article 3(49)(a), (b) or (d) of the AI Act (Article 70(1)). The self-report discount is the biggest, but it means handing the regulator "all material circumstances" of your own breach. That trade is for Polish counsel, not a blog post.

The 150-złoty opinion

This is the most useful tool for a small team. A company that must apply the AI Act, or plans to do something that would bring it into scope, can ask KRiBSI for an individual opinion on one issue, about a current situation or a planned one (Article 9). You state the facts and your own legal assessment. The fee is 150 złoty (Article 11).

Screenshot: Dziennik Ustaw 2026, item 1003, Article 12. Captured October 29, 2026.

KRiBSI must answer within 30 days, or 60 for a complicated case. If it doesn't, the opinion is deemed to agree with your position (Article 12(3)). It binds KRiBSI and the other state bodies it consulted (Article 13(1)), and anonymised opinions will be published.

Two catches. KRiBSI can change or revoke an opinion it decides was wrong (Article 15), though following it before then "may not harm" you. The Polish site Digital HR points out that the list of grounds for revoking one is open-ended. And one company can file only one request every 30 days (Article 9(5)), so choose the question carefully. The form asks for Polish registry numbers (REGON, KRS, NIP) only "if assigned." Our reading: nothing in the text shuts out a company registered abroad.

Article 50 comes first

KRiBSI said its first explanations will cover Article 50, "in force since August 2, 2026," and focus on content labelling and "informing users when they are in contact with AI." In the week of her appointment, Krzypkowska told a Sejm committee that deepfake labelling would be one of the first topics she wants in the inspection plan.

For a small team, that means the chatbot that should say it's an AI, and the image or video feature whose output should carry a machine-readable mark. Generators already on the EU market before August 2 have until December 2, 2026 for the marking duty in Article 50(2). Our watermarking checklist for December 2 covers who owes what.

What to do this month

1. Check whether people in Poland use your chatbot, voice agent or generator. If they do, confirm the bot tells users they are dealing with an AI and that deepfake output is labelled.
2. Write down, with dates, what your disclosure says and where it appears. If a complaint names your system, that record is your first answer.
3. Decide who receives a KRiBSI inspection notice. You get at least 7 days, and the inspection is remote by default, so the job is gathering documents and system access, not hosting a visit.
4. If you can't tell whether a feature falls under Article 50, consider the 150-złoty opinion: one issue, your own reasoning, and a deemed yes if KRiBSI doesn't answer within 30 or 60 days.

What we could not confirm

The complaint and opinion forms were promised for October 29. At 02:42 UTC that day they weren't up, and we'll recheck before this post goes live. We haven't mapped which AI Act duties KRiBSI enforces itself and which stay with other Polish bodies. Graś i Wspólnicy says the act describes KRiBSI's relationship with the data protection office (UODO) "very superficially" and doesn't regulate AI in recruitment. A secondary site reports that the Digital Omnibus gives the EU AI Office exclusive competence over some systems built on general-purpose models. We haven't checked that in the regulation text, so this piece doesn't say which of those systems stay with KRiBSI.

Screenshot: Dziennik Ustaw 2026, item 1003, Article 107(1). Captured October 29, 2026.

Related Reading

• EU AI Act Article 50: Chatbot and Deepfake Disclosure
• EU AI Act Nudification Ban and Watermarking Checklist
• EU AI Act Compliance for Small Teams: The Complete Guide
• EU AI Act SME Support and Sandboxes: What Small Firms Get
• CNIL Credit Scoring Rules and the AI Act: What Applies When
• EU AI Act Prohibited AI Practices: Article 5 Banned Uses
• AI Regulation Deadline Calendar: 2026 and 2027 Dates