AI Regulation Tracker  /  EU member-state implementation

Poland's AI systems act is now law, and a brand new commission is designated to enforce it

The statute was promulgated in the Dziennik Ustaw on 27 July 2026 as item 1003. Article 5(1) puts market surveillance in the hands of a body that did not exist before the Act created it.

By Anthony Guerriero  ·  Published July 28, 2026  ·  Last updated July 28, 2026  ·  Standard news article

What actually changed on 27 July, given the tracker already covered the bill?

This tracker followed the bill twice before: the shape of the proposed watchdog, then its passage through parliament. Both pieces described a designation that had not yet taken legal effect, because until a Polish statute is published in the Dziennik Ustaw it is not law.

That is the whole event here. Publication happened on 27 July 2026, the gazette record carries the line "Data ogloszenia: 2026-07-27", and the item number is 1003. The President signed on 24 July. A question that belonged in the "watch this" column of a member-state map moves into the "settled" column.

What does Article 5 actually say?

The operative text is short. Designation clauses are also the part of an implementing statute most often paraphrased into ambiguity by secondary coverage, so here it is as published:

"Art. 5. 1. Komisja Rozwoju i Bezpieczenstwa Sztucznej Inteligencji, zwana dalej "Komisja", jest organem nadzoru rynku w zakresie systemow sztucznej inteligencji w rozumieniu art. 70 ust. 1 rozporzadzenia 2024/1689. 2. Komisja dziala jako pojedynczy punkt kontaktowy, o ktorym mowa w art. 70 ust. 2 rozporzadzenia 2024/1689."

Dz. U. z 2026 r. poz. 1003, Rozdzial 2, Art. 5 ust. 1 to 2

In English: the Commission for the Development and Safety of Artificial Intelligence, hereinafter the Commission, is the market surveillance authority for artificial intelligence systems within the meaning of Article 70(1) of Regulation 2024/1689. The Commission acts as the single point of contact referred to in Article 70(2) of Regulation 2024/1689.

Two designations in one article. Market surveillance and single point of contact sit in the same body, which is not guaranteed across the member states. The Act gives the Commission enforcement, regulatory sandbox, individual-opinion and register functions, and sets a fee of PLN 150 for a binding individual opinion.

Which member states built a new body, and which handed the job to an existing regulator?

Article 70(1) of the AI Act tells each member state to designate a market surveillance authority. It does not tell them which one. The institution you deal with in Warsaw is a different species of regulator from the one you deal with in Paris. Poland went with a purpose-built commission, as Spain did with AESIA. Others reused what they had. The table below covers only member states this tracker has documented; it is not a complete map of the twenty-seven.

A dedicated AI commission starts with no supervisory backlog, but also with no staff, no precedent and no record of how it reads a technical file. A data protection authority arrives with enforcement muscle and a strong prior that AI questions are personal data questions. A telecoms regulator brings product-oversight habits and tends to treat an AI system the way it treats equipment placed on a market. None of these is obviously the right answer, but they produce different first questions, and the first question a regulator asks shapes the file you should have ready.

What does this mean for a US company placing AI systems on the Polish market?

Start with the question in-house counsel actually gets asked: who enforces in Poland. As of 27 July 2026 the answer is KRiBSI, by name, under Article 5(1), with a gazette citation you can put in a memo. "The bill designates a new commission" and "the statute designating a new commission is published law" are different sentences in a board paper.

Second, the single point of contact matters operationally. Article 5(2) puts the Article 70(2) contact function in the same body, so Polish correspondence does not fork between a supervisory authority and a separate coordination desk.

Third, plan for a ramp rather than a switch. The Commission has to be constituted, chaired and staffed before it behaves like a regulator, and the Act provides that the Sejm is to appoint the Chair within two months of entry into force. Early enforcement from a body in that position is not the realistic risk. Inconsistent early practice is.

Fourth, the sandbox and the individual opinion are the channels worth knowing about now. A PLN 150 binding opinion is cheap enough to be a live option for a genuinely uncertain classification question, and a new regulator building its precedent base is usually more receptive to that traffic than a mature one. Use judgment about what you ask. A binding opinion cuts both ways.

What the gazette publication does not settle

Publication is not the same as full commencement, and this piece should not be read as saying the whole Act operates today. The ISAP record for poz. 1003 indicates staged entry into force, stating that articles 8 to 18 and chapters 3 to 5, 8 and 9 commence on 28 October 2026; this tracker has not independently checked that against the commencement article itself. So treat the October date as a diary entry to confirm against the statute, not a fixed deadline.

It also does not settle how KRiBSI will read anything. A designation clause gives you the address, not the enforcement posture, the sector priorities, or the boundary between the Commission's remit and the Polish data protection authority's. Those answers arrive with the first decisions; the Act provides that appeals from KRiBSI decisions run through amended civil procedure provisions rather than a bespoke tribunal.

Frequently asked questions

Who is the AI Act market surveillance authority in Poland?

When did Poland's AI systems act become law?

Is KRiBSI operational and can it be contacted today?

Does Poland charge for a binding opinion on an AI system?

Last verified: July 28, 2026