The President of Poland's data protection authority asked the labour ministry to legislate additional protections against AI discrimination in recruitment and employment

What UODO sent, and to whom

Miroslaw Wroblewski, President of the Personal Data Protection Office, addressed the Minister of Family, Labour and Social Policy with a request that work begin on provisions giving candidates and employees additional protection against discrimination resulting from the use of AI systems. The announcement carries the file reference DPNT.0623.18.2026 and is dated 16 July 2026.

The stated reason is signal volume. UODO says it is receiving more and more reports of AI-based tools being used in recruitment processes, tools that allow personal data to be processed on a large scale, sometimes including special category data.

The reason UODO gives for wanting legislation is technical rather than rhetorical: AI systems carry a serious risk of reproducing biases present in their training data.

Where the GDPR leaves room, and Poland has not filled it

The letter's legal architecture is straightforward. The GDPR contemplates additional guarantees of this kind being introduced through national employment law. The Polish Labour Code already establishes equal treatment of employees regardless of sex, age, disability, origin, religion, political convictions or sexual orientation.

Between those two, UODO argues, there is a gap that AI tools walk through. It points out that such systems can analyse considerably more information than the catalogue of data an employer may demand from a job candidate under article 22-1 of the Labour Code allows.

UODO also raises the right of a data subject not to be subject to a decision based solely on automated processing. That right carries an exception permitting such processing where national law allows it, and UODO's point is conditional: if profiling is to be applied or permitted on the basis of legal provisions, those provisions should guarantee appropriate measures to safeguard the rights of the people whose data is processed. Poland, in other words, cannot switch the exception on without writing the safeguards.

The AI Act layer

AI tools used in recruitment fall under the AI Act's high-risk category, and UODO quotes article 86(1) at length: an affected person subject to a decision taken by a deployer on the basis of the output of a high-risk AI system listed in Annex III, other than systems listed in point 2 of that annex, where that decision produces legal effects or similarly significantly affects the person such that they consider it adversely affects their health, safety or fundamental rights, has the right to obtain from the deployer a clear and meaningful explanation of the role of the AI system in the decision procedure and of the main elements of the decision taken.

UODO then makes a point that is easy to get wrong in practice. The obligation to assess a high-risk system's impact on fundamental rights, including privacy, follows directly from article 27 of the AI Act, but that assessment is only meant to supplement a data protection impact assessment, not to replace it. Two assessments, not one.

The letter lists what article 26 pulls in for deployers of high-risk systems: a risk management system under article 9, data and data governance under article 10, technical documentation under article 11, logging under article 12, transparency and provision of information to users under article 13, human oversight under article 14, and accuracy, robustness and cybersecurity under article 15. UODO's position is that the guarantees set out in the EU regulation should be reflected in national provisions at statutory level.

What the regulator is asking for, and what it offered

UODO's transparency ask is specific. High-risk systems should be transparent, meaning they should guarantee access to information about how the AI models work and a proper explanation of both the technical processes and the justification of the decision reached. People using them must be aware they are dealing with artificial intelligence.

The legislative shopping list follows from that: provisions should indicate the purposes the use of such systems is meant to serve, identify who the data controller is, and set out the guarantees and rights available to data subjects.

There is also a procedural instruction aimed at the ministry itself. If the ministry wants to introduce provisions permitting AI systems in employment, that should be preceded by a data protection impact assessment, which would identify potential risks and make it easier for entities using AI tools to demonstrate that their processing complies with the GDPR. The President closed by offering the ministry his expert support in analysing draft provisions from a GDPR compliance perspective.

Reading this as an employer

Nothing here changes what you must do tomorrow. But it does tell you where the supervisory authority's attention is, and it identifies the theory it would use.

The article 22-1 point is the one with immediate teeth. If a screening tool infers characteristics beyond the data an employer may lawfully demand from a candidate, the problem exists under current Polish law regardless of what the ministry does next. That is worth a look at what your vendor's model actually consumes and outputs.

The second thing to take from it is the two-assessment structure. If you are deploying a recruitment tool in Poland, a fundamental rights impact assessment under article 27 does not discharge your DPIA, and UODO has now said so in writing.

What we did not verify

We opened the UODO announcement page dated 16 July 2026 in Polish and took every fact and the quotation from it. The article 86(1) text above is UODO's own quotation of the AI Act as reproduced on that page, rendered into English by us.

We did not open the linked PDF of the letter itself, so we describe the announcement's account of the letter rather than its full text. We found no English version of either. We did not contact the Ministry of Family, Labour and Social Policy and have no information about its response.

We do not claim any legislative proposal exists, because the letter asks that work begin. We do not claim UODO has opened, or intends to open, any proceeding against an employer or vendor over AI recruitment tools.

Related briefings

• CNIL 2026 control priorities include AI recruitment
• ICO guidance on ADM and profiling in recruitment
• Poland's AI Systems Act and the KRiBSI authority
• HR and employment hub
• AI Regulation News hub