AI Act for boards

AI Act in the company: timeline and board questions

From the author

I have brought together the AI Act dates and provisions that a board member should know before asking management about AI. Each date comes with a question for management. Start with the three dates and three key points below. The company's lawyer assesses its specific situation.

From 28.10.2026, Polish provisions on inspections of AI Act compliance apply

Three AI Act dates for the company
DateWho in the company is affectedBoard question for management
from 2.02.2025appliesEveryone using AI on behalf of the company: AI literacy and prohibited practicesDo we have an inventory of AI tools checked against the prohibitions and an AI literacy programme?
from 2.08.2026appliesCustomer service, marketing, communications: chatbots, deepfakes, transparencyWhere do customers or employees encounter AI, and how do we inform them?
from 2.12.2027HR, credit scoring, life and health insurance: high riskWhich systems will be high-risk, who oversees them in the company, and what is the plan?

Full wording of the questions for these dates in the timeline:

  1. Do we have an inventory of AI tools checked for prohibited practices?
  2. What measures supporting AI literacy can the company demonstrate?
  3. Where do customers or employees encounter AI, and how do we inform them?
  4. Which of our systems will be high-risk, who provides human oversight, and what is the plan?

From 28.10.2026, the provisions of the Polish Act of 3.07.2026 on artificial intelligence systems concerning individual opinions, inspections, proceedings before the supervisory authority and penalties, as well as criminal provisions, apply (Article 127(2) of the Act). From that date, a company can also request an individual opinion from KRiBSI on its own case. The remaining dates, each with its legal basis, appear in the timeline below.

Three key points

  1. A company using AI purchased from suppliers is a deployer under the AI Act. It already has obligations relating to AI literacy, prohibited practices and transparency towards customers and employees.
  2. Regulation (EU) 2026/1744 postponed the obligations for high-risk systems to 2.12.2027. These include systems used in recruitment, employee assessment and credit scoring.
  3. From 28.10.2026, the provisions of the Polish Act on artificial intelligence systems concerning inspections, proceedings and penalties apply. The market surveillance authority is the Commission for the Development and Safety of Artificial Intelligence (KRiBSI).

AI Act timeline

Each date has a board question for management. The main entries concern a typical company deploying AI. They also state what the company should have in place from that date. For the additional entries, a short note after the question explains when the date is relevant to the company.

  • Filled dot: the date has passed
  • Empty dot: a future date
  • Small dot: a reference date or a deadline mainly affecting providers, Member States or authorities.
DateStatusWho in the company is affectedWhat the company should have in place from this dateBoard question for management
2.02.2025 applies Everyone using AI on behalf of the company; compliance, HR, IT Assurance that no AI tool, including purchased tools, is used for prohibited purposes, such as analysing employees' emotions; an inventory of tools is helpful. Usually: compliance with IT and HR. Do we have an inventory of AI tools checked for prohibited practices?
Legal basis and source, 2.02.2025, prohibited practices
Obligation
a prohibition on eight AI practices, including manipulation, exploitation of vulnerabilities, social scoring, biometric categorisation by sensitive characteristics and inferring a person's emotions in the workplace, except for medical or safety reasons.
Article
Article 5(1)(a)-(h), Article 113, third paragraph, point (a); penalty under Article 99(3) (see “Penalties and liability”).
Legislation
Regulation (EU) 2024/1689.
Source
[S1], [S2a], checked 22.10.2026.
27.07.2026 applies Staff and other persons operating and using AI on behalf of the company Measures supporting AI literacy, such as training and rules for working with AI for everyone using it on the company's behalf, tailored to their use. Usually: the management board member responsible for HR or IT. What measures supporting AI literacy can the company demonstrate?
Legal basis and source, 27.07.2026, AI literacy
Obligation
providers and deployers “take measures that support the development of AI literacy” among persons operating and using AI on their behalf. “Such an obligation does not mean that providers or deployers must ensure that individuals attain a specific level of AI literacy.” The obligation remains, but its standard has changed.
Article
Article 4(1), as amended by Regulation 2026/1744.
Legislation
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
Source
[S2a], [S3a], checked 22.10.2026.
2.08.2026 applies Customer service, marketing, communications, investor relations Information for customers and employees that a deepfake image, audio or video was generated or manipulated by AI and, for the company's own chatbot, that they are interacting with a machine. Usually: marketing, customer service, investor relations. Where do customers or employees encounter AI, and how do we inform them?
Legal basis and source, 2.08.2026, transparency
Obligation
the chatbot provider informs people that they are interacting with AI (paragraph 1); the provider marks synthetic content in a machine-readable format (paragraph 2); the deployer informs people about emotion recognition and biometric categorisation (paragraph 3) and discloses deepfakes (paragraph 4, first subparagraph). It also discloses AI-generated text published on matters of public interest, unless the text has undergone human review or editorial control and a natural or legal person holds editorial responsibility (paragraph 4, second subparagraph). The information must be clear and distinguishable, at the latest at the first interaction (paragraph 5). Content generated and published before 2.08.2026 does not need to be labelled retrospectively.
Article
Article 50(1)-(5); penalty under Article 99(4)(g).
Legislation
Regulation (EU) 2024/1689.
Source
[S2a], [S4], [S6] points 153-154, checked 22.10.2026.
11.08.2026 applies Every company in Poland It is useful to designate a person to liaise with the Polish supervisory authority, KRiBSI. Usually: compliance with the legal department. Who in the company is responsible for contact with the Polish supervisory authority?
Legal basis and source, 11.08.2026
Obligation
the Polish Act on artificial intelligence systems generally enters into force and establishes KRiBSI as the market surveillance authority and single point of contact.
Article
Articles 5 and 127 of the Act.
Legislation
Polish Act of 3.07.2026 on artificial intelligence systems, Journal of Laws 2026, item 1003, published 27.07.2026.
Source
[S7], [S8], checked 22.10.2026.
28.10.2026 applies from 28.10.2026 The company as a provider or deployer in Poland Readiness for a KRiBSI inspection, because obstructing an inspection is punishable; a procedure for this situation is useful. Usually: the legal department with compliance. Does the company have a procedure for an inspection by the AI supervisory authority?
Legal basis and source, 28.10.2026
Obligation
provisions enter into force on KRiBSI individual opinions and explanations (Articles 8-18), inspections (Chapter 3), proceedings before the supervisory authority, including complaints (Chapter 4), agreements on extraordinary mitigation of sanctions (Chapter 5), administrative fines and criminal provisions (Chapter 8), and amendments to other laws (Chapter 9).
Article
Article 127(2) of the Act.
Legislation
Polish Act of 3.07.2026 on artificial intelligence systems, Journal of Laws 2026, item 1003.
Source
[S7], [S8], checked 22.10.2026.
2.12.2026 future Less relevant to a typical company: only if it uses a system to generate such content itself If the company generates AI content itself: assurance that it does not use AI to create intimate material depicting an identifiable person without their consent or child sexual abuse material. Usually: compliance with IT. Do the rules for using AI exclude the practices prohibited from December 2026?
Legal basis and source, 2.12.2026, two new prohibitions
Obligation
two new prohibitions concerning systems that generate realistic material depicting the intimate body parts or sexual activities of an identifiable person without their consent, and systems that generate child sexual abuse material. These are less relevant to a typical company: the prohibition applies to a deployer when it uses such a system itself.
Article
Article 5(1)(ba) and (bb), paragraphs 1a and 1b; Article 113, third paragraph, point (a).
Legislation
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
Source
[S2], [S2a], [S3], checked 22.10.2026.
2.12.2027 future HR, credit scoring, life and health insurance: high risk When using a high-risk system, for example for recruitment and employee assessment, credit scoring of natural persons, or risk assessment and pricing in life and health insurance: among other things, human oversight, logs, and information for employees and people affected by decisions supported by the system; an inventory of systems and a plan are useful. Usually: the process owner with compliance. Which systems will be high-risk, who oversees them in the company, and what is the plan?
Legal basis and source, 2.12.2027
Obligation
requirements for high-risk systems in Annex III and obligations of their providers and deployers (Chapter III, Sections 1-3, including Articles 26 and 27). These cover, among other things, recruitment and employee assessment (Annex III, point 4), assessment of creditworthiness and credit scoring of natural persons (point 5(b)), and risk assessment and pricing in life and health insurance (point 5(c)). Previous date: 2.08.2026. For systems placed on the market before that date, see Article 111(2) under “Questions of interpretation”.
Article
Article 113, third paragraph, point (c)(i), Article 6(2), Annex III.
Legislation
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
Source
[S2a], [S3], [S4], checked 22.10.2026.
Full question
Which of our systems will be high-risk, who provides human oversight, and what is the plan?
Other dates, mainly for providers, Member States and authorities (13)
DateStatusWho in the company is affectedBoard question for management
1.08.2024 applies Every company developing or deploying AI; the time limits run from this date Who on the management board is responsible for applying the AI Act in the company?Note: a reference date for a typical company; obligations apply from the dates in the following rows.
Legal basis and source, 1.08.2024
Obligation
the AI Act enters into force on the twentieth day after its publication in the Official Journal of the EU on 12.07.2024; its provisions apply from the dates below.
Article
Article 113, first paragraph.
Legislation
Regulation (EU) 2024/1689.
Source
[S1], [S2a], [S3], checked 22.10.2026.
2.02.2025 applies Staff and other persons operating and using AI on behalf of the company Since when has the company been taking measures relating to AI literacy?Note: for a typical company, a historical date: the original wording of Article 4, replaced on 27.07.2026; the question about current measures appears at that later date.
Legal basis and source, 2.02.2025, AI literacy
Obligation
providers and deployers address the AI literacy of their staff and other persons operating and using AI on their behalf. Wording until 26.07.2026: “take measures to ensure, to their best extent, a sufficient level of AI literacy”.
Article
Article 4 (Chapter I), Article 113, third paragraph, point (a).
Legislation
Regulation (EU) 2024/1689 in its original wording.
Source
[S1], checked 22.10.2026.
2.08.2025 applies The company only if it is itself a provider of a general-purpose AI model Does the company act as a provider of a general-purpose AI model in any area?Note: not relevant to a typical company that only uses ready-made models; this applies to their providers.
Legal basis and source, 2.08.2025
Obligation
obligations of providers of general-purpose AI models; provisions on authorities (Chapter VII) and penalties (Chapter XII), except Article 101, also apply from this date. A company that only uses ready-made models is not their provider.
Article
Article 113, third paragraph, point (b).
Legislation
Regulation (EU) 2024/1689.
Source
[S1], [S2a], [S3], checked 22.10.2026.
2.02.2026 deadline passed; draft published People assessing whether a system is high-risk Who follows the Commission's guidelines on classifying high-risk AI systems?Note: an indirect date for a typical company: it binds the Commission, and the guidelines remain a draft as of the verification date.
Legal basis and source, 2.02.2026
Obligation
the European Commission was to issue guidelines by 2.02.2026 (Article 6(5)). As of the verification date, a draft published on 19.05.2026 is available. Regulation 2026/1744 excluded Article 6(5) from the postponement of dates (Article 113, third paragraph, point (c)).
Legislation
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
Source
[S2a], [S5], checked 22.10.2026.
27.07.2026 applies Every company covered by the AI Act Do our compliance plans reflect the dates amended by Regulation 2026/1744?Note: a reference date for a typical company; the Regulation changes the dates and Article 4, with the effects described in the main entries.
Legal basis and source, 27.07.2026, amending Regulation
Obligation
Regulation (EU) 2026/1744 (the digital omnibus concerning AI, commonly called the AI Omnibus) enters into force on the third day after publication on 24.07.2026; it amends, among other provisions, Articles 4, 5, 6, 27, 50, 57, 99, 111 and 113 of the AI Act.
Article
Article 4 of Regulation 2026/1744.
Legislation
Regulation (EU) 2026/1744.
Source
[S2], [S2a], checked 22.10.2026.
2.08.2026 applies Every company covered by the AI Act; authorities begin enforcement Which AI Act obligations has the company been applying since 2.08.2026?Note: a reference date for a typical company, namely the general date of application; its obligations are described in the main entries.
Legal basis and source, 2.08.2026, general date of application
Obligation
the general date of application of the AI Act; the AI Office and national authorities begin enforcement.
Article
Article 113, second paragraph.
Legislation
Regulation (EU) 2024/1689.
Source
[S2a], [S3], [S4], checked 22.10.2026.
2.08.2026 applies Providers of general-purpose AI models; the company indirectly, through contracts with providers Do contracts with AI providers address the consequences of their AI Act infringements?Note: only indirectly relevant to a typical company, through contracts with its provider; this applies to model providers.
Legal basis and source, 2.08.2026, penalties for model providers
Obligation
the Commission may impose fines on providers of general-purpose AI models.
Article
Article 101, Article 113, third paragraph, point (b).
Legislation
Regulation (EU) 2024/1689.
Source
[S2a], [S4], checked 22.10.2026.
2.12.2026 future Providers of generative tools; a typical company to a lesser extent, as their customer Is the company a provider of its own content-generating system?Note: indirectly relevant to a typical company as a provider's customer, and directly relevant if it is itself a provider of a content-generating system.
Legal basis and source, 2.12.2026, machine-readable marking
Obligation
providers of systems generating audio, images, video or text placed on the market before 2.08.2026 must ensure machine-readable marking of outputs by 2.12.2026 (Article 50(2)). This deadline concerns Article 50(2) only; the chatbot disclosure obligation (Article 50(1)) applies from 2.08.2026. It is less directly relevant to a typical company, as a customer of such providers.
Article
Article 111(4).
Legislation
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
Source
[S2a], [S6] point 153, checked 22.10.2026.
2.08.2027 future Member States; the company if it wants to test AI under the authority's supervision Does the company plan to test any AI solution in a national regulatory sandbox?Note: an opportunity for a typical company to test AI under the authority's supervision; the obligation lies with Member States.
Legal basis and source, 2.08.2027, regulatory sandboxes
Obligation
each Member State establishes at least one national AI regulatory sandbox. Previous date: 2.08.2026.
Article
Article 57(1).
Legislation
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
Source
[S2a], checked 22.10.2026.
2.08.2027 future Providers of older general-purpose AI models; the company indirectly Did the company place a general-purpose model on the market before 2.08.2025?Note: only indirectly relevant to a typical company as a provider's customer; this applies to providers of older models.
Legal basis and source, 2.08.2027, older general-purpose models
Obligation
providers of general-purpose AI models placed on the market before 2.08.2025 comply with the AI Act obligations.
Article
Article 111(3).
Legislation
Regulation (EU) 2024/1689.
Source
[S2a], checked 22.10.2026.
2.08.2028 future Manufacturers of regulated products with AI as a safety component, and companies deploying such high-risk systems Do we manufacture or deploy AI as a product safety component?Note: relevant to a typical company only if it deploys such a system; this mainly concerns manufacturers.
Legal basis and source, 2.08.2028
Obligation
requirements for high-risk systems in Annex I, namely AI as a safety component of regulated products, such as machinery and medical devices. Previous date: 2.08.2027.
Article
Article 113, third paragraph, point (c)(ii), Article 6(1), Annex I.
Legislation
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
Source
[S2a], [S3], checked 22.10.2026.
2.08.2030 future Providers and deployers of high-risk systems intended for public authorities Do we supply or deploy high-risk systems intended for public authorities?Note: relevant to a typical company only if it supplies or deploys such systems, regardless of the deployment date.
Legal basis and source, 2.08.2030
Obligation
providers and deployers of high-risk systems intended for use by public authorities ensure compliance regardless of when the system was introduced.
Article
Article 111(2), second sentence.
Legislation
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
Source
[S2a], checked 22.10.2026.
31.12.2030 future Operators of AI systems within the large-scale EU IT systems in Annex X Does any of our systems operate within large-scale EU IT systems?Note: usually not relevant to a typical company.
Legal basis and source, 31.12.2030
Obligation
compliance of AI systems that are components of the large-scale EU IT systems in Annex X and were placed on the market before 2.08.2027.
Article
Article 111(1).
Legislation
Regulation (EU) 2024/1689.
Source
[S2a], checked 22.10.2026.

Company obligations as a deployer

The AI Act places obligations on the company as an operator; it does not identify the person or body within the company that carries them out. Internal responsibilities follow the Polish Commercial Companies Code (KSH) and internal rules: management conducts the company's affairs and implements solutions, while the supervisory board exercises ongoing oversight (Article 382 § 1 KSH). The owner suggested for each obligation is an organisational proposal for each company to adapt to its own structure.

Article 4

AI literacy

In plain language
everyone using AI at work on the company's behalf receives training and rules tailored to what they use AI for.
Board question for management
What measures supporting AI literacy can the company demonstrate?
Legal requirements, responsibility and penalty, Article 4
What the legislation says
from 27.07.2026, the company takes measures supporting the development of AI literacy among staff and other persons operating and using AI on its behalf, taking into account their knowledge, experience, the context of use and the people affected by that use. The Act does not require a specific level of literacy to be achieved by every individual.
Who is usually responsible
the management board member overseeing HR or IT; evidence includes the training programme and rules for using AI.
Penalty
Article 4 is not included in the list in Article 99(4)(a)-(g); see “Questions of interpretation”.
Article 5

Prohibited practices

In plain language
some AI uses are prohibited altogether, including in tools purchased from a provider, such as analysing employees' emotions in a customer service centre.
Board question for management
Do we have an inventory of AI tools checked for prohibited practices?
Legal requirements, responsibility and penalty, Article 5
What the legislation says
from 2.02.2025, prohibited uses include AI to infer a person's emotions in the workplace, except for medical or safety reasons; biometric categorisation by sensitive characteristics; manipulative techniques causing significant harm; and social scoring. Two new prohibitions are added from 2.12.2026 (timeline entry 13).
Who is usually responsible
compliance together with IT, HR and the legal department.
Penalty
Article 99(3) (see “Penalties and liability”).
Article 50

Transparency

In plain language
customers and employees know when they are talking to a machine and when they are viewing an image or recording created by AI.
Board question for management
Where do customers or employees encounter AI, and how do we inform them?
Legal requirements, responsibility and penalty, Article 50
What the legislation says
from 2.08.2026, a deployer informs people about the use of emotion recognition or biometric categorisation on them (paragraph 3); discloses that deepfake images, audio or video have been generated or manipulated (paragraph 4, first subparagraph); and discloses that text published to inform the public on matters of public interest was generated by AI, unless it has undergone human review or editorial control and a natural or legal person holds editorial responsibility (paragraph 4, second subparagraph). If a company offers its own chatbot to customers under its own name, it may be its provider, in which case the disclosure obligation in paragraph 1 falls on that company.
Who is usually responsible
marketing and communications, customer service, and investor relations for public communications.
Penalty
Article 99(4)(g).
Article 26

High-risk systems: deployer obligations from 2.12.2027

Board question for management
Which systems will be high-risk, who oversees them in the company, and what is the plan?
Legal requirements, responsibility and penalty, Article 26
When this applies to the company
when it uses a system in Annex III, for example for recruitment, assessment of candidates, decisions on promotion, dismissal or allocation of tasks, monitoring performance (point 4), assessment of creditworthiness or credit scoring of natural persons, except fraud detection (point 5(b)), or risk assessment and pricing in life and health insurance (point 5(c)).
What the legislation says
the company uses the system in accordance with the provider's instructions (paragraph 1); assigns human oversight to persons with the necessary competence, training, authority and support (paragraph 2); ensures that input data are appropriate insofar as it controls them (paragraph 4); monitors operation and reports risks and serious incidents (paragraph 5); keeps automatically generated logs for at least six months (paragraph 6); as an employer, informs workers' representatives and workers before deployment (paragraph 7); informs people affected by decisions supported by the system (paragraph 11); and cooperates with authorities (paragraph 12). Financial institutions fulfil their monitoring and record-keeping obligations through the internal governance requirements under financial services law (paragraph 5, second subparagraph; paragraph 6, second subparagraph).
Who is usually responsible
the business owner of the process (HR, credit risk, insurance risk assessment), with designated human oversight; coordination by compliance.
Penalty
Article 99(4)(e).
Article 27

Fundamental rights impact assessment from 2.12.2027

Board question for management
Will we need to carry out a fundamental rights impact assessment from December 2027?
Legal requirements, responsibility and penalty, Article 27
Who it applies to
bodies governed by public law, private entities providing public services, and every deployer of a system in Annex III, point 5(b) (credit scoring) and (c) (life and health insurance). In practice, financial institutions assessing the creditworthiness of natural persons and insurers, if they use such systems.
What the legislation says
before first use, the company carries out an assessment covering the processes, duration and frequency of use, categories of people affected, specific risks of harm, human oversight measures and measures if risks materialise, including internal governance and complaints (paragraph 1); it notifies the market surveillance authority of the results using the AI Office's template (paragraphs 3 and 5). From 27.07.2026, relevant parts of a GDPR data protection impact assessment may be referenced or attached (paragraph 4).
Who is usually responsible
risk and compliance, together with the data protection officer.
Penalty
Article 27 is not included in the list in Article 99(4)(a)-(g); see “Questions of interpretation”.

An inventory of AI use cases is an oversight tool for supervisory boards and management boards. The AI Act does not require every deployer to maintain such an inventory.

Polish Act on artificial intelligence systems

From 28.10.2026, Poland has a national procedure for inspections, complaints and penalties for AI Act infringements, and a company may request an individual opinion from the authority on its own case.

Board question for managementWho in the company prepares it for inspections and proceedings before KRiBSI?

Legislation, authority, penalties and procedure
Legislation
Polish Act of 3.07.2026 on artificial intelligence systems, Journal of Laws 2026, item 1003, published 27.07.2026.
Entry into force
generally 11.08.2026; Article 125(4) from 28.07.2026; Articles 8-18 and Chapters 3-5, 8 and 9 from 28.10.2026 (Article 127; dates from the Sejm's ELI record).
Authority
The Commission for the Development and Safety of Artificial Intelligence (KRiBSI) is the market surveillance authority for artificial intelligence systems within the meaning of Article 70(1) of the AI Act and the single point of contact (Article 5 of the Polish Act). The Commission comprises a Chair, two Deputy Chairs and four members nominated by the President of UOKiK, KNF, KRRiT and the President of UKE (Article 19(1)).
Chair
Pamela Krzypkowska, appointed by a Sejm resolution of 18.09.2026 (Monitor Polski 2026, item 945), with the Senate's consent of 24.09.2026 (Monitor Polski 2026, item 946).
Penalties in Poland
KRiBSI imposes administrative fines “in the cases, amounts and on the conditions laid down in Chapter XII of Regulation 2024/1689” (Article 104(1)). Amounts in euro are converted into Polish zloty at the average NBP exchange rate of 28 January each year (Article 104(4)).
Reduction of a fine
by 10-50%, if the penalised entity carries out the actions specified in the warning within 3 months of receiving the penalty decision, and the infringement did not cause death or serious injury (Article 107(1)).
Appeal
to the Regional Court in Warsaw, the Competition and Consumer Protection Court, through KRiBSI (Article 109(1)).
Warning
where there are reasonable grounds to suspect an infringement, KRiBSI may issue an order containing a warning during proceedings and specify actions to restore compliance (Article 61).
Mandatory order
where a system poses an immediate threat to the life, health, safety or fundamental rights of natural persons, KRiBSI may order the operator to stop using the system or withdraw it from the market or from use, including with immediate enforceability (Article 63(2)).
Complaints
a natural person, legal person or organisational entity without legal personality may submit a complaint to KRiBSI (Article 59(1)).

Individual opinions from KRiBSI

The fee for an individual opinion application is PLN 150 (Article 11(1)). KRiBSI issues the opinion within 30 days of the application, or within 60 days for particularly complex cases (Article 12(1)).

Board question for managementWill the company seek an individual opinion from KRiBSI before deploying any system?

Scope, fee, deadline and effect of the opinion
  • From 28.10.2026, KRiBSI may issue individual opinions and explanations on matters within its remit (Article 8(1)).
  • The fee for an individual opinion application is PLN 150 (Article 11(1)).
  • Deadline: without delay, within 30 days of the application at the latest, or within 60 days for particularly complex cases (Article 12(1)).
  • Failure to issue an opinion on time constitutes an opinion consistent with the position presented in the application (Article 12(3)).
  • The opinion binds KRiBSI and other authorities consulted by the Commission, in relation to the particular case and facts stated in the application (Article 13(1)).
  • An opinion is not issued on factual elements that are the subject of pending proceedings before the Commission, other authorities or a court, or where the case has already been resolved (Article 14).

Penalties and liability

AI Act penalties

Maximum AI Act penalties
InfringementMaximum penaltyProvision
Failure to comply with the prohibitions in Article 5up to EUR 35,000,000 or, if the offender is an undertaking, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever amount is higherArticle 99(3)
Failure to comply with provisions concerning operators or notified bodies other than Article 5, listed in points (a)-(g): obligations of providers (Article 16), authorised representatives (Article 22), importers (Article 23), distributors (Article 24), providers and operators under Article 25(2) and (4) (from 27.07.2026), deployers (Article 26), notified bodies, and transparency (Article 50)up to EUR 15,000,000 or, if the offender is an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever amount is higherArticle 99(4)
Supplying incorrect, incomplete or misleading information to notified bodies or national authorities in response to their requestup to EUR 7,500,000 or, if the offender is an undertaking, up to 1% of its total worldwide annual turnover for the preceding financial year, whichever amount is higherArticle 99(5)
Penalties for SMEs, small mid-cap companies and providers of general-purpose AI models
Penalties for SMEs, small mid-cap companies and providers of general-purpose AI models
InfringementMaximum penaltyProvision
SMEs, including start-upsthe fine does not exceed the percentage or amount in paragraphs 3, 4 and 5, whichever amount is lowerArticle 99(6)
Small mid-cap companies (from 27.07.2026)the fine under paragraphs 4 and 5 does not exceed the percentages or amounts in those paragraphs, whichever value is lowerArticle 99(6a)
Providers of general-purpose AI models (the European Commission imposes the fine)up to 3% of total worldwide annual turnover in the preceding financial year or EUR 15,000,000, whichever amount is higherArticle 101(1)

When deciding whether to impose a fine and its amount, the authority considers all relevant circumstances, including the degree of cooperation with authorities to remedy the infringement and mitigate its effects (Article 99(7)(f)), and the operator's degree of responsibility, taking into account the technical and organisational measures it has implemented (point (g)). Documented technical and organisational measures are therefore one of the circumstances affecting the amount of a fine.

In Poland, KRiBSI imposes fines under Chapter XII of the AI Act, converting euro amounts into Polish zloty at the NBP exchange rate of 28 January (Article 104(1) and (4) of the Polish Act).

Board question for managementWhat documented technical and organisational measures can the company show the authority?

Liability of board members

The AI Act places obligations on operators: providers, product manufacturers, deployers, authorised representatives, importers and distributors (Article 3(8)). Article 99 fines are imposed on operators and undertakings. The Act contains no provision imposing obligations or fines on members of supervisory boards or management boards.

The Polish Act provides for a restriction of liberty or a fine for anyone who obstructs or prevents an inspection or activities in proceedings before KRiBSI (Article 112(1)), and for anyone who fails to comply with a decision ordering the discontinuation of use or withdrawal of a system (Article 113(1), in conjunction with Article 63(2)). The same penalty applies to a person acting on behalf of or in the interests of a legal person (Article 112(2), Article 113(2)). Cases are heard under the Code of Procedure in Petty Offence Cases (Article 114). These provisions concern obstructing supervision and failing to comply with the authority's decisions.

A board member's liability towards the company arises under the Polish Commercial Companies Code (KSH). A management board or supervisory board member “is liable to the company for damage caused by an act or omission contrary to the law or the company's articles of association, unless they are not at fault” (Article 483 § 1). A fine imposed on the company for an AI Act infringement may constitute such damage; the assessment depends on the circumstances of the case.

The Code links the assessment of a board member's diligence, among other things, to whether they acted on the information, analyses and opinions that they should have considered (Article 483 § 3 KSH). Minutes show what information the board requested. They do not determine the absence of liability.

English translation of Article 483 § 3 KSH

“A management board member, supervisory board member or liquidator does not breach the duty of care arising from the professional nature of their activities if, acting loyally towards the company, they act within the limits of justified business risk, including on the basis of information, analyses and opinions that should be considered in the circumstances when making a diligent assessment.”

What the board can check under the Commercial Companies Code

In a Polish joint-stock company, the Commercial Companies Code gives the supervisory board the right to regular information from management and the right to request documents. The full wording of the provisions from the 2024 consolidated text appears below; as of October 2026, these articles have not been amended.

English translation of Article 382 § 1, Article 380¹ and Article 382 § 3¹-6 KSH

Article 382 § 1. The supervisory board exercises ongoing supervision over the company's activities in all areas of its operations.

Article 380¹. § 1. The management board is required, without an additional request, to inform the supervisory board about:

1) resolutions of the management board and their subject matter;

2) the company's situation, including its assets, and significant circumstances relating to the conduct of its affairs, particularly in operational, investment and personnel matters;

3) progress in implementing the company's established development directions, indicating any departures from those directions and explaining their reasons;

4) transactions and other events or circumstances that materially affect or may affect the company's financial position, including its profitability or liquidity;

5) changes to information previously provided to the supervisory board, where those changes materially affect or may affect the company's situation.

§ 2. The obligations referred to in § 1 points 2-5 include information held by the management board concerning subsidiaries and affiliated companies.

§ 3. The information referred to in § 1 and 2 should be provided in the cases specified in:

1) § 1 points 1-3: at every supervisory board meeting, unless the supervisory board decides otherwise;

2) § 1 points 4 and 5: without delay after the relevant events or circumstances occur.

§ 4. The information referred to in § 1 and 2 should be presented in writing, except where this is impossible because it must be communicated immediately to the supervisory board. The supervisory board may permit this information to be communicated in another form as well.

§ 5. The articles of association may exclude or limit the information obligations specified in § 1 or 2.

Article 382 § 3¹. The supervisory board's report contains at least:

1) the results of the assessments referred to in § 3 points 1 and 2;

2) an assessment of the company's situation, taking into account the adequacy and effectiveness of the company's internal control, risk management, compliance with standards or applicable practices, and internal audit systems;

3) an assessment of the management board's fulfilment of the obligations referred to in Article 380¹;

4) an assessment of how management prepares or provides the supervisory board with information, documents, reports or explanations requested under the procedure specified in § 4;

5) information on the total remuneration payable by the company for all examinations commissioned by the supervisory board during the financial year under Article 382¹.

§ 4. To perform its duties, the supervisory board may examine all company documents, inspect the company's assets, and request the preparation or provision of any information, documents, reports or explanations concerning the company, particularly its activities or assets, from the management board, commercial proxies and persons employed by the company under an employment contract or regularly performing specified activities for it under a contract for specific work, a mandate contract or another similar contract. The request may also cover information, reports or explanations concerning subsidiaries and affiliated companies that are held by the body or person required to provide them.

§ 5. The information, documents, reports or explanations referred to in § 4 are provided to the supervisory board without delay, within two weeks of the request to the relevant body or person at the latest, unless the request specifies a longer period.

§ 6. The management board may not restrict supervisory board members' access to the information, documents, reports or explanations they request under § 4.

Requested materials must reach the board without delay, within two weeks of the request at the latest, unless the board specifies a longer period in its request (Article 382 § 5).

An inventory of AI systems, an assessment of their classification, an AI literacy programme and a plan for 2.12.2027 are materials the board may request under Article 382 § 4. They fall within its assessment of internal control, risk management and compliance systems under Article 382 § 3¹ point 2. The company's articles of association may exclude or limit the information obligations under Article 380¹ § 1 and 2 (§ 5), so a board member checks the articles of association before invoking this provision.

Best Practice for WSE Listed Companies 2021

Best Practice for WSE Listed Companies 2021 is a corporate governance code that took effect on 1.07.2021. Applying the principles is voluntary; reporting on their application is mandatory for every listed company. Principle 3.9, linked to Principle 2.11.3, is the most directly relevant to AI oversight.

English translation of Principles 3.9, 2.11.3 and 3.1
  • 3.9

    Main principle

    “The supervisory board monitors the effectiveness of the systems and functions referred to in Principle 3.1, based, among other things, on reports periodically submitted directly to it by the persons responsible for those functions and by the management board. It also conducts an annual assessment of the effectiveness of those systems and functions, in accordance with Principle 2.11.3. Where the company has an audit committee, that committee monitors the effectiveness of the systems and functions referred to in Principle 3.1, but this does not relieve the supervisory board of its annual assessment of their effectiveness.”

  • 2.11.3

    Related principle; part of the board's annual report

    “an assessment of the company's situation on a consolidated basis, including an assessment of the internal control, risk management, compliance and internal audit systems and functions, together with information on the actions taken by the supervisory board to conduct this assessment; the assessment covers all material control mechanisms, particularly those relating to reporting and operations;”

  • 3.1

    Context; referred to in Principle 3.9

    “A listed company maintains effective internal control, risk management and legal compliance systems, as well as an effective internal audit function, appropriate to the company's size and the nature and scale of its activities, for which the management board is responsible.”

Board question for managementWhat AI reports will the board receive for its annual assessment of the systems?

Questions of interpretation

In two areas, the provisions do not provide an unambiguous answer. They are reproduced below in English translation without resolving the questions; the company's lawyer assesses its specific situation.

Question of interpretation (a)Penalties for AI literacy (Article 4) and fundamental rights impact assessments (Article 27)

Article 4(1)

“Providers and deployers of AI systems take measures that support the development of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context in which the AI systems are to be used, and considering the persons or groups of persons on whom the AI systems are to be used. Such an obligation does not mean that providers or deployers must ensure that individuals attain a specific level of AI literacy.”

Article 4(2)

“The Commission and Member States support and facilitate the efforts of providers and deployers of AI systems, particularly SMEs, to fulfil the obligation under paragraph 1 of this Article. To that end, the Commission publishes practical examples of how to comply with this obligation on the single information platform referred to in Article 62(3)(b).”

Article 4(3)

“The AI Board adopts recommendations, taking into account the European competence frameworks, to support the Commission and Member States in promoting the AI literacy required under paragraph 1, including by identifying common objectives.”

Article 27(1), first sentence

“Before deploying a high-risk AI system referred to in Article 6(2), except high-risk AI systems intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law or private entities providing public services, and deployers of high-risk AI systems referred to in point 5(b) and (c) of Annex III, perform an assessment of the impact on fundamental rights that the use of such a system may produce.”

Article 99(1)

“In accordance with the terms and conditions laid down in this Regulation, Member States lay down rules on penalties and other enforcement measures, which may also include administrative fines, warnings and non-monetary measures, applicable to infringements of this Regulation by operators, and take all measures necessary to ensure that they are properly and effectively implemented, taking into account the guidelines issued by the Commission under Article 96. The penalties provided for must be effective, proportionate and dissuasive. When imposing penalties, Member States take into account the interests of SMEs, including start-ups, and small mid-cap companies, and their economic viability.”

Article 99(4)

“Non-compliance with any of the following provisions relating to operators or notified bodies, other than those laid down in Article 5, is subject to administrative fines of up to EUR 15,000,000 or, if the offender is an undertaking, up to 3% of its total worldwide annual turnover for the preceding financial year, whichever amount is higher:

a) obligations of providers under Article 16;

b) obligations of authorised representatives under Article 22;

c) obligations of importers under Article 23;

d) obligations of distributors under Article 24;

da) obligations of providers and operators under Article 25(2) and (4);

e) obligations of deployers under Article 26;

f) requirements and obligations of notified bodies under Article 31, Article 33(1), (3) and (4), or Article 34;

g) transparency obligations of providers and deployers under Article 50.”

Article 104(1) of the Polish Act of 3.07.2026 on artificial intelligence systems

“The Commission imposes an administrative fine, by decision, on an entity required to comply with Regulation 2024/1689, in the cases, amounts and on the conditions laid down in Chapter XII of Regulation 2024/1689.”

Articles 4 and 27 are not included in the list in Article 99(4)(a)-(g). In its AI literacy questions and answers (updated 20.10.2026; non-binding explanation), the European Commission states: “National market surveillance authorities could impose penalties and other enforcement measures to sanction infringements of Article 4. This will be based on national laws that Member States are due to adopt by 2 August 2025.” The Polish version of this page also provides the author's Polish translation of this quotation.

Question of interpretation (b)High-risk systems placed on the market before 2.12.2027

Article 111(2)

“Without prejudice to the application of Article 5 under Article 113, third paragraph, point (a), this Regulation applies to operators of high-risk AI systems other than the systems referred to in paragraph 1 of this Article, which were placed on the market or put into service before the date of application of Chapter III under Article 113, only if those systems undergo significant changes in their design after that date. In any event, providers and deployers of high-risk AI systems intended to be used by public authorities take the necessary steps to comply with the requirements and obligations laid down in this Regulation by 2 August 2030.”

Article 113, third paragraph, point (c)

“Chapter III, Sections 1, 2 and 3, except Article 6(5), apply from: (i) 2 December 2027 for AI systems classified as high-risk under Article 6(2) and Annex III; and (ii) 2 August 2028 for AI systems classified as high-risk under Article 6(1) and Annex I;”

Article 26(1)

“Deployers of high-risk AI systems take appropriate technical and organisational measures to ensure that they use those systems in accordance with the accompanying instructions for use, pursuant to paragraphs 3 and 6.”

Article 26(2)

“Deployers assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.”

Article 27(2), first sentence

“The obligation laid down in paragraph 1 applies to the first use of a high-risk AI system.”

These provisions concern a company using an Annex III system, for example in recruitment or credit scoring, purchased before 2.12.2027. The board can ask management: Has the company's lawyer assessed how Article 111(2) applies to our systems?

Next steps

Seven questions for management and possible board responses are on the page Questions for boards and management. If this topic is relevant to your board and you would like to discuss it, get in touch.

Sources

Questions about this material can be sent to kontakt@maciejstolarski.com.

Disclaimer

Information for members of supervisory boards and management boards. This is not legal advice or a legal opinion and does not replace an assessment of a particular company by its lawyer. Legal status as of October 2026. Sources and verification dates accompany each provision.