Start with an AI inventory
List tools used by employees, systems embedded in products and services bought from suppliers. Record the purpose, users, affected persons, data, outputs and business decisions influenced by each system. Include informal tools adopted without central procurement.
Determine the company’s role
A company may be a provider, deployer, importer or distributor, and its role can differ between systems. Rebranding, substantial modification or changing the intended purpose may affect that classification.
Identify prohibited and high-risk uses
Screen first for prohibited practices and uses that may be high-risk, including certain employment, education, essential-service and biometric applications. Do not infer the category from the technology name alone; context and intended purpose matter.
Check transparency duties
Some systems require people to be informed that they are interacting with AI or that content has been artificially generated or manipulated. The notice and process should fit the actual interface and audience.
Organise AI literacy
People selecting, configuring and using AI need training appropriate to their role and the risks of the use case. A generic presentation is not a substitute for operational guidance on data, verification and escalation.
Review contracts and supplier information
Confirm intended use, documentation, performance limitations, security, incident support, audit cooperation, data rights, subcontractors and exit arrangements. Marketing claims should not replace the evidence needed for compliance.
Data, copyright and confidentiality
How the issue appears in practice
Hypothetical example: one tool, two risk profiles
A company uses the same model to draft product descriptions and to rank job candidates. Treating both uses under one generic policy misses the different affected persons, risks and control requirements.
Human oversight and output verification
Define who reviews outputs, when an automated recommendation may be rejected, which decisions require escalation and how material errors are recorded. Oversight must be practical rather than a clause no one can follow.
Documentation and governance
Assign an owner to each material use case, preserve supplier documents and key decisions, and integrate AI into procurement, security, privacy and incident processes.
Build a timetable
Different duties apply on different dates. Maintain a system-level implementation plan and reassess classification when the tool, purpose or law changes.
Focus on the use case, not the label
The same general-purpose model may create low risk when drafting product copy and materially greater risk when screening job applicants. Each use requires its own assessment.
Legal basis
- Polish Civil Code of 23 April 1964
- Polish Consumer Rights Act of 30 May 2014
- Regulation (EU) 2024/1689 (AI Act)
- Polish Entrepreneurs' Law of 6 March 2018
- Polish Act of 6 March 2018 on participation of foreign entrepreneurs and other foreign persons in economic activity in Poland
This article provides general information and does not constitute legal advice for a specific matter. The appropriate solution depends on the facts, documents and business objective.
Summary
A useful AI Act programme is built around a system inventory, role and risk classification, trained users, controlled procurement and documented oversight. It should sit alongside GDPR, IP and security compliance.