From Oct 28, AI fines in Poland are real, and anyone can complain
TL;DR
Poland's AI Act has been in force since Aug 11, 2026. On Oct 28, its enforcement half switches on: inspections, complaints, and fines up to EUR 35 million. Here is what changes, in plain terms.
Table of Contents
Executive Briefing: Poland AI enforcement from Oct 28, 2026
On Oct 28, 2026, Poland's AI regulator gains its enforcement powers. From that date, the Commission for the Development and Security of Artificial Intelligence, known as KRiBSI, can inspect AI systems, take complaints, run enforcement proceedings, and impose fines. The fines run to up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices. This post covers what switches on, what the fines are, who can complain, and how settlement can cut a fine.
One fact frames the whole post. Poland's act does not create the AI rules themselves. The rules come from the EU AI Act. Poland's act supplies the enforcement machinery: the regulator, the inspections, the complaints, the penalties, and the settlement route. The act was adopted July 3, 2026, and most of its provisions applied from Aug 11, 2026. Oct 28 is the date the enforcement provisions become applicable. This post is plain-language information, not legal advice.
What switches on Oct 28
Five enforcement pieces become applicable on Oct 28, 2026: individual opinions, inspections, enforcement proceedings, settlement, and penalties, plus amendments to 10 existing laws that set cooperation duties with KRiBSI. Before Oct 28, the complaint and inspection machinery was not yet live. After Oct 28, it is.
KRiBSI is Poland's AI market-surveillance authority. Its chair appointment was expected in October 2026, with the Commission fully operational from November. That timing matters for readers: Oct 28 is the legal start date for the powers, and the regulator's full operation follows weeks later. A complaint filed on Oct 28 lands in a system that is still staffing up.
The fines, in one table
Figure 1: Three fine tiers, three very different ceilings. The top tier is reserved for prohibited practices.
Say "up to" every time you read this table. These are ceilings, not automatic fines. The actual fine in any case would depend on the breach, and most cases, if any, would land far below the ceiling.
| Breach | Maximum fine |
|---|---|
| Prohibited practices | Up to EUR 35 million or 7% of worldwide annual turnover |
| Other specified infringements | Up to EUR 15 million or 3% of turnover |
| Incorrect or misleading information given to the authority | Up to EUR 7.5 million or 1% of turnover |
Anyone can complain
Figure 2: From Oct 28, the complaint route is open to citizens, businesses, and institutions alike.
From Oct 28, citizens, businesses, and institutions can submit complaints to KRiBSI about an AI system. That is the practical change for ordinary people. Before Oct 28, there was no live complaint route to this regulator. After Oct 28, there is. A complaint does not guarantee an inspection or a fine, but it is the front door to the enforcement system.
Settlement can cut a fine
Poland's act has a formal settlement mechanism. If the conditions are met, a fine can be reduced by 20 to 70%, or by 30 to 90% for voluntary disclosure, with a possible full waiver in exceptional cases. Settlement means giving up the right to appeal the settlement decision. It is not available where the breach caused death, serious injury, serious critical-infrastructure disruption, serious property damage, or serious environmental harm.
The practical read is simple. A company that owns up early and cooperates pays less than one that fights every step. The 30 to 90% band for voluntary disclosure is the widest cut in the act, and it is the reason lawyers will tell clients to come forward before KRiBSI comes to them.
One useful extra: ask first
A company can ask KRiBSI for an individual opinion on a planned AI deployment, with its own legal assessment included. The opinion is binding, and if KRiBSI does not respond within the deadline, the applicant's position is deemed correct. Anonymised opinions will be published, which should slowly build practical guidance for everyone else planning a deployment.
Scope notes, so nothing gets mixed up
This date covers Poland's enforcement only. The EU-wide ban on AI systems that generate non-consensual intimate imagery is a separate rule with its own date, Dec 2, 2026, covered in our deepfake post. And Oct 28 is the date KRiBSI gains its powers, not a date on which fines are scheduled to land. The first fines, if any, will come after inspections and proceedings run their course.
Frequently Asked Questions
Does this affect me if I do not live in Poland?
Only if you sell or deploy AI systems in Poland, or your system is used there. The EU AI Act applies across the EU, but this enforcement date is Poland's.
Can I really complain to KRiBSI?
From Oct 28, yes, the complaint route opens for citizens, businesses, and institutions.
Is EUR 35 million the fine everyone pays?
No. It is the maximum for prohibited practices. Most cases, if any, would be far lower and depend on the breach.
What if a company owns up early?
Voluntary disclosure can cut a fine by 30 to 90% under the settlement mechanism, subject to its conditions.
Where does this sit with the Dec 2 EU ban?
Different track. Dec 2 is the EU ban on AI-generated non-consensual intimate imagery and related material, covered in the deepfake post.
Sources: Digital Policy Alert, on the Oct 28 applicability of the enforcement provisions; Chambers, on Poland's AI law and its fine tiers; mi-code.pl, on what applies from August 2026; Lexology, on the act's settlement and opinion routes. This post is not legal advice.
Was this article helpful?
Comments
Loading comments...