Poland

Is there a specific enacted legislation regulating AI in your jurisdiction?

Besides the EU AI Act, there is no specific national regulation of AI in Poland. 

Is there a proposed legislation regulating AI in your jurisdiction?

Yes: ustawa o systemach sztucznej inteligencji (AI Systems Act) - please see here.

Are there any guidelines/ codes of conduct/ recommendations / reports / policies in connection with AI in your jurisdiction?

No comprehensive guidance documents have been issued yet, but the Polish DPA is stepping up its activity in AI and GDPR and has recently published its position on data protection impact assessments for AI systems (see the answer below for details). 

Any additional relevant news regarding AI / or anticipated future changes (e.g. white papers, policy statements about AI regulation)?

The Polish DPA has just recently published its position on DPIAs (Data Protection Impact Assessments), specifically addressing AI systems (available here in Polish). The position cites a few AI use case where a DPIA is mandatory (e.g., development and deployment of high-risk AI systems). So far, the official DPIA blacklist has not been updated to include these examples.

The Polish DPA is increasingly active on topics regarding the intersection of AI and data protection. Recently, it announced plans to establish a dedicated AI working group and to develop best practices to support entities in bringing AI tools to market (available here in Polish). The outcomes of these initiatives remain to be seen.

In addition to these plans, the Polish DPA has been engaged in several key activities:

• Industry Meetings: Held several meetings with industry representatives to discuss AI-related data protection issues. For example, recent meetings with Microsoft and the AI Coalition for Healthcare (Polish: Koalicja AI w Zdrowiu) focused on the use of personal data in AI training, privacy risks and compliance (sources available here and here in Polish)
  
• Conferences and Seminars: Participated in various conferences and seminars to discuss AI topics.
  
• Legislative Contributions (see the answer below for details).
  
• DeepSeek Case Statements: Issued statements on the DeepSeek case, highlighting the risks posed by AI tools that process massive amounts of data, and is collaborating with other data protection authorities on this case.

In December 2024, the Ministry of Digitization has published a document entitled “Policy for the Development of Artificial Intelligence in Poland 2025-2030,” developed by the Working Group on AI. It presents a vision for AI development in Poland, which is based on four pillars: human capital, innovation, investment and implementation. The document outlines challenges, purposes and benefits of AI regulation and steps to be taken.

The Polish Ministry of Digitalization established a Working Group on Artificial Intelligence to identify measures to ensure that Poland has the right conditions for the development of AI applications in both the private and public sectors, as well as for the conduct of scientific research.

Is AI specifically addressed in IP laws? Are there any guidelines / soft laws relating to AI? 

The Text and Data Mining Exception stipulated in the DSM Directive was implemented in the Polish Copyright Act (Art. 26(3)) 

Is AI specifically addressed in data protection laws? Are there any guidelines / soft laws relating to AI?

No, AI is not specifically addressed in data protection laws in Poland.

However, the Polish DPA is actively involved in the AI Act’s implementation into Polish law. It has provided its comments on the draft legislation and worked with the parliamentary committee for AI and the transparency of algorithms. 

Who are the competent AI supervisory authorities in your jurisdiction? 

Planned (not yet established): Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji  (AI Development and Security Commission).

Are there any publicly known enforcement actions in relation to AI?

Yes, the Polish DPA has launched an official investigation into OpenAI following a complaint concerning ChatGPT. The complainant's requests for rectification and access to their personal data were not fulfilled, and they were not informed about the processing, source, and recipients of their data. The case is ongoing but nearing its conclusion. The Polish DPA had planned to issue a decision in December 2024, but procedural aspects have delayed the proceedings (sources available here and here in Polish). 

Are there any other sector specific laws or guideline / soft laws (e.g. finance, healthcare etc.) where AI is specifically addressed?

N/A

*Information is accurate up to 30 April 2025