Poland’s AI enforcement powers need an evidence-intake operating map

The final commencement step

Poland’s official ELI record for the Act on Artificial Intelligence Systems shows a staged commencement. Most provisions entered into force on 11 August 2026, while articles 8–18 and chapters 3–5, 8 and 9 became effective on 28 October. Those later provisions include core supervisory and procedural machinery, including inspections, infringement proceedings and financial penalties.

The act creates the Commission for the Development and Safety of Artificial Intelligence, or KRiBSI, as a market-surveillance body within the national implementation of the EU AI Act. The chair had already been appointed in September. The new effective date is therefore not the birth of the whole regime and not proof of an enforcement action; it is the point at which specified operational powers and procedures become legally available.

An independent Polish cyber-governance analysis similarly identifies 28 October as the last commencement step and highlights controls, proceedings and penalties. The analysis is useful orientation but is not legal advice, and the statute remains the source of truth.

Replace the compliance folder with an intake route

A generic folder labelled “AI Act” is unlikely to answer a regulator’s first operational questions. Evidence is distributed across procurement, product, security, privacy, human resources, quality, legal and service teams. A model inventory may name the system without showing who approved the use case, which provider version was tested, what inputs are permitted or how an incident was handled.

Create one evidence-intake map per system. It should identify provider and deployer roles; intended purpose; applicable risk classification; technical documentation; data and logging boundaries; human-oversight design; accuracy, robustness and cybersecurity testing; incident and complaint records; conformity evidence; and the person authorised to respond. Mark which items the organisation owns and which depend on a supplier.

Rehearse the first request

Run a tabletop exercise using a narrow, plausible request: identify the responsible legal entity, preserve the current model and configuration, export the relevant logs, produce the approval record and explain the human-review path. Time the handoffs. If the response depends on a single employee, an expired vendor link or undocumented interpretation, the gap is operational even before its legal consequence is assessed.

Keep legal conclusions separate from factual evidence. The intake team can preserve records and describe controls without deciding whether a violation occurred. Escalate privilege, notification, employee relations and cross-border issues to qualified counsel. Do not retrospectively edit logs or create a policy document that was not in force at the time of the event.

Map sandboxes and support too

The Polish framework is not only punitive. The commission also has innovation-support and regulatory-sandbox functions. Route sandbox requests, individual opinions and education needs through the same system inventory so experimentation and enforcement do not use incompatible descriptions of purpose, data or ownership.

The effective date does not mean every EU AI Act obligation has the same application date. High-risk obligations and sector rules follow the EU timetable and system-specific law. Organisations should therefore maintain a dated applicability view instead of copying one national commencement date across every control.

Assign a custodian to that dated view and require every material system change to reopen it. A new provider, purpose, data source or human-review design can alter the evidence route even when the statutory calendar is unchanged. This is a change-control obligation, not a one-off launch checklist.

Decision rule

Do not mark a Polish AI system “enforcement ready” because a policy and model list exist. Require a timed evidence-retrieval exercise with named owners, preserved version identifiers and a counsel escalation path. If the team cannot assemble a bounded case record without altering source evidence, treat that as a control gap. This converts the evidence-pack principle in the SEC examination priority into a system-level intake practice for Poland’s new supervisory powers.