Ask your Head of Marketing how many AI tools their team uses. Then ask HR. Then IT. Then compare their answers with what the management board knows.
That gap is your risk – legal, operational and reputational. And since 2 February 2025, that risk has had a name: the AI Act.
Regulation (EU) 2024/1689 on artificial intelligence entered into force on 1 August 2024. Some of its provisions – including the prohibition of certain AI practices and the obligation to ensure AI competence (so-called AI literacy) – have applied since 2 February 2025. The Regulation will become fully applicable, including the requirements for high-risk systems, on 2 August 2026.
For technology companies, SaaS businesses, software houses and organisations implementing AI in HR, marketing or sales, this means one thing: the time to get AI under control within the company is running out.
In this article, you will find a practical assessment of the risks, a map of your obligations and an action plan – from auditing AI tools to implementing a policy and preparing your company for an inspection.
Key terms you need to know
Before we move on to the risks and obligations, let us establish a common language. The AI Act introduces several concepts that directly affect the obligations imposed on your company.
| Term | What it means for your company |
|---|---|
| AI system | A machine-based system designed to operate with varying levels of autonomy that may exhibit adaptiveness after deployment and infers how to generate outputs (predictions, content, recommendations or decisions) from the input it receives. If a tool learns, adapts and generates outputs that influence decisions, it is an AI system within the meaning of the law. |
| Provider | An entity that develops an AI system or has one developed and places it on the market under its own name. Note: simply putting your own logo on a system, modifying how it operates or changing its intended purpose may move your company from the role of user to that of provider, radically expanding its obligations. |
| Deployer | A company that uses an AI system in the course of its professional or business activities. Even if you did not create the AI tool, you are responsible for how you use it. |
| AI literacy | The skills, knowledge and understanding needed to deploy AI systems in an informed manner and to be aware of their capabilities, risks and potential harm. The obligation to ensure AI literacy has applied since 2 February 2025. |
| Shadow AI | AI tools used by employees without the management board’s knowledge or approval – e.g. ChatGPT, Copilot, content generators and data analysis tools. The greatest risk does not come from planned implementations, but from tools that no one has formally approved. |
Shadow AI – the hidden risk affecting every company
Global studies discussed in Polish sources indicate that between 59% and more than 90% of employees use AI tools without their employer’s authorisation. In Poland, an estimated 18% of employees use generative AI at work – more than half of them without their managers’ knowledge.
These are not isolated cases. This is everyday reality: an employee pastes customer data into ChatGPT to prepare a report. The marketing department tests a content generator. HR considers using a CV screening tool. No one has established rules on what data may be entered into external AI tools. The company learns about the incident after the fact.
Why shadow AI is dangerous
- Leakage of personal data and confidential information. Uncontrolled entry of data into external AI tools exposes the company to a GDPR breach (fines of up to EUR 20 million or 4% of turnover) and the loss of trade secrets.
- Inability to justify decisions. If a business decision was made with the involvement of AI and the company does not know which tool was used or what data it relied on, it cannot explain the decision-making process to a customer, employee or supervisory authority.
- Unintentional change of regulatory role. A department that independently customises an AI tool – e.g. modifies a prompt, changes its intended purpose or integrates it with an internal system – may inadvertently move the company from the role of deployer to that of provider under the AI Act. This entails a significantly broader range of obligations.
- Decision-making chaos. Each department implements AI independently, compliance finds out after the fact, and there are no consistent risk assessment criteria.
- Reputational and contractual risk. An enterprise customer sends a questionnaire about the organisation’s rules for using AI. The company does use AI, but has no policy, register or documents to present. A lack of AI governance may result in the loss of the contract.
Who is affected
Shadow AI is not exclusively a problem for large corporations. It affects every company whose employees have access to the internet and digital tools:
| Type of organisation | Typical shadow AI uses | Risk |
|---|---|---|
| Startup / scale-up | ChatGPT for copywriting, Copilot for code, data analysis tools | Customer data leakage, no AI policy during investor due diligence |
| Software house | AI tools for code review, testing and generating documentation | Change of role from deployer to provider, IP risk |
| E-commerce | Marketing automation, personalisation, customer service chatbots | GDPR breach, lack of transparency towards consumers |
| Service company | AI in HR (CV screening), customer scoring, report automation | High-risk systems without a conformity assessment |
Contact us – we will help you assess where to start bringing AI under control in your company.
What already applies – the AI Act timeline
The AI Act does not become applicable all at once. Its provisions are being phased in, and some obligations already apply.
| Date | What takes effect | Status |
|---|---|---|
| 1 August 2024 | The AI Act enters into force | In force |
| 2 February 2025 | Prohibition of certain AI practices (Article 5) + AI literacy obligation (Article 4) | Applicable |
| 2 August 2025 | Obligations concerning general-purpose AI models (GPAI), supervisory authorities, rules for imposing penalties | Applicable |
| 2 August 2026 | The AI Act becomes fully applicable – risk classification, documentation obligations, registration, human oversight, transparency | Upcoming |
| 2 December 2027 | Full application of the provisions on high-risk systems in employment (Annex III, point 4) | Upcoming |
Two obligations require your attention today: prohibited AI practices and AI literacy.
Prohibited AI practices – what your company must eliminate
Since 2 February 2025, eight categories of AI practices have been strictly prohibited. A breach may result in a fine of up to EUR 35 million or 7% of global annual turnover – whichever is higher (Article 99(3) of the AI Act).
The prohibition applies to every operator – provider, deployer, importer and distributor – regardless of where it is established, if the system is placed on the EU market or its outputs are used in the EU.
Eight prohibited practices
| No. | Prohibited practice | Example in a business context |
|---|---|---|
| 1 | Subliminal and deliberately manipulative techniques | A chatbot that pressures vulnerable people; AI-personalised dark patterns |
| 2 | Exploitation of the vulnerabilities of specific groups (age, disability, economic situation) | Microloan systems aggressively targeting people in financial difficulty |
| 3 | Social scoring | A system assessing employees’ “trustworthiness” based on their social media activity |
| 4 | Assessment of the risk of a person committing a criminal offence based solely on profiling | Systems identifying “suspects” based on psychological profiles without any connection to specific events |
| 5 | Untargeted scraping of facial images | Mass collection of photographs from the internet to build a facial recognition database |
| 6 | Emotion recognition in workplaces and educational institutions | Analysis of employees’ facial expressions during video conferences; analysis of tone of voice in a call centre |
| 7 | Biometric categorisation to infer protected characteristics | HR systems inferring employees’ beliefs from their appearance |
| 8 | Real-time remote biometric identification in public spaces (for law enforcement purposes) | Real-time biometric surveillance – narrow exceptions for law enforcement authorities |
What to look out for in your company
Prohibition no. 6 (emotion recognition in the workplace) directly affects employers. It rules out employee monitoring tools that analyse emotions – even if employees have formally given their consent. This includes systems assessing the “emotional” component of performance.
Prohibition no. 3 (social scoring) rules out systems assessing employees’ “loyalty” or “trustworthiness” based on a broad analysis of their activity. Note: credit scoring (assessing creditworthiness in the context of granting credit) is not prohibited – it is classified as a high-risk system.
Check whether your company uses any tools that may serve any of the prohibited purposes – even unintentionally.
AI literacy – an obligation that already applies
Article 4 of the AI Act requires providers and deployers to ensure that their staff and other persons dealing with the operation and use of AI systems have a sufficient level of AI literacy.
This obligation has applied since 2 February 2025.
What this means for your company
- Persons covered. The obligation applies to everyone who designs, implements, operates or monitors AI systems as part of their duties – employees, contractors and subcontractors.
- Subject matter. The European Commission has confirmed that simply providing a supplier’s manuals does not satisfy the requirements of Article 4. Knowledge must actually be imparted, including:
- an understanding of basic AI concepts,
- knowledge of the specific AI systems used within the organisation,
- the ability to identify risks (AI hallucinations, prediction errors, algorithmic bias),
- the ability to interpret and assess AI outputs,
- knowledge of the legal framework: GDPR, copyright law, the AI Act and sector-specific regulations.
- Role-based differentiation. Programmes must be tailored to roles and levels of knowledge – they cannot be a single standardised training course “for everyone”. The European Commission has implemented an internal AI@EC programme with three tracks: for generalists, managers and developers.
- Documentation. Article 4 does not explicitly require knowledge to be measured, but the Commission recommends documenting educational activities (participant records, materials and test results) for inspections and audits.
Relationship with Polish employment law
The amendment to the Labour Code (Article 94¹³) provides that training required by law is mandatory, must be paid for by the employer and, where possible, must take place during working hours. Combined with Article 4 of the AI Act, this means that an employer may issue binding instructions requiring employees to attend AI training.
A lack of AI literacy increases the risk of breaches of the AI Act and GDPR – it may be treated as an aggravating circumstance when a penalty is determined.
High-risk AI systems – where your company may face problems
Annex III to the AI Act lists eight areas in which AI systems are classified as high-risk systems. Two of these are particularly important for technology companies and organisations implementing AI: employment and access to services.
High-risk areas in Annex III
| Area | Examples of AI systems | Full application |
|---|---|---|
| Biometrics | Remote biometric identification, emotion recognition (outside prohibited contexts) | 2 August 2026 |
| Critical infrastructure | AI used to manage energy grids, transport and digital infrastructure | 2 August 2026 |
| Education and vocational training | Systems making decisions on admission to educational institutions or assessing learning outcomes | 2 August 2026 |
| Employment and worker management | Recruitment, CV screening, candidate assessment, performance monitoring, task allocation, promotion or dismissal decisions | 2 December 2027 |
| Access to services | Credit scoring, insurance risk assessment, eligibility assessment for benefits | 2 August 2026 |
| Law enforcement | Predictive analytics, identification of individuals in surveillance footage | 2 August 2026 |
| Migration and border management | Migration risk assessment, asylum decisions | 2 August 2026 |
| Administration of justice | Systems assisting judges, influencing voting behaviour | 2 August 2026 |
AI in HR – a particularly high-risk area
If your company plans to implement AI for CV screening, competence assessment, performance monitoring or task allocation, you are entering the area of high-risk systems.
The obligations of a deployer of a high-risk system (Article 26 of the AI Act) include:
- Using the system in accordance with the provider’s instructions.
- Ensuring human oversight of the system’s operation – including the ability to disregard, override or reverse the AI output and stop the system.
- Monitoring the system’s operation and ensuring that input data is appropriate.
- Reporting serious incidents to the provider and the authorities.
- Informing employees and candidates that a high-risk AI system is being used.
- Carrying out a fundamental rights impact assessment (FRIA) – for public bodies and selected private entities.
Human oversight is a legal requirement, not an option. Article 14 of the AI Act requires high-risk systems to enable a natural person to decide not to use the AI output, intervene in the system’s operation or stop it.
Exemption condition – when an Annex III system is not high-risk
A system listed in Annex III may not be considered high-risk if it does not pose a significant risk of harm and meets at least one of the following conditions: it performs a narrow procedural task, improves the outcome of a previously completed human activity, detects patterns without replacing human assessment, or performs preparatory tasks.
Exception: the exemption does not apply when the system profiles natural persons – in that case, it is always considered a high-risk system.
Financial penalties – a three-tier structure
Article 99 of the AI Act provides for three levels of penalties:
| Tier | Breach | Maximum fine | Percentage of turnover |
|---|---|---|---|
| Highest | Prohibited practices (Article 5) | EUR 35 million | 7% of global annual turnover |
| Middle | Other AI Act requirements (high-risk systems, deployer obligations, GPAI) | EUR 15 million | 3% of global annual turnover |
| Lowest | Providing false or misleading information to authorities | EUR 7,5 million | 1% of global annual turnover |
The higher amount applies – except for SMEs, for which the “whichever is lower” rule applies. Example: an SME with a turnover of EUR 10 million will pay a maximum of EUR 300 thousand (3% of turnover), rather than EUR 15 million, for a breach under Article 99(4).
Criteria for determining the penalty
The authority takes into account, among other things: the nature, gravity and duration of the breach, the extent of harm to natural persons, the operator’s size and annual turnover, the degree of cooperation with the authority, and whether the breach was intentional or negligent. This list is not exhaustive.
Cumulative penalties under the GDPR
A breach of the AI Act may also constitute a breach of the GDPR – penalties may be cumulative. The GDPR provides for fines of up to EUR 20 million or 4% of turnover. The AI Act thresholds are higher. The AI Act does not displace the application of the GDPR.
Supervisory authority in Poland – status as of 2026
Poland did not designate an AI Act market surveillance authority by the statutory deadline (2 August 2025). On 31 March 2026, the Council of Ministers adopted a bill establishing the Artificial Intelligence Development and Security Commission (KRiBSI). Its first reading in the Sejm took place on 29 April 2026.
Until KRiBSI is established, there is no formal authority enforcing the AI Act at national level. This does not mean there is no risk – the provisions of the AI Act apply directly as an EU regulation, and the European Commission retains its powers in relation to GPAI models (Article 101).
The Polish bill provides for an extraordinary penalty reduction mechanism (leniency): a reduction of 20-70% in exchange for cooperation with KRiBSI and remedying the effects of the breach.
Action plan – 5 steps to bring AI under control in your company
Bringing AI under control within an organisation does not have to mean blocking innovation. Well-designed rules make it possible to implement AI faster because the company has clear decision-making criteria and does not have to assess every tool from scratch.
Step 1: map your AI use
Collect information from every department (HR, marketing, sales, IT, customer service, analytics and product) about the AI tools that are being used or tested. Determine:
- Who uses them and for what purpose.
- What data they process – whether it includes personal data, customer data or confidential information.
- Whether the system learns from the data entered and what happens to that data afterwards.
- What decisions the outputs are used for.
These are not questions to put off until later. The answers determine whether you are complying with the GDPR and the AI Act – and whether you are exposing your company to fines, data leakage or loss of customer trust.
Step 2: classify uses under the AI Act
For each identified tool, carry out a four-step assessment:
- Check whether the tool meets the legal definition of an AI system.
- Determine the risk category (prohibited, high, limited or minimal).
- Identify your company’s role – provider or deployer.
- Match the obligations to the role and risk category.
Remember: minimal-risk systems (e.g. automatic meeting summaries, transcriptions, spreadsheet suggestions and sales recommendations) are not subject to compliance obligations. Not everything requires extensive compliance measures.
Step 3: implement an AI policy and an approval model for new tools
Develop clear rules for employees:
- What data may and may not be entered into AI tools.
- When approval must be obtained before using a new tool.
- How to protect personal data and confidential information.
- How to verify AI outputs before using them.
- Who reports a new tool, who assesses the risk (lawyer, DPO, IT, security), and who approves it.
Define an approval process: what information must be collected before implementation, what decision-making criteria apply, and who makes the final decision.
Step 4: launch an AI literacy programme
Provide training tailored to specific roles:
- Management board and managers – responsibility for oversight, legal framework and consequences.
- Operational teams (HR, marketing, sales) – rules for using AI, identifying risks and verifying outputs.
- Technical teams (IT, product, development) – system classification, provider vs. deployer obligations, documentation requirements.
Document educational activities – participant records, materials and test results. This will be needed during an inspection.
Step 5: prepare an AI use register and external communications
- Document every use of AI – assign a process owner, assess the risk, and record decisions and their rationale.
- Prepare a template response to enterprise customer questionnaires concerning AI governance.
- Develop a due diligence section for investors.
- Prepare contractual clauses concerning AI for agreements with customers and suppliers.
- Appoint a person responsible for reviewing the AI register quarterly and updating the policy when new tools are implemented.
How we can help your company
AI does not exist in a regulatory vacuum. It intersects with the GDPR, cybersecurity, intellectual property, trade secrets and contractual liability. Bringing it under control requires combining legal expertise with an understanding of how technology companies operate.
We support founders, CTOs and management boards in bringing AI under control within their organisations – from assessment to implementation:
- AI use mapping and risk classification – we identify the AI tools used within the company, determine the organisation’s role (provider / deployer), and classify uses under the AI Act.
- AI policy and approval model for new tools – we design rules tailored to the company’s operating model, not “standard documents to be filed away”.
- Regulatory cross-mapping – we combine the AI Act analysis with the GDPR (DPIAs for AI uses involving personal data), IP, cybersecurity and trade secrets.
- AI literacy programme – we help design and implement role-based training.
- Documentation for customers and investors – we prepare responses to AI governance questionnaires, due diligence sections and contractual clauses.
- Ongoing support – monitoring regulatory changes, updating policies and assessing new AI tools before implementation.
We do not divide our work into separate areas (contracts, IP, AI, GDPR) – we combine them into a single operating model tailored to your product and your company’s stage of development.
Bring AI under control in your company before the regulator does
The AI Act applies. The prohibition of certain practices and the AI literacy obligation – since 2 February 2025. Full application of the provisions on high-risk systems – from 2 August 2026 (for employment – from 2 December 2027). Fines can reach EUR 35 million or 7% of global turnover.
The greatest risk does not come from planned AI implementations, but from tools that no one has formally approved. Start by mapping AI use, classify the applications, implement a policy and train your team.
If you need support with an AI audit, developing a policy or preparing your company for the requirements of the AI Act – contact us.
Frequently asked questions
If my employees only use ChatGPT and Copilot, is the company subject to the AI Act?
Yes – if the tools are used as part of professional or business activities, the company is a deployer within the meaning of the AI Act. The AI literacy obligation (Article 4) has applied since 2 February 2025 and covers all persons dealing with the operation and use of AI systems. The scope of further obligations depends on what the tools are used for and what data they process.
Where should we start – with an AI use map, a policy or team training?
Start with an AI use map. Without knowing what tools are used, what data they process and what decisions they support, you cannot classify the risks, write a meaningful policy or design role-based training. The map is the starting point for all subsequent activities.
Who in the company should be responsible for AI compliance?
There is no single answer – it depends on the organisation’s structure. The issue requires cooperation between a lawyer, the DPO, IT and the management board. The management board is responsible for oversight. The DPO – for alignment with the GDPR. IT – for technical security. The lawyer – for regulatory classification and documentation. It is worth appointing one person to coordinate the entire process.
What are the consequences for the management board if the company uses AI without a policy or oversight?
Administrative fines under the AI Act can reach EUR 35 million or 7% of turnover for prohibited practices, and EUR 15 million or 3% for other breaches. In addition: the risk of a GDPR breach (fines of up to EUR 20 million / 4% of turnover), liability for data leakage, loss of enterprise contracts and problems during investor due diligence. A lack of AI literacy may be treated as an aggravating circumstance when determining a penalty.
Does AI literacy require formal certified training, or are internal rules sufficient?
Article 4 of the AI Act does not require certification. It requires an appropriate level of competence to be ensured. The European Commission recommends documenting educational activities (participant records, materials and test results) and tailoring the programme to specific roles. Simply providing a supplier’s manuals does not satisfy the requirements – knowledge must actually be imparted.
Which uses of AI in HR are considered high-risk under the AI Act?
Annex III lists: systems for the recruitment or selection of natural persons (placing job advertisements, analysing and filtering applications, evaluating candidates), systems for making decisions affecting working conditions, promotions or termination of contracts, systems for allocating tasks based on individual characteristics, and systems for monitoring or evaluating performance and behaviour. These provisions become fully applicable on 2 December 2027, but it is worth starting preparations earlier.
