{"id":3493,"date":"2026-10-06T13:07:12","date_gmt":"2026-10-06T13:07:12","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3493"},"modified":"2026-10-06T13:07:34","modified_gmt":"2026-10-06T13:07:34","slug":"compliance-growing-tech-company-poland","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/compliance-growing-tech-company-poland\/","title":{"rendered":"Compliance for a Growing Technology Company in Poland: From Scattered Policies to a Working System"},"content":{"rendered":"

Imagine this situation: during due diligence, an investor asks about the AI policy, the whistleblowing procedure, and the data processing map. The CTO looks at the COO, the COO looks at HR, and HR says, \u201cI think legal has that." No one has the full picture. This is not an exception \u2014 this is what compliance looks like at most growing technology companies. And this is exactly when the transaction starts to get complicated.<\/p>\n

If your company employs 50\u2013200 people, processes customer data, uses AI tools, and is planning a funding round, you are now subject to at least a dozen overlapping regulatory regimes. GDPR, the Whistleblower Protection Act, the AI Act, the amendment to the National Cybersecurity System Act (NIS2), employment law, and industry-specific regulations. Each of these areas has different deadlines, different supervisory authorities, and different penalties.<\/p>\n

In this article, I will show you how to move from fragmented, reactive compliance to a structured system \u2014 with a map of obligations, priorities, and owners. Without legal jargon. With specific steps.<\/p>\n

Key terms to know before reading<\/h2>\n

Before we continue, I will explain a few terms that will appear throughout the article. Each of them has a direct impact on your company\u2019s obligations.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nWhat it means for your company<\/th>\n<\/tr>\n<\/thead>\n
Compliance<\/strong><\/td>\nA set of measures ensuring that the company operates in accordance with applicable laws \u2014 not only that it has the relevant documents, but that it actually follows them<\/td>\n<\/tr>\n
Accountability<\/strong><\/td>\nThe principle under Article 5(2) GDPR \u2014 you must not only comply with the law but also be able to prove it (e.g. during an inspection by the Polish Data Protection Authority, UODO)<\/td>\n<\/tr>\n
Data controller<\/strong><\/td>\nThe entity that determines the purposes and means of processing personal data \u2014 at a technology company, this is usually the company itself<\/td>\n<\/tr>\n
AI literacy<\/strong><\/td>\nAn obligation under Article 4 of the AI Act \u2014 providers and deployers of AI systems must ensure that their employees have an appropriate level of AI literacy<\/td>\n<\/tr>\n
AI deployer<\/strong><\/td>\nA company that uses an AI system in its operations \u2014 it has fewer obligations than a provider, but must ensure human oversight, input data quality, and employee notification<\/td>\n<\/tr>\n
Due diligence<\/strong><\/td>\nA legal and financial review of a company conducted before an investment or acquisition \u2014 increasingly, it includes a comprehensive compliance review<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Regulatory map for your technology company in 2026<\/h2>\n

Let us start with the rules that actually apply. Below is an overview of the regulations that typically apply to a technology or SaaS company operating in Poland.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Regulation<\/th>\nStatus<\/th>\nSupervisory authority<\/th>\nMaximum penalties<\/th>\n<\/tr>\n<\/thead>\n
GDPR (Regulation 2016\/679)<\/td>\nApplicable since 2018<\/td>\nUODO<\/td>\nUp to EUR 20 million or 4% of global turnover<\/td>\n<\/tr>\n
Whistleblower Protection Act (of 14 June 2024)<\/td>\nApplicable since 25 September 2024<\/td>\nPublic prosecutors, courts<\/td>\nA fine for failing to establish a procedure; up to 2 years\u2019 imprisonment for retaliation<\/td>\n<\/tr>\n
AI Act (Regulation 2024\/1689)<\/td>\nPhased entry into force from 1 August 2024<\/td>\nNational authorities (currently being designated)<\/td>\nUp to EUR 35 million or 7% of global turnover<\/td>\n<\/tr>\n
Amendment to the National Cybersecurity System Act (NIS2)<\/td>\nApplicable since 3 April 2026<\/td>\nCompetent cybersecurity authorities<\/td>\nUp to EUR 10 million or 2% of turnover; up to PLN 100 million (extraordinary penalty)<\/td>\n<\/tr>\n
Labour Code (occupational health and safety, working time, and employment rules)<\/td>\nApplicable<\/td>\nPIP<\/td>\nFixed penalties, fines, and wage payment orders<\/td>\n<\/tr>\n
DSA (Regulation 2022\/2065)<\/td>\nApplicable since 17 February 2024<\/td>\nDigital Services Coordinator<\/td>\nUp to 6% of annual worldwide turnover<\/td>\n<\/tr>\n
Data Act (Regulation 2023\/2854)<\/td>\nPhased application from 12 September 2025<\/td>\nNational authorities<\/td>\nDetermined at national level<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

This is not an exhaustive list \u2014 depending on the industry, DORA (financial sector), MiCA (crypto-assets), CRA (products with digital elements), and CSRD (ESG reporting)<\/a> may also apply. But even the seven regulations listed above create dozens of separate obligations, deadlines, and documentation requirements.<\/p>\n

AI Act timeline \u2014 what already applies and what takes effect in the coming months<\/h3>\n

The AI Act deserves a separate discussion because its obligations are being phased in, and many technology companies are not keeping track of these dates.<\/p>\n\n\n\n\n\n\n\n\n\n
Date<\/th>\nWhat takes effect<\/th>\n<\/tr>\n<\/thead>\n
2 February 2025<\/td>\nProhibitions on unacceptable-risk practices (Article 5) \u2014 including emotion recognition in the workplace and social scoring. AI literacy obligation (Article 4)<\/td>\n<\/tr>\n
2 August 2025<\/td>\nObligations for general-purpose AI models (Chapter V)<\/td>\n<\/tr>\n
2 August 2026<\/td>\nFull application as a general rule + transparency obligations (Article 50) \u2014 labelling AI-generated content and informing people that they are interacting with an AI system<\/td>\n<\/tr>\n
2 December 2027<\/td>\nObligations for stand-alone high-risk AI systems<\/a> (Annex III)<\/td>\n<\/tr>\n
2 August 2028<\/td>\nObligations for AI systems embedded in products (Annex I)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

If your company uses AI tools in HR (e.g. CV screening), marketing (personalisation), or sales (chatbots, recommendations), the AI literacy obligation already applies. So do the prohibitions under Article 5. Check whether your tools violate the prohibitions on emotion recognition or subliminal manipulation.<\/p>\n

Moreover, a company may unknowingly shift from the role of an AI deployer<\/a> to that of a provider \u2014 for example, by putting its own logo on a system, making a substantial modification to the algorithm, or changing its intended purpose. This radically increases the scope of its obligations: from human oversight and log retention to a comprehensive risk management system, technical documentation, and a conformity assessment before the system is placed on the market.<\/p>\n

NIS2 in Poland \u2014 deadlines already running<\/h3>\n

The amendment to the National Cybersecurity System Act<\/a> entered into force on 3 April 2026<\/strong> \u2014 later than the EU deadline (18 October 2024). The European Commission sent Poland a reasoned opinion on 7 May 2025.<\/p>\n\n\n\n\n\n\n\n\n
Deadline<\/th>\nObligation<\/th>\n<\/tr>\n<\/thead>\n
By 6 May 2026<\/td>\nEx officio registration of essential and important entities<\/td>\n<\/tr>\n
7 May \u2013 3 October 2026<\/td>\nSelf-registration of entities in the register<\/td>\n<\/tr>\n
By 3 April 2027<\/td>\nImplementation of cybersecurity risk management measures<\/td>\n<\/tr>\n
By 3 April 2028<\/td>\nFirst audit of essential entities + full penalty regime<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Penalties: up to EUR 10 million or 2% of turnover for essential entities; up to EUR 7 million or 1.4% of turnover for important entities. Extraordinary penalty \u2014 up to PLN 100 million. Personal liability of the entity\u2019s manager: up to 600% of their monthly remuneration<\/strong>.<\/p>\n

Contact us<\/a> \u2014 we will help determine whether your company is an essential or important entity under NIS2 and plan the implementation.<\/p>\n

Why compliance breaks down at growing companies \u2014 and the risks this creates<\/h2>\n

Each department sees only its own piece of the puzzle<\/h3>\n

HR knows its employment law obligations. IT knows about security controls. Legal knows about contracts. But no one combines this information into a single map. No one knows whether the whistleblowing procedure is consistent with the GDPR policy. No one checks whether the contract with an AI provider addresses the obligations under the AI Act.<\/p>\n

This is not a lack-of-knowledge problem. It is a lack-of-coordination problem.<\/p>\n

The documents exist, but no one follows them<\/h3>\n

Many companies have privacy policies, internal rules, and confidentiality statements. But regulators \u2014 UODO, PIP, and cybersecurity authorities \u2014 do not ask, \u201cDo you have a document?" They ask, \u201cDo you follow it, and can you prove it?"<\/p>\n

The accountability principle<\/a> under Article 5(2) GDPR means that your company must demonstrate compliance \u2014 the authority does not have to prove the infringement. Personal data confidentiality statements should be signed before employees begin working with data, kept in personnel records, and monitored by the organisation for compliance. During a UODO inspection, these documents may serve as evidence of compliance \u2014 but only if they are actually used in practice.<\/p>\n

The same applies to a password policy: it must be formally approved, technically implemented by IT, monitored through audits, and updated. Responsibility for enforcing it is spread across IT, managers, the DPO, and the management board. One compliance component \u2014 four departments that must work together.<\/p>\n

Inspection statistics \u2014 how many companies are affected<\/h3>\n

Data for 2024 shows the scale of supervisory authorities\u2019 activity:<\/p>\n\n\n\n\n\n\n
Authority<\/th>\nInspections \/ decisions in 2024<\/th>\nFinancial penalties<\/th>\n<\/tr>\n<\/thead>\n
UODO<\/td>\n8,056 complaints, 14,842 data breach notifications, 1,719 administrative decisions, 22 penalty decisions<\/td>\nMcDonald’s Polska: PLN 16.9 million; ING Bank \u015al\u0105ski: PLN 18.4 million; Morele.net: PLN 3.8 million<\/td>\n<\/tr>\n
PIP<\/td>\n61,900 inspections at 49,800 entities, 6,000 wage payment orders totalling PLN 214 million<\/td>\nPLN 23.3 million in fixed penalties (up 5.4% year on year); 15,900 employers penalised<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

In its sectoral inspection plan for 2024, UODO identified, among others, entities processing data using online web applications<\/strong> \u2014 this directly affects SaaS and e-commerce companies. Inspections of marketing entities and online delivery platforms are planned for 2026.<\/p>\n

PIP conducted inspections<\/a> at entities employing a total of approximately 3.8 million people. The most common infringements were failure to keep working time records or keeping unreliable records (almost half of the entities examined), failure to record overtime, and violations of the right to daily and weekly rest.<\/p>\n

Personal liability of the management board \u2014 this is not theoretical<\/h3>\n

The absence of a compliance system creates risks not only for the company but also personally for its management board members.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Legal basis<\/th>\nScope of liability<\/th>\n<\/tr>\n<\/thead>\n
Articles 293 and 483 of the Commercial Companies Code<\/td>\nCivil liability of a management board member for damage caused to the company by an act or omission contrary to the law or the company\u2019s articles of association<\/td>\n<\/tr>\n
2022 amendment to the Commercial Companies Code<\/td>\nThe supervisory board is required to assess compliance systems; the business judgment rule protects decisions made within the bounds of justified risk, but it does not protect the absence of a system<\/td>\n<\/tr>\n
Article 107 of the Personal Data Protection Act<\/td>\nCriminal liability for unlawful data processing: up to 2 years\u2019 imprisonment; for special-category data \u2014 up to 3 years<\/td>\n<\/tr>\n
Article 108 of the Personal Data Protection Act<\/td>\nObstructing a UODO inspection: up to 2 years\u2019 imprisonment<\/td>\n<\/tr>\n
Article 58 of the Whistleblower Protection Act<\/td>\nA fine for failing to establish an internal reporting procedure or for establishing one in material breach of the requirements<\/td>\n<\/tr>\n
Article 220 of the Criminal Code<\/td>\nCriminal liability for violating occupational health and safety regulations<\/td>\n<\/tr>\n
Article 296 of the Criminal Code<\/td>\nBreach of trust in business dealings<\/td>\n<\/tr>\n
Amendment to the National Cybersecurity System Act (NIS2)<\/td>\nPersonal liability of the manager: up to 600% of their monthly remuneration<\/td>\n<\/tr>\n
Article 116 of the Tax Ordinance Act<\/td>\nLiability of a management board member for the company\u2019s tax arrears<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The 2022 amendment to the Commercial Companies Code introduced the business judgment rule \u2014 but this rule protects decisions made within the bounds of justified business risk. It does not protect a situation in which the management board has failed to implement any compliance oversight system at all. The absence of compliance may constitute an independent basis for liability.<\/p>\n

What compliance costs \u2014 and what non-compliance costs<\/h2>\n

A comparison of the cost of building a compliance system with the cost of non-compliance over a 5-year period:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Category<\/th>\nOption A: compliance system<\/th>\nOption B: no system<\/th>\n<\/tr>\n<\/thead>\n
Personnel costs (compliance officer + support)<\/td>\n~PLN 270,000\/year<\/td>\nPLN 0 (until an incident occurs)<\/td>\n<\/tr>\n
Employee training<\/td>\n~PLN 80,000\/year<\/td>\nPLN 0<\/td>\n<\/tr>\n
IT tools and systems<\/td>\n~PLN 70,000\/year<\/td>\nPLN 0<\/td>\n<\/tr>\n
Audits and reviews<\/td>\n~PLN 30,000\/year<\/td>\nPLN 0<\/td>\n<\/tr>\n
Total (5 years)<\/strong><\/td>\n~PLN 2.25 million<\/strong><\/td>\nPLN 0<\/strong><\/td>\n<\/tr>\n
GDPR fine (single incident)<\/td>\nRisk minimised<\/td>\nUp to EUR 20 million or 4% of turnover<\/td>\n<\/tr>\n
Post-incident remediation costs<\/td>\nMinimal<\/td>\nPLN 2.5\u20133 million (fine + remediation + claims)<\/td>\n<\/tr>\n
Lost investment transaction<\/td>\nRisk minimised<\/td>\nImpossible to estimate \u2014 but it happens<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The median monthly salary of a compliance officer in Poland is PLN 10,650 gross. The total annual cost of employment (including employer contributions) is approximately PLN 170,000\u2013190,000. This is a fraction of what a company may have to pay for a single GDPR infringement.<\/p>\n

The total value of UODO fines imposed on the private sector in one recent year exceeded PLN 64 million \u2014 up from approximately PLN 13 million the previous year and approximately PLN 1 million two years earlier. The trend is clear.<\/p>\n

How to move from firefighting to a system \u2014 4 steps<\/h2>\n

Step 1: inventory your regulatory obligations<\/h3>\n

Bring together information from HR, IT, legal, administration, and operations. Document:<\/p>\n

    \n
  1. Who is currently responsible for what in the area of compliance<\/li>\n
  2. The relevant legal basis (GDPR, employment law, the Whistleblower Protection Act, the AI Act, NIS2)<\/li>\n
  3. What documents and procedures exist \u2014 and where they are physically stored<\/li>\n
  4. Which obligations have an assigned owner and which are \u201cfalling through the cracks"<\/li>\n<\/ol>\n

    The goal is not a perfect legal analysis. The goal is to obtain a complete picture \u2014 even if imperfect \u2014 of what the company is and is not doing.<\/p>\n

    Step 2: prioritised risk map<\/h3>\n

    Based on the inventory, assign each obligation to one of three categories:<\/p>\n\n\n\n\n\n\n\n
    Priority<\/th>\nDescription<\/th>\nExamples<\/th>\n<\/tr>\n<\/thead>\n
    Critical<\/td>\nAn infringement may result in a financial or criminal penalty or block a transaction<\/td>\nNo whistleblowing procedure (Article 58 of the Whistleblower Protection Act); failure to report a GDPR breach within 72 hours (Article 33 GDPR); violation of AI Act prohibitions<\/td>\n<\/tr>\n
    Important<\/td>\nRisk of an administrative penalty or issues during due diligence<\/td>\nOutdated GDPR documentation; no AI literacy policy; incomplete working time records<\/td>\n<\/tr>\n
    Forward-looking<\/td>\nAn obligation that takes effect in the future or applies to the company conditionally<\/td>\nNIS2 obligations (if the company is not yet an essential\/important entity); CRA; CSRD<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Assign an owner within the organisation and an implementation deadline to each obligation. It does not have to be a lawyer \u2014 it may be the HR Manager, CTO, or COO. What matters is that one person knows the issue is \u201ctheirs".<\/p>\n

    Step 3: review existing procedures \u2014 what works and what is dead<\/h3>\n

    Review all compliance documents by asking three questions:<\/p>\n

      \n
    1. Is the document up to date?<\/strong> \u2014 a GDPR policy from 2019 may not reflect changes in UODO case law, new IT tools, or changes in the company\u2019s structure<\/li>\n
    2. Does anyone follow it?<\/strong> \u2014 if employees do not know that a procedure exists, it is not a procedure \u2014 it is a file on a drive<\/li>\n
    3. Does it reflect the actual business model?<\/strong> \u2014 a procedure written for a 20-person company will not work at a 150-person company with three offices<\/li>\n<\/ol>\n

      Identify documents that are dead (no one follows them), duplicated (two departments have their own versions), outdated (they do not account for new regulations), or missing (e.g. no data breach response procedure or AI use policy).<\/p>\n

      Step 4: coordination and periodic review<\/h3>\n

      Designate one person or team to coordinate compliance across the organisation. Even if it is only a part-time role, someone must have the authority to bring together information from different departments.<\/p>\n

      Prepare a simple compliance dashboard for the management board:<\/p>\n

        \n
      1. Status of obligations (green \/ amber \/ red)<\/li>\n
      2. Open risks with assigned owners<\/li>\n
      3. Planned actions with deadlines<\/li>\n
      4. Regulatory changes that may affect the company in the next quarter<\/li>\n<\/ol>\n

        Update it quarterly. Schedule a recurring compliance review in the management board\u2019s calendar \u2014 at least once every six months.<\/p>\n

        Preparing for an inspection and due diligence \u2014 what to have ready in advance<\/h2>\n

        Both a UODO or PIP inspection and investor due diligence may arise at short notice. The company should have a document pack ready that can be provided within 48 hours of a request.<\/p>\n\n\n\n\n\n\n\n\n\n\n
        Area<\/th>\nWhat should be ready<\/th>\n<\/tr>\n<\/thead>\n
        GDPR<\/td>\nRecord of processing activities, privacy policy, data processing agreements<\/a>, data breach response procedure, confidentiality statements, DPIA results (if required)<\/td>\n<\/tr>\n
        Whistleblowing<\/td>\nInternal reporting procedure, report register, evidence that the procedure was communicated to employees<\/td>\n<\/tr>\n
        Employment law<\/td>\nWorking time records, personnel records, workplace regulations, contracts (employment, B2B), occupational health and safety documentation<\/td>\n<\/tr>\n
        AI<\/td>\nList of AI tools used in the organisation, risk assessment, AI literacy policy, AI system logs (at least 6 months)<\/td>\n<\/tr>\n
        Cybersecurity<\/td>\nInformation security policy, incident response procedure, audit results, business continuity plan<\/td>\n<\/tr>\n
        Contracts<\/td>\nContract templates for business partners, contract register, contractual risk analysis<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        Contractual risk management \u2014 particularly in IT contracts \u2014 should be integrated with the compliance system. Decisions on liability caps, exclusions, and financial safeguards should be based on risk analysis, and material deviations from contracting standards should be formally approved at management level.<\/p>\n

        We can help you with this<\/h2>\n

        Building a compliance system at a growing technology company requires expertise across several areas of law \u2014 GDPR, employment law, AI, cybersecurity, contract law, and corporate law. We do not divide these into separate projects. We combine them into a single operating model tailored to your organisation\u2019s structure, scale, and pace of growth.<\/p>\n

        Our support includes:<\/p>\n

          \n
        1. Inventory of obligations<\/strong> \u2014 we gather information from all departments and create a complete map of the regulations that apply to your company<\/li>\n
        2. Prioritised risk map<\/strong> \u2014 we identify what is critical, important, and forward-looking, and assign owners and deadlines<\/li>\n
        3. Document review and updates<\/strong> \u2014 we identify gaps, eliminate dead procedures, and prepare missing documents<\/li>\n
        4. Preparation for inspections and due diligence<\/strong> \u2014 we build a document pack that can be provided within 48 hours<\/li>\n
        5. Training for the management board and team<\/strong> \u2014 not on the legislation itself, but on practical obligations: what you must do, what you must not do, and whom to contact<\/li>\n
        6. Ongoing monitoring<\/strong> \u2014 we inform you about regulatory changes and update the map of obligations<\/li>\n<\/ol>\n

          We do not create documents \u201cjust in case." We design rules where risks actually arise \u2014 and tailor them to how your company operates day to day.<\/p>\n

          Compliance does not have to slow your company down \u2014 a lack of compliance does<\/h2>\n

          A growing technology company faces an increasing number of regulatory obligations. GDPR, whistleblowing, the AI Act, NIS2, employment law \u2014 each of these regulations imposes separate requirements and has different deadlines and penalties. Without a single system, the management board loses control of risks that may jeopardise an investment, a contract, or the company\u2019s reputation.<\/p>\n

          Moving from firefighting to a system requires four things: an inventory of obligations, a prioritised risk map, a review of existing procedures, and the appointment of a coordinator authorised to bring together information from different departments.<\/p>\n

          If you want to establish where your company stands on compliance today and what should be put in order first \u2014 contact us<\/a>. We will have a no-obligation conversation, without legal jargon, and end with specific conclusions.<\/p>\n

          Frequently asked questions<\/h2>\n

          What compliance obligations apply to my technology company, and how can I find out?<\/strong><\/p>\n

          The scope of your obligations depends on several factors: the number of employees (the threshold of 50 people under the Whistleblower Protection Act), the type of data processed (GDPR), the use of AI (AI Act), whether you operate in a sector covered by NIS2, and your sales model (DSA, Data Act). There is no single register that will display a list of your obligations \u2014 that is why the first step is an inventory carried out with the involvement of all departments: HR, IT, legal, and operations. This provides the basis for a map of obligations with assigned owners and deadlines.<\/p>\n

          As a CEO or founder, can I be held personally liable for compliance gaps?<\/strong><\/p>\n

          Yes. Articles 293 and 483 of the Commercial Companies Code provide for the civil liability of a management board member for damage caused to the company. Article 107 of the Personal Data Protection Act makes unlawful data processing punishable by up to 2 years\u2019 imprisonment. Article 58 of the Whistleblower Protection Act provides for a fine if no reporting procedure has been established. The amendment to the National Cybersecurity System Act (NIS2) introduces personal liability of the manager of up to 600% of their monthly remuneration. The business judgment rule introduced by the 2022 amendment to the Commercial Companies Code protects decisions made within the bounds of justified risk \u2014 but it does not protect the absence of an oversight system.<\/p>\n

          Where should I start organising compliance if the company has grown quickly and no one has been managing it?<\/strong><\/p>\n

          Start with an inventory. Gather information from every department: who is responsible for what, what documents exist, where they are stored, and whether anyone follows them. Then create a risk map with three priorities (critical, important, and forward-looking) and assign owners. Do not try to fix everything at once \u2014 start with obligations whose violation may result in a financial or criminal penalty (no whistleblowing procedure, failure to report a GDPR breach within 72 hours, violation of AI Act prohibitions).<\/p>\n

          How can I reconcile AI implementation with regulatory obligations?<\/strong><\/p>\n

          Start by mapping where AI tools are used in the organisation \u2014 HR, marketing, sales, and customer service. Check what data they process and who is responsible for compliance with the AI Act and GDPR. The AI literacy obligation (Article 4 of the AI Act) has applied since 2 February 2025 \u2014 your employees must have the appropriate competencies. The prohibitions under Article 5 (e.g. emotion recognition in the workplace) also already apply. An AI deployer is required to retain logs for at least 6 months and inform employees about the use of AI. Be aware of the risk of a change in role \u2014 if you modify the algorithm or put your own logo on the system, you may become a provider under the AI Act, which radically increases the scope of your obligations.<\/p>\n

          Do I need a dedicated compliance officer?<\/strong><\/p>\n

          There is no statutory obligation for a technology company to employ a compliance officer (unlike, for example, a DPO required under GDPR<\/a> in certain cases). But someone in the organisation must coordinate information from different departments and report to the management board. This may be a part-time role \u2014 for example, the COO, Head of Operations, or an external adviser. What matters is that this person has the authority to gather information from HR, IT, legal, and operations and has access to the management board.<\/p>\n

          What does an investor review during compliance due diligence?<\/strong><\/p>\n

          Increasingly, due diligence includes a comprehensive compliance review, not just finances and intellectual property. Typical areas include GDPR documentation (record of processing activities, data processing agreements, data breach response procedure), employment status (risk of B2B contracts being reclassified), the whistleblowing procedure, the AI use policy, regulatory licences and permits, and contracts with business partners. A company should have a document pack ready that can be provided within 48 hours of an investor\u2019s request \u2014 the absence of such a pack is itself a red flag.<\/p>\n","protected":false},"excerpt":{"rendered":"

          Learn how to map GDPR, AI Act, NIS2 and other obligations, assign owners, review procedures and prepare your Polish tech company for due diligence.<\/p>\n","protected":false},"author":13,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"6614c9fb-997f-487d-b589-347e0932477a","sip_pair_state":"verified"},"categories":[1],"tags":[1545,1446,1540,1546,1532],"specialization":[1207],"practice_area":[],"class_list":["post-3493","post","type-post","status-publish","format-standard","hentry","category-bez-kategorii","tag-ai-act-en","tag-gdpr","tag-internal-procedure","tag-risk-assessment","tag-whistleblowers","specialization-compliance"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3493","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=3493"}],"version-history":[{"count":2,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3493\/revisions"}],"predecessor-version":[{"id":3496,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3493\/revisions\/3496"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=3493"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=3493"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=3493"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=3493"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=3493"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}