{"id":2733,"date":"2026-10-06T13:07:05","date_gmt":"2026-10-06T13:07:05","guid":{"rendered":"https:\/\/sawaryn.com\/us\/?p=2733"},"modified":"2026-10-06T13:07:24","modified_gmt":"2026-10-06T13:07:24","slug":"poland-tech-company-compliance-system","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/us\/poland-tech-company-compliance-system\/","title":{"rendered":"Compliance for a Growing Technology Company in Poland: From Scattered Policies to a Working System"},"content":{"rendered":"

Compliance for a Growing Technology Company in Poland: From Scattered Policies to a Working System<\/h1>\n

An investor reviewing a Polish technology company asks for its AI policy, whistleblowing procedure, and map of personal data processing. The CTO looks to the COO, the COO asks HR, and HR assumes legal has the answer. Each team holds part of the picture, but no one can assemble it quickly. That is when due diligence becomes harder than it needs to be.<\/p>\n

For a company with 50\u2013200 people that processes customer data, uses AI tools, and is planning an investment round, compliance can involve numerous overlapping requirements. GDPR, Poland\u2019s Whistleblower Protection Act, the EU AI Act, Poland\u2019s amended National Cybersecurity System Act implementing NIS2, employment law, and sector-specific rules each bring different obligations, deadlines, authorities, and sanctions. Which rules apply depends on the company\u2019s activities and circumstances.<\/p>\n

The practical goal is not a larger folder of policies. It is a system that shows what the company must do, who owns each task, whether the procedure works, and how the company can demonstrate that it works.<\/p>\n

Key terms for readers outside Poland<\/h2>\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nWhat it means in practice<\/th>\n<\/tr>\n<\/thead>\n
Compliance<\/strong><\/td>\nMeasures that help a company operate in accordance with applicable rules\u2014not merely maintain documents, but follow them.<\/td>\n<\/tr>\n
Accountability<\/strong><\/td>\nUnder Article 5(2) GDPR, a company must be able to demonstrate its compliance with data protection principles, including during an inspection by Poland\u2019s data protection authority.<\/td>\n<\/tr>\n
Data controller<\/strong><\/td>\nThe entity that determines the purposes and means of processing personal data. In a technology business, this is often the company itself.<\/td>\n<\/tr>\n
AI literacy<\/strong><\/td>\nArticle 4 of the AI Act requires AI system providers and deployers to ensure an appropriate level of AI literacy among relevant personnel.<\/td>\n<\/tr>\n
AI deployer<\/strong><\/td>\nAn organization using an AI system in its operations. Its obligations differ from those of a provider and include requirements concerning oversight, input data, and information to affected people.<\/td>\n<\/tr>\n
Due diligence<\/strong><\/td>\nA legal and financial review before an investment or acquisition. Investors increasingly examine operational compliance as part of that review.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Two Polish institutions recur below: UODO<\/strong> is Poland\u2019s personal data protection authority, and PIP<\/strong> is its labor inspectorate. A Polish company\u2019s management board<\/strong> is the corporate body responsible for managing the company; it should not be confused with a supervisory board, which has a separate oversight role.<\/p>\n

The regulatory map for a technology company operating in Poland in 2026<\/h2>\n

The following is an overview of rules relevant to a typical technology or SaaS business operating in Poland. It is not a determination that every rule applies to every company.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Regulation<\/th>\nStatus stated in the approved source<\/th>\nAuthority<\/th>\nMaximum sanctions stated in the approved source<\/th>\n<\/tr>\n<\/thead>\n
GDPR<\/strong> (Regulation 2016\/679)<\/td>\nApplicable since 2018<\/td>\nUODO<\/td>\nUp to EUR 20 million or 4% of global turnover<\/td>\n<\/tr>\n
Polish Whistleblower Protection Act<\/strong> of June 14, 2024<\/td>\nApplicable since September 25, 2024<\/td>\nPublic prosecutors and courts<\/td>\nA fine for failure to establish a procedure; up to two years\u2019 imprisonment for retaliation<\/td>\n<\/tr>\n
AI Act<\/strong> (Regulation 2024\/1689)<\/td>\nPhased entry into force from August 1, 2024<\/td>\nNational authorities, described in the source as being designated<\/td>\nUp to EUR 35 million or 7% of global turnover<\/td>\n<\/tr>\n
Amendment to Poland\u2019s National Cybersecurity System Act<\/strong> (NIS2)<\/td>\nApplicable since April 3, 2026<\/td>\nCompetent cybersecurity authorities<\/td>\nUp to EUR 10 million or 2% of turnover; an extraordinary penalty of up to PLN 100 million<\/td>\n<\/tr>\n
Polish Labor Code<\/strong>, including occupational health and safety, working time, and employment rules<\/td>\nApplicable<\/td>\nPIP<\/td>\nPenalty notices, fines, and wage payment orders<\/td>\n<\/tr>\n
Digital Services Act<\/strong> (DSA; Regulation 2022\/2065)<\/td>\nApplicable since February 17, 2024<\/td>\nDigital Services Coordinator<\/td>\nUp to 6% of annual worldwide turnover<\/td>\n<\/tr>\n
Data Act<\/strong> (Regulation 2023\/2854)<\/td>\nPhased application from September 12, 2025<\/td>\nNational authorities<\/td>\nDetermined at national level<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Other regimes may matter depending on the business: DORA for the financial sector, MiCA for crypto-assets, the Cyber Resilience Act (CRA) for products with digital elements, and CSRD reporting requirements<\/a>. Even the seven areas in the table can generate dozens of separate tasks and document requirements.<\/p>\n

AI Act: track both your tools and your role<\/h3>\n

The AI Act\u2019s staged timetable matters because a company may be using AI well before it has classified its systems or assigned responsibility for them.<\/p>\n\n\n\n\n\n\n\n\n\n
Date<\/th>\nRequirement described in the approved source<\/th>\n<\/tr>\n<\/thead>\n
February 2, 2025<\/strong><\/td>\nProhibitions on unacceptable-risk practices under Article 5, including workplace emotion recognition and social scoring; the AI literacy obligation under Article 4<\/td>\n<\/tr>\n
August 2, 2025<\/strong><\/td>\nObligations for general-purpose AI models under Chapter V<\/td>\n<\/tr>\n
August 2, 2026<\/strong><\/td>\nFull application as a general rule, together with Article 50 transparency obligations, including labeling AI-generated content and informing people when they interact with an AI system<\/td>\n<\/tr>\n
December 2, 2027<\/strong><\/td>\nObligations for stand-alone high-risk AI systems<\/a> listed in Annex III<\/td>\n<\/tr>\n
August 2, 2028<\/strong><\/td>\nObligations for AI systems embedded in products covered by Annex I<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

If the company uses AI in HR\u2014for example, to screen r\u00e9sum\u00e9s\u2014or in marketing, sales, or customer service, start with an inventory. Identify the tool, its purpose, the data it uses, the team responsible for it, and whether a prohibited practice is involved. The source specifically recommends checking for workplace emotion recognition and subliminal manipulation. AI literacy and the Article 5 prohibitions are already identified in the source as applicable.<\/p>\n

A company should also watch for a change in its legal role. It may move from being an AI deployer<\/a> to being treated as a provider, for example by placing its own branding on a system, substantially modifying an algorithm, or changing the system\u2019s intended purpose. That can materially expand its obligations, including risk management, technical documentation, and conformity assessment before placing a system on the market. Do not assume that buying a third-party tool settles the question of responsibility.<\/p>\n

NIS2 in Poland: establish whether your company is covered<\/h3>\n

According to the approved source, the amendment to Poland\u2019s National Cybersecurity System Act<\/a> entered into force on April 3, 2026<\/strong>, after the EU\u2019s October 18, 2024 deadline. The source also notes that the European Commission sent Poland a reasoned opinion on May 7, 2025.<\/p>\n\n\n\n\n\n\n\n\n
Deadline<\/th>\nStep described in the approved source<\/th>\n<\/tr>\n<\/thead>\n
By May 6, 2026<\/strong><\/td>\nRegistration of essential and important entities by the authorities<\/td>\n<\/tr>\n
May 7\u2013October 3, 2026<\/strong><\/td>\nSelf-registration of entities in the register<\/td>\n<\/tr>\n
By April 3, 2027<\/strong><\/td>\nImplementation of cybersecurity risk-management measures<\/td>\n<\/tr>\n
By April 3, 2028<\/strong><\/td>\nFirst audit of essential entities and the full sanctions regime<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The source states maximum penalties of EUR 10 million or 2% of turnover for essential entities, and EUR 7 million or 1.4% of turnover for important entities. It also identifies an extraordinary penalty of up to PLN 100 million and personal liability of an entity\u2019s manager of up to 600% of monthly remuneration<\/strong>.<\/p>\n

The first business decision is whether the Polish entity falls within the essential or important category. Its size alone is not a substitute for that assessment. Contact us<\/a> if you need help determining your status and planning implementation.<\/p>\n

Why compliance breaks down as a company grows<\/h2>\n

Each department owns a fragment<\/h3>\n

HR understands employment processes. IT manages security controls. Legal reviews contracts. Operations may know how work actually happens. Yet no one may have checked whether the whistleblowing procedure fits the company\u2019s GDPR documentation, or whether an AI supplier agreement addresses the company\u2019s AI Act responsibilities.<\/p>\n

This is often a coordination problem rather than a complete absence of expertise. A transaction exposes it because an investor asks for a company-wide answer, not five separate departmental answers.<\/p>\n

A document is not evidence that a process works<\/h3>\n

Companies commonly have privacy notices, internal rules, and confidentiality statements. In an inspection, the issue is also whether staff follow them and whether the company can show that they do.<\/p>\n

The GDPR accountability principle<\/a> in Article 5(2) makes demonstrable compliance important. For example, personal data confidentiality statements should be signed before staff start working with the data, retained in personnel documentation, and supported by monitoring of the underlying rules. The signed document may help during a UODO inspection\u2014but it is more persuasive when it reflects actual practice.<\/p>\n

A password policy illustrates the cross-functional work involved. It needs formal approval, technical implementation by IT, audit or monitoring, and updates. IT, managers, the data protection officer (DPO), where appointed, and the management board may all have a part to play. Without coordination, each may assume someone else has completed the work.<\/p>\n

Polish inspection activity makes the risk concrete<\/h3>\n

The source gives the following figures for 2024:<\/p>\n\n\n\n\n\n\n
Authority<\/th>\nActivity reported in the source<\/th>\nFinancial measures and examples reported in the source<\/th>\n<\/tr>\n<\/thead>\n
UODO<\/strong><\/td>\n8,056 complaints; 14,842 data breach notifications; 1,719 administrative decisions; 22 penalty decisions<\/td>\nMcDonald\u2019s Polska: PLN 16.9 million; ING Bank \u015al\u0105ski: PLN 18.4 million; Morele.net: PLN 3.8 million<\/td>\n<\/tr>\n
PIP<\/strong><\/td>\n61,900 inspections at 49,800 entities; 6,000 wage payment orders totaling PLN 214 million<\/td>\nPLN 23.3 million in penalty notices, up 5.4% year over year; 15,900 employers penalized<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

UODO\u2019s 2024 sectoral inspection plan included entities processing data through online web applications<\/strong>, a category directly relevant to SaaS and e-commerce businesses. The source says inspections of marketing entities and online delivery platforms were planned for 2026.<\/p>\n

PIP\u2019s inspections<\/a> covered entities employing approximately 3.8 million people in total. Problems identified in the source include missing or unreliable working-time records\u2014found at nearly half of the entities examined\u2014unrecorded overtime, and breaches of daily and weekly rest requirements.<\/p>\n

Management can face personal exposure<\/h3>\n

A company-level fine is not the only concern. The source identifies several possible bases of personal liability under Polish law. Their application depends on the facts and the requirements of the relevant provision.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Polish legal basis identified in the source<\/th>\nExposure described in the source<\/th>\n<\/tr>\n<\/thead>\n
Articles 293 and 483 of the Commercial Companies Code<\/strong><\/td>\nCivil liability of a management board member for damage caused to the company by an act or omission contrary to law or the company\u2019s governing document<\/td>\n<\/tr>\n
2022 amendment to the Commercial Companies Code<\/strong><\/td>\nSupervisory board assessment of compliance systems; the business judgment rule protects decisions within justified business risk, but, as the source argues, not the absence of a system<\/td>\n<\/tr>\n
Article 107 of the Personal Data Protection Act<\/strong><\/td>\nCriminal liability for unlawful processing: up to two years\u2019 imprisonment, or up to three years for special-category data<\/td>\n<\/tr>\n
Article 108 of the Personal Data Protection Act<\/strong><\/td>\nUp to two years\u2019 imprisonment for obstructing a UODO inspection<\/td>\n<\/tr>\n
Article 58 of the Whistleblower Protection Act<\/strong><\/td>\nA fine for failing to establish an internal reporting procedure or establishing one in material breach of requirements<\/td>\n<\/tr>\n
Article 220 of the Criminal Code<\/strong><\/td>\nCriminal liability connected with breaches of occupational health and safety rules<\/td>\n<\/tr>\n
Article 296 of the Criminal Code<\/strong><\/td>\nBreach of trust in business dealings<\/td>\n<\/tr>\n
Amendment to the National Cybersecurity System Act<\/strong><\/td>\nPersonal liability of the entity\u2019s manager of up to 600% of monthly remuneration<\/td>\n<\/tr>\n
Article 116 of the Tax Ordinance Act<\/strong><\/td>\nManagement board member liability for company tax arrears<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The approved source\u2019s position is that the business judgment rule introduced by the 2022 Commercial Companies Code amendment protects decisions taken within justified business risk, not a management board\u2019s failure to establish compliance oversight at all. It states that the absence of compliance may itself form a basis for liability. For decision-makers, the operational lesson is to give compliance ownership, reporting, and review a place in management processes.<\/p>\n

The cost of a system\u2014and of an incident<\/h2>\n

The source offers this five-year comparison. It is an illustrative model, not a forecast for every technology company; actual costs and outcomes will depend on the organization and any incident.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Category<\/th>\nOption A: compliance system<\/th>\nOption B: no system<\/th>\n<\/tr>\n<\/thead>\n
Personnel: compliance officer and support<\/td>\nApproximately PLN 270,000 per year<\/td>\nPLN 0 until an incident<\/td>\n<\/tr>\n
Employee training<\/td>\nApproximately PLN 80,000 per year<\/td>\nPLN 0<\/td>\n<\/tr>\n
IT tools and systems<\/td>\nApproximately PLN 70,000 per year<\/td>\nPLN 0<\/td>\n<\/tr>\n
Audits and reviews<\/td>\nApproximately PLN 30,000 per year<\/td>\nPLN 0<\/td>\n<\/tr>\n
Five-year total shown in the source<\/strong><\/td>\nApproximately PLN 2.25 million<\/strong><\/td>\nPLN 0 before incident-related costs<\/strong><\/td>\n<\/tr>\n
GDPR fine for a single incident<\/td>\nRisk reduced<\/td>\nPotential maximum of EUR 20 million or 4% of turnover<\/td>\n<\/tr>\n
Post-incident remediation<\/td>\nDescribed as minimal in the model<\/td>\nPLN 2.5\u20133 million for a fine, remediation, and claims<\/td>\n<\/tr>\n
Lost investment transaction<\/td>\nRisk reduced<\/td>\nNot reliably quantifiable<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The source puts the median gross monthly salary of a compliance officer in Poland at PLN 10,650 and the approximate total annual employment cost, including employer contributions, at PLN 170,000\u2013190,000. It also states that UODO fines imposed on the private sector exceeded PLN 64 million in one recent year, compared with approximately PLN 13 million the preceding year and approximately PLN 1 million two years earlier.<\/p>\n

A compliance system cannot guarantee that a company will avoid a fine or preserve a transaction. Its value is in reducing avoidable gaps, improving response when something goes wrong, and making the company\u2019s position easier to explain and document.<\/p>\n

Four steps from reactive compliance to a working system<\/h2>\n

1. Inventory obligations and existing work<\/h3>\n

Bring HR, IT, legal, administration, and operations into one exercise. Record:<\/p>\n

    \n
  1. Who currently handles each compliance subject.<\/li>\n
  2. The relevant rule or area, such as GDPR, Polish employment law, whistleblowing, the AI Act, or NIS2.<\/li>\n
  3. Which documents and procedures exist, and where they are stored.<\/li>\n
  4. Which obligations have an owner\u2014and which are assumed to belong to someone else.<\/li>\n<\/ol>\n

    Do not wait for a perfect legal analysis before creating the first version. A candid, incomplete inventory gives the company something to test and improve.<\/p>\n

    2. Prioritize risks and assign owners<\/h3>\n

    Use the inventory to distinguish immediate exposure from work that is conditional or further ahead.<\/p>\n\n\n\n\n\n\n\n
    Priority<\/th>\nMeaning<\/th>\nExamples from the source<\/th>\n<\/tr>\n<\/thead>\n
    Critical<\/strong><\/td>\nA breach could bring a financial or criminal sanction or obstruct a transaction<\/td>\nNo required whistleblowing procedure under Article 58 of the Whistleblower Protection Act; failure to notify a reportable GDPR breach within the Article 33 timeframe of 72 hours; breach of an AI Act prohibition<\/td>\n<\/tr>\n
    Important<\/strong><\/td>\nAdministrative penalty risk or a material due diligence problem<\/td>\nOutdated GDPR records; no AI literacy policy; incomplete working-time records<\/td>\n<\/tr>\n
    Forward-looking<\/strong><\/td>\nA future or conditionally applicable requirement<\/td>\nNIS2 work where essential or important entity status has not yet been established; CRA; CSRD<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Give every task one named organizational owner and a deadline. The owner need not be a lawyer: an HR manager, CTO, or COO may be better placed to implement and maintain the process. Legal input can support the owner without replacing ownership.<\/p>\n

    3. Test procedures against reality<\/h3>\n

    For each policy or procedure, ask:<\/p>\n

      \n
    1. Is it current?<\/strong> A GDPR document written in 2019 may not reflect the company\u2019s newer tools, structure, or relevant developments.<\/li>\n
    2. Do people use it?<\/strong> A procedure unknown to employees is merely a stored file.<\/li>\n
    3. Does it fit today\u2019s business?<\/strong> A process designed for 20 people may fail at a company of 150 people across three locations.<\/li>\n<\/ol>\n

      Mark documents that are unused, duplicated across departments, outdated, or missing. Common gaps identified in the source include a data breach response procedure and an AI use policy.<\/p>\n

      4. Create coordination and regular management review<\/h3>\n

      Appoint a person or team with authority to gather information across departments, even if the role is part-time. Then give the management board a short dashboard showing:<\/p>\n