EU AI ACT FOR COMPANIES
The EU AI Act in your company - what to do and by when
The EU regulation on artificial intelligence is already in force in Poland and also applies to companies that only use off-the-shelf AI tools. See what needs doing, the deadlines and the fines - and how to get your organisation ready step by step.
The AI Act in your company: six things to do
Most companies do not build AI, they use it. For them the AI Act comes down to six steps. We describe each one separately, with control questions.
-
Map your AI tools
List what your staff actually use, including privately created accounts. Without that list you cannot check any other obligation.
How to build an AI system register → -
Rule out prohibited practices
Article 5 bans, among other things, recognising employees’ emotions and manipulating people. It has applied since 2 February 2025, with fines of up to €35M or 7% of turnover.
Prohibited practices step by step → -
Train your team
Article 4 requires measures that build AI literacy among the people who use AI. What counts is what you can show: who, when and on which programme.
AI Literacy training for companies → -
Set the rules for using AI
The AI Act does not require a policy in so many words, but without one diligence is hard to show. It is where the company says which tools and data may be used and who approves new ones.
How to write a company AI policy → -
Label AI-generated content
Since 2 August 2026, deepfakes and text published on matters of public interest must disclose that AI was involved (Article 50(4)).
Labelling AI content step by step → -
Keep the evidence
Policy acknowledgements, training completion certificates, the decision history in your register. From 28 October 2026 in Poland, a customer, job applicant or employee can file a complaint.
Evidence of due diligence →
Want to check where your company stands? An EU AI Act compliance audit step by step →
Already in force in Poland
The EU regulation sets out how companies and other organisations may use AI.
"If your employees use AI tools, the AI Act applies to your company too - at least the AI literacy duty in Article 4 and the Article 5 prohibitions."
The AI Act is an EU regulation governing how companies, public bodies and other organisations may use artificial intelligence. It covers any situation in which employees use AI-enabled tools at work - including browsers, search engines or content-generating systems. The rules are already in force in Poland.
provisions on AI literacy and prohibited AI practices apply. That is over eighteen months during which your staff should have been trained.
a documented approach to due diligence matters more and more: AI policies and procedures, risk assessment, a tool register, an incident register, full documentation and reporting - so the organisation is ready to answer questions during an inspection or a security incident.
AI Act sanctions
for the most serious breaches, e.g. prohibited AI practices.
for breaches of obligations regarding AI systems, including for deployers.
for providing false, incomplete or misleading information to authorities.
The AI Act does not apply identically to every organisation. The scope of obligations and sanctions depends on the role of the organisation, how it uses AI and the risk level of the AI system in question.
Does the AI Act apply to your company?
The scope of obligations depends mainly on what the company does with AI, not on its industry. Find your situation - usually more than one fits.
| Situation in the company | What applies | Since |
|---|---|---|
| Staff use ChatGPT, Copilot, Gemini or other AI-enabled tools | Measures that build AI literacy (Article 4) and the ban on Article 5 practices. The company acts as a deployer of AI. | 2 February 2025 |
| You publish images, video or text created with AI | Disclosing AI involvement for deepfakes and for text published on matters of public interest (Article 50(4)). | 2 August 2026 |
| You offer customers your own chatbot or AI assistant | The company acts as a provider: people must know they are dealing with AI (Article 50(1)). | 2 August 2026 |
| You use AI in recruitment, employee evaluation or credit scoring of individuals | A possible Annex III high-risk system, with the deployer obligations of Article 26. When it is high-risk → | 2 December 2027 |
| You build an AI system and sell it to others | Provider obligations, depending on the system’s risk class. | in stages, 2025-2028 |
The table simplifies. Roles and obligations are assessed for each AI use case separately, which is why the same company is often a deployer and a provider at once. Does the AI Act only apply to tech companies?
Train your team on the EU AI Act
AI Literacy courses with an exam and a certificate for every employee. From 10 people, the AI Governance platform is included.
Has the AI Act been postponed
No. On 27 July 2026 Regulation 2026/1744, the Digital Omnibus on AI , entered into force, and the press described it as a postponement of the rules on artificial intelligence. That shorthand is misleading.
The deadlines that moved are those for high-risk systems . Nothing moved for an ordinary company using off-the-shelf AI tools. The AI literacy obligation has applied since February 2025, the prohibited practices likewise, and the transparency obligations took effect on 2 August 2026 as planned. The penalties are unchanged.
What did change is the wording of the training obligation. Previously Article 4 of the AI Act required ensuring a sufficient level of AI literacy; it now speaks of taking measures to support its development. An obligation of result became an obligation of diligent conduct - the kind where what counts is what you can show.
Who checks this in Poland
Supervision of the AI Act in Poland falls to KRiBSI, the Commission for AI Development and Safety. It was established by the Act of 3 July 2026 on artificial intelligence systems (Journal of Laws 2026, item 1003).
The rules on inspections, proceedings and penalties take effect on 28 October 2026. According to the announcements, the chair is due to be appointed in October and the full Commission is to start work in November. Until then the authority runs no inspections and imposes no penalties.
In practice one thing matters most: a complaint about how an AI system operates can be filed by a customer, a job applicant or an employee. Not only by a regulator acting on its own initiative.
Frequently asked questions
-
Does the AI Act apply to my company?
Most likely yes. If your employees use AI-enabled tools at work - even browsers, search engines or content generators - your company may fall under AI Act obligations. The rules are not limited to technology companies; they also cover public bodies and other organisations.
-
Does the AI Act apply to a small company?
Yes. The AI Act exempts no one on account of size - obligations depend on how the company uses AI. A small company whose staff use AI tools has the same Article 4 and Article 5 obligations as a large one. For small and medium-sized enterprises, however, the regulation sets a gentler ceiling on fines: the lower of the fixed amount and the percentage applies (Article 99(6) of the AI Act), plus support from Member States, including training and priority access to regulatory sandboxes (Article 62 of the AI Act). More in the EU AI Act for small and medium-sized companies.
-
When do the rules apply and what are the deadlines?
The AI Act applies in stages. The AI literacy rules and the prohibited practices have applied since 2 February 2025. General-purpose AI model rules since 2 August 2025. Transparency obligations and the start of enforcement since 2 August 2026. From 2 December 2026 two further prohibitions apply, and providers of generative systems already on the market before August 2026 run out of their transitional period for machine-readable marking of content. The full AI Act implementation timeline is published by the European Commission. In Poland, the rules on inspections, complaints and penalties take effect on 28 October 2026, and supervision falls to KRiBSI, the Commission for AI Development and Safety, which starts work in November. Separate, later deadlines apply to high-risk systems.
-
Is AI TrustCERT a training or a compliance support system?
AI TrustCERT combines both. The organisation buys training licences for its staff, and within those licences it gets access to the AI Governance platform - with policies, AI registers, risk assessment and action documentation. The training is the core product, and the platform lets you put the knowledge into practice.
-
How long does implementation take?
You open the platform and add users on day one, and the ready-made AI Literacy training starts immediately. Completing policies and registers usually takes 7-14 days, depending on the size of the organisation.
-
How much does it cost?
Individual access to the courses is 1,395 PLN net per person per year. The organisation programme with the platform included starts at 13,950 PLN net per year (from 10 people). See our pricing and contact us for details.
-
Does the AI Act replace GDPR?
No. The AI Act and GDPR are separate, complementary regulations. Our training and policies also cover AI use in the context of data protection, GDPR and information security.
-
What due-diligence evidence does AI TrustCERT help collect?
A full set of documentation: AI usage policies and procedures with employee acknowledgements, an AI tool register, an organisational risk assessment, training completion certificates and a readiness report for the board, HR, compliance or IT. The AI Act does not require every company to keep a register of AI tools. But without one you cannot check whether you happen to be using a system from the high-risk list, nor show that nobody in your organisation is doing something prohibited under Article 5 of the AI Act. The inspection powers of the authorities are set out in Article 74 of the AI Act. The scope of evidence you need depends on how you actually use AI, the role you act in and the processes you have in place.
-
Do the courses end with a certificate?
Yes. Every course ends with an exam and a certificate - classic or micro-credential, depending on the implementation level. Certificates confirm course completion and competence within the AI Literacy programme - they are not a certificate of the organisation's compliance with the AI Act.
-
What is the AI Ready Check?
A free diagnostic tool. In about 3 minutes, with no commitment, you find out which AI Act obligations may apply to your organisation and whether any of your AI use cases fall into the high-risk category. It runs in your browser.
Have another question? Get in touch →
Not sure where to start?
Check in 3 minutes which AI Act obligations apply to your organisation. No commitment.