What happened
On Friday 24 July 2026 the President signed Poland's law on artificial intelligence systems — the national act that anchors the EU AI Act in Polish law. It creates the Commission for the Development and Security of Artificial Intelligence (KRiBSI): a single market surveillance authority and a single point of contact with EU institutions, with the power to inspect companies, issue authorisations for high-risk systems, impose penalties and withdraw non-compliant systems from the market. Regulatory sandboxes and a route for individual complaints come with it.
The whole matter is in the calendar. The commission's chair is appointed by the Sejm with the Senate's consent within two months of the law entering into force, and its first sitting has to take place within three — in practice October and November 2026. Meanwhile on 2 August 2026, eight days from now, the AI Act's general applicability arrives together with the Article 50 transparency obligations: disclosing that the thing on the other side of the conversation is a system, and marking content generated or manipulated by a model. The Digital Omnibus, which entered into force in July and pushed high-risk obligations to December 2027 and August 2028, left that date untouched.
So a gap opens: the obligation runs from August, and the body that enforces it sits down in November. AI supervision in Poland starts several months after the obligations do.
Our thesis
That gap is not an amnesty — and in our view an amnesty is exactly what it will most often be mistaken for. The Article 50 obligation doesn't come from the Polish statute, nor from whether KRiBSI has convened. It comes from a regulation that applies directly from 2 August. The absence of an enforcer changes only when somebody asks. It doesn't change the date from which the answer counts.
And the answer will have to reach backwards. A newly appointed authority doesn't start from the current week — it starts from the period when the rule was already binding and nobody was watching. The other side of this risk, the one without an authority, works the same way: a client running a procurement review, or an auditor asking about compliance because they need it themselves. Those aren't waiting for November.
That makes the takeaway from this signature different from the takeaway from the statute itself back in June. Then we wrote that an address appears — an authority that can ask for evidence. Now we know that address starts working after the date on which the evidence begins to count. For the coming months, compliance is therefore not a state you are in, but a record with a date on it.
Why it matters
Private Equity
For a fund, what changes is how much the answer "we're compliant" is worth. Until November nobody in Poland will verify it officially, so diligence has to verify it directly — and the question is not "do you label content and bots" but "since when, and what do you show for it". A portfolio company that fixes its surfaces in October with no record will look identical to one that did it on time. The difference only surfaces when somebody asks for dates — and by then it's a line in the price, not in the checklist.
Enterprise
A large organization will make the labelling deadline; documenting when it shipped, less often. It's the same distinction that always does the work in AI governance: between "we have it" and "we can show it". If changes to the chat surface, to communications and to marketing material run through several teams at once, it's worth having one place now where the deployment date and scope land — not a new system, one table with an owner. How we set up that evidence trail alongside the systems register is part of our work with large organizations.
SMB / mid-market
This is where reading the gap as a free pass is most tempting, because it sounds reasonable: there's no regulator yet, we're twenty people, we'll deal with it after the holidays. Except Article 50 covers everyone deploying AI professionally — the chat on your site, the bot on your helpline, the generated image or video in a campaign. The penalty for breaching obligations other than the prohibited practices reaches EUR 15 million or 3% of annual turnover, and the ceiling isn't the point here: the point is that the first person to check your labelling will most likely be a corporate client filling in their own vendor questionnaire.
One move for this week
Walk your customer-facing surfaces — chat, voice bot, generated content in campaigns — and for each one write down two things: exactly what the person on the other side sees or hears, and since when that has been true. A dated screenshot is enough; you need no tooling and no policy for it. If 2 August catches you without that one page, in November you'll be reconstructing from memory something that takes an hour today.
Describe your case
If you don't know which of your surfaces fall under Article 50, or what a record that survives a question about dates looks like, bring the list of places where your clients meet AI. We start from something concrete. Describe your case: mailto:[email protected]?subject=Rozmowa%20z%20Aurora%20AI.