EU AI Act came into force August 1, 2024but its provisions are launched in stages. The official timeline on the European Commission website shows that most of the key obligations are to apply from August 2, 2026.and full implementation is scheduled for August 2, 2027. This is why companies that use AI in recruitment, customer scoring or risk assessment should no longer postpone the topic.
This does not only apply to the IT industry
There is one convenient myth circulating around the AI Act: that it is a regulation for model creators and large technology companies. In practice, the regulations cover not only those who build AI systems, but also those who build them implement, sell, import, distribute or use in specific applications. This means that an ordinary company that has purchased a ready-made tool and uses it, for example, to pre-select candidates or assess creditworthiness, may also be subject to regulation.
Biggest risk? Recruitment, loans, insurance
The AI Act does not work according to a simple formula: “this industry is covered and that one is not.” The key is what exactly do you use AI for?. Annex III to the regulation explicitly lists, among others: systems used in employment, access to private and public services and the assessment of people.
The most sensitive cases today are primarily:
- Recruitment and HR: if AI analyzes CVs, filters candidates, evaluates them or supports HR decisions, the company may enter the regime of a high-risk system.
- Banks and fintechs: especially where AI influences creditworthiness scores or a customer’s access to important financial services.
- Insurance: especially if the algorithm influences customer or risk assessment or access to an important service.
- Software providers: because even if they do not make decisions for people themselves, they can provide tools that are later used in areas covered by the AI Act.
August 2026 looks dangerous. But there is one important catch
As of today, the EU’s official timetable still shows August 2, 2026 as the effective date for most major obligations. At the same time, work is underway in the EU on changing the deadlines within the package Digital Omnibus on AI. This means the calendar may still change, but for now, companies should not assume that the problem will go away on its own. It is safer to prepare according to the current dates than to count on a political delay.
Which is already in effect now
This is important because many companies think that the AI Act “starts” only in 2026. That’s not true. Some of the regulations are already in force, and others are being introduced in stages. The official EU timeline shows that the regulation is being implemented gradually, with the full rollout expected to take place by August 2027.
For business, the most important conclusion is simple: The time to organize the use of AI is already hereeven if the heaviest responsibilities for many companies are still ahead of them.
The penalties are real and very high
This regulation is not about symbolic warnings. Article 99 of the AI Act provides for very high sanctions. The penalty for using prohibited practices is up to: 35 million euros or to 7 percent annual turnoverwhichever amount is higher. For other violations, including: obligations related to high-risk systems and transparency, threatens to 15 million euros or 3 percent annual turnover. For providing false or misleading information to the authorities, to 7.5 million euros or 1 percent turnover.
Poland is still in the preparation phase
In Poland, work is still underway on the national law regarding artificial intelligence systems. It is listed on gov.pl draft act on artificial intelligence systemswhich shows that the state is just building its national supervisory and organizational base. However, this does not mean that companies can wait calmly. The AI Act is an EU regulation, so it works directly, regardless of whether the Polish surveillance system will be ready on time.
Worst mistake? Assume that “it doesn’t concern us”
For many companies, the biggest risk will not even be the technology itself, but the false assumption that because they do not create their own AI model, the problem does not concern them. Meanwhile, it is enough to use a ready-made tool in an area such as recruitment or customer scoring to enter the area of high-risk regulations.
What should the company do now?
The first step is simple: make a list of all the AI tools used in your company. Not only the “large” ones, but also seemingly innocent systems for HR, customer service, document analysis and risk assessment.
The second step is to check whether any of these applications are high risk. What matters is not the buzzword in the supplier’s offer, but the real impact of the system on people and decisions.
The third step is to prepare the organization for documentation and control. The AI Act does not reward chaos. Bonuses will be awarded to a company that can say: what system it uses, for what, on what data and with what impact on people.
The shortest conclusion
The AI Act will not hit all companies in Poland at once. But for some businesses, the buffer time is running out. If a company uses AI in recruitment, finance, insurance or provides such tools to others, should check its situation now, not when the regulator knocks on the door.
Sources: European Commission: AI Act Service Desk, EUR-Lex, European Commission: Digital Strategy: https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-actMinistry of Digitization, Chancellery of the Prime Minister, Government Legislation Center: https://www.gov.pl/web/cyfryzacji/projekt-ustawy-o-systemach-szkolnej-inteligencja
