If someone in your company uses Copilot, ChatGPT or a chatbot on the website, the AI Act already applies to you. Not from next year. Since February 2025.
I say this as a vendor of AI agents, not as a lawyer. This is not legal advice, only a list of things my customers ask me about and that I ask my own lawyer about.
The reason is visible in Eurostat's data. Among European companies that considered AI and gave it up, 71 in 100 pointed to a lack of knowledge, but right after: 53 in 100 unclear legal consequences and 49 in 100 concerns about data protection. Law blocks deployments more often than money, which 33 in 100 pointed to.
What applies today.
Article 4 of the AI Act, AI literacy, has applied since 2 February 2025 to everyone who provides or uses AI systems, regardless of risk level. After the Digital Omnibus package the wording was softened from "ensure" to "support the development of" competence, but the obligation stayed. In practice: employees who use AI at work should know what it is, what it can do, what it can't and how to use it. A short training and an AI use policy take care of it in most companies. Supervision of this obligation started on 2 August 2026.
Prohibited practices under Article 5 have applied since February 2025, rules for general-purpose models since August 2025. High-risk systems were due on 2 August 2026, but the Digital Omnibus may move that date. For a company deploying a website chat or a document assistant, this is usually not the high-risk category.
The Polish Act on Artificial Intelligence Systems was passed on 3 July 2026, signed on 24 July and published on 27 July in the Journal of Laws as item 1003. Full application and penalties from 28 October 2026. From then on, the Commission for the Development and Safety of Artificial Intelligence (KRiBSI) gets the right to inspect and impose fines: up to 35 million euros or 7 percent of turnover for prohibited practices, up to 15 million or 3 percent for other violations, up to 7.5 million or 1 percent for incorrect information. The act provides for a reduction of the fine by up to 90 percent for quickly remedying a violation.
On top of that, GDPR, which hasn't gone away. A website chat collects names, order numbers, addresses. A document assistant reads invoices with contractors' data.
A starting list, in order:
- An AI use policy in the company: what is allowed, what must not be pasted into a tool, who is responsible. One page is enough.
- AI literacy training for people who use the tools. Confirmed by signature, so there is a trace.
- Choosing the first processes so that they don't fall into the high-risk category and process as little personal data as possible. Transcription of internal meetings, product descriptions, search in technical documentation are safe in this respect. Employee evaluation or credit decisions are not.
- A human in the loop wherever AI touches the customer. And information for the customer that they are talking to AI. When a human joins, too.
- A contract with the vendor that covers data processing, the place of processing, and whether your data trains someone else's model.
One warning from the data on professional services: most accountants and lawyers use consumer ChatGPT instead of tools with a data processing agreement. That is today the biggest confidentiality risk in small companies, bigger than any chatbot on a website.
Regulations are in motion, so check the dates with your lawyer before deciding. The state above is as of September 2026.
A question for you: have your employees signed anything about how they use AI at work?
Want to see how the agent handles your customers' questions? Enter your website address and e-mail in the demo form. In 20 minutes you get an agent trained on your website's offer, ready to be quizzed.
Sources
- Polish Act on Artificial Intelligence Systems, Journal of Laws 2026 item 1003; EU AI Act (Regulation 2024/1689) Articles 4 and 5
- Eurostat, Use of artificial intelligence in enterprises (2025 data): https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Use_of_artificial_intelligence_in_enterprises