{"id":4356,"date":"2026-08-20T22:56:41","date_gmt":"2026-08-20T20:56:41","guid":{"rendered":"https:\/\/www.lablogic.pl\/?page_id=4356"},"modified":"2026-10-03T12:01:08","modified_gmt":"2026-10-03T10:01:08","slug":"ai-act","status":"publish","type":"page","link":"https:\/\/www.lablogic.pl\/en\/ai-act\/","title":{"rendered":"AI Act: establishing your role, obligations and scope of preparation"},"content":{"rendered":"\n
\n
\n
\n
\n
\n

SERVICES \u00b7 AI ACT<\/p>\n\n

AI Act: establishing your role, obligations and scope of preparation<\/h1>\n\n

I help establish the role an organization holds under the AI Act. I separate the obligations that already apply from those that require preparation. The starting point is the actual state of affairs: the places where artificial intelligence is already at work.<\/p>\n\n

Over 20 years of practice \u00b7 Legal and technological perspective \u00b7 Work in Polish and English<\/p>\n\n

\n
Book a diagnostic call<\/a><\/div>\n\n
See the scope of support<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n\n
\n
\n

WHAT ALREADY APPLIES AND WHAT COMES NEXT<\/p>\n\n

\n
\n

from 2 February 2025<\/p>\n\n

Prohibited practices and AI literacy<\/h4>\n\n

Applies to every organization that uses AI.<\/p>\n<\/div>\n\n

\n

from 2 August 2026<\/p>\n\n

Transparency obligations towards individuals<\/h4>\n\n

Informing people about contact with a system and about artificially generated content.<\/p>\n<\/div>\n\n

\n

from 2 December 2026<\/p>\n\n

requires action<\/p>\n\n

Two new prohibitions and labelling of content in older systems<\/h4>\n\n

Also applies to systems made available earlier.<\/p>\n<\/div>\n<\/div>\n\n

The postponement of deadlines covered only the requirements for high-risk systems. The remaining provisions apply unchanged.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

ENTRY SITUATIONS<\/p>\n\n

When support is needed<\/h2>\n\n
\n
\n
\n

There is no inventory of use cases<\/h3>\n\n

AI tools entered the organization by different routes and nobody keeps a record of them.<\/p>\n<\/div>\n<\/div>\n\n

\n
\n

The tool was built inside the organization<\/h3>\n\n

A team built an assistant or a classifier on a general-purpose model.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n

\n
\n
\n

AI supports decisions about people<\/h3>\n\n

Systems operate in recruitment, employee assessment or client qualification.<\/p>\n<\/div>\n<\/div>\n\n

\n
\n

The question came from outside<\/h3>\n\n

A client, insurer or auditor asks about compliance with the AI Act.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n

\n
\n
\n

Content is produced automatically<\/h3>\n\n

The organization publishes material generated or processed by AI.<\/p>\n<\/div>\n<\/div>\n\n

\n
\n

A deployment is planned<\/h3>\n\n

The project is due to start before the dates from which high-risk requirements apply.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

TIMELINE<\/p>\n\n

The postponement did not cover the whole regulation<\/h2>\n\n

In July 2026 the European Union changed the timeline for applying the AI Act. The postponement concerns the requirements and obligations relating to high-risk systems. The remaining provisions apply unchanged.<\/p>\n\n

An organization using off-the-shelf tools therefore faces the opposite of the common message. Part of the obligations already applies. The deferral bought time to prepare for the rest.<\/p>\n\n

\n
\n

2 February 2025<\/p>\n\n

<\/p>\n\n

\n

Prohibited practices and AI literacy<\/h4>\n<\/div>\n\n

in force<\/p>\n<\/div>\n\n

\n

2 August 2025<\/p>\n\n

<\/p>\n\n

\n

General-purpose models, supervision and penalties<\/h4>\n<\/div>\n\n

in force<\/p>\n<\/div>\n\n

\n

2 August 2026<\/p>\n\n

<\/p>\n\n

\n

Transparency obligations towards individuals<\/h4>\n\n

Informing people about interaction with an AI system and labelling artificially generated content.<\/p>\n<\/div>\n\n

in force now<\/p>\n<\/div>\n\n

\n

2 December 2026<\/p>\n\n

<\/p>\n\n

\n

Two new prohibitions and labelling of content in older systems<\/h4>\n\n

Also applies to systems made available earlier.<\/p>\n<\/div>\n\n

requires action<\/p>\n<\/div>\n\n

\n

2 December 2027<\/p>\n\n

<\/p>\n\n

\n

Requirements for high-risk systems from Annex III<\/h4>\n<\/div>\n\n

preparation<\/p>\n<\/div>\n\n

\n

2 August 2028<\/p>\n\n

<\/p>\n\n

\n

Requirements for high-risk systems from Annex I<\/h4>\n<\/div>\n\n

preparation<\/p>\n<\/div>\n<\/div>\n\n

In Poland the application of the regulation is supervised by the Commission for the Development and Security of Artificial Intelligence, established by the Act on artificial intelligence systems.<\/p>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

STARTING POINT<\/p>\n\n

Who the organization is under the AI Act<\/h2>\n\n

This question determines the scope of obligations.<\/p>\n\n

The line between these roles is thinner than it looks at first glance<\/h3>\n\n
\n
\n

<\/p>\n\n

MOST COMMON ROLE<\/p>\n\n

Deployer<\/h3>\n\n

Uses an AI system in its own activity. Where the system is high-risk, it is responsible for using it in accordance with the instructions for use and for assigning human oversight to people with the necessary competence and authority \u2014 the obligations in Article 26, which apply from 2 December 2027 or 2 August 2028. Regardless of how the system is classified, the transparency duties towards individuals in Article 50 apply.<\/p>\n<\/div>\n\n

\n

A deployer is considered to be a provider of a high-risk AI system in the three situations set out in Article 25(1):<\/p>\n\n

\n

<\/p>\n\n

\n

Own name or trademark<\/h4>\n\n

The organization makes a high-risk system already on the market available under its own brand.<\/p>\n<\/div>\n<\/div>\n\n

\n

<\/p>\n\n

\n

Substantial modification of the system<\/h4>\n\n

A high-risk system already placed on the market is substantially modified.<\/p>\n<\/div>\n<\/div>\n\n

\n

<\/p>\n\n

\n

Change of intended purpose<\/h4>\n\n

A system that was not a high-risk system is used in a way that makes it one.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n

\n

<\/p>\n\n

BROADER ROLE<\/p>\n\n

Provider<\/h3>\n\n

Places a system on the market or puts it into service under its own name. The scope of its obligations is considerably broader and includes conformity assessment.<\/p>\n<\/div>\n<\/div>\n\n

The third case applies to many organizations today. A team that built an internal tool on a general-purpose model and directed it at supporting decisions about candidates may have changed the organization\u2019s role without a board decision.<\/p>\n\n

\n

<\/p>\n\n

The regulation does not ask whether an organization \u201eworks with AI\u201d. It asks about its role in relation to a specific system.<\/p>\n\n

\n
\n

1<\/p>\n\n

Establishing the role is the first step<\/strong><\/p>\n<\/div>\n\n

\n

2<\/p>\n\n

It determines the scope of further work<\/strong><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

HOW IT RUNS<\/p>\n\n

How the cooperation works<\/h2>\n\n
\n
\n

STAGE 1<\/p>\n\n

Diagnostic call<\/h3>\n\n

We establish what the organization already uses and where the need came from.<\/p>\n<\/div>\n\n

\n

STAGE 2<\/p>\n\n

Review of use cases<\/h3>\n\n

Conversations with process owners and a review of tools and contracts.<\/p>\n<\/div>\n\n

\n

STAGE 3<\/p>\n\n

Qualification and gaps<\/h3>\n\n

Role, risk category and the difference between the current and the required state.<\/p>\n<\/div>\n\n

\n

STAGE 4<\/p>\n\n

Plan and implementation<\/h3>\n\n

Priorities, task owners and deadlines matched to the timeline of the regulation.<\/p>\n<\/div>\n\n

\n

STAGE 5<\/p>\n\n

Maintenance<\/h3>\n\n

Review of new deployments and updates to the register and documentation.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

SCOPE OF SUPPORT<\/p>\n\n

What the cooperation covers<\/h2>\n\n
\n
\n

<\/p>\n\n

Register of AI use cases<\/h3>\n\n

We establish where AI is already at work \u2013 including tools built in-house and AI features in software bought for another purpose.<\/p>\n<\/div>\n\n

\n

<\/p>\n\n

Qualification of role and risk level<\/h3>\n\n

For each use case we establish the organization\u2019s role and the system\u2019s category, from prohibited practices to high risk.<\/p>\n<\/div>\n\n

\n

<\/p>\n\n

Transparency towards individuals<\/h3>\n\n

We check where the organization must inform people about interaction with a system or about artificially generated content.<\/p>\n<\/div>\n\n

\n

<\/p>\n\n

Human oversight<\/h3>\n\n

We establish who exercises oversight and whether they can stop the system \u2013 it is a role, not an entry in a policy.<\/p>\n<\/div>\n\n

\n

<\/p>\n\n

Contracts and the supply chain<\/h3>\n\n

We check whether contracts with tool suppliers give the organization the information and documentation it needs to meet its own obligations.<\/p>\n<\/div>\n\n

\n

<\/p>\n\n

Documentation and evidence<\/h3>\n\n

We put in order the records showing how decisions on deployment and oversight were made \u2013 the organization answers clients and auditors with that same material.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

FORMS OF COOPERATION<\/p>\n\n

Cooperation options<\/h2>\n\n

The scope is matched to the point the organization is at today. Each option can be closed or extended into the next one.<\/p>\n\n

\n
\n
\n
\n
\n

1<\/p>\n\n

First step<\/p>\n<\/div>\n\n

Review of AI use cases and qualification<\/h3>\n\n

For an organization that does not yet have a picture of the situation.<\/p>\n\n

Result:<\/strong> a list of use cases, the organization\u2019s role established for each of them, and a report with priorities for the board.<\/p>\n<\/div>\n<\/div>\n\n

\n
\n
\n

2<\/p>\n\n

Putting order in place<\/p>\n<\/div>\n\n

Organizing AI governance<\/h3>\n\n

For an organization after qualification. Covers the rules for using AI, keeping the register and the model of human oversight. Requirements towards suppliers come with it.<\/p>\n\n

Result:<\/strong> a plan of preparation for the dates from which requirements for high-risk systems apply.<\/p>\n<\/div>\n<\/div>\n\n

\n
\n
\n

3<\/p>\n\n

Ongoing cooperation<\/p>\n<\/div>\n\n

Standing advisory support<\/h3>\n\n

For an organization deploying AI on a continuous basis.<\/p>\n\n

Result:<\/strong> assessment of new deployments before launch, updates to the register and responses to changes in the law and to questions from outside.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

What the board gains<\/h2>\n\n
\n
\n
\n
\n

1<\/p>\n\n

A picture of the situation<\/h4>\n\n

It is known where AI operates and who is responsible for it.<\/p>\n<\/div>\n\n

\n

2<\/p>\n\n

A settled role<\/h4>\n\n

The organization knows whether it acts as a deployer or as a provider.<\/p>\n<\/div>\n\n

\n

3<\/p>\n\n

Separated deadlines<\/h4>\n\n

It is clear what requires action now and what should be planned.<\/p>\n<\/div>\n\n

\n

4<\/p>\n\n

Workable oversight<\/h4>\n\n

It is known who can halt a system and on what basis.<\/p>\n<\/div>\n\n

\n

5<\/p>\n\n

A basis for deployment decisions<\/h4>\n\n

New AI projects go through assessment before launch.<\/p>\n<\/div>\n\n

\n

6<\/p>\n\n

Material for questions from outside<\/h4>\n\n

An answer for a client or an auditor rests on documents.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n

Division of roles in the cooperation<\/h3>\n\n
\n
\n
\n

LabLogic<\/h3>\n\n

Runs the review and qualification, formulates recommendations and coordinates the work.<\/p>\n<\/div>\n<\/div>\n\n

\n
\n

The organization<\/h3>\n\n

Takes decisions, provides information about processes and indicates task owners.<\/p>\n<\/div>\n<\/div>\n\n

\n
\n

Tool suppliers<\/h3>\n\n

Provide technical documentation, instructions and the information needed for assessment.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n
\n
\n

WHO DELIVERS IT<\/p>\n\n

Knowledge that comes from practice<\/h2>\n\n

Over twenty years of work in technology, data protection and cybersecurity. Combining the legal, organizational and technological perspectives makes it possible to assess an AI tool both from the side of the provision and from the side of the deployment. The cooperation is conducted in Polish and in English.<\/p>\n\n

\n
Meet the expert<\/a><\/div>\n<\/div>\n<\/div>\n\n
\n
\n

DIRECT CONTACT WITH THE EXPERT<\/p>\n\n

Micha\u0142 Rutkowski<\/h3>\n\n

LabLogic \u2014 support and acting as DPO, preparation for NIS2 and the local law KSC, incident response, audits and training.<\/p>\n\n

M.Rutkowski@LabLogic.pl<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n

Frequently asked questions<\/h2>\n\n
\n
Does the AI Act apply to us if we only use off-the-shelf tools?<\/summary>\n

Yes. The regulation also imposes obligations on organizations that merely deploy AI systems. Their scope depends on what a given system is used for.<\/p>\n<\/details>\n\n

We heard the deadlines were postponed. Is there anything to do now?<\/summary>\n

The postponement covered the requirements for high-risk systems. Prohibited practices, the obligation to support AI literacy and the transparency obligations apply regardless of it.<\/p>\n<\/details>\n\n

When does an organization using AI become its provider?<\/summary>\n

When it makes the system available under its own name, substantially modifies it, or uses it in a way that turns it into a high-risk system. The last case happens with tools built in-house.<\/p>\n<\/details>\n\n

Does an AI tool in recruitment always mean a high-risk system?<\/summary>\n

Not always. What decides is the system\u2019s intended purpose and the way it is used, not its mere presence in the recruitment process. That is why qualification is carried out for a specific use case.<\/p>\n<\/details>\n\n

Is a data protection impact assessment enough instead of a fundamental rights impact assessment?<\/summary>\n

It does not replace it, but it connects with it. If the obligation has already been met in the data protection impact assessment, its relevant parts can be included in the fundamental rights impact assessment.<\/p>\n<\/details>\n\n

Who supervises the application of the AI Act in Poland?<\/summary>\n

The Commission for the Development and Security of Artificial Intelligence, established by the Act on artificial intelligence systems. It cooperates with the authorities competent in the remaining areas, including the data protection authority.<\/p>\n<\/details>\n<\/div>\n\n

Related services<\/h3>\n\n

The obligations under the AI Act meet three areas in which an organization usually already has its own rules.<\/p>\n\n

\n
\n
\n

SERVICE<\/p>\n\n

Data protection<\/a><\/h3>\n\n

Many AI use cases process personal data, so GDPR obligations apply in parallel. Information received from the system\u2019s supplier is used in the data protection impact assessment.<\/p>\n\n

See DPO support \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n

\n
\n

SERVICE<\/p>\n\n

Cybersecurity<\/a><\/h3>\n\n

Organizations covered by NIS2 and the local law on the national cybersecurity system also assess AI tools as part of the supply chain.<\/p>\n\n

See NIS2 and KSC preparation \u2192<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n\n

\n
\n
\n

SERVICE<\/p>\n\n

Staff competence<\/a><\/h3>\n\n

The regulation requires measures supporting AI literacy among the people who use these systems. Scope and format are matched to roles.<\/p>\n\n

See training matched to roles \u2192<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n\n

Related materials<\/h3>\n\n

Questions that keep coming back during a first review of AI use cases \u2014 with answers read from the consolidated text of the regulation.<\/p>\n\n

\n
\n
\n

KNOWLEDGE BASE<\/p>\n\n

When does an organization using AI become the provider of the system?<\/a><\/h3>\n\n

Three circumstances from Article 25(1) and the contractual reservation that settles the outcome.<\/p>\n\n

Read \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n

\n
\n

KNOWLEDGE BASE<\/p>\n\n

What should a register of AI use cases contain?<\/a><\/h3>\n\n

The regulation does not require a register. It imposes obligations for which a central inventory is a practical and evidentially strong tool.<\/p>\n\n

Read \u2192<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n\n

\n
\n
\n

KNOWLEDGE BASE<\/p>\n\n

Who is responsible for the transparency obligations under the AI Act?<\/a><\/h3>\n\n

Four obligations from Article 50 divided between the provider and the deployer.<\/p>\n\n

Read \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n

\n
\n

KNOWLEDGE BASE<\/p>\n\n

What does the AI literacy obligation require?<\/a><\/h3>\n\n

Article 4 of the AI Act describes the duty through measures, not a level of knowledge \u2014 it binds providers and deployers and has applied since 2 February 2025.<\/p>\n\n

Read \u2192<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n\n

\n
\n
\n

KNOWLEDGE BASE<\/p>\n\n

Is the AI tool we use a high-risk system?<\/a><\/h3>\n\n

Intended purpose and use decide, not the product name \u2014 two routes under Article 6 of the AI Act, and profiling closes the derogation.<\/p>\n\n

Read \u2192<\/a><\/p>\n<\/div>\n<\/div>\n\n

\n
\n

KNOWLEDGE BASE<\/p>\n\n

What new prohibitions does the AI Act introduce from 2 December 2026 and whom do they cover?<\/a><\/h3>\n\n

Two new prohibitions in Article 5 \u2014 non-consensual intimate material and child sexual abuse material \u2014 and when they cover the provider and when the organisation using the tool.<\/p>\n\n

Read \u2192<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n\n\n

\n
\n
\n
\n

FIRST STEP<\/p>\n\n

Book a diagnostic call<\/h2>\n\n

Let us start by establishing where artificial intelligence works in your organization today and in what role the organization stands towards it. The conversation makes it possible to name the first sensible step before you decide on the scope of work.<\/p>\n\n

\n
Write directly<\/a><\/div>\n<\/div>\n\n

This material is general and informational.<\/strong> It does not constitute individual legal advice or a recommendation for a specific organization. The scope of obligations should be assessed with that organization\u2019s situation in mind. Legal status: August 2026.<\/p>\n<\/div>\n\n

\n
\n

REQUEST A CALL<\/p>\n