{"id":4356,"date":"2026-08-20T22:56:41","date_gmt":"2026-08-20T20:56:41","guid":{"rendered":"https:\/\/www.lablogic.pl\/?page_id=4356"},"modified":"2026-08-20T23:09:54","modified_gmt":"2026-08-20T21:09:54","slug":"ai-act-roles-obligations-and-preparation-support","status":"publish","type":"page","link":"https:\/\/www.lablogic.pl\/en\/ai-act-roles-obligations-and-preparation-support\/","title":{"rendered":"AI Act: establishing your role, obligations and scope of preparation"},"content":{"rendered":"\n
\n
\n
\n
\n

Services \u2022 AI Act<\/p>\n\n\n\n

AI Act: establishing your role, obligations and scope of preparation<\/h1>\n\n\n\n

I help establish the role an organisation holds under the AI Act. I separate the obligations that already apply from those that require preparation. The starting point is the facts: the places where artificial intelligence is already at work.<\/p>\n\n\n\n

\n
Book a diagnostic call<\/a><\/div>\n\n\n\n
See what the work covers<\/a><\/div>\n<\/div>\n\n\n\n

Over 20 years of practice \u2022 Legal and technological perspective \u2022 Work in Polish and English<\/p>\n<\/div>\n\n\n\n

\n

What already applies<\/h2>\n\n\n\n
\n

since 2 February 2025<\/p>\n\n\n\n

Prohibited practices and AI literacy<\/p>\n\n\n\n

Applies to every organisation that uses AI.<\/p>\n<\/div>\n\n\n\n

\n

since 2 August 2026<\/p>\n\n\n\n

Transparency obligations towards individuals<\/p>\n\n\n\n

Informing people about contact with a system and about artificially generated content.<\/p>\n<\/div>\n\n\n\n

The postponement covered only the requirements for high-risk systems. The remaining provisions apply unchanged.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

\n

Timeline<\/p>\n\n\n\n

The postponement did not cover the whole regulation<\/h2>\n\n\n\n

In July 2026 the EU changed the timeline for applying the AI Act. The postponement concerns the requirements and obligations relating to high-risk systems. The remaining provisions apply unchanged.<\/p>\n\n\n\n

An organisation that uses off-the-shelf tools therefore faces the opposite of the common message. Some obligations already apply. The deferral bought time to prepare for the rest.<\/p>\n\n\n\n

\n
\n

2 February 2025<\/p>\n\n\n\n

Prohibited practices and AI literacy<\/p>\n\n\n\n

in force<\/p>\n<\/div>\n\n\n\n

\n

2 August 2025<\/p>\n\n\n\n

General-purpose models, supervision and penalties<\/p>\n\n\n\n

in force<\/p>\n<\/div>\n\n\n\n

\n

2 August 2026<\/p>\n\n\n\n

Transparency obligations towards individuals<\/p>\n\n\n\n

Informing people about interaction with an AI system and labelling artificially generated content.<\/p>\n\n\n\n

in force now<\/p>\n<\/div>\n\n\n\n

\n

2 December 2026<\/p>\n\n\n\n

Two new prohibitions and labelling of content in legacy systems<\/p>\n\n\n\n

This also covers systems made available earlier.<\/p>\n\n\n\n

action required<\/p>\n<\/div>\n\n\n\n

\n

2 December 2027<\/p>\n\n\n\n

Requirements for high-risk systems under Annex III<\/p>\n\n\n\n

preparation<\/p>\n<\/div>\n\n\n\n

\n

2 August 2028<\/p>\n\n\n\n

Requirements for high-risk systems under Annex I<\/p>\n\n\n\n

preparation<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n

In Poland, supervision over the application of the regulation rests with the Komisja Rozwoju i Bezpiecze\u0144stwa Sztucznej Inteligencji<\/strong> (the Commission for the Development and Security of Artificial Intelligence), established under the Polish Act on Artificial Intelligence Systems.<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n

When it comes up<\/p>\n\n\n\n

When support is needed<\/h2>\n\n\n\n
\n
\n

No inventory of use cases<\/h3>\n\n\n\n

AI tools entered the organisation through different routes and nobody keeps a record of them.<\/p>\n<\/div>\n\n\n\n

\n

The tool was built in-house<\/h3>\n\n\n\n

A team built an assistant or a classifier on a general-purpose model.<\/p>\n<\/div>\n\n\n\n

\n

AI supports decisions about people<\/h3>\n\n\n\n

Systems are used in recruitment, employee assessment or client qualification.<\/p>\n<\/div>\n\n\n\n

\n

The question came from outside<\/h3>\n\n\n\n

A client, insurer or auditor asks about AI Act compliance.<\/p>\n<\/div>\n\n\n\n

\n

Content is generated automatically<\/h3>\n\n\n\n

The organisation publishes material generated or processed by AI.<\/p>\n<\/div>\n\n\n\n

\n

A deployment is planned<\/h3>\n\n\n\n

The project is due to start before the dates on which the high-risk requirements apply.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

\n

Starting point<\/p>\n\n\n\n

What the organisation is under the AI Act<\/h2>\n\n\n\n

This question determines the scope of obligations. The regulation does not ask whether an organisation \u201cworks with AI\u201d. It asks about the role it holds towards a specific system.<\/p>\n\n\n\n

\n
\n

Most common role<\/p>\n\n\n\n

Deployer<\/h3>\n\n\n\n

Uses an AI system in its own activity. Its responsibilities include using the system in accordance with the instructions, assigning human oversight to people with the appropriate competence and authority, and informing individuals in the cases set out in the regulation.<\/p>\n<\/div>\n\n\n\n

\n

Broader role<\/p>\n\n\n\n

Provider<\/h3>\n\n\n\n

Places a system on the market or puts it into service under its own name. Its obligations are considerably broader and include conformity assessment.<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n

The line between these roles is thinner than it looks at first sight<\/h3>\n\n\n\n

The regulation treats a deployer as a provider in three situations:<\/p>\n\n\n\n

\n
\n

1<\/p>\n\n\n\n

Own name or trade mark<\/h3>\n\n\n\n

The organisation makes the system available under its own brand.<\/p>\n<\/div>\n\n\n\n

\n

2<\/p>\n\n\n\n

Substantial modification<\/h3>\n\n\n\n

A high-risk system already placed on the market is substantially modified.<\/p>\n<\/div>\n\n\n\n

\n

3<\/p>\n\n\n\n

Change of intended purpose<\/h3>\n\n\n\n

A system that was not high-risk is used in a way that makes it one.<\/p>\n<\/div>\n<\/div>\n\n\n\n

The third case applies to many organisations today. A team that built an internal tool on a general-purpose model and pointed it at supporting decisions about candidates may have changed the organisation\u2019s role without any board decision. Establishing the role is the first step.<\/strong> The scope of everything that follows depends on it.<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n

Scope of support<\/p>\n\n\n\n

What the work covers<\/h2>\n\n\n\n
\n
\n

AI use-case register<\/h3>\n\n\n\n

We establish where AI systems are already at work, who introduced them and on what basis. The register also covers tools built in-house and AI features in software the organisation bought for another purpose.<\/p>\n<\/div>\n\n\n\n

\n

Role and risk qualification<\/h3>\n\n\n\n

For each use case we establish the organisation\u2019s role and the category the system falls into. The regulation distinguishes prohibited practices and high-risk systems.<\/p>\n<\/div>\n\n\n\n

\n

Transparency towards individuals<\/h3>\n\n\n\n

We check where the organisation must inform people about interaction with a system or about artificially generated content.<\/p>\n<\/div>\n\n\n\n

\n

Human oversight<\/h3>\n\n\n\n

Oversight is a role, not a statement in a policy. We establish who exercises it, what authority they have and whether they are able to stop the system.<\/p>\n<\/div>\n\n\n\n

\n

Contracts and the supply chain<\/h3>\n\n\n\n

We review the terms of cooperation with tool vendors for the information, documentation and support the organisation needs to meet its own obligations.<\/p>\n<\/div>\n\n\n\n

\n

Documentation and evidence<\/h3>\n\n\n\n

We put in order the records showing how the organisation made its decisions on deployment and oversight. The same material answers questions from clients and auditors.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

\n

Ways of working<\/p>\n\n\n\n

Ways we can work together<\/h2>\n\n\n\n

We match the scope to where the organisation is today. Each option can be closed or extended into the next one.<\/p>\n\n\n\n

\n
\n

First step<\/p>\n\n\n\n

Review of AI use cases and qualification<\/h3>\n\n\n\n

For an organisation that does not yet have a picture of the situation.<\/p>\n\n\n\n

Result:<\/strong> a list of use cases, the organisation\u2019s role towards each of them and a report with priorities for the board.<\/p>\n<\/div>\n\n\n\n

\n

Putting order in<\/p>\n\n\n\n

Establishing AI governance<\/h3>\n\n\n\n

For an organisation after qualification. It covers the rules for using AI, keeping the register and the model of human oversight, along with the requirements towards vendors.<\/p>\n\n\n\n

Result:<\/strong> a plan of preparations for the dates on which the high-risk requirements apply.<\/p>\n<\/div>\n\n\n\n

\n

Ongoing support<\/p>\n\n\n\n

Standing advisory support<\/h3>\n\n\n\n

For an organisation that deploys AI continuously.<\/p>\n\n\n\n

Result:<\/strong> assessment of new deployments before launch, updates to the register and responses to changes in the law and questions from outside.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

\n

How it runs<\/p>\n\n\n\n

How we work together<\/h2>\n\n\n\n
\n
\n

STAGE 1<\/p>\n\n\n\n

Diagnostic call<\/h3>\n\n\n\n

We establish what the organisation already uses and where the need came from.<\/p>\n<\/div>\n\n\n\n

\n

STAGE 2<\/p>\n\n\n\n

Review of use cases<\/h3>\n\n\n\n

Conversations with process owners and a review of tools and contracts.<\/p>\n<\/div>\n\n\n\n

\n

STAGE 3<\/p>\n\n\n\n

Qualification and gaps<\/h3>\n\n\n\n

The role, the risk category and the difference between the current and the required state.<\/p>\n<\/div>\n\n\n\n

\n

STAGE 4<\/p>\n\n\n\n

Plan and implementation<\/h3>\n\n\n\n

Priorities, task owners and deadlines matched to the timeline of the regulation.<\/p>\n<\/div>\n\n\n\n

\n

STAGE 5<\/p>\n\n\n\n

Maintenance<\/h3>\n\n\n\n

Review of new deployments and updates to the register and documentation.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

What the board gains<\/h2>\n\n\n\n
\n

A picture of the situation.<\/strong> It is clear where AI is running and who is accountable for it.<\/p>\n\n\n\n

A settled role.<\/strong> The organisation knows whether it acts as a deployer or as a provider.<\/p>\n\n\n\n

Separated deadlines.<\/strong> It is visible what needs action now and what should be planned.<\/p>\n\n\n\n

A basis for deployment decisions.<\/strong> New AI projects are assessed before launch.<\/p>\n\n\n\n

Material for questions from outside.<\/strong> The answer for a client or an auditor rests on documents.<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

LabLogic<\/h3>\n\n\n\n

Runs the review and qualification, formulates recommendations and coordinates the work.<\/p>\n<\/div>\n\n\n\n

\n

The organisation<\/h3>\n\n\n\n

Makes the decisions, provides information about its processes and appoints task owners.<\/p>\n<\/div>\n\n\n\n

\n

Tool vendors<\/h3>\n\n\n\n

Provide technical documentation, instructions and the information needed for the assessment.<\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

\n

Context<\/p>\n\n\n\n

Where this meets other obligations<\/h2>\n\n\n\n
\n
\n

Data protection<\/h3>\n\n\n\n

Many AI use cases process personal data, so GDPR obligations apply in parallel. Information received from the system provider is used in the data protection impact assessment, and parts of that assessment can be incorporated into the fundamental rights impact assessment.<\/p>\n\n\n\n

external DPO support \u2192<\/strong><\/a><\/p>\n<\/div>\n\n\n\n

\n

Cybersecurity<\/h3>\n\n\n\n

Organisations covered by NIS2 and the Polish Act on the National Cybersecurity System (KSC) also assess AI tools as part of the supply chain.<\/p>\n\n\n\n

NIS2 and KSC readiness \u2192<\/strong><\/a><\/p>\n<\/div>\n\n\n\n

\n

Staff competence<\/h3>\n\n\n\n

The regulation requires measures supporting AI literacy among the people who use these systems. The scope and format are matched to roles.<\/p>\n\n\n\n

training matched to roles \u2192<\/strong><\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

\n
\n
\n

Who runs the work<\/p>\n\n\n\n

Knowledge that comes from practice<\/h2>\n\n\n\n

Over twenty years of work in technology, data protection and cybersecurity. Combining legal, organisational and technological perspectives makes it possible to assess an AI tool from the side of the provision and from the side of the deployment at the same time. Work is carried out in Polish and English.<\/p>\n\n\n\n

\n
Meet the expert<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n
\n

Direct contact with the expert<\/p>\n\n\n\n

Micha\u0142 Rutkowski<\/p>\n\n\n\n

LabLogic \u2014 support for and performance of the DPO role, NIS2 and KSC readiness, incident response, audits and training.<\/p>\n\n\n\n

M.Rutkowski@LabLogic.pl<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n

\n

Frequently asked questions<\/h2>\n\n\n\n
\n
Does the AI Act apply to us if we only use off-the-shelf tools?<\/summary>\n

Yes. The regulation also places obligations on organisations that merely deploy AI systems. Their scope depends on what the system is used for.<\/p>\n<\/details>\n\n\n\n

We heard the deadlines were postponed. Is there anything to do now?<\/summary>\n

The postponement covered the requirements for high-risk systems. Prohibited practices, the AI literacy obligation and the transparency obligations apply regardless of it.<\/p>\n<\/details>\n\n\n\n

When does an organisation using AI become its provider?<\/summary>\n

When it makes the system available under its own name, substantially modifies it, or uses it in a way that makes it a high-risk system. The last case happens with tools built in-house.<\/p>\n<\/details>\n\n\n\n

Does an AI tool in recruitment always mean a high-risk system?<\/summary>\n

Not always. What decides is the intended purpose of the system and the way it is used, not its mere presence in the recruitment process. That is why qualification is carried out for a specific use case.<\/p>\n<\/details>\n\n\n\n

Is a data protection impact assessment enough instead of a fundamental rights impact assessment?<\/summary>\n

It does not replace it, but it connects with it. Where the obligation has already been met in the data protection impact assessment, the relevant parts of it can be incorporated into the fundamental rights impact assessment.<\/p>\n<\/details>\n\n\n\n

Who supervises the application of the AI Act in Poland?<\/summary>\n

The Komisja Rozwoju i Bezpiecze\u0144stwa Sztucznej Inteligencji (the Commission for the Development and Security of Artificial Intelligence), established under the Act on Artificial Intelligence Systems. It cooperates with the authorities competent in other areas, including the data protection authority.<\/p>\n<\/details>\n<\/div>\n<\/div>\n\n\n\n

\n
\n
\n
\n

Book a diagnostic call<\/h2>\n\n\n\n

Let us start by establishing where artificial intelligence works in your organisation today and what role your organisation holds towards it. The call makes it possible to name the first sensible step before you decide on the scope of the work.<\/p>\n\n\n\n

Prefer to write straight away? M.Rutkowski@LabLogic.pl<\/a><\/p>\n<\/div>\n\n\n\n