Implementing artificial intelligence in an organisation does not begin with choosing a tool, but with answering the question of who we are in the AI value chain and what we are responsible for. This article sets out the relationship between the GDPR and the AI Act: from the roles of provider, deployer and controller, through algorithmic risks, the limits of lawfulness in the workplace and the rights of individuals, to the DPIA, the FRIA and the AI Governance model. It reflects the legal position following the entry into force of the Polish Act on Artificial Intelligence Systems and the postponement of the AI Act application dates by Regulation (EU) 2026/1744.
KG LEGAL Kiełtyka Gładkowski was pleased to be represented at the ABA International Law Section Fall Conference, held in London from 21–25 September 2026 at the magnificent Mansion House.
On 10 August 2026, MyDr, one of Poland’s largest providers of electronic medical records software, confirmed that it had been the target of a deliberate criminal attack on its systems. Two days later, the Ministry of Digital Affairs announced that the incident may affect close to 19 million individuals and more than 12,000 healthcare facilities, and that the exfiltrated database exceeds 2 terabytes.
The attackers supplied the security portal Zaufana Trzecia Strona with a data sample suggesting that they hold PESEL numbers (Polish national identification numbers) and at least fragments of prescription information.
The subject of this analysis is a marketing model for a physical product based on the use of influencer marketing combined with the environment of the game Minecraft. Online creators promote branded toys containing candy, widely available in retail sale, including in popular discount store chains. The campaign also involves creating and making available within Minecraft virtual counterparts of the promoted products, which function, inter alia, on servers, on maps and through game modifications.
