On 10 August 2026, MyDr, one of Poland’s largest providers of electronic medical records software, confirmed that it had been the target of a deliberate criminal attack on its systems. Two days later, the Ministry of Digital Affairs announced that the incident may affect close to 19 million individuals and more than 12,000 healthcare facilities, and that the exfiltrated database exceeds 2 terabytes.
The attackers supplied the security portal Zaufana Trzecia Strona with a data sample suggesting that they hold PESEL numbers (Polish national identification numbers) and at least fragments of prescription information.
The Legal Environment and Practical Aspects of Dual-Use Technology – the Ukrainian Conflict as a Lens on the Development of EU Regulation and the Polish Jurisdiction – Expanded Edition – Legal status as at 25 August 2026
Authors: attorney-at-law (radca prawny) K. Jakub Gładkowski (corporate practice, court and regulatory representation), attorney-at-law (radca prawny) Małgorzata Kiełtyka (M&A, high-technology and highly regulated sectors) – KG Legal Kiełtyka Gładkowski Spółka Partnerska Kancelaria Radców Prawnych; iSTART1 programme.
This material is of a popular-science and informational nature. It does not constitute legal advice or a binding opinion. Before citing any specific provision, the current consolidated version in EUR-Lex and the current entry in the Polish Journal of Laws (Dziennik Ustaw) should be verified in each case.
The development of artificial intelligence in medicine is no longer just a futuristic vision. Algorithms now support diagnostics, test result analysis, and disease prevention, and Polish medical law is beginning to address the challenges involved. The 2025 amendment to the Code of Medical Ethics explicitly addresses the use of AI by physicians for the first time, imposing obligations regarding patient information, obtaining informed consent, and the use of certified systems. However, the question arises: where does the role of technology end and the physician’s responsibility begin?
On June 3, 2026, the European Commission adopted a proposal for the Cloud and AI Development Act (hereinafter: CADA or the draft), which is the centerpiece of the broader European Technological Sovereignty Package. This draft seeks to translate the political concept of digital sovereignty into binding legal standards governing public procurement, the certification of cloud computing providers, and artificial intelligence infrastructure.
