I. Introduction

On June 3, 2026, the European Commission adopted a proposal for the Cloud and AI Development Act (hereinafter: CADA or the draft), which is the centerpiece of the broader European Technological Sovereignty Package. This draft seeks to translate the political concept of digital sovereignty into binding legal standards governing public procurement, the certification of cloud computing providers, and artificial intelligence infrastructure.

CADA focuses on 3 goals:

•          Pillar 1 – Research and Innovation: Support for next-generation technologies, frontier, industrial and physical AI; introduction of “grand challenges”; implementation of Experience and Acceleration Centres for AI.

•          Pillar 2 – Capacity: target to triple EU data centre capacity within 5-7 years; simplify and speed up construction permitting.

•          Pillar 3 – autonomy (core of regulation): a single EU framework for assessing cloud and AI sovereignty, a public sector adoption mechanism; an open source-first principle; and a common public procurement framework.

CADA fits into the broader EU digital policy framework, which includes the AI Act, Data Act, Data Governance Act, Digital Markets Act (DMA) and Digital Services Act (DSA), as well as soft law initiatives such as Gaia-X and the 2020 European Data Strategy. CADA takes a coordinated “ecosystem approach” as it combines supply-side actions to strengthen national capabilities, demand-side actions to drive deployment, and enablers for innovation and investment in cloud computing and AI.

“This initiative will connect networks, cloud, artificial intelligence, and software into cohesive ecosystems to address the following:

(1) future challenges related to energy-efficient computing infrastructure;

(2) autonomy across the entire cloud stack;

(3) advanced EU capabilities in advanced AI technologies, such as frontier AI, physical AI and industrial AI;

(4) implementing cloud and artificial intelligence in the public and private sectors.”

II. The concept of digital sovereignty and the “sovereign cloud” in EU documents

1. Origin of the concept

The concept of digital sovereignty (technological sovereignty) entered the vocabulary of the European Commission and the Council of the EU around 2020-2021 as a reaction to three phenomena: (1) the ongoing consolidation of the global cloud market in the hands of hyperscalers from the United States. à”The current situation in the cloud computing and artificial intelligence sector is characterized by a clear dependence on a limited group of third-country providers. Although the EU cloud computing market is growing significantly, the share of EU providers fell from 29% in 2017 to 15% in 2022 and has remained unchanged since then. Currently, three non-EU cloud computing providers control over 70% of the European cloud computing market… This dependency also exposes European users to the risk of disruptions, especially in situations where unilateral decisions by third-country entities could disrupt service provision.”

(2) legal risks related to the extraterritorial application of the US CLOUD Act of 2018, which allows US authorities to access data stored by US-based companies regardless of the location of the servers, and

(3) the CJEU judgments in Schrems I (2015) and Schrems II (2020), questioning the legal basis for transatlantic transfers of personal data. The Court of Justice of the EU (CJEU) invalidated the Privacy Shield Agreement, finding that US regulations did not guarantee EU citizens adequate protection of their personal data against surveillance. This forced the processing of sensitive data in Europe.

The Gaia-X initiative, launched in 2019 by Germany and France, was the first attempt to operationalize cloud sovereignty. The project’s main goals are:

• reducing Europe’s dependence on American and Chinese cloud providers (such as AWS, Google Cloud, Azure, Alibaba)
• Gaia-X does not build its own cloud, but creates rules, standards and trust mechanisms that allow different providers (small and large) to offer interoperable, compatible services.
• companies and institutions must maintain control over where and how their data is stored and processed, in accordance with European regulations (e.g. GDPR)
• common certification rules, trust labels (“Gaia-X Trust Framework”) and open API

However, the project was criticized for its slow pace and the influence of large American technology companies, which raised doubts about the sovereign nature of the undertaking.

2. Components of digital sovereignty according to the CADA project

The CADA project does not have a single, closed dictionary definition of “cloud/digital sovereignty.” Instead, the project develops the concept through a system of levels and assessment criteria.

Recital 51 of the Preambleà “it is necessary to establish a Union cloud computing sovereignty framework determining criteria for trusted cloud computing services. To cater for the nuanced and layered nature of sovereignty, the framework should provide for four different levels of trusted offers (‘Union assurance levels’).”

Recital 50 of the Preambleà “The Union and Member States being critically dependent on a limited number of cloud computing service providers subject to the control of a third country or a legal entity established in a third-country may lead to risks such as misuse (ie manipulation, remote access and control, sabotage, weaponization), access to information (ie access to sensitive information, unauthorized communication, technology leakage, data manipulation or exfiltration, espionage) and dependency vulnerabilities (ie political and/or economic coercion, for example by using vendor or technology lock-ins, embargos or sanctions, monopoly pricing damaging the financial interest of the Union and Member States).” – risks to sovereignty

Article 16à “This Chapter establishes a Union cloud computing sovereignty framework comprising four Union assurance levels, the criteria for which are set out in Annex II, that cloud computing service providers shall meet in order to provide their cloud computing services to Union entities and public sector bodies”

Annex IIà contains four cumulative sets of technical, legal and organisational criteria. “Software” within the meaning of the Annex includes Regulation 2024/2847 (Cyber Resilience Act). CADA in Annex II defines sovereignty in the field of cloud computing and artificial intelligence, comprising four levels of guarantees that public sector bodies will benefit from based on their risk assessments. Cloud service providers can be recognised by Member States under this framework after passing an audit. The Commission retains the competence to issue implementing acts identifying third countries whose providers would be subject to audits under the above system.

Level 1 (Basic) –  pt. 1

The lowest threshold, covering all public sector services:

• supplier’s registered office in the EU; infrastructure and assets in the EU (unless the customer expressly agrees otherwise);
• customer data (including metadata, telemetry) remains exclusively within the EU, unless a public authority decides otherwise;
• when outsourcing technical support outside the EU, the requirement of traceability and safeguards that do not undermine operational autonomy;
• compliance with current cybersecurity standards;
• full transparency regarding subcontractors;
• if the supplier is controlled by an entity from a third country – a guarantee of no obligation to report security vulnerabilities to the authorities of that country before their disclosure.

Level 2 (Standard) – point 2

It requires an audit (not just a declaration) and adds:

• mandatory location of infrastructure, assets and personnel in the EU;
• the possibility of requesting EU citizenship of staff (at the client’s request);
• cybersecurity certificate of at least “substantial” level (EUCS or national equivalent);
• prohibition on using customer data to train AI models operated by a third-country entity;
• if the supplier is subject to third-country control – requirement to demonstrate safeguards against: limiting the ability to provide the service, access to data, disruption of service continuity, enforcement of sanctions/embargoes;
• technical support only from the EU;
• transparency of the software supply chain (SBOM – Software Bill of Materials), control of components from third-country suppliers, source code audit;
• legal and technical separation between the EU parent company and the subsidiary in a third country.

Level 3 (Enhanced) – point 3

Adds important refinements:

• staff must be EU citizens and, when handling classified information, have a national security clearance;
• “substantial” cybersecurity certificate;
• as a rule, a ban on control by a third-country entity – except where the Commission issues an implementing act under Article 19 authorising such a supplier (in which case additional safeguards apply, including “reasonable access to the code”);
• technical support provided exclusively by EU residents and entities not subject to third-country control.

Level 4 (Sovereign) – point 4

Highest, most restrictive threshold:

• complete lack of control by a third country entity (without any exception authorised by the Commission, as opposed to Level 3);
• cybersecurity certificate at least “high”;
• staff – EU citizens with appropriate security clearances;
• for software components: requirement of effective control over design, development and maintenance – no third-country entity may have the ability to materially influence the technical development, maintenance priorities or continuity of the component

III. EU Cloud Sovereignty Framework

The EU Cloud Sovereignty Framework is also a key document defining the “sovereign cloud.” This document is not part of the CADA regulation itself, but a separate DG DIGIT methodological tool used in specific procurement procedures. Compared to the four-level Union Assurance Levels scale in CADA Annex II (levels 1–4, based on cumulative binary criteria—pass/fail), the SEAL framework is more detailed. According to it, digital sovereignty consists of eight elements.

Eight Components of Digital Sovereignty (SOV-1 to SOV-8)

Rating scale: Sovereignty Effectiveness Assurance Levels (SEAL)

Independently of the eight components, the document introduces a five-level maturity scale (SEAL-0 to SEAL-4) used to assess each of the eight objectives separately:

Sovereignty Score

The document also introduces percentage weightings for each of the eight components when calculating the aggregate sovereignty score in the tender process:

• Supply Chain (SOV-5): 20% – Highest Weight
• Strategic sovereignty (SOV-1) and operational sovereignty (SOV-4): 15% each
• Technological Sovereignty (SOV-6): 15%
• Legal/Jurisdictional (SOV-2), Data/AI (SOV-3), Security (SOV-7): 10% each
• Environmental Sustainability (SOV-8): 5% – Lowest Weight

The lower weights for SOV-2 and SOV-7 were justified by the fact that these areas are already covered by separate procedural safeguards in the procurement procedure itself.

IV. Impact of the CADA project on public procurement

One of the central mechanisms of CADA is the common EU-level procurement framework.

Recital 64 of the Preambleà The free flow of data within the EU is a prerequisite for the functioning of the internal market – data cannot be artificially limited to the territory of a single Member State. The EU pledges, in principle, open, non-discriminatory market access in accordance with the TFEU and international obligations (including the WTO GPA on Government Procurement).

However, the EU invokes Article III:2(a) of the WTO GPA, which allows for measures necessary to protect public order, public morality, or security. This justifies proportionate restrictions on access to public procurement based on the risk of critical dependencies, unauthorized access to EU data, technology leakage, sabotage, and espionage by third-country entities. Contracting entities whose activities are identified as relevant to public order are required to procure cloud services only at levels 2-4. At the same time, level 1 becomes the mandatory minimum for the entire EU public sector, providing a consistent baseline level of security.

Motif 65à To reduce vendor dependency, EU entities and Member States should consider a multi-vendor/multi-cloud strategy in their procurement processes, based on a contextual risk assessment that takes into account operational, regulatory and resilience circumstances.

Motif 66à Public procurement is treated as a directional signal for the entire market – requirements imposed on the public sector regarding levels of assurance tend to be imitated by the private sector in regulated industries. Article 31 allows private entities from sectors covered by Annex I of the NIS2 Directive to carry out similar assessments.

Article 29 àMember States and EU entities are required (annually or biannually) to carry out risk assessments that:

• identify public sector activities using cloud services in areas covered by Annexes I/II of the NIS2 Directive and in the spheres of national security, defence, justice and law enforcement;
• determine which assurance level (Union assurance level 2, 3 or 4) is appropriate for a given activity.

The Commission has the power to impose the methodology for this assessment by means of implementing acts and, if it considers the Member State’s assessment to be inadequate, to determine the required level itself (Article 29(5)).

Article 30à

Paragraph 2: entities whose activities are not classified as important for public order must use at least level 1 cloud services.

Paragraph 3: contracting entities whose activities have been so qualified (NIS2, national security, defence, justice sectors) may only procure cloud services classified as level 2, 3 or 4 .

Paragraph 4: allows for derogations in exceptional, justified cases (lack of available services on the market, lack of offers in the previous procedure, grossly disproportionate cost).

Art. 32 àIn procurement procedures for innovative cloud services and AI systems, contracting authorities must take into account non-price criteria for the evaluation of offers , including:

• the contractor’s contribution to strengthening the EU digital technology supply chain,
• the use of technologies developed in the EU (including the results of EU R&D programmes),
• providing the service using hardware components designed/manufactured in the EU.

Recital 67 clarifies that this criterion cannot be decisive and suggests an indicative maximum weighting of 15 points out of 120 in the tender evaluation methodology – it is intended to be subsidiary to the technical and financial criteria.

Article 33à Member States are to aim to ensure that at least 25% of procurement for cloud services and AI systems goes to innovative SMEs, and report annual data on SME participation in procurement to the Commission.

V. Relationship of the CADA project with existing EU legal acts

1. AI Act (Regulation 2024/1689)

The AI Act governs the security and fundamental rights of AI systems; the CADA governs the sovereignty of the infrastructure that supports these systems.

Art. 2 point 3 of CADA does not create its own definition of an AI system, but refers directly to the AI Act à”‘AI system’ means an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689″

Explanatory memorandumà “The proposal also reinforces key objectives of the AI Act. The AI Act harmonises rules for AI systems and general-purpose AI models to be placed on the EU market, improving the functioning of the internal market and promoting the uptake of human-centric and trustworthy AI along the value chain. The AI Act ensures a high level of protection of health, safety and fundamental rights. It does not cover aspects of sovereignty.” – The Commission explicitly states that the AI Act does not cover the issue of sovereignty – this is the very gap that CADA aims to fill.

CADA entrusts the AI Board (the body established under the AI Act) with a coordinating role beyond its original mandate:

• Motif 33à “As cloud computing underpins and enables AI, the AI Board should serve as a platform to facilitate cooperation and coordination of AI adoption-related activities between the Union and the Member States.”
• Article 7(6) gives the AI Board a specific operational responsibility: to advise and support Member States in coordinating national cloud and AI strategies required by CADA, and to facilitate the exchange of good practices between Member States.

This is an important institutional arrangement: CADA does not create a new, parallel body for AI issues, but extends the remit of the existing body from the AI Act to a new area (cloud as an infrastructure supporting AI).

2. Data Act (Regulation 2023/2854)

The Data Act, effective from September 2025, imposes obligations on cloud service providers to facilitate data portability and switching. CADA builds on this foundation by adding a dimension of sovereignty: it’s no longer just about data portability, but also about ensuring that data remains under the sole jurisdiction of the EU throughout its time in the cloud. The two acts create a complementary layer of protection: the Data Act allows for switching providers, and CADA establishes criteria for which alternative cloud services are considered sufficiently sovereign. Without CADA, the Data Act’s switching mechanism would be “blind” to the quality or sovereignty of the target provider.

“”The proposal is consistent with the rules on switching between data processing services introduced by the Data Act. By enabling switching and removing key sources of vendor lock-in, the Data Act seeks to ensure that cloud computing service providers in the EU compete on quality, innovation, and price. It seeks to enable cloud users to freely choose the provider that best meets their needs and combine offers of different providers in a multi-cloud approach.”

“However, the Data Act does not contain elements to shape up a more competitive offer of European cloud computing services or encourage the entry into the market of a more diverse set of cloud computing service providers.”

“The Data Act opens the path towards a possible reduction of dependencies on non-EU providers but does not build the road towards a more sovereign and trusted EU cloud computing sector. […] The Data Act is thus an enabler for the proposal.“

3. Data Governance Act (Regulation 2022/868)

The Data Governance Act, effective from September 2023, establishes a framework for neutral data intermediaries and the reuse of public sector data. The CADA does not explicitly address the DGA in its text. However, it imposes sovereign certification requirements on the infrastructure storing this data, which in practice limits the range of providers deemed suitable for handling data covered by the DGA.

4. Digital Markets Act

The DMA, effective from May 2023, imposes obligations on gatekeepers, including interoperability requirements and prohibition of self-preferential services. CADA and DMA operate under different logics: DMA regulates market behavior ex ante, while CADA creates positive eligibility criteria for the public sector. There is a risk of conflict between the interoperability obligations with the DMA and the closed architectures required by the highest levels of CADA sovereignty.

5. Digital Services Act and the general regulatory context

The DSA, fully applicable since February 2024, governs the liability of online intermediaries. Although it does not directly address cloud infrastructure, it contributes to a regulatory climate characterized by high levels of EU intervention in the digital market and increasing assertiveness towards global technology providers.

“While certain providers of cloud computing services could be regulated under both this proposal and the DMA, the DMA has different objectives and does not contain measures that would actively promote the uptake of sovereign cloud computing services . The DMA only aims at maintaining and promoting a fair and contestable cloud market in the Union, regulating specific behaviors of companies designated as gatekeepers and thus intervenes at a different level than the proposal, which focuses on the uptake and use of the services provided.”

VI. Arguments in favor of introducing CADA regulations

• Security and strategic independence: AWS, Microsoft Azure, and Google Cloud control approximately 70-80% of the EU cloud computing market. This concentration means that key EU administrative, banking, and healthcare systems are de jure accessible to US authorities under the US CLOUD Act (the CLOUD Act gives US law enforcement and intelligence agencies the right to demand access to data from US service providers (including cloud computing providers)  – regardless of the physical location of the servers on which that data is stored.) – which EU authorities classify as a security risk. CADA will help mitigate this risk by introducing a complex system of vendor evaluation criteria.
• Risk of service interruptionà “This dependence also exposes European users to the risks related to operational discontinuity, particularly in scenarios where unilateral decisions by third-country actors could disrupt service provision.”
• Critical loss of market position for European providers – “While the EU market for cloud computing services is growing significantly, the market share of EU providers decreased from 29% in 2017 to 15% in 2022 and has remained stagnant since then.” CADA will help them regain their strategic position.
• Industrial and investment goal: The project assumes tripling the capacity of data centers in the EU within 5–7 years, which will significantly improve the efficiency and functionality of the AI system in the EU àtoday: “The EU’s limited data center capacity poses a significant threat to its ability to benefit from the digital transformation and adopt AI-driven solutions, notably those requiring low-latency compute capacity.” The lack of appropriate infrastructure also hinders the EU’s economic growth: “the lack of data center capacity in the EU forces European enterprises to route critical workloads through foreign hyperscaler infrastructure. This makes the EU a less attractive destination for tech investment than regions with more abundant, lower-cost compute resources.”
• Enabling the use of the EU’s own potential – “Europe has world-class research and development capabilities, vibrant open-source communities and a strong industrial base in cloud and AI, which however remain largely untapped.“

VII. Tensions with Single Market Principles and Competition Law

The CADA project, whose legal basis is Article 114 and Article 173(3) TFEU (harmonisation of the internal market and strengthening of the EU’s industrial competitiveness), is consciously constructed by the Commission as a means of removing internal market barriers – the argument justifying the intervention is precisely the divergence of national sovereignty criteria and procurement practices, which hinders suppliers from operating freely between Member States.

Despite this declared harmonisation logic, the practical effect of the sovereignty criteria at levels 3-4 (complete lack of control by a third-country entity, EU citizenship of staff, location of the entire infrastructure in the EU) may in fact restrict the freedom to provide services by non-EU suppliers in the EU internal market. However, the Act itself does not explicitly address this potential tension with Article 56 TFEU – the Commission locates the justification for procurement restrictions not in primary EU law, but in the public policy exception in Article III:2(a) of the WTO GPA (recital 64), consistently using the category of “public order” as the substantive basis for the restrictions (recitals 49-53).

The question whether the criteria thus constructed – despite their declared technological neutrality – in fact constitute a measure having an effect equivalent to a quantitative restriction or infringe the principle of proportionality required for derogations from the internal market freedoms remains open and not determined by the text of the act itself – this would require an assessment by the Court of Justice of the EU in a possible preliminary ruling procedure or an action for annulment.

Application

It is believed that despite the weaknesses identified earlier, the CADA project offers more benefits than threats – especially in the context of growing cyber warfare, where information, not just physical critical infrastructure, becomes the primary weapon.

Data collected by healthcare providers, the banking sector, and digital service providers is strategic in nature – its confidentiality and integrity today determine the security of citizens to a degree comparable to energy or military security. As the Schrems II case demonstrated, no contractual safeguards effectively protect against a situation in which an infrastructure provider is legally obligated to disclose data to third-party authorities – regardless of the physical location of the servers. CADA addresses precisely this gap: it no longer regulates only the method of data processing, but also the structure of control over the entity that manages it. This seems to me a necessary step, not an unnecessary one.

The complete dependence of the European digital economy on external infrastructure providers would limit its ability to fully develop – particularly in the field of artificial intelligence, where control over training data and computing infrastructure is becoming a key factor in competitiveness. The European Union possesses significant research and development resources, which currently remain largely untapped due to the lack of coherent institutional and regulatory support to fully develop their potential. CADA, by combining infrastructure investments with preferential procurement criteria, is attempting to fill this gap.

A mechanism to level the playing field for smaller European providers is also crucial. Automatic recognition of compliance for SMEs at the basic assurance level and the goal of at least a quarter of cloud and AI service contracts going to innovative SMEs create a real stimulus for development—not just a barrier for large entities. Such a competitive boost could, in the long run, motivate European providers to continually improve the quality and innovation of their services, rather than remain permanently in the shadow of foreign hyperscalers.

Finally, the planned tripling of data centre capacity in the EU over the next 5-7 years is an investment not only in sovereignty, but also in the security of the data itself – a distributed, redundant infrastructure located within the EU reduces the risk of systemic failures, service interruptions or abuses resulting from unilateral decisions by foreign entities.

Artykuł NOTE – EU Cloud and AI Development Act (CADA) project and the concept of the sovereign cloud in the European Union’s digital policy pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

We are delighted to share an important milestone in the continued development of KG Legal’s Data, AI & Cybersecurity Desk.

It has been a great honour to serve as the exclusive expert contributors for Poland to the OneTrust DataGuidance Privacy Overview – Poland, one of the world’s leading professional legal compliance resources relied upon by in-house counsel, privacy professionals, compliance officers, multinational organisations and technology companies operating across multiple jurisdictions.

Preparing this contribution was a long-term project that required several months of intensive legal analysis, research and editorial work. Our objective was not simply to describe the application of the GDPR in Poland. Instead, we sought to create a practical and comprehensive guide reflecting the significant transformation of the Polish regulatory landscape that has taken place in recent years as a result of new European legislation and its implementation into Polish law.

The publication therefore extends far beyond a traditional overview of Polish data protection law. It examines the interaction between privacy, digital regulation, cybersecurity and artificial intelligence, providing readers with practical guidance on the most important legal developments affecting organisations operating in Poland.

Our contribution discusses, among other things:

• the practical application of the GDPR within the Polish legal system;
• the powers and regulatory practice of the Polish supervisory authority for personal data protection;
• employee monitoring and workplace privacy;
• cookies, consent mechanisms and online tracking technologies;
• electronic communications and direct marketing requirements;
• international data transfers;
• personal data breaches and notification obligations;
• practical compliance with Polish privacy legislation;
• cybersecurity-related regulatory developments;
• the growing interaction between data protection and artificial intelligence governance.

A particularly important aspect of this work was addressing the rapidly evolving legislative environment. During the last few years, Poland has experienced substantial regulatory changes resulting from the implementation of numerous European legal instruments and the entry into force of directly applicable EU regulations that significantly affect organisations processing personal data.

Accordingly, the publication takes into account the practical implications of the evolving European digital regulatory framework, including the interaction between the GDPR and newer legal instruments governing digital services, artificial intelligence, cybersecurity and data governance. The analysis also reflects the impact of the AI regulatory framework, developments concerning data governance and electronic communications, as well as the increasingly interconnected compliance obligations facing businesses operating in today’s digital economy.

Rather than presenting legislation in isolation, the publication adopts a practical, compliance-oriented perspective. It combines:

• the GDPR and Polish implementing legislation;
• guidance issued by the European Data Protection Board (EDPB);
• the jurisprudence of the Court of Justice of the European Union;
• decisions and regulatory guidance published by the Polish Personal Data Protection Office (UODO);
• recent Polish legislative developments and market practice.

Our ambition was to create a resource that would assist both international and domestic organisations in navigating one of the fastest-changing areas of European regulation, where privacy law increasingly intersects with cybersecurity, AI governance, digital platforms, online communications and emerging technologies.

The contribution was prepared by Małgorzata Kiełtyka and Jakub Gładkowski, whose combined experience covers complex cross-border advisory work in data protection, artificial intelligence, life sciences, healthcare, technology law, cybersecurity, intellectual property and regulatory compliance.

https://www.dataguidance.com/experts-directory/Jakub_G%C5%82adkowski

https://www.dataguidance.com/experts-directory/Malgorzata_Kieltyka

For many years, Małgorzata Kiełtyka has advised international companies on GDPR compliance, healthcare regulation, AI governance, technology transactions and cross-border regulatory matters. Her practice combines strategic legal advice with practical implementation of compliance frameworks for multinational businesses operating in highly regulated sectors.

Jakub Gładkowski focuses on data protection, digital regulation, cybersecurity, intellectual property, IT law and emerging technologies. His practice includes advising innovative businesses on regulatory compliance, digital transformation projects and the implementation of European technology legislation affecting both public and private sector organisations.

Being entrusted with preparing Poland’s national contribution to OneTrust DataGuidance represents an important recognition of our team’s expertise and international standing. We are particularly proud that this publication reflects not only our experience in privacy law, but also our broader interdisciplinary approach, integrating data protection with AI regulation, cybersecurity, digital compliance and technology law.

We sincerely thank the editorial team at OneTrust DataGuidance for their confidence in our expertise and for the opportunity to contribute to a publication that supports legal and compliance professionals around the world.

For KG Legal, this publication marks another significant milestone in the continued growth of our Data, AI & Cybersecurity Desk and reinforces our commitment to delivering practical, business-oriented legal advice at the intersection of privacy, technology and innovation.

Artykuł A Major Milestone for KG Legal’s Data, AI & Cybersecurity Practice: Exclusive Poland Contribution to OneTrust DataGuidance pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The dynamic development of artificial intelligence-based technologies is revolutionizing not only the commercial sector but also the area of state oversight of the digital market. The implementation of multi-agent systems by the Office of Competition and Consumer Protection (UOKiK) opens a new era in consumer rights enforcement, enabling the mass and automated identification of unfair market practices. With the Digital Services Act (DSA) and the Omnibus Directive in force, traditional control methods are giving way to algorithmic interface analysis aimed at eliminating so-called dark patterns and price manipulation. However, the use of “digital controllers” raises fundamental questions for legal science and business practice about the limits of automated decision-making processes in public administration. Although AI agents significantly improve the effectiveness of detecting violations, their legal status as a source of evidence remains the subject of heated debate. The main thesis is that while AI can be a powerful auxiliary tool for regulatory bodies, the ultimate responsibility for determining the facts and assessing the legitimate interests of a party must rest with humans, which is the foundation of a fair procedure in a state governed by the rule of law.

Dark Patterns: Legal and Ethical Aspects of Prohibiting Manipulation in Digital Interfaces

A key obligation of internet platform providers in light of modern regulations is to design interfaces in a transparent and ethical manner. The prohibition of manipulation, formulated, among others, in the Digital Services Act (Article 25), directly affects the structure of so-called deceptive interfaces (dark patterns). Websites and applications cannot be designed in a way that limits the recipient’s cognitive autonomy, interferes with their ability to rationally assess the situation, or forces them to make a purchasing decision that they would not have made under other circumstances.

One of the most glaring examples of such violations is the asymmetry in the contract conclusion and termination process, particularly evident in subscription models. This mechanism relies on extreme simplification of the purchase path while simultaneously mounting procedural barriers when attempting to cancel the service. Visual techniques are used here, among other things: payment activation buttons are highlighted with bright colors and a central location, while contract termination options are deliberately hidden at the bottom of the page, written in small font or masked with colors that blend with the background. Furthermore, canceling a subscription on online platforms often requires multiple selections or confirmation of the desire to cancel, despite the consumer’s prior explicit choice. Artificial intelligence algorithms, analyzing the page structure and visual hierarchy of elements, can pinpoint these disparities with mathematical precision, creating a list of violations that serves as hard evidence.

In the context of the Omnibus Directive, the obligation to disclose the lowest price 30 days before the discount has become a market standard, but its implementation is open to abuse. The practice of “empty promotions” involves artificially inflating the base price just before a planned discount or providing a false reference amount. In this area, AI agents demonstrate particular effectiveness, acting as real-time monitoring systems; they can archive the price history of each product, creating an independent database. Comparing this information with the entrepreneur’s declaration visible on the website allows for immediate detection of manipulation of the promotional algorithm.

An equally important area of control is the phenomenon of drip pricing , or hiding the real costs of a transaction until the final stage of the shopping cart. Businesses often employ a “decoy” strategy, presenting an attractive unit price, which, at the time of order finalization, is increased by mandatory, previously undisclosed costs, such as service fees, packaging costs, or payment processing fees. Pursuant to Article 12 of the Consumer Rights Act, businesses are obligated to clearly and understandably inform consumers about, among other things, the total price for the proposed service. Automated control systems are capable of conducting a full simulation of the purchasing process, from product selection to the payment gateway. Any discrepancy between the price presented in the product list and the amount required to complete the contract is reported by AI as an attempt to circumvent disclosure obligations and a direct violation of the collective interests of consumers.

According to Article 5 of the Act on Combating Unfair Market Practices, the key criterion for assessing a trader’s behavior is the impact of their actions on the recipient’s decision-making process. A market practice is considered misleading if “this action in any way causes or is likely to cause the average consumer to make a transactional decision that they would not otherwise have made”. The legislator specifies that both “spreading false information” and “spreading true information in a manner that is likely to be misleading” can constitute an infringement. In the digital environment, these manipulations most often focus on the “existence of a product, its type, or availability.” A common method of exerting unjustified pressure on consumers is the use of social proof mechanisms and an artificial sense of scarcity. This manifests itself in messages such as: “this product is now being viewed by x people,” “x items have already been purchased today,” or displaying timers indicating that “only 30 minutes left until the end of the promotion.” Particularly problematic from the perspective of trade ethics is the use of so-called false advertising. Timers – clocks counting down to the finale of a supposedly unique price opportunity. In reality, these are fake mechanisms, as after the specified deadline, the offer remains active and the product price remains unchanged or becomes even more favorable. This type of activity, a classic example of dark patterns, is designed to induce fear of missing out (FOMO) in customers and induce them to rush into a transaction. Using AI agents allows regulators to serially monitor such counters and prove their cyclical recurrence, providing direct evidence of deceptive practices.

The algorithm as a controller

With millions of transactions taking place across the country in just a few minutes or hours, standard order verification procedures prove insufficient to effectively fulfill the statutory responsibilities of supervisory authorities. Technological advancements in the form of AI algorithms come to the rescue. These algorithms can automatically monitor numerous commercial transactions simultaneously, generating preliminary opinions that are ultimately subject to human review. Such systems not only save significant processing time but, above all, enable oversight of a much broader range of businesses and their online platforms. The AI multi-agents used in this process are virtual “consumer robots” capable of mass-auditing e-commerce websites, simulating the natural behavior of online users to detect irregularities that a human controller would be unable to detect on such a large scale.

To conduct reliable and effective inspections, Polish law already offers supervisory authorities a toolkit in the form of the “mystery shopper” institution. Traditionally, this involves a person unrelated to the inspected company or the inspecting authority making a purchase and then completing a survey regarding specific activities they observe during standard shopping. The implementation of AI technology by the Office of Competition and Consumer Protection (UOKiK) aims to entrust AI multi-agents with the role of such digital “mystery shoppers.” Their task is to interact with the website interface, add a product to the cart, and complete the entire purchasing process without disclosing that this activity is being performed by an algorithm or that it is part of an official inspection procedure. This approach allows for direct verification of whether the entrepreneur is not using prohibited manipulative practices, known as dark patterns. However, it should be emphasized that the activity of AI multi-agents is strictly regulated by legal procedures and cannot be arbitrary. The algorithm operates under the strict supervision of the President of the Office of Competition and Consumer Protection, who, pursuant to Article 105ia of the Act on Competition and Consumer Protection, must always obtain prior consent from the Court of Competition and Consumer Protection. This mechanism serves as a key safeguard against abuse of power. Furthermore, after completing the inspection, the office is obligated to immediately provide the entrepreneur with an official ID and authorization for the inspection. In the age of digital administration, this obligation can be fulfilled electronically immediately after the AI multi-agents withdraw from the sales platform.

The key legal framework for the operation of algorithms commissioned by the regulator is provided by the EU AI Act. According to its provisions, AI systems used by public authorities for control and supervisory purposes should be considered high-risk AI systems. This entails a strict requirement to design them with appropriate transparency, which allows both the controlling and the controlled entities to properly interpret the system’s results and use them fairly. In practice, this means that algorithms must be built in an “explainable” model. A business subject to allegations based on an algorithmic audit has the statutory right to request full insight into the operation of AI tools. This transparency is essential for the controlled entity to understand the basis and criteria on which the authority deemed its online platform unfair or infringing on the collective interests of consumers (Article 24). This balance between the effectiveness of digital supervision and the right to defense is the foundation of a modern rule of law in the age of algorithms.

The opinion of AI multi-agents as evidence in the case

After completing the inspection activities on the entrepreneur’s online platform, the AI algorithm’s role evolves towards an analytical function, consisting of preparing an opinion indicating detected violations. In the context of potential proceedings against an entity employing unfair market practices, the admissibility of using such an analysis as valid evidence becomes a key issue. Pursuant to Article 7 of the Code of Administrative Procedure (hereinafter referred to as the Code of Administrative Procedure), which establishes the principle of objective truth, a public administration body is obligated to take all steps necessary to thoroughly clarify the factual circumstances. This obligation is consistent with Article 75 § 1 of the Code of Administrative Procedure, which introduces an open catalog of evidence, allowing as evidence anything that may contribute to the clarification of the case, provided it is not contrary to the law.

Under these regulations, the results of AI multi-agent work – taking the form of reports, opinions, or analyses generated after conducting an audit with court approval – fully fall within the statutory definition of evidence. However, it should be clearly stated that an AI opinion cannot be equated with an expert opinion within the meaning of Article 84 of the Code of Administrative Procedure. This stems from the fact that an algorithm does not possess the status of a natural person equipped with specialized knowledge, which is a statutory requirement for appointing an expert. Instead, documentation generated by an AI agent should be classified as a private document or so-called “unnamed evidence.”

Practical justification for this position can be found in the case law concerning digital evidence. The judgment of the Court of Appeal in Szczecin of September 19, 2016, I ACa 364/15, LEX no. 2147337 aptly describes this issue, pointing out that evidence in a case may include official and private documents, but also means other than those listed in Articles 305-308 of the Code of Civil Procedure. Electronic evidence, currently increasingly used in civil proceedings, is not explicitly listed in the catalog of means of evidence. However, the Code of Civil Procedure does not contain a closed list of evidence sources; anything relevant to the case may constitute evidence. Although the above ruling was issued in the context of civil procedure, due to the identical approach to the openness of the evidence system, it remains fully applicable to administrative proceedings conducted by the President of the Office of Competition and Consumer Protection.

The key element of algorithmic evidence remains the human factor, which serves as a primary safeguard over the autonomous operation of technology. It’s important to note that AI multi-agents, despite their high sophistication, operate based on statistical probability models, which carries the risk of misinterpreting dynamic website elements. For example, the system may incorrectly classify a standard technical error as intentional dark web activity. patterns or misinterpret the interface’s intentions in a specific cultural or linguistic context. Therefore, opinions generated by AI agents cannot constitute a standalone and final basis for a decision, but should be subjected to thorough, critical review by an official. Only such a comparison of the “raw” algorithmic result with human knowledge and experience allows for avoiding errors that could lead to unjustified penalties. This approach is directly supported by Article 80 of the Code of Administrative Procedure, according to which a public administration body assesses whether a given circumstance has been proven based on the entirety of the evidence. In this process, the “AI opinion” is only one of many components that must be weighed against other evidence and evaluated through the prism of principles of logic and life experience, ultimately guaranteeing the implementation of the principle of objective truth and protecting the entrepreneur from the automaticity of decisions made by the algorithm.

Summary

Multi-agent system implemented by the Office of Competition and Consumer Protection for automatic control of the e-commerce sector poses a significant challenge for entrepreneurs, forcing strict compliance with regulations regarding dark patterns, price transparency (Omnibus Directive, Art. 6a) and information obligations (Consumer Rights Act, Art. 12). These tools are used to mass detect manipulative practices such as drip pricing, fake timers or making it difficult to unsubscribe. Although AI agents perform a function similar to “mystery shoppers,” their activity must meet the rigors of Article 105ia of the Act on Competition and Consumer Protection, including the requirement to obtain court consent for a controlled purchase. What is crucial from a procedural perspective is that the findings made by the algorithm do not have the status of an expert opinion within the meaning of Article 84 of the Code of Administrative Procedure (lack of the status of a natural person with specialist knowledge), but constitute only a private document or “other evidence” subject to the authority’s free assessment (Article 80 of the Code of Administrative Procedure).

Consequently, the official is required to subject AI reports to thorough human review to eliminate the risk of misclassification resulting from so-called “AI hallucinations” or technical errors in the interpretation of the website’s code. The entrepreneur has full rights of defense based on the principle of active participation of the party (Article 10 of the Code of Administrative Procedure) and the principle of objective truth (Article 7 of the Code of Administrative Procedure), which means the right to question the bot’s logic and to access the instructions and parameters of the AI system, in accordance with the “explainability” requirement enshrined in the AI Act (Article 13). Any decision based solely on the automated generation of conclusions, without providing the party with an opportunity to comment on the evidence (Article 81 of the Code of Administrative Procedure), constitutes a gross violation of administrative procedure and may constitute an effective basis for challenging the authority’s decision.

Sources:

Regulation 2022/2065 on the single market for digital services and amending Directive 2000/31/EC (Digital Services Act) (OJ EU L 277, 2022, No. 277, p. 1, as amended).

Directive (EU) 2019/2161 of the European Parliament and of the Council of 27 November 2019 amending Council Directive 93/13/EEC and Directives 98/6/EC, 2005/29/EC and 2011/83/EU of the European Parliament and of the Council as regards the better enforcement and modernisation of Union consumer protection rules (OJ L 328, 2019, p. 7, as amended).

Act of 30 May 2014 on consumer rights (consolidated text: Journal of Laws of 2024, item 1796, as amended).

Act of 23 August 2007 on counteracting unfair market practices (consolidated text: Journal of Laws of 2023, item 845).

Act of 16 February 2007 on competition and consumer protection (consolidated text: Journal of Laws of 2025, item 1714).

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) Text with EEA relevance (OJ L 1689, 2024).

Act of 14 June 1960, the Code of Administrative Procedure (consolidated text: Journal of Laws of 2025, item 1691).

Judgment of the Court of Appeal in Szczecin of 19 September 2016, I ACa 364/15, LEX no. 2147337.

Artykuł Multi-agent system in the service of the Polish Office of Competition and Consumer Protection – a new era of e-commerce control and the limits pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

Publication date: July 07, 2026

– the first edition of a new nationwide event dedicated to the defence, security and resilience of the state

On June 19-20, 2026, representatives of our law firm will participate in the Warsaw Defense Trade Fair (WTO 2026), which will be held at the EXPO XXI Exhibition Center in Warsaw. This is the first edition of a completely new trade fair and conference event, created in response to the growing importance of the defense sector, national security, and technologies supporting Poland’s institutional, economic, and social resilience. The fair is held under the honorary patronage of the Ministry of Interior and Administration and the Minister of National Defense. The event is informally referred to as a “mini-MSPO in Warsaw” – a capital city-based, intimate alternative to the September International Defense Industry Fair in Kielce, open not only to professionals but also – on the second day – to the general public.

The goal of the Warsaw Defense Fair is to integrate key groups responsible for national security and to create a space for dialogue, collaboration, and exchange of experiences between public administration, the military, uniformed services, the defense industry, the technology sector, the investor community, and military universities. The event combines exhibition, conference, and networking elements , creating a platform for showcasing modern technologies, exchanging expert knowledge, and building business relationships in one of the fastest-growing sectors of the Polish economy.

The trade fair program is divided into two complementary days, representing one of the most distinctive solutions adopted by the organizers. Friday, June 19, 2026, will be an industry day (B2B/B2G), intended exclusively for companies, institutions, and business partners. Industry registration is required. This day will be a platform for meetings and discussions between individuals and entities interested in establishing cooperation in the defense and security sector, including representatives of public administration and local governments, soldiers and uniformed services, representatives of companies in the defense and technology sectors, investors, industry advisors, and representatives of military universities. The program focuses on key challenges facing the defense and national security sectors, including conferences, panel discussions, and business and institutional meetings concerning the development of the Polish defense industry, modernization of the Armed Forces, public procurement in the defense sector, and cross-sectoral cooperation.

Saturday, June 20, 2026, will be an open day (B2B/B2G/B2C), also open to the public interested in security, defense, and shooting. The second day significantly complements the industry portion and expands the event to include the general public, as well as educational and outreach communities. It will feature demonstrations of equipment and technologies in near-operational settings, demonstration zones by exhibitors and manufacturers, presentations of solutions in cybersecurity, drones, communications, and critical infrastructure protection, as well as numerous lectures for enthusiasts. Topics covered include firearms licenses – myths and legal realities, training and shooting sports, hearing and eye protection, safety and ergonomics at the shooting range, and civic preparedness for crisis situations.

Exhibitors and thematic scope

Over 100 exhibitors will be present at the fair, representing a full cross-section of entities active in the Polish defense and security sector. Exhibitors include military units such as the 1st Warsaw Armored Brigade and the 18th Capital Territorial Defense Brigade, international technology companies, including 3M Poland, which presents personal protection solutions for the defense sector, and Artec 3D with 3D scanners used in military applications. The shooting and equipment segment will be strongly represented, with companies such as House of Guns , Hubertus Pro Hunting , Kaliber, 4HUNTING, Kolba, 4SHOOTER, Son of Gun , Jammas , and Wolfer. Group and Works11. The event is also partnered by the Legia Warsaw Central Military Sports Club – Shooting Section.

The exhibition covers cutting-edge weapons, equipment, facilities and technologies used in the defense and security sector: unmanned systems and drones, cybersecurity solutions, tactical communications and communication technologies, critical infrastructure protection, personal protective equipment, 3D scanning and simulation technologies, individual soldier equipment, as well as solutions in the area of civil defense and population protection.

Three conference stages and a substantive agenda

The WTO 2026 program will unfold simultaneously across three conference stages. The industry day will be dedicated to the most important strategic challenges facing the defense sector – the technical modernization of the Polish Armed Forces, the development of the domestic arms industry, cooperation with foreign partners, public procurement in the defense sector, new dual-use technologies , and the role of the private sector in building national resilience. The second day, open to the public, will feature lectures and discussions covering a much broader range of topics – from legal issues concerning access to weapons and individual security, through shooting sports and defense training, to preparing society for crisis situations and disseminating knowledge about modern defense technologies.

The significance of the event from a legal perspective

The establishment of the Warsaw Defense Fair is part of the broader context of the dynamic development of the Polish defense sector, which in recent years has become one of the most important areas of public and private investment, generating significant demand for legal services. From the firm’s perspective, issues related to public procurement in the defense sector, regulations regarding trade in arms and dual-use technologies, export controls, protection of classified information, cybersecurity in the context of the NIS2 directive, intellectual property rights in defense technology projects, and financing of projects from European funds (including the European Defense Fund and ASAP), as well as the development of regulations regarding artificial intelligence in military applications in light of the European AI Act . The participation of representatives of the KG LEGAL KIEŁTYKA GŁADKOWSKI law firm in this event is a natural element of tracking the development of one of the fastest-growing sectors of the Polish economy and building competences in the area of law related to new defense technologies.

The Warsaw Defense Fair 2026 demonstrates that security and defense are no longer the exclusive domain of the military and state administration. They have become an area of broad cross-sectoral cooperation, with technology companies, investors, academia, non-governmental organizations, and informed citizens playing key roles. The development of this sector today requires not only advanced technological competencies but also an appropriate legal, regulatory, and institutional environment.

Link to the event: https://wto26.exposupport.pl/program

#WarsawDefenceExpo #WTO2026 #WarszawskieTargiObronne #DefenceIndustry #DefenseIndustry #DefenceExpo #DefenseExpo #PolishDefenceIndustry #PolishArmedForces #NationalSecurity #StateResilience #CivilDefence #HomelandSecurity #DefenceTechnology #DefenseTech #MilitaryTechnology #MilitaryInnovation #DualUseTechnology #DefenceProcurement #PublicProcurement #ArmsTrade #ExportControl #ClassifiedInformation #CyberSecurity #NIS2 #CriticalInfrastructure #InfrastructureProtection #UnmannedSystems #Drones #UAV #TacticalCommunications #PersonalProtectiveEquipment #3DScanning #AIinDefence #AIAct #ArtificialIntelligence #EuropeanDefenceFund #EDF #ASAP #IntellectualProperty #DefenceIP #TerritorialDefence #WOT #ArmedForces #MilitaryModernization #SportShooting #FirearmsLaw #WeaponsPermits #ShootingSports #RangeSafety #CrisisPreparedness #EmergencyPreparedness #Resilience #B2B #B2G #EXPOXXI #Warsaw #Warszawa #Poland #MONRP #MSWiA #MiniMSPO #DefenceConference #SecurityConference #LegalTech #LawFirm #KGLegal #KieltykaGladkowski

Artykuł Representatives of our law firm KG LEGAL KIEŁTYKA GŁADKOWSKI will take part in the Warsaw Defence Fair 2026 pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The Digital Omnibus is a comprehensive draft of two regulations of the European Parliament and Council, the most important part of a broader package of changes to data regulations (especially personal data) and those regulating the digital market in the EU. The changes aim to stimulate innovation and the development of the European artificial intelligence market, and to introduce solutions that could save businesses capital (estimated at up to €4 billion in total by 2029). The changes aim to ensure that businesses of all types, from factories to start-ups, spend less time and money on administration and maintaining the documentation required by current EU regulations.

The draft amendments consist of two regulations:

• Digital Omnibus, which introduces changes to many important EU regulations already in force, such as:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L. of 2016, No. 119, p. 1, as amended).

Regulation (EU) 2018/1724 of the European Parliament and of the Council of 2 October 2018 on establishing a single digital gateway to provide access to information, procedures and assistance and problem-solving services and amending Regulation (EU) No 1024/2012 (OJ EU L 295, 2018, p. 1, as amended).

Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and the free movement of such data , and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ EU L 295, 2018, p. 39).

Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (” Data Act “) (OJ L 2854, 2023, item 2854, as amended).

Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 2002, p. 37–47)

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 concerning measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972 and repealing Directive (EU) 2016/1148 (NIS Directive 2) (OJ L 333, 2022, p. 80, as amended).

Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC (OJ EU L 333, 2022, p. 164).

• Digital Omnibus on AI, which amends:

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (“Artificial Intelligence Act“) (OJ L 1689, 2024).

Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July 2018 on common rules in the field of civil aviation and establishing a European Union Aviation Safety Agency, and amending Regulations (EC) No 2111/2005, (EC) No 1008/2008, (EU) No 996/2010, (EU) No 376/2014 and Directives 2014/30/EU and 2014/53/EU of the European Parliament and of the Council, and repealing Regulations (EC) No 552/2004 and (EC) No 216/2008 of the European Parliament and of the Council and Council Regulation (EEC) No 3922/91 (OJ L 212, 2018, p. 1, as amended).

The bill also assumes the repeal of the following acts:

1. Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018 on a framework for the free flow of non-personal data in the European Union (OJ L 303, 2018, p. 59).
2. Regulation (EU) 2019/1150 of the European Parliament and of the Council of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services (OJ L 186, 2019, p. 57).
3. Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European Data Governance and amending Regulation (EU) 2018/1724 (Data Governance Act) (OJ L 152, 2022, p. 1, as amended).
4. Directive (EU) 2019/1024 of the European Parliament and of the Council of 20 June 2019 on open data and the re-use of public sector information (OJ L 172, 2019, p. 56)

In theory, all these changes are purely technical: they unify processes and obligations occurring simultaneously under various acts, simplify definitions and procedures, and simultaneously maintain the level of protection of fundamental rights. How? The justifications for both projects only state that they do not violate the fundamental rights of EU citizens. In practice, the presented projects introduce numerous solutions that will be significantly different from those previously implemented, primarily in terms of privacy and data protection for individuals. The overarching goal of the changes is to increase the competitiveness of the European digital market by introducing solutions that enable artificial intelligence to train on larger datasets, including personal data.

AI Act

The changes proposed in the draft amendment to this act are intended to improve the implementation of its individual elements and counteract problems that have already occurred – some provisions have already entered into force, while others are yet to be replaced.

The most significant change is the introduction of a new Article 4a, which replaces the previous Article 10(5). The repealed provision provided the legal basis for providers of high-risk AI systems to exceptionally process special categories of personal data to ensure the detection and correction of bias in specific circumstances. In principle, the new regulation is identical to the previous one, but paragraph 2 significantly expands its scope, as: “Paragraph 1 may apply to providers and implementers of other AI systems and models , and implementers of high-risk AI systems , if necessary and proportionate, provided that the processing is carried out for the purposes specified in that paragraph and subject to compliance with the conditions set out in the safeguards set out in that paragraph.” Consequently, this provision allows for the processing of personal data to a broader extent for AI training purposes.

In general, significant changes are expected to occur within high-risk systems. These are systems that have a significant impact on society and the lives of individuals. Examples include systems used to diagnose diseases, predict treatment outcomes, or assist in the recruitment process. These systems may be used provided they meet the requirements of the AI Act.

First, the powers granted to small and medium-sized enterprises (SMEs) in many regulations have been expanded, including the right to prepare simplified technical documentation for high-risk systems. As a result of the changes, small mid-cap companies (SMCs) will also have this power.

The European Commission also wants to link the entry into force of the regulations on high-risk systems to the availability of support tools. Therefore, the entry into force of the regulations on high-risk systems is to be postponed for a maximum of 16 months, so that it takes place after the support tools are available.

Changes are also taking place in the scope of the AI Authority’s powers under Article 75 to supervise and control general-purpose AI systems. The Authority will be the exclusive authority responsible for supervising and enforcing the obligations arising from the AI Act in relation to AI systems that constitute or are integrated with a designated very large online platform or very large online search engine within the meaning of Regulation (EU) 2022/2065.

A number of new regulations are also intended to enable greater use of regulatory sandboxes and real-world testing.

The bill also extends the deadline for AI systems and general-purpose models already on the market or put into service to meet the requirements of the AI Act for labeling and watermarking AI-generated content until February 2, 2027, giving companies more time to adapt their technology.

GDPR

The justification for the GDPR amendments states that “Targeted changes to the GDPR will harmonize, clarify, and simplify certain rules to increase innovation and make it easier for organizations to comply, while preserving the essence of the GDPR and ensuring the highest level of personal data protection.” This is an interesting statement, considering that one of the first changes introduced is a narrowing of the definition of personal data. The new definition introduces a subjective approach to personal data, focusing on whether an entity has “likely means of identifying a natural person.” This approach to personal data has been presented in the case law of the CJEU (including case number C-413/23 P). Introducing this definition would mean that if an entity claims that it cannot or does not intend to identify natural persons based on the data it possesses, the provisions of the regulation would cease to apply. The greatest impact of such a change would be in sectors that use pseudonymization and identification numbers to build consumer profiles (e.g., online advertising). As a result, individual data could be considered personal or not, depending on whether a specific entity has the means to legitimately identify an individual based on that data.

Recital 32 of the draft regulation clearly states that “the development and operation of artificial intelligence systems or models constitutes a ‘legitimate interest’ of the controller pursuant to Article 6(1)(f) of the GDPR.” This statement provides a legal basis for the processing of personal data for AI training purposes, provided that the requirements set out in the aforementioned provision are met. Further limitations on the rights of data subjects result from the addition of paragraph 5 to Article 13, according to which the information obligations under Article 13 need not be complied with if the data are processed for scientific research purposes (including AI development) if this proves impossible or would involve a disproportionate effort.

Changes are also to be made to the processing of special categories of data (Article 9). Two new exceptions are introduced:

• an exception to the general prohibition on processing biometric data, which will be permitted for identity verification purposes, provided that the data remains under the user’s control (e.g. FaceID verification taking place only on the device)
• an exception for the processing of special categories of personal data for the development and operation of an artificial intelligence system or model, subject to certain conditions, including appropriate organisational and technical measures to avoid the collection of special categories of personal data and the deletion of such data.

The draft also excludes the application of the information obligation under Article 13 if there are reasonable grounds to believe that the data subject already has the information that must be provided under that provision. This exception will not apply if the data subject transfers data to other recipients or categories of recipients, transfers data to a third country, engages in automated decision-making, or the processing is likely to result in a high risk to the rights of data subjects.

The amendment also includes Article 33 on reporting personal data breaches to the supervisory authority. This obligation would apply only to breaches “likely to result in a high risk to the rights and freedoms of natural persons,” aligning its threshold with the information obligation towards data subjects under Article 34. The period within which notification must be made has also been extended to 96 hours.

Significant changes may also occur in the area of data processing on end devices. Article 88a is proposed, which introduces the possibility of using grounds other than consent for the processing of personal data and for the specific purposes listed in this provision. With regard to consent to the processing of personal data on end devices, data subjects must be able to easily and understandably refuse requests for consent by means of a single click or equivalent means. Article 88b, in turn, requires controllers to adapt their web interfaces to the automated and machine-readable indication of data subjects’ choices regarding consent or refusal to the processing of personal data on end devices. These changes will have significant implications for cookies and are intended to reduce the number of cookie notifications and allow users to express consent and save preferences through central preference settings in browsers and operating systems.

Access to data

The proposed changes to data access should be viewed positively. Significant and still relevant provisions from the four repealed EU acts are to be implemented in the Data Act . This move aims to increase transparency regarding the regulation of data management and circulation in the EU by consolidating all relevant provisions into a single act.

The remaining changes to the Data Act will not be revolutionary. It is intended to enable entities covered by the regulation to comply with the Act’s guidelines through model contractual terms and clauses regarding data access and use. Furthermore, a rule will be introduced according to which data owners may refuse to disclose trade secrets to a user if there is a significant risk of unlawful acquisition, use, or disclosure of the data to third countries or entities under their control that are subject to jurisdictions with weaker protection than that available in the EU.

Cybersecurity reporting

The most important change in streamlining procedures and standardizing obligations under various EU acts is the proposal to create a single, common interface, known as a “contact point,” where entities required to report various types of incidents under various legal acts can fulfill their obligations. Currently, such obligations arise from, among others, the GDPR, the NIS2 Directive, and the AI Act, which necessitates the preparation of multiple reports on the same incident. The changes assume a single report submitted through a single system, which will be forwarded to the appropriate authorities.

Summary

The European Commission’s goal in creating these projects was to increase innovation and competitiveness in the European digital market, primarily in relation to the development of artificial intelligence. The changes were intended to simplify procedures and remove restrictions that hinder the faster development of AI. As can be seen, the proposed changes could significantly limit the protection of individuals in terms of their privacy and personal data, which could be used to train systems, not only high-risk ones. Many groups in the European Parliament do not support the proposed changes, believing that they will not bring real benefits to European entities and will instead facilitate the work of foreign technology giants. The changes to the GDPR are the most criticized, as member states requested that they remain outside the scope of the Digital Omnibus, as in the original draft.

Sources:

1. Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework , and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus) {SWD(2025) 836 final }
2. Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulations (EU) 2024/1689 and (EU) 2018/1139 as regards the simplification of the implementation of harmonized rules on artificial intelligence (Digital Omnibus on AI) {SWD(2025) 836 final }
3. https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2718

Artykuł Digital Omnibus pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

On September 12-14, 2025, lawyers from KIELTYKA GLADKOWSKI KG LEGAL participated in the annual Futurology Congress in Krakow.

The participants, among which there was AGH University of Science and Technology’s Artificial Intelligence Center of Excellence discussed aspects of new technologies, including:

• Optical Illusions in AI Systems: The Danger of Adversarial Attacks. Adversarial attacks on vision systems are a topic of growing interest in both science and the technology industry – not only due to autonomous vehicles but also medical systems. The panelists demonstrated how subtle, almost invisible image modifications can completely confuse AI algorithms, leading to situations where the algorithm fails to recognize a STOP road sign or makes an error when analyzing medical images. Examples of such attacks from both transportation and medicine were presented, highlighting their impact on everyday life and safety. There were explained the mechanisms behind these phenomena and their consequences for machine learning-based systems. In this area, there is a constant race between the creators of such attacks and the engineers developing protection methods, and ensuring complete security remains a major challenge for the AI industry.

• The development of the Polish space sector, combining engineering, science, and modern technologies. Domestic entities are among the leaders building Poland’s position in the global space industry supply chain. During the panel, there were discussed the most important achievements and participation of Polish teams in prestigious international missions. Representatives of key companies discussed their projects, challenges, and role in the global space ecosystem. There were also considered barriers to sector development and legislative and financial needs. The panel was an opportunity to look to the future and attempt to answer the question of Poland’s potential role in the exploration and use of space. Participants shared their experiences collaborating with the European Space Agency and other international partners.

• Modern biotechnology. Biotechnology is becoming one of the pillars of modern civilization, offering breakthrough solutions in medicine, diagnostics, agriculture, and environmental protection. Faced with global challenges such as aging societies, the growing number of lifestyle diseases, and the need for sustainable development, the dynamic development of biotechnology is opening up new opportunities to improve the quality of life. The panel discussed the potential of gene and cell therapies, the importance of innovative drugs in the fight against cancer, and the role of collaboration between science, the investment sector, and industry. Guests addressed ethical, regulatory, and social issues related to the implementation of new biological technologies. The discussion explored how biotechnology can truly benefit humanity in the coming decades.

The Congress lectures are related to specific examples and problems that scientists are struggling with in daily lives – for example, how to easily delude artificial intelligence in software in an unmanned vehicle resulting in a failure to recognize a STOP sign

source: https://www.drmalinowski.edu.pl/posts/2824-adwersarialne-ataki-na-sztuczna-inteligencje

Artykuł Optical Illusions in AI Systems, the Danger of Adversarial Attacks, Biological Technologies, Explainable AI – topics discussed during Futurology Congress 2025 pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

In an era of dynamic digital technology development and a growing number of cyberthreats, cybersecurity and personal data protection are becoming key aspects of how organizations operate in the European Union. New regulations, such as NIS2, DORA, AI Act, CRA, and eIDAS 2.0, combined with the current GDPR, create a comprehensive security system aimed at raising protection standards and ensuring greater transparency in data processing.

NIS2 and GDPR: Strengthening Data Protection and Incident Response

The Network and Information Security Directive (NIS2) is another step towards increasing the cyber resilience of entities operating in key economic sectors. In 2025, its implementation will require organizations to take a number of actions, including:

• Expanding security measures against cyberattacks,
• Introducing more rigorous incident reporting procedures,
• Strengthening cooperation between supervisory authorities and the private sector.

NIS2, in conjunction with GDPR (Regulation 2016/679), means that businesses will not only have to protect personal data more effectively, but also implement new procedures for risk management and auditing of IT security activities.

5 Things You Need to Know About NIS2

01 – Fines up to €10 million or 2% of total annual global turnover

02 – Expanded scope compared to NIS1, changing the way companies are classified and requiring more of them to comply with the directives

03 – Management staff is liable for violations and the authorities may suspend activities or functions

04 – Broad security risk management measures and shift to a risk-based approach

05 – Initial reporting of security incidents within 24 hours, further action within 72 hours, and final summary within 1 month

DORA: Cyber Resilience and Personal Data Security in Finance

DORA is the Regulation of the European Parliament and of the Council (EU) of 14 December 2022 on the digital operational resilience of the financial sector. This is another of many recent regulations concerning cybersecurity and the broadly defined security of information technology.

The Digital Operational Resilience Act (DORA) focuses on the financial sector, which is particularly vulnerable to cyberattacks. Key requirements imposed by DORA include:

• Testing the operational resilience of IT systems,
• Implementing risk management strategies based on threat analysis,
• Obligation to monitor and report digital incidents.

DORA applies to:

1. credit institutions;
2. payment institutions, including payment institutions exempted under Directive (EU) 2015/2366;
3. providers of account information access services;
4. electronic money institutions, including electronic money institutions exempted under Directive 2009/110/EC;
5. investment companies;
6. crypto-asset service providers,
7. central securities depositories;
8. central counterparties;
9. trading systems;
10. transaction repositories;
11. alternative investment fund managers;
12. management companies;
13. information sharing service providers;
14. insurance and reinsurance undertakings;
15. insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries;
16. institutions of occupational pension programs;
17. rating agencies;
18. administrators of critical benchmarks;
19. crowdfunding service providers;
20. securitization repositories;
21. external ICT service providers.

In the context of GDPR compliance, financial institutions must ensure adequate security measures to protect customer data against unauthorized access and information leakage. GDPR also mandates cooperation with cloud service providers and external IT operators, which requires thorough verification of their security standards.

Article 33 of the DORA Directive requires personal data breaches to be reported without undue delay, and within 72 hours where possible. In the event of a delay, an explanation of the reason for the delay must be included.

AI Act and GDPR: Managing Artificial Intelligence and Data Protection

The AI Act regulations classify AI systems according to risk level and impose obligations on entities that implement them. In the context of data protection, the AI Act requires:

• Transparency of artificial intelligence algorithms and mechanisms,
• Possibilities of controlling and auditing decisions made by AI,
• Compliance with the principles of data minimization and limitation of the processing purpose.

Companies that use AI to process personal data will have to meet stringent GDPR requirements, giving users greater control over their information and minimizing the risk of abuse.

CRA: Cyber Resilience Act – Security of Digital Products

The Cyber Resilience Act (CRA) introduces obligations related to the security of digital software and hardware. Its key requirements include:

• Designing secure digital products,
• Monitoring vulnerabilities and updating them regularly,
• Manufacturers’ responsibility to ensure continued safety throughout the product life cycle.

CRA aims to increase cybersecurity across the entire digital ecosystem, minimizing the risk of attacks based on device and application vulnerabilities.

eIDAS 2.0: Strengthening digital identification

The amendment to the eIDAS (electronic IDentification, Authentication and trust Services) regulation – known as eIDAS 2.0 – introduces a European digital identity wallet that:

• Allows citizens to securely store and share their identity data,
• It enables public and private institutions to provide secure online services,
• Strengthens authentication standards in digital transactions.

In conjunction with GDPR, eIDAS 2.0 improves users’ control over their identity data and increases the security of online transactions.

Challenges and benefits of new regulations

Adapting to new regulations poses numerous challenges for companies, including:

• The need to invest in modern security systems,
• Employee training in cybersecurity and data protection,
• Implementation of effective incident monitoring and reporting mechanisms.

However, the new regulations also bring numerous benefits, such as:

• Better protection of customer data and greater trust in the organization,
• Increased resistance to cyber attacks,
• Possibility to avoid high fines for violating data protection regulations.

The impact of new regulations on small and medium-sized enterprises (SMEs)

New regulations such as NIS2, DORA, AI Act, CRA, and eIDAS 2.0 can pose challenges for small and medium-sized enterprises (SMEs). Implementing these regulations requires investment in modern security systems and employee training in cybersecurity and data protection. SMEs may face challenges related to limited financial and human resources, which can make it difficult to fully comply with the new requirements.

However, compliance with these regulations also brings benefits, such as better protection of customer data, increased trust in the organization, and the ability to avoid significant fines for violating data protection regulations. Therefore, it is worthwhile for SMEs to consider partnering with external IT service providers and cybersecurity specialists to effectively implement the required security measures.

The future of cybersecurity in the EU

In the coming years, we can expect further development of regulations regarding cybersecurity and personal data protection. The European Union will continue to work on strengthening the legal framework to address growing cyber threats and ensure a high level of data protection. Organizations will need to be prepared to continuously adapt to new requirements and invest in modern security technologies and procedures.

Summary

In 2025, organizations will have to comply with a range of regulations regarding cybersecurity and personal data protection. NIS2, DORA, AI Act, CRA, and eIDAS 2.0, combined with the GDPR, create a modern legal framework aimed at improving data protection and increasing resilience to cyber threats across various economic sectors. Implementing these regulations will be a challenge, but also an opportunity, to build a more secure and digitally resilient business environment in the EU.

Artykuł Cybersecurity and GDPR Compliance in 2025 pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.