We are delighted to share an important milestone in the continued development of KG Legal’s Data, AI & Cybersecurity Desk.

It has been a great honour to serve as the exclusive expert contributors for Poland to the OneTrust DataGuidance Privacy Overview – Poland, one of the world’s leading professional legal compliance resources relied upon by in-house counsel, privacy professionals, compliance officers, multinational organisations and technology companies operating across multiple jurisdictions.

Preparing this contribution was a long-term project that required several months of intensive legal analysis, research and editorial work. Our objective was not simply to describe the application of the GDPR in Poland. Instead, we sought to create a practical and comprehensive guide reflecting the significant transformation of the Polish regulatory landscape that has taken place in recent years as a result of new European legislation and its implementation into Polish law.

The publication therefore extends far beyond a traditional overview of Polish data protection law. It examines the interaction between privacy, digital regulation, cybersecurity and artificial intelligence, providing readers with practical guidance on the most important legal developments affecting organisations operating in Poland.

Our contribution discusses, among other things:

• the practical application of the GDPR within the Polish legal system;
• the powers and regulatory practice of the Polish supervisory authority for personal data protection;
• employee monitoring and workplace privacy;
• cookies, consent mechanisms and online tracking technologies;
• electronic communications and direct marketing requirements;
• international data transfers;
• personal data breaches and notification obligations;
• practical compliance with Polish privacy legislation;
• cybersecurity-related regulatory developments;
• the growing interaction between data protection and artificial intelligence governance.

A particularly important aspect of this work was addressing the rapidly evolving legislative environment. During the last few years, Poland has experienced substantial regulatory changes resulting from the implementation of numerous European legal instruments and the entry into force of directly applicable EU regulations that significantly affect organisations processing personal data.

Accordingly, the publication takes into account the practical implications of the evolving European digital regulatory framework, including the interaction between the GDPR and newer legal instruments governing digital services, artificial intelligence, cybersecurity and data governance. The analysis also reflects the impact of the AI regulatory framework, developments concerning data governance and electronic communications, as well as the increasingly interconnected compliance obligations facing businesses operating in today’s digital economy.

Rather than presenting legislation in isolation, the publication adopts a practical, compliance-oriented perspective. It combines:

• the GDPR and Polish implementing legislation;
• guidance issued by the European Data Protection Board (EDPB);
• the jurisprudence of the Court of Justice of the European Union;
• decisions and regulatory guidance published by the Polish Personal Data Protection Office (UODO);
• recent Polish legislative developments and market practice.

Our ambition was to create a resource that would assist both international and domestic organisations in navigating one of the fastest-changing areas of European regulation, where privacy law increasingly intersects with cybersecurity, AI governance, digital platforms, online communications and emerging technologies.

The contribution was prepared by Małgorzata Kiełtyka and Jakub Gładkowski, whose combined experience covers complex cross-border advisory work in data protection, artificial intelligence, life sciences, healthcare, technology law, cybersecurity, intellectual property and regulatory compliance.

https://www.dataguidance.com/experts-directory/Jakub_G%C5%82adkowski

https://www.dataguidance.com/experts-directory/Malgorzata_Kieltyka

For many years, Małgorzata Kiełtyka has advised international companies on GDPR compliance, healthcare regulation, AI governance, technology transactions and cross-border regulatory matters. Her practice combines strategic legal advice with practical implementation of compliance frameworks for multinational businesses operating in highly regulated sectors.

Jakub Gładkowski focuses on data protection, digital regulation, cybersecurity, intellectual property, IT law and emerging technologies. His practice includes advising innovative businesses on regulatory compliance, digital transformation projects and the implementation of European technology legislation affecting both public and private sector organisations.

Being entrusted with preparing Poland’s national contribution to OneTrust DataGuidance represents an important recognition of our team’s expertise and international standing. We are particularly proud that this publication reflects not only our experience in privacy law, but also our broader interdisciplinary approach, integrating data protection with AI regulation, cybersecurity, digital compliance and technology law.

We sincerely thank the editorial team at OneTrust DataGuidance for their confidence in our expertise and for the opportunity to contribute to a publication that supports legal and compliance professionals around the world.

For KG Legal, this publication marks another significant milestone in the continued growth of our Data, AI & Cybersecurity Desk and reinforces our commitment to delivering practical, business-oriented legal advice at the intersection of privacy, technology and innovation.

Artykuł A Major Milestone for KG Legal’s Data, AI & Cybersecurity Practice: Exclusive Poland Contribution to OneTrust DataGuidance pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The Act amending the Act on the National Cybersecurity System aims to implement Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 (NIS Directive 2) and the partial application of Commission Delegated Regulation (EU) 2024/1366 of 11 March 2024 supplementing Regulation (EU) 2019/943 of the European Parliament and of the Council.

The amendment to the KSC Act significantly expands the scope of the regulations and introduces new obligations in the field of cybersecurity management. The changes include, among other things, the implementation of risk management systems and expanded incident reporting requirements. The new regulations also strengthen the powers of supervisory authorities and significantly increase the maximum amount of financial penalties. It also introduces liability for the management staff (manager) of an entity. In practice, this requires certain entities to take steps to comply with the new regulations.

The first experiences of entrepreneurs after the amendment came into force – practical conclusions

The few months that the amended Act on the National Cybersecurity System has been in effect demonstrate that the biggest challenge for businesses is no longer the analysis of the new regulations, but their practical implementation. For many organizations, the adaptation process began with a seemingly simple task: determining whether a given entity is even subject to the new regulations. In practice, this step proves to be one of the most problematic.

Under the previous legal framework, many businesses awaited a formal administrative decision confirming their status as an essential service operator. This approach is no longer appropriate. The status of a key or important entity stems directly from the Act, and obligations arise regardless of whether the business has already been entered on the register. This means that the responsibility for properly assessing their own situation rests primarily with the business itself.

Practice also shows that many companies focus solely on the issue of being entered into the register of key and important entities. However, entry itself is not the purpose of the regulation. The greatest challenges remain the actual implementation of an information security management system, conducting a risk analysis, developing incident response procedures, and adequately documenting the actions taken. In the future, supervisory authorities will primarily assess an organization’s actual level of compliance with the Act, not merely the formal fulfillment of registration obligations.

Another significant change is the significant increase in management responsibility. Management can no longer treat cybersecurity as a matter solely within the purview of IT departments. The Act requires active management involvement in the organization of the cybersecurity management system, oversight of its operation, and provision of adequate organizational and financial resources. In practice, this requires regular reporting on cybersecurity issues at the management level and documentation of decisions made.

Supply chain security is also becoming increasingly important. Businesses are required not only to secure their own IT systems but also to consider the risks arising from collaboration with IT service providers, cloud computing operators, software vendors, and outsourcing providers. In practice, this means reviewing supplier contracts, verifying the security measures in place, and implementing appropriate provisions for incident management and crisis cooperation.

It’s also noticeable that a growing number of businesses are choosing to conduct internal compliance audits before the statutory deadlines expire. This approach allows for early identification of organizational and technical gaps, reducing the risk of subsequent violations and costly remedial actions.

In practice, the best solution is to treat the implementation of the Act’s requirements not as a one-time project, but rather as a process encompassing regular risk analysis, procedure updates, employee training, and ongoing oversight of the organization’s security. This approach not only increases compliance but also significantly reduces the risk of cybersecurity incidents.

It’s worth emphasizing that the current transition period should be used to calmly prepare organizations for the full application of the new regulations. Postponing implementation until the final months before the statutory deadlines expire can be risky, especially for large organizations where implementing information security management systems requires the involvement of multiple departments and adequate time to prepare procedures and documentation.

Change in the circle of entities to which the Act applies.

Under the previous wording of the Act, an administrative decision was required to recognize an entity as an essential service operator (Article 5 of the Act before the amendment). Currently, the group of key and important entities is determined automatically (ex lege). The criteria for qualifying an entity as essential are found in Article 5, Section 1, and as an important entity in Article 5, Section 2 of the Act. It is possible that an entity meets the criteria for both key and important entities; such an entity is considered a key entity under Article 5, Section 4. When attempting to qualify entities, the Act also refers to EU regulations, particularly Regulation 651/2014/EU, which defines SMEs. Therefore, the primary criteria taken into account will be the number of employees and annual turnover. It is also necessary to refer to Annexes 1 and 2 of the Act, which precisely define the categories of entrepreneurs in specific sectors and subsectors.

The added Article 5a in paragraph 1 provides that key and important entities are subject to the obligations arising from the Act if they reside in the territory of the Republic of Poland or conduct their business in the territory of the Republic of Poland.

Articles 7 et seq. regulate matters related to the list of key and important entities. Before the amendment, the list contained only operators of essential services; now it includes key and important entities. Unlike the previous legal status, in which entry was made at the request of the authority responsible for cybersecurity (former wording of Article 7, paragraph 3 of the Act), entry is now made at the request of a key or important entity within six months of the occurrence of the conditions (Article 7c, paragraph 1 of the Act). Ex officio entry will generally only apply to existing operators of essential services, trust service providers, telecommunications companies, and public entities. This means that for entities meeting the conditions on the date the amendment comes into force, the deadline for submitting an application is October 3, 2026. Pursuant to the Announcement of the Minister of Digitization of April 8, 2026, regarding the schedule for submitting applications for entry in the register of key and important entities and for key or important entities to commence using the ICT system , self-registration on the list is possible from May 7, 2026, to October 3, 2026. The platform operating in the S46 system is available at https://wykaz-ksc.gov.pl/ . By April 3, 2027, key and important entities are required to commence using the ICT system specified in Art. 46 sec. 1 of the Act. This deadline begins depending on whether the entities were parties to agreements regarding the use of the ICT system referred to in Art. 46 sec. 1 of the Act concluded before April 3, 2026. For the former, the possibility of using the system was opened on April 8, 2026, and for the latter, this possibility will be available from June 12, 2026 (point 2 of the Communication of the Minister of Digital Affairs).

If an entity that meets the criteria for being considered a key or important entity fails to submit an application for entry, the authority responsible for cybersecurity may enter the entity on the list ex officio (Article 7j, paragraph 1 of the Act). Failure to comply with certain obligations related to the list (failure to timely complete missing data on the list or failure to correct data despite a request or failure to submit an application for entry) may result in the imposition of a substantial fine (Article 73, paragraph 1, point 1 and Article 73, paragraph 1a, point 1 of the Act). The catalogue of data to be included on the list has also been changed (expanded) (Article 7, paragraph 2).

In practice: The expansion of the scope of entities and the shift from administrative decision-making to automatic regulation mean that many entities may be subject to the Act without formal confirmation of this status. In practice, independent qualification analysis and continuous monitoring of compliance with statutory criteria become crucial. An incorrect assessment (or failure to comply) may result in exposure to sanctions (severe fines).

New responsibilities for cybersecurity management.

Duties

Chapter 3, which governs the obligations of key and important entities, has been expanded, and Chapters 3a and 3b have been added, addressing domain name registration service providers and public entities. Article 8 of the Act governs obligations related to the implementation of an information security management system. Compared to the previous legal framework, numerous obligations have been added. The responsibility of the manager of a key or important entity for the performance of its cybersecurity obligations has been introduced (Article 8c of the Act), and the manager’s responsibilities have also been defined (Articles 8d–8f of the Act).

The regulations regarding incident reporting have also changed. A key or important entity classifies a given incident as serious (after meeting the requirements of Article 2, Section 7 of the Act), then issues an early warning, reports the incident, and finally submits a final report on the handling of the serious incident to the CSIRT (a three-step reporting model instead of the previous one-step model – Article 11 of the Act).

Deadlines

Pursuant to Article 15 of the Act, key entities must conduct a security audit of the information system used in the service provision process at least once every three years. For key entities that were not previously classified as key service operators, the first audit should be conducted within 24 months of the date the conditions are met (Article 16, point 2, therefore, for these entities, the deadline for conducting the audit is April 3, 2028).

The Act amending the KSC Act establishes a 12-month transition period during which key and important entities have time to fulfill the obligations specified in Chapter 3 of the Act (except for the obligation to conduct the first audit, which entities have 24 months to conduct). Therefore, with respect to obligations such as implementing an information security management system, risk assessment, implementing technical and organizational measures, reporting and managing incidents, and verifying personnel’s criminal records, the deadline for compliance with these regulations expires on April 3, 2027.

In practice: The imposed obligations require the implementation of an information security management system. Furthermore, the single-tier incident reporting system has been changed, replaced by a more complex three-tier system. Essential entities will be required to conduct audits. Importantly, entities that were not previously considered essential service operators will be required to conduct an audit within two years of the amendment’s entry into force. However, most of the new obligations will have to be implemented by April 3, 2027. Failure to comply with these obligations will result in the manager of the relevant entity being held liable.

Change in the amount and grounds for imposing fines.

Until April 2, 2026, the maximum amount of the fine imposed on entities (only for the most serious violations) was PLN 1 million (former wording of Article 73, paragraph 5 in fine). Currently, the maximum amount of the fine is, as a rule, EUR 10 million (Article 73, paragraph 3 of the Act), and for the most serious violations, up to PLN 100 million (Article 73, paragraph 5 in fine of the Act).

With the imposition of a large number of obligations on key and important entities, the list of violations for which a fine may be imposed has also been expanded (Article 73 of the Act).

The new provisions on fines come into force only two years after the entry into force of the Act (i.e. from April 3, 2028).

In practice: Increasing the amount of fines disciplines key entities and important entities to take their cybersecurity obligations very seriously. It is worth emphasizing, however, that the amended regulations on fines will not enter into force until April 3, 2028.

Changes in the supervision and control of key and important entities.

Chapter 11 of the Act, which deals with the supervision and control of key and important entities, has been significantly expanded. Some provisions remain unchanged (the requirement to apply the provisions of the Entrepreneurs’ Law or the Act on Audit in Government Administration, the powers of the person conducting the audit, most of the obligations of audited entities, and provisions regarding audit protocols and post-audit recommendations).

Important changes

The most important changes in the scope of supervision include a significant expansion of Article 53, which describes the powers of the authority responsible for cybersecurity regarding supervision and oversight of key entities. It empowers the competent authority to issue various types of administrative decisions aimed at enforcing the provisions of the Act. This article also contains a number of procedural provisions defining the nature of the proceedings. Generally, the regulations contained in this article apply only to key entities, but as stated in Article 53, paragraph 17, certain provisions also apply to inspections of important entities. Article 53, paragraph 3 states that supervision of key entities is both post-empty and preventive, while for important entities, supervision is only post-empty.

A new obligation for both key and important entities is the information obligation specified in Article 53c, which requires a key or important entity to provide certain data at the request of the authority responsible for cybersecurity.

A new institution is the ad hoc review added in Article 59c, which may be carried out only if the conditions specified in the cited Article are met.

In practice: Strengthening the powers of supervisory authorities and introducing ad hoc inspections means increased risk of inspections and the need to maintain constant readiness to demonstrate compliance with regulations. Entities should also prepare for more frequent requests for information from authorized bodies.

Minor changes

Chapter 10 has been amended and Chapters 10a – 10c have been added, but they do not contain any standards addressed to entities and are therefore not relevant from a practical point of view.

Several changes concern Chapter 12 concerning the Government Plenipotentiary for Cybersecurity and the Cybersecurity Board, but these changes do not have any significant impact on the entities.

Article 12a has been added, addressing specific measures to ensure cybersecurity at the national level. It primarily contains provisions on recommendations from the Government Plenipotentiary for Cybersecurity (Article 67a), the procedure for designating a supplier as a high-risk supplier (Articles 67b–67f), and a safeguarding order in the event of a critical incident (Articles 67g–67i).

Minor changes also apply to the Cybersecurity Strategy of the Republic of Poland (Articles 68–72). The changes primarily concern the content and method of developing the strategy, as well as the frequency of strategy reviews (2.5 years instead of the previous 2 years).

The amendment to the Act on the National Emergency Response Plan creates the basis for the adoption of the National Emergency Response Plan (Articles 72a – 72f of the Act).

Recommended actions.

In light of the amendments to the Commercial Companies Code, entities subject to the new regulations should take steps to ensure their operations are in compliance with the law. It is recommended that:

1)      Self-identification in order to determine whether a given entity qualifies as a key or important entity within the meaning of the Act.

2)      Implementation or update of an information security management system.

3)      Development of procedures for identifying and reporting incidents, taking into account the new procedure.

4)      Ensuring the involvement of management staff, e.g. the manager’s implementation of the obligations under Article 8d or 8e.

5)      Preparing the organization for potential supervisory activities, e.g. inspections.

• Action:

ex officio entries carried out by the Minister of Digital Affairs (current key service operators, trust service providers, telecommunications companies and public entities)

• Deadline:

April 13 – May 6, 2026

• Action:

self-registration in the list of key and important entities

• Deadline:

May 7 – October 3, 2026

• Action:

launching the possibility of using the S46 system for new entities

• Deadline:

June 12, 2026

• Action:

end of the deadline for starting to use the S46 system and implementing obligations (end of the adjustment period)

• Deadline:

April 3, 2027

• Action:

the first ISMS audit (for key entities that were not key service operators) and the beginning of the application of the provisions on penalties

• Deadline:

April 3, 2028

Artykuł NIS2 in Poland: Practical Implications of the New Cybersecurity Framework for Businesses pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

Just a few years ago, online store owners primarily had to ensure terms and conditions, privacy policies, and efficient order processing. Today, this is clearly not enough. EU regulations such as the Omnibus Directive and the Digital Services Act (DSA), as well as the increasing role of artificial intelligence in assessing store credibility, force businesses to consider their platforms much more broadly. It is no longer just about regulatory compliance, but also about building digital trust, which influences a store’s visibility, legal security, and customer purchasing decisions. Below, we present a practical checklist of the most important actions to implement to reduce the risk of sanctions and increase the credibility of an online store.

Practical guidelines for online store owners

I.            Avoiding UOKiK fines and compliance with the Omnibus Directive

a. Implement transactional verification: You should configure your feedback system so that each review you post is technically linked to the unique order number and email address of the customer who actually completed the purchase.

b. Updating the content of the regulations: In the “Rules for publishing opinions” section, the verification procedure should be described in detail, whether all opinions (including critical ones) are published and how the average product rating is calculated.

c. Transparent labeling: Each review should have a clear status indication (e.g., “Purchase confirmed”). If a benefit is provided in exchange for reviews (e.g., a discount code), this information must be clearly and prominently displayed within the review text.

d. Lowest price mechanism: In accordance with the requirements of price transparency, each discount must display the lowest price of the product that was valid in the 30 days prior to the introduction of the discount.

Legal basis: Act of 30 May 2014 on consumer rights ( Journal of Laws of 2024, item 1796, as amended); Directive (EU) 2019/2161 of the European Parliament and of the Council of 27 November 2019 amending Council Directive 93/13/EEC and Directives 98/6/EC, 2005/29/EC and 2011/83/EU of the European Parliament and of the Council as regards the better enforcement and modernisation of Union consumer protection rules (OJ EU L 328 of 2019, No. 328, p. 7, as amended); Act of 23 August 2007 on counteracting unfair market practices ( i.e. Journal of Laws of 2023, item 845).

II.            Ensuring compliance with the Digital Services Act (DSA)

a. Implementing a “report content” mechanism: Every review or user-generated content must have an easily accessible button to report suspected illegality or manipulation of the content.

b. Procedure for justifying decisions: In the event of deletion of an opinion or blocking of a user account, the platform is obliged to send the author a detailed justification indicating a specific violation of the regulations or legal provisions.

c. Internal Complaints Process: Users must be able to appeal moderation decisions for a period of at least 6 months from the date the platform takes action.

d. Designation of a contact point: The entrepreneur must designate an electronic contact point for supervisory authorities and users, enabling efficient communication on matters relating to digital security.

Legal basis: Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on the single market for digital services and amending Directive 2000/31/EC (Digital Services Act) (OJ EU L 277, 2022, No. 277, p. 1, as amended), in particular Articles 16, 17 and 20.

III.            Reducing the risk of “algorithmic exclusion”

a. Design Patterns (UX) Audit: Eliminate so-called dark patterns, such as asymmetric selector buttons, hard-to-close pop-ups, or mechanisms that make it difficult to unsubscribe. Supervisory algorithms treat such practices as signals of poor interface quality.

b. Data Certification for AI: Ensure structured review data is provided, allowing shopping assistants and crawlers to properly verify the “digital provenance” of the data.

c. Filtering synthetically generated content: It is worth implementing tools that monitor review language for bot-like patterns (unnatural correctness, lack of detail) to avoid indexing false enthusiasm that results in lower trust rankings.

Legal basis: REGULATION (EU) 2022/2065 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 19 October 2022 on the single market for digital services and amending Directive 2000/31/EC (Digital Services Act) (OJ EU L 277, 2022, p. 1, as amended) – Article 25 (prohibition of deceptive interfaces)

IV.            Proper management of data and opinions (CaaS model)

a. Digital Audit Trail: It is recommended to store logs containing transaction metadata related to opinions for a period enabling verification of data reliability (e.g. 12-24 months).

b. Active mediation systems: Instead of deleting negative feedback, use complaint management systems that document the process of resolving customer disputes. Resolving a problem is treated by ranking systems as evidence of high-quality service.

c.       “Know Your Business Customer” principle: When running a marketplace model, it is essential to verify the identity of sellers before allowing them to offer goods, collecting registration numbers and contact details.

Legal basis: REGULATION (EU) 2022/2065 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 19 October 2022 on the single market for digital services and amending Directive 2000/31/EC (Digital Services Act) (OJ EU L of 2022, No. 277, p. 1, as amended) – Article 30; Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L of 2016, No. 119, p. 1, as amended).

Artykuł Is Your Online Store Ready for the New Era of Control? A Practical Guide to E-Commerce Responsibilities in 2026 pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The dynamic development of artificial intelligence-based technologies is revolutionizing not only the commercial sector but also the area of state oversight of the digital market. The implementation of multi-agent systems by the Office of Competition and Consumer Protection (UOKiK) opens a new era in consumer rights enforcement, enabling the mass and automated identification of unfair market practices. With the Digital Services Act (DSA) and the Omnibus Directive in force, traditional control methods are giving way to algorithmic interface analysis aimed at eliminating so-called dark patterns and price manipulation. However, the use of “digital controllers” raises fundamental questions for legal science and business practice about the limits of automated decision-making processes in public administration. Although AI agents significantly improve the effectiveness of detecting violations, their legal status as a source of evidence remains the subject of heated debate. The main thesis is that while AI can be a powerful auxiliary tool for regulatory bodies, the ultimate responsibility for determining the facts and assessing the legitimate interests of a party must rest with humans, which is the foundation of a fair procedure in a state governed by the rule of law.

Dark Patterns: Legal and Ethical Aspects of Prohibiting Manipulation in Digital Interfaces

A key obligation of internet platform providers in light of modern regulations is to design interfaces in a transparent and ethical manner. The prohibition of manipulation, formulated, among others, in the Digital Services Act (Article 25), directly affects the structure of so-called deceptive interfaces (dark patterns). Websites and applications cannot be designed in a way that limits the recipient’s cognitive autonomy, interferes with their ability to rationally assess the situation, or forces them to make a purchasing decision that they would not have made under other circumstances.

One of the most glaring examples of such violations is the asymmetry in the contract conclusion and termination process, particularly evident in subscription models. This mechanism relies on extreme simplification of the purchase path while simultaneously mounting procedural barriers when attempting to cancel the service. Visual techniques are used here, among other things: payment activation buttons are highlighted with bright colors and a central location, while contract termination options are deliberately hidden at the bottom of the page, written in small font or masked with colors that blend with the background. Furthermore, canceling a subscription on online platforms often requires multiple selections or confirmation of the desire to cancel, despite the consumer’s prior explicit choice. Artificial intelligence algorithms, analyzing the page structure and visual hierarchy of elements, can pinpoint these disparities with mathematical precision, creating a list of violations that serves as hard evidence.

In the context of the Omnibus Directive, the obligation to disclose the lowest price 30 days before the discount has become a market standard, but its implementation is open to abuse. The practice of “empty promotions” involves artificially inflating the base price just before a planned discount or providing a false reference amount. In this area, AI agents demonstrate particular effectiveness, acting as real-time monitoring systems; they can archive the price history of each product, creating an independent database. Comparing this information with the entrepreneur’s declaration visible on the website allows for immediate detection of manipulation of the promotional algorithm.

An equally important area of control is the phenomenon of drip pricing , or hiding the real costs of a transaction until the final stage of the shopping cart. Businesses often employ a “decoy” strategy, presenting an attractive unit price, which, at the time of order finalization, is increased by mandatory, previously undisclosed costs, such as service fees, packaging costs, or payment processing fees. Pursuant to Article 12 of the Consumer Rights Act, businesses are obligated to clearly and understandably inform consumers about, among other things, the total price for the proposed service. Automated control systems are capable of conducting a full simulation of the purchasing process, from product selection to the payment gateway. Any discrepancy between the price presented in the product list and the amount required to complete the contract is reported by AI as an attempt to circumvent disclosure obligations and a direct violation of the collective interests of consumers.

According to Article 5 of the Act on Combating Unfair Market Practices, the key criterion for assessing a trader’s behavior is the impact of their actions on the recipient’s decision-making process. A market practice is considered misleading if “this action in any way causes or is likely to cause the average consumer to make a transactional decision that they would not otherwise have made”. The legislator specifies that both “spreading false information” and “spreading true information in a manner that is likely to be misleading” can constitute an infringement. In the digital environment, these manipulations most often focus on the “existence of a product, its type, or availability.” A common method of exerting unjustified pressure on consumers is the use of social proof mechanisms and an artificial sense of scarcity. This manifests itself in messages such as: “this product is now being viewed by x people,” “x items have already been purchased today,” or displaying timers indicating that “only 30 minutes left until the end of the promotion.” Particularly problematic from the perspective of trade ethics is the use of so-called false advertising. Timers – clocks counting down to the finale of a supposedly unique price opportunity. In reality, these are fake mechanisms, as after the specified deadline, the offer remains active and the product price remains unchanged or becomes even more favorable. This type of activity, a classic example of dark patterns, is designed to induce fear of missing out (FOMO) in customers and induce them to rush into a transaction. Using AI agents allows regulators to serially monitor such counters and prove their cyclical recurrence, providing direct evidence of deceptive practices.

The algorithm as a controller

With millions of transactions taking place across the country in just a few minutes or hours, standard order verification procedures prove insufficient to effectively fulfill the statutory responsibilities of supervisory authorities. Technological advancements in the form of AI algorithms come to the rescue. These algorithms can automatically monitor numerous commercial transactions simultaneously, generating preliminary opinions that are ultimately subject to human review. Such systems not only save significant processing time but, above all, enable oversight of a much broader range of businesses and their online platforms. The AI multi-agents used in this process are virtual “consumer robots” capable of mass-auditing e-commerce websites, simulating the natural behavior of online users to detect irregularities that a human controller would be unable to detect on such a large scale.

To conduct reliable and effective inspections, Polish law already offers supervisory authorities a toolkit in the form of the “mystery shopper” institution. Traditionally, this involves a person unrelated to the inspected company or the inspecting authority making a purchase and then completing a survey regarding specific activities they observe during standard shopping. The implementation of AI technology by the Office of Competition and Consumer Protection (UOKiK) aims to entrust AI multi-agents with the role of such digital “mystery shoppers.” Their task is to interact with the website interface, add a product to the cart, and complete the entire purchasing process without disclosing that this activity is being performed by an algorithm or that it is part of an official inspection procedure. This approach allows for direct verification of whether the entrepreneur is not using prohibited manipulative practices, known as dark patterns. However, it should be emphasized that the activity of AI multi-agents is strictly regulated by legal procedures and cannot be arbitrary. The algorithm operates under the strict supervision of the President of the Office of Competition and Consumer Protection, who, pursuant to Article 105ia of the Act on Competition and Consumer Protection, must always obtain prior consent from the Court of Competition and Consumer Protection. This mechanism serves as a key safeguard against abuse of power. Furthermore, after completing the inspection, the office is obligated to immediately provide the entrepreneur with an official ID and authorization for the inspection. In the age of digital administration, this obligation can be fulfilled electronically immediately after the AI multi-agents withdraw from the sales platform.

The key legal framework for the operation of algorithms commissioned by the regulator is provided by the EU AI Act. According to its provisions, AI systems used by public authorities for control and supervisory purposes should be considered high-risk AI systems. This entails a strict requirement to design them with appropriate transparency, which allows both the controlling and the controlled entities to properly interpret the system’s results and use them fairly. In practice, this means that algorithms must be built in an “explainable” model. A business subject to allegations based on an algorithmic audit has the statutory right to request full insight into the operation of AI tools. This transparency is essential for the controlled entity to understand the basis and criteria on which the authority deemed its online platform unfair or infringing on the collective interests of consumers (Article 24). This balance between the effectiveness of digital supervision and the right to defense is the foundation of a modern rule of law in the age of algorithms.

The opinion of AI multi-agents as evidence in the case

After completing the inspection activities on the entrepreneur’s online platform, the AI algorithm’s role evolves towards an analytical function, consisting of preparing an opinion indicating detected violations. In the context of potential proceedings against an entity employing unfair market practices, the admissibility of using such an analysis as valid evidence becomes a key issue. Pursuant to Article 7 of the Code of Administrative Procedure (hereinafter referred to as the Code of Administrative Procedure), which establishes the principle of objective truth, a public administration body is obligated to take all steps necessary to thoroughly clarify the factual circumstances. This obligation is consistent with Article 75 § 1 of the Code of Administrative Procedure, which introduces an open catalog of evidence, allowing as evidence anything that may contribute to the clarification of the case, provided it is not contrary to the law.

Under these regulations, the results of AI multi-agent work – taking the form of reports, opinions, or analyses generated after conducting an audit with court approval – fully fall within the statutory definition of evidence. However, it should be clearly stated that an AI opinion cannot be equated with an expert opinion within the meaning of Article 84 of the Code of Administrative Procedure. This stems from the fact that an algorithm does not possess the status of a natural person equipped with specialized knowledge, which is a statutory requirement for appointing an expert. Instead, documentation generated by an AI agent should be classified as a private document or so-called “unnamed evidence.”

Practical justification for this position can be found in the case law concerning digital evidence. The judgment of the Court of Appeal in Szczecin of September 19, 2016, I ACa 364/15, LEX no. 2147337 aptly describes this issue, pointing out that evidence in a case may include official and private documents, but also means other than those listed in Articles 305-308 of the Code of Civil Procedure. Electronic evidence, currently increasingly used in civil proceedings, is not explicitly listed in the catalog of means of evidence. However, the Code of Civil Procedure does not contain a closed list of evidence sources; anything relevant to the case may constitute evidence. Although the above ruling was issued in the context of civil procedure, due to the identical approach to the openness of the evidence system, it remains fully applicable to administrative proceedings conducted by the President of the Office of Competition and Consumer Protection.

The key element of algorithmic evidence remains the human factor, which serves as a primary safeguard over the autonomous operation of technology. It’s important to note that AI multi-agents, despite their high sophistication, operate based on statistical probability models, which carries the risk of misinterpreting dynamic website elements. For example, the system may incorrectly classify a standard technical error as intentional dark web activity. patterns or misinterpret the interface’s intentions in a specific cultural or linguistic context. Therefore, opinions generated by AI agents cannot constitute a standalone and final basis for a decision, but should be subjected to thorough, critical review by an official. Only such a comparison of the “raw” algorithmic result with human knowledge and experience allows for avoiding errors that could lead to unjustified penalties. This approach is directly supported by Article 80 of the Code of Administrative Procedure, according to which a public administration body assesses whether a given circumstance has been proven based on the entirety of the evidence. In this process, the “AI opinion” is only one of many components that must be weighed against other evidence and evaluated through the prism of principles of logic and life experience, ultimately guaranteeing the implementation of the principle of objective truth and protecting the entrepreneur from the automaticity of decisions made by the algorithm.

Summary

Multi-agent system implemented by the Office of Competition and Consumer Protection for automatic control of the e-commerce sector poses a significant challenge for entrepreneurs, forcing strict compliance with regulations regarding dark patterns, price transparency (Omnibus Directive, Art. 6a) and information obligations (Consumer Rights Act, Art. 12). These tools are used to mass detect manipulative practices such as drip pricing, fake timers or making it difficult to unsubscribe. Although AI agents perform a function similar to “mystery shoppers,” their activity must meet the rigors of Article 105ia of the Act on Competition and Consumer Protection, including the requirement to obtain court consent for a controlled purchase. What is crucial from a procedural perspective is that the findings made by the algorithm do not have the status of an expert opinion within the meaning of Article 84 of the Code of Administrative Procedure (lack of the status of a natural person with specialist knowledge), but constitute only a private document or “other evidence” subject to the authority’s free assessment (Article 80 of the Code of Administrative Procedure).

Consequently, the official is required to subject AI reports to thorough human review to eliminate the risk of misclassification resulting from so-called “AI hallucinations” or technical errors in the interpretation of the website’s code. The entrepreneur has full rights of defense based on the principle of active participation of the party (Article 10 of the Code of Administrative Procedure) and the principle of objective truth (Article 7 of the Code of Administrative Procedure), which means the right to question the bot’s logic and to access the instructions and parameters of the AI system, in accordance with the “explainability” requirement enshrined in the AI Act (Article 13). Any decision based solely on the automated generation of conclusions, without providing the party with an opportunity to comment on the evidence (Article 81 of the Code of Administrative Procedure), constitutes a gross violation of administrative procedure and may constitute an effective basis for challenging the authority’s decision.

Sources:

Regulation 2022/2065 on the single market for digital services and amending Directive 2000/31/EC (Digital Services Act) (OJ EU L 277, 2022, No. 277, p. 1, as amended).

Directive (EU) 2019/2161 of the European Parliament and of the Council of 27 November 2019 amending Council Directive 93/13/EEC and Directives 98/6/EC, 2005/29/EC and 2011/83/EU of the European Parliament and of the Council as regards the better enforcement and modernisation of Union consumer protection rules (OJ L 328, 2019, p. 7, as amended).

Act of 30 May 2014 on consumer rights (consolidated text: Journal of Laws of 2024, item 1796, as amended).

Act of 23 August 2007 on counteracting unfair market practices (consolidated text: Journal of Laws of 2023, item 845).

Act of 16 February 2007 on competition and consumer protection (consolidated text: Journal of Laws of 2025, item 1714).

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) Text with EEA relevance (OJ L 1689, 2024).

Act of 14 June 1960, the Code of Administrative Procedure (consolidated text: Journal of Laws of 2025, item 1691).

Judgment of the Court of Appeal in Szczecin of 19 September 2016, I ACa 364/15, LEX no. 2147337.

Artykuł Multi-agent system in the service of the Polish Office of Competition and Consumer Protection – a new era of e-commerce control and the limits pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The Polish dietary supplements market is facing the most significant regulatory overhaul in years. The draft amendment to the Act on Food and Nutrition Safety and the Act on the State Sanitary Inspectorate introduces a series of far-reaching changes that will substantially alter the way supplements are notified, monitored, advertised, and supervised in Poland. While the reform does not formally introduce a pre-market authorization system, it undeniably strengthens the position of regulatory authorities and increases the compliance burden imposed on businesses operating in the sector.

The amendment, expected to enter into force six months after publication, reflects both domestic concerns regarding the rapid expansion of the supplements market and the broader European trend toward stricter food safety oversight. For manufacturers, importers, distributors, and marketing agencies, the proposed changes may require a complete reassessment of internal procedures, legal risk management, and commercial strategy.

The reform arrives at a time when the Polish dietary supplements market continues to expand at an exceptional pace. Poland has become one of the largest supplement consumers in the European Union, both in terms of total market value and per capita spending. According to market estimates, the sector exceeded PLN 7 billion in value in 2024 and is expected to continue growing steadily over the coming years. The scale of the market alone has become a challenge for regulators. Between 2017 and 2020, more than 62,000 supplement notifications were submitted to the Chief Sanitary Inspectorate (GIS), while the number of products listed in official registers exceeded 29,000.

At the same time, authorities increasingly pointed to systemic weaknesses in the existing framework. Under the current rules, a business may place a dietary supplement on the market immediately after submitting a notification to GIS, even if doubts exist regarding the product’s composition or classification. The authorities may initiate explanatory proceedings, but the product can still remain commercially available during the investigation. In practice, this system has often been criticized for providing insufficient preventive control and allowing potentially problematic products to circulate before any meaningful assessment takes place.

Another major concern involved the widespread use of aggressive advertising strategies. For years, the dietary supplements industry has been accused of blurring the line between supplements and medicinal products. Many advertisements indirectly suggested therapeutic effects or implied that supplements could substitute proper medical treatment or balanced nutrition. Regulators and pharmaceutical companies repeatedly argued that existing penalties were too low to deter large market participants from engaging in questionable promotional practices.

The lack of a centralized digital supervision system also contributed to inefficiencies. The notification process relied partly on outdated administrative mechanisms, resulting in difficulties with document verification, inconsistent communication, and lengthy proceedings. The new amendment seeks to address these concerns through digitalization, stricter procedural obligations, and substantially higher financial sanctions.

One of the most visible changes introduced by the reform is the mandatory use of the e-Sanepid platform for all supplement notifications. Until now, notifications could be submitted either electronically or in paper form, and businesses had some flexibility regarding the form and timing of submission. Under the new rules, however, the process becomes fully digitized. Notifications will only be accepted through the e-Sanepid system and will require either a qualified electronic signature or a trusted electronic profile.

This change may appear largely technical at first glance, but in reality it significantly increases the formalization of the entire notification process. For large companies with developed compliance departments, adapting to electronic communication systems is unlikely to create serious difficulties. Smaller businesses, however, may face operational and financial challenges connected with digital authentication tools, procedural monitoring, and document management requirements.

The amendment also changes the moment at which the notification obligation arises. Previously, the law referred both to products already introduced to the market and those merely intended for future introduction. The new wording removes the reference to “intended introduction,” meaning that the obligation will arise only once the product is actually being placed on the market. Although this clarification simplifies the legal interpretation of the obligation, it also narrows the flexibility businesses previously enjoyed when planning product launches.

Perhaps the most consequential aspect of the reform concerns explanatory proceedings and scientific opinions. Under the current framework, businesses could effectively delay proceedings indefinitely by postponing the submission of required scientific documentation. While the law imposed certain deadlines on the authorities themselves, it did not establish sufficiently strict obligations for the notifying entity. This created situations where proceedings remained unresolved for years, significantly limiting the effectiveness of supervision.

The amendment introduces a much stricter procedural regime. Once GIS requests a scientific opinion regarding a product’s classification or compliance, the business will have only 14 days to submit an application to a scientific institution or to the President of the Office for Registration of Medicinal Products. Furthermore, the scientific opinion itself must generally be issued within six months, with an absolute maximum period of twelve months in exceptional cases.

The most significant innovation is the introduction of a legal presumption against the entrepreneur. If the entity fails to submit the application for an opinion within the required 14-day period, the law will automatically presume that the proposed classification of the product is incorrect and that the product does not meet the requirements applicable to its category. In practical terms, procedural inactivity itself may lead to negative legal consequences.

This fundamentally changes the balance between businesses and regulatory authorities. Previously, delaying the process often worked in favor of companies by allowing products to remain on the market while proceedings continued. Under the new rules, inaction may immediately weaken the entrepreneur’s legal position. Businesses will therefore need to implement much stricter internal monitoring systems to ensure compliance with procedural deadlines.

The amendment additionally prohibits businesses from circumventing the procedure by repeatedly submitting notifications for identical products. Once proceedings are initiated, companies will no longer be able to submit another notification concerning a product with the same qualitative and quantitative composition. Similarly, withdrawing a notification will not allow the entrepreneur to restart the process with the same formula at a later stage. These restrictions are intended to eliminate procedural abuse and prevent companies from avoiding regulatory scrutiny through repeated filings.

Another major reform concerns transparency and the expansion of the public product register maintained within the SEPIS system. The current register already contains certain information regarding notified products, but the scope of publicly available data remains relatively limited. The new system significantly broadens the amount of information accessible to consumers and competitors alike.

Under the amendment, the register will include the product name, form of the product, qualitative composition, information regarding active substances, details concerning explanatory proceedings, and information about prohibited ingredients. Although quantitative composition data and certain identifying information regarding the reporting entity will remain confidential, the reform nevertheless represents a substantial increase in market transparency.

From the consumer protection perspective, this may be viewed as a positive development. Consumers will gain easier access to information about supplement composition and regulatory status, potentially allowing for more informed purchasing decisions. However, from the business perspective, the new transparency rules create considerable reputational risks. Information regarding ongoing explanatory proceedings may become publicly visible long before any final administrative decision is issued. As a result, companies may face reputational damage even in situations where no violation is ultimately confirmed.

The reform also updates the broader inspection framework to align Polish law with Regulation (EU) 2017/625 on official controls. Although the regulation has already been directly applicable across the European Union since 2019, several references in Polish legislation still pointed to repealed EU acts. The amendment therefore modernizes the legal terminology and adapts national provisions to the currently binding European framework.

Importantly, however, the changes do not significantly expand the substantive powers of sanitary authorities. The amendment primarily introduces terminological adjustments, extending references from “official food controls” to “official controls and other official activities.” Sanitary authorities will continue to possess extensive powers during inspections, including access to facilities, examination of production processes and documentation, and collection of samples for laboratory testing.

The reform does, however, expand the situations in which businesses must bear the costs of inspections and administrative activities. In addition to existing obligations related to violations, follow-up inspections, and border sanitary controls, businesses will now also be required to cover costs associated with official activities performed at their own request, such as the issuance of certain documents. While this change may appear relatively modest compared to other parts of the reform, it nevertheless contributes to the overall increase in operational costs for market participants.

One of the most controversial elements of the amendment concerns advertising and marketing practices. The reform significantly broadens the scope of administrative liability related to the promotion and presentation of dietary supplements. Previously, penalties focused primarily on incorrect product labeling. Under the new rules, liability will explicitly extend to advertising, online promotion, social media activities, and the overall presentation of products.

Most importantly, the amendment introduces severe sanctions for advertising or presenting a supplement before notifying GIS. This is likely to have a major impact on digital marketing strategies commonly used in the supplements industry. Influencer campaigns, online pre-launch promotions, teaser advertisements, and social media product announcements may all potentially fall within the scope of the new sanctions if conducted before formal notification.

The amendment also reinforces existing prohibitions against suggesting that a balanced diet cannot provide sufficient nutrients or implying medicinal properties of supplements. Although these prohibitions already existed under current law, the reform significantly strengthens enforcement mechanisms by attaching much higher financial penalties to violations.

Indeed, the increase in administrative penalties represents one of the most dramatic aspects of the reform. Under the current framework, the maximum administrative fine generally amounts to thirty times the average monthly salary. The amendment raises this threshold to one hundred times the average salary, increasing potential penalties by more than 330 percent.

Based on current economic indicators, maximum fines could exceed PLN 800,000. Such amounts are clearly intended to function as genuinely deterrent sanctions rather than symbolic administrative measures. For large corporations with extensive marketing operations, these penalties may significantly alter risk calculations related to aggressive advertising or borderline compliance practices.

For businesses operating in the supplements sector, the cumulative impact of these changes may be substantial. Compliance costs are likely to increase considerably. Companies may need to invest in legal advisory services, digital infrastructure, scientific assessments, employee training, and enhanced compliance monitoring systems. Marketing departments in particular will face increased scrutiny and will need to carefully verify advertising content before publication.

The reform may also contribute to market consolidation. Large, well-established companies are generally better positioned to absorb increased compliance costs and adapt to stricter regulatory requirements. Smaller businesses, startups, and niche supplement brands may struggle with the financial and administrative burden created by the new framework. As a result, the amendment could unintentionally reduce market diversity and strengthen the competitive position of major industry players.

From the perspective of public authorities, the reform aims to improve the efficiency and credibility of food safety supervision. Digitalization through e-Sanepid and SEPIS is expected to accelerate administrative processes, improve data analysis capabilities, and strengthen market oversight. The introduction of strict procedural deadlines should also reduce the risk of excessively lengthy proceedings and administrative disputes.

At the same time, the implementation of these systems will require significant investments in technological infrastructure and administrative capacity. The effectiveness of the reform will therefore depend not only on the wording of the legislation itself, but also on the practical ability of GIS and related institutions to manage the new digital environment efficiently.

Ultimately, the amendment does not formally transform dietary supplements into products requiring prior authorization before market entry. Businesses will still be able to introduce supplements through a notification-based system rather than a licensing procedure. Nevertheless, the practical reality of operating in the sector is likely to change considerably.

The reform substantially increases the procedural obligations imposed on businesses, strengthens enforcement tools available to authorities, raises financial exposure connected with non-compliance, and introduces far greater transparency into the market. While these changes may improve consumer protection and market oversight, they also create new operational and reputational risks for entrepreneurs.

For companies active in the supplements industry, the coming months may therefore become a critical period of preparation. Businesses that fail to adapt quickly to the new regulatory environment may face not only financial penalties, but also significant disruptions to their commercial operations and marketing strategies.

Artykuł Dietary Supplements Under Tightened Scrutiny: How the 2026 Reform Could Reshape the Polish Market pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.