We are delighted to share an important milestone in the continued development of KG Legal’s Data, AI & Cybersecurity Desk.

It has been a great honour to serve as the exclusive expert contributors for Poland to the OneTrust DataGuidance Privacy Overview – Poland, one of the world’s leading professional legal compliance resources relied upon by in-house counsel, privacy professionals, compliance officers, multinational organisations and technology companies operating across multiple jurisdictions.

Preparing this contribution was a long-term project that required several months of intensive legal analysis, research and editorial work. Our objective was not simply to describe the application of the GDPR in Poland. Instead, we sought to create a practical and comprehensive guide reflecting the significant transformation of the Polish regulatory landscape that has taken place in recent years as a result of new European legislation and its implementation into Polish law.

The publication therefore extends far beyond a traditional overview of Polish data protection law. It examines the interaction between privacy, digital regulation, cybersecurity and artificial intelligence, providing readers with practical guidance on the most important legal developments affecting organisations operating in Poland.

Our contribution discusses, among other things:

• the practical application of the GDPR within the Polish legal system;
• the powers and regulatory practice of the Polish supervisory authority for personal data protection;
• employee monitoring and workplace privacy;
• cookies, consent mechanisms and online tracking technologies;
• electronic communications and direct marketing requirements;
• international data transfers;
• personal data breaches and notification obligations;
• practical compliance with Polish privacy legislation;
• cybersecurity-related regulatory developments;
• the growing interaction between data protection and artificial intelligence governance.

A particularly important aspect of this work was addressing the rapidly evolving legislative environment. During the last few years, Poland has experienced substantial regulatory changes resulting from the implementation of numerous European legal instruments and the entry into force of directly applicable EU regulations that significantly affect organisations processing personal data.

Accordingly, the publication takes into account the practical implications of the evolving European digital regulatory framework, including the interaction between the GDPR and newer legal instruments governing digital services, artificial intelligence, cybersecurity and data governance. The analysis also reflects the impact of the AI regulatory framework, developments concerning data governance and electronic communications, as well as the increasingly interconnected compliance obligations facing businesses operating in today’s digital economy.

Rather than presenting legislation in isolation, the publication adopts a practical, compliance-oriented perspective. It combines:

• the GDPR and Polish implementing legislation;
• guidance issued by the European Data Protection Board (EDPB);
• the jurisprudence of the Court of Justice of the European Union;
• decisions and regulatory guidance published by the Polish Personal Data Protection Office (UODO);
• recent Polish legislative developments and market practice.

Our ambition was to create a resource that would assist both international and domestic organisations in navigating one of the fastest-changing areas of European regulation, where privacy law increasingly intersects with cybersecurity, AI governance, digital platforms, online communications and emerging technologies.

The contribution was prepared by Małgorzata Kiełtyka and Jakub Gładkowski, whose combined experience covers complex cross-border advisory work in data protection, artificial intelligence, life sciences, healthcare, technology law, cybersecurity, intellectual property and regulatory compliance.

https://www.dataguidance.com/experts-directory/Jakub_G%C5%82adkowski

https://www.dataguidance.com/experts-directory/Malgorzata_Kieltyka

For many years, Małgorzata Kiełtyka has advised international companies on GDPR compliance, healthcare regulation, AI governance, technology transactions and cross-border regulatory matters. Her practice combines strategic legal advice with practical implementation of compliance frameworks for multinational businesses operating in highly regulated sectors.

Jakub Gładkowski focuses on data protection, digital regulation, cybersecurity, intellectual property, IT law and emerging technologies. His practice includes advising innovative businesses on regulatory compliance, digital transformation projects and the implementation of European technology legislation affecting both public and private sector organisations.

Being entrusted with preparing Poland’s national contribution to OneTrust DataGuidance represents an important recognition of our team’s expertise and international standing. We are particularly proud that this publication reflects not only our experience in privacy law, but also our broader interdisciplinary approach, integrating data protection with AI regulation, cybersecurity, digital compliance and technology law.

We sincerely thank the editorial team at OneTrust DataGuidance for their confidence in our expertise and for the opportunity to contribute to a publication that supports legal and compliance professionals around the world.

For KG Legal, this publication marks another significant milestone in the continued growth of our Data, AI & Cybersecurity Desk and reinforces our commitment to delivering practical, business-oriented legal advice at the intersection of privacy, technology and innovation.

Artykuł A Major Milestone for KG Legal’s Data, AI & Cybersecurity Practice: Exclusive Poland Contribution to OneTrust DataGuidance pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The Polish dietary supplements market is facing the most significant regulatory overhaul in years. The draft amendment to the Act on Food and Nutrition Safety and the Act on the State Sanitary Inspectorate introduces a series of far-reaching changes that will substantially alter the way supplements are notified, monitored, advertised, and supervised in Poland. While the reform does not formally introduce a pre-market authorization system, it undeniably strengthens the position of regulatory authorities and increases the compliance burden imposed on businesses operating in the sector.

The amendment, expected to enter into force six months after publication, reflects both domestic concerns regarding the rapid expansion of the supplements market and the broader European trend toward stricter food safety oversight. For manufacturers, importers, distributors, and marketing agencies, the proposed changes may require a complete reassessment of internal procedures, legal risk management, and commercial strategy.

The reform arrives at a time when the Polish dietary supplements market continues to expand at an exceptional pace. Poland has become one of the largest supplement consumers in the European Union, both in terms of total market value and per capita spending. According to market estimates, the sector exceeded PLN 7 billion in value in 2024 and is expected to continue growing steadily over the coming years. The scale of the market alone has become a challenge for regulators. Between 2017 and 2020, more than 62,000 supplement notifications were submitted to the Chief Sanitary Inspectorate (GIS), while the number of products listed in official registers exceeded 29,000.

At the same time, authorities increasingly pointed to systemic weaknesses in the existing framework. Under the current rules, a business may place a dietary supplement on the market immediately after submitting a notification to GIS, even if doubts exist regarding the product’s composition or classification. The authorities may initiate explanatory proceedings, but the product can still remain commercially available during the investigation. In practice, this system has often been criticized for providing insufficient preventive control and allowing potentially problematic products to circulate before any meaningful assessment takes place.

Another major concern involved the widespread use of aggressive advertising strategies. For years, the dietary supplements industry has been accused of blurring the line between supplements and medicinal products. Many advertisements indirectly suggested therapeutic effects or implied that supplements could substitute proper medical treatment or balanced nutrition. Regulators and pharmaceutical companies repeatedly argued that existing penalties were too low to deter large market participants from engaging in questionable promotional practices.

The lack of a centralized digital supervision system also contributed to inefficiencies. The notification process relied partly on outdated administrative mechanisms, resulting in difficulties with document verification, inconsistent communication, and lengthy proceedings. The new amendment seeks to address these concerns through digitalization, stricter procedural obligations, and substantially higher financial sanctions.

One of the most visible changes introduced by the reform is the mandatory use of the e-Sanepid platform for all supplement notifications. Until now, notifications could be submitted either electronically or in paper form, and businesses had some flexibility regarding the form and timing of submission. Under the new rules, however, the process becomes fully digitized. Notifications will only be accepted through the e-Sanepid system and will require either a qualified electronic signature or a trusted electronic profile.

This change may appear largely technical at first glance, but in reality it significantly increases the formalization of the entire notification process. For large companies with developed compliance departments, adapting to electronic communication systems is unlikely to create serious difficulties. Smaller businesses, however, may face operational and financial challenges connected with digital authentication tools, procedural monitoring, and document management requirements.

The amendment also changes the moment at which the notification obligation arises. Previously, the law referred both to products already introduced to the market and those merely intended for future introduction. The new wording removes the reference to “intended introduction,” meaning that the obligation will arise only once the product is actually being placed on the market. Although this clarification simplifies the legal interpretation of the obligation, it also narrows the flexibility businesses previously enjoyed when planning product launches.

Perhaps the most consequential aspect of the reform concerns explanatory proceedings and scientific opinions. Under the current framework, businesses could effectively delay proceedings indefinitely by postponing the submission of required scientific documentation. While the law imposed certain deadlines on the authorities themselves, it did not establish sufficiently strict obligations for the notifying entity. This created situations where proceedings remained unresolved for years, significantly limiting the effectiveness of supervision.

The amendment introduces a much stricter procedural regime. Once GIS requests a scientific opinion regarding a product’s classification or compliance, the business will have only 14 days to submit an application to a scientific institution or to the President of the Office for Registration of Medicinal Products. Furthermore, the scientific opinion itself must generally be issued within six months, with an absolute maximum period of twelve months in exceptional cases.

The most significant innovation is the introduction of a legal presumption against the entrepreneur. If the entity fails to submit the application for an opinion within the required 14-day period, the law will automatically presume that the proposed classification of the product is incorrect and that the product does not meet the requirements applicable to its category. In practical terms, procedural inactivity itself may lead to negative legal consequences.

This fundamentally changes the balance between businesses and regulatory authorities. Previously, delaying the process often worked in favor of companies by allowing products to remain on the market while proceedings continued. Under the new rules, inaction may immediately weaken the entrepreneur’s legal position. Businesses will therefore need to implement much stricter internal monitoring systems to ensure compliance with procedural deadlines.

The amendment additionally prohibits businesses from circumventing the procedure by repeatedly submitting notifications for identical products. Once proceedings are initiated, companies will no longer be able to submit another notification concerning a product with the same qualitative and quantitative composition. Similarly, withdrawing a notification will not allow the entrepreneur to restart the process with the same formula at a later stage. These restrictions are intended to eliminate procedural abuse and prevent companies from avoiding regulatory scrutiny through repeated filings.

Another major reform concerns transparency and the expansion of the public product register maintained within the SEPIS system. The current register already contains certain information regarding notified products, but the scope of publicly available data remains relatively limited. The new system significantly broadens the amount of information accessible to consumers and competitors alike.

Under the amendment, the register will include the product name, form of the product, qualitative composition, information regarding active substances, details concerning explanatory proceedings, and information about prohibited ingredients. Although quantitative composition data and certain identifying information regarding the reporting entity will remain confidential, the reform nevertheless represents a substantial increase in market transparency.

From the consumer protection perspective, this may be viewed as a positive development. Consumers will gain easier access to information about supplement composition and regulatory status, potentially allowing for more informed purchasing decisions. However, from the business perspective, the new transparency rules create considerable reputational risks. Information regarding ongoing explanatory proceedings may become publicly visible long before any final administrative decision is issued. As a result, companies may face reputational damage even in situations where no violation is ultimately confirmed.

The reform also updates the broader inspection framework to align Polish law with Regulation (EU) 2017/625 on official controls. Although the regulation has already been directly applicable across the European Union since 2019, several references in Polish legislation still pointed to repealed EU acts. The amendment therefore modernizes the legal terminology and adapts national provisions to the currently binding European framework.

Importantly, however, the changes do not significantly expand the substantive powers of sanitary authorities. The amendment primarily introduces terminological adjustments, extending references from “official food controls” to “official controls and other official activities.” Sanitary authorities will continue to possess extensive powers during inspections, including access to facilities, examination of production processes and documentation, and collection of samples for laboratory testing.

The reform does, however, expand the situations in which businesses must bear the costs of inspections and administrative activities. In addition to existing obligations related to violations, follow-up inspections, and border sanitary controls, businesses will now also be required to cover costs associated with official activities performed at their own request, such as the issuance of certain documents. While this change may appear relatively modest compared to other parts of the reform, it nevertheless contributes to the overall increase in operational costs for market participants.

One of the most controversial elements of the amendment concerns advertising and marketing practices. The reform significantly broadens the scope of administrative liability related to the promotion and presentation of dietary supplements. Previously, penalties focused primarily on incorrect product labeling. Under the new rules, liability will explicitly extend to advertising, online promotion, social media activities, and the overall presentation of products.

Most importantly, the amendment introduces severe sanctions for advertising or presenting a supplement before notifying GIS. This is likely to have a major impact on digital marketing strategies commonly used in the supplements industry. Influencer campaigns, online pre-launch promotions, teaser advertisements, and social media product announcements may all potentially fall within the scope of the new sanctions if conducted before formal notification.

The amendment also reinforces existing prohibitions against suggesting that a balanced diet cannot provide sufficient nutrients or implying medicinal properties of supplements. Although these prohibitions already existed under current law, the reform significantly strengthens enforcement mechanisms by attaching much higher financial penalties to violations.

Indeed, the increase in administrative penalties represents one of the most dramatic aspects of the reform. Under the current framework, the maximum administrative fine generally amounts to thirty times the average monthly salary. The amendment raises this threshold to one hundred times the average salary, increasing potential penalties by more than 330 percent.

Based on current economic indicators, maximum fines could exceed PLN 800,000. Such amounts are clearly intended to function as genuinely deterrent sanctions rather than symbolic administrative measures. For large corporations with extensive marketing operations, these penalties may significantly alter risk calculations related to aggressive advertising or borderline compliance practices.

For businesses operating in the supplements sector, the cumulative impact of these changes may be substantial. Compliance costs are likely to increase considerably. Companies may need to invest in legal advisory services, digital infrastructure, scientific assessments, employee training, and enhanced compliance monitoring systems. Marketing departments in particular will face increased scrutiny and will need to carefully verify advertising content before publication.

The reform may also contribute to market consolidation. Large, well-established companies are generally better positioned to absorb increased compliance costs and adapt to stricter regulatory requirements. Smaller businesses, startups, and niche supplement brands may struggle with the financial and administrative burden created by the new framework. As a result, the amendment could unintentionally reduce market diversity and strengthen the competitive position of major industry players.

From the perspective of public authorities, the reform aims to improve the efficiency and credibility of food safety supervision. Digitalization through e-Sanepid and SEPIS is expected to accelerate administrative processes, improve data analysis capabilities, and strengthen market oversight. The introduction of strict procedural deadlines should also reduce the risk of excessively lengthy proceedings and administrative disputes.

At the same time, the implementation of these systems will require significant investments in technological infrastructure and administrative capacity. The effectiveness of the reform will therefore depend not only on the wording of the legislation itself, but also on the practical ability of GIS and related institutions to manage the new digital environment efficiently.

Ultimately, the amendment does not formally transform dietary supplements into products requiring prior authorization before market entry. Businesses will still be able to introduce supplements through a notification-based system rather than a licensing procedure. Nevertheless, the practical reality of operating in the sector is likely to change considerably.

The reform substantially increases the procedural obligations imposed on businesses, strengthens enforcement tools available to authorities, raises financial exposure connected with non-compliance, and introduces far greater transparency into the market. While these changes may improve consumer protection and market oversight, they also create new operational and reputational risks for entrepreneurs.

For companies active in the supplements industry, the coming months may therefore become a critical period of preparation. Businesses that fail to adapt quickly to the new regulatory environment may face not only financial penalties, but also significant disruptions to their commercial operations and marketing strategies.

Artykuł Dietary Supplements Under Tightened Scrutiny: How the 2026 Reform Could Reshape the Polish Market pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

On June 19, 2026, representatives of our law firm will participate in the Data Science Summit AI Edition 2026, which will be held at the Palace of Culture and Science in Warsaw. For many years, the event has been one of the most important technology conferences in Central and Eastern Europe, bringing together specialists responsible for the development and implementation of the most advanced solutions based on artificial intelligence, machine learning, and data analysis. It provides a meeting place for the business, technology, scientific, and administrative communities—a space where implementation practice meets regulatory and strategic reflection.

Link to the event: https://ml.dssconf.pl/#agenda

This year’s edition focuses on the most important directions of development of modern artificial intelligence, including, among others, generative AI ( Generative AI), large language models (LLM), GPT systems, AI agents, Agent-to-Agent (A2A) architectures, Context Model Protocol (MCP), reinforcement learning, computer vision, predictive analytics, MLOps, LLMOps, AI governance and broadly understood data-driven business transformation.

The conference is aimed at data scientists, AI experts, data engineers, IT system architects, programmers, cybersecurity specialists, digital transformation leaders, product development managers, public administration representatives, and executives of enterprises implementing AI-based solutions. Speakers will include representatives of global technology companies, international corporations, financial institutions, telecommunications operators, energy companies, research and development organizations, academia, and technology startups – including AI directors, chief system architects, digital transformation leaders, scientists, AI engineers, MLOps experts, cybersecurity specialists, and managers responsible for implementing technological innovations.

The event is distinguished by its practical nature. The program focuses not only on presenting technological innovations, but primarily on showcasing real-world implementations already in place in businesses, public administration, the financial and energy sectors, e-commerce, telecommunications, healthcare, and industry.

Enterprise AI – From Experiment to Infrastructure

One of the most important themes of the conference is the practical use of artificial intelligence in production environments. It is increasingly clear that AI has ceased to be an experimental technology and has become a component of real-world business infrastructure. In this context, we are analyzing ways to counteract the phenomenon of so-called information bubbles and build more sustainable recommendation systems used by the largest media platforms. Methods are emerging to increase the diversity of presented content, reduce algorithmic bias, and design systems that responsibly influence user behavior.

A key issue is the collaboration between classic machine learning and generative AI. Combining both approaches allows for the development of scalable, cost-effective solutions, ready for use by large organizations. A significant portion of the discussion also focuses on countering financial fraud – methods for detecting fraud and building competitive advantage through structured AI system development processes. Developer experience and modern work environments for AI teams are also gaining importance, including ways to accelerate the creation and maintenance of AI-based applications.

The technological landscape is strongly influenced by the prototyping of AI agents using modern programming environments and platforms supporting the creation of autonomous systems. Simultaneously, there are emerging themes regarding the use of AI in the legal sector – methods for assessing the reasoning ability of language models, methods for tracing legal sources, and techniques for increasing the reliability of AI-generated responses. From a security perspective, mechanisms for securing autonomous systems against attacks, unauthorized access, and attempts to manipulate their behavior are particularly important.

Equally important is the optimization of language models – techniques for quantization, distillation, and model size reduction while maintaining high efficiency. In the financial sector, solutions are emerging that include automated document processing, data extraction, and the development of intelligent analytical platforms. As an illustration of the creative potential of AI, the mechanisms behind music generation by artificial intelligence and the application of deep learning in creative processes are also discussed.

Generative AI – Multimodality, Agents, and Public Administration

Generative AI is one of the fastest-growing areas of contemporary technology. In production practice, it is used to automatically describe works of art, create alternative descriptions that increase the accessibility of digital documents for people with disabilities, and develop strategies for replacing very large and expensive language models with smaller, specialized solutions that can be effectively used in enterprises. The evolution of architectures leads from simple prompts, through RAG mechanisms, to multi-stage pipelines integrating multiple data sources and advanced LLM architectures.

Multimodality plays a significant role – solutions that can simultaneously analyze text, images, sound, and spatial information – opening the door to building more versatile AI systems. In enterprise environments where standard communication protocols aren’t feasible, building agents that exclusively utilize approved APIs, internal tools, and development platforms becomes crucial, while adhering to security and governance principles.

A crucial direction is the use of artificial intelligence in public administration, including the process of transforming an AI project into a product accessible to millions of citizens. Solutions that generate sound, speech, and music using modern diffusion models and transformers are also gaining importance, as are automatic analysis of PDF documents and the extraction of structured data from multi-page administrative materials. Hybrid pipelines combining generative AI, signal processing, and embedded systems for use in resource-constrained devices are also emerging. A separate, increasingly important issue is assessing the quality of RAG chatbots, testing them before deployment, and building reliable conversational systems.

Machine learning in practice – recommendations, energy, finance

Classic machine learning remains relevant – on the contrary, it’s finding applications in major industrial and financial implementations. Modern recommendation systems are emerging, based on data representation vectors and embedding architectures, where balancing recommendation effectiveness with the ability for users to discover new content is paramount. Digital twins are being used to optimize energy assets and manage industrial infrastructure. In the financial sector, teams of collaborative models are emerging to support decision-making processes.

The challenges associated with AI agents operating in social media are increasingly being discussed – issues such as user privacy, data security, and customer interaction design. In the banking sector, there’s a clear trend toward building millions of personalized models operating in parallel, which requires advanced training optimization, system scaling, and efficient processing of massive data sets.

Deployments, MLOps, and Security – The AI Systems Lifecycle

One of the most practical areas of the event is implementing, maintaining, and scaling AI systems in production environments. Simply developing a model is no longer the biggest challenge; ensuring its stable, secure, and effective operation in real-world business environments is crucial.

The security of generative AI is becoming one of the most pressing issues. Practical methods are emerging to protect models from prompts, injection, jailbreaking, and attempts to bypass control mechanisms. Referring to OWASP guidelines and modern solutions enabling the implementation of AI systems in accordance with the security- by-design principle is becoming standard.

From a legal perspective, issues related to designing global data platforms operating simultaneously in multiple jurisdictions are particularly important. These challenges include data sovereignty, local regulations, and the need to reconcile legal requirements across different jurisdictions.

A key theme is the full lifecycle of machine learning models – the processes of building, deploying, monitoring, updating, and retiring AI models, as well as how to manage their performance at scale. System performance optimization plays a significant role – techniques for reducing latency, shortening inference times, and adapting models to various hardware environments. Case studies from the pharmaceutical sector also appear, demonstrating how to manage chatbots’ deviance from their original purpose and how to minimize the risk of generating undesirable responses. Simultaneously, computer model optimization techniques are being developed, allowing to increase their efficiency many times while maintaining high quality of prediction.

Monitoring LLM systems and AI agents before end-user errors occur is becoming particularly important. Systems for model tracking, automated evaluation, anomaly detection, cost management, and continuous response quality improvement are emerging. Solutions are emerging that enable the management of thousands of AI agents and their evaluation at scale. This is complemented by approaches based on GitMLOps, DevSecOps, and modern observability solutions for systems based on large language models.

AI Agents – Autonomous Decision-Making Systems

One of the most important areas of the conference is AI agents. Modern artificial intelligence is increasingly moving beyond the role of a mere tool for human support and instead becoming an autonomous system capable of executing complex business processes. Methods are emerging for assessing the effectiveness of large-scale multi-agent systems – methods for automated testing, reliability testing, tracing error sources, and building systems that guarantee repeatable results. Significant attention is being paid to monitoring agents in real time, identifying errors, measuring response quality, and continuously improving decision-making processes.

Issues related to the security of AI agents are becoming increasingly important, including attack scenarios that confuse autonomous systems and methods for securing them against manipulation. Practical applications of agents utilizing financial, registry, and business data are emerging, supporting analytical, scoring, and decision-making processes. AI agents are also finding applications in telecommunications and in the construction of systems that independently conduct research and analysis.

Agents’ long-term memory plays a significant role – solutions utilizing knowledge graphs and mechanisms that enable agents to independently organize and expand their accumulated knowledge. Real-time voice agents are highly practical – systems capable of conducting telephone conversations with users, analyzing speech, and generating responses that approximate natural communication. Solutions are also emerging that enable automatic detection of problems arising during the operation of production agents and the generation of evaluation processes without human intervention. Applications also include systems supporting energy management, intelligent buildings, and Internet of Things devices. A separate, important area is the evaluation of Text -to-SQL systems, which enable the automatic conversion of natural language into database queries.

Development and tuning of large language models

A significant portion of the conference was devoted to the creation, training, and refinement of large-scale language models. The most common errors made when building AI models are increasingly understood, as is the significant impact that the proper selection of training data has on their quality. Specialized models for the banking sector are being developed, along with methods for adapting them to specific business applications.

A significant area of research is Polish multimodal models capable of simultaneously understanding text and images, including methods for building them with limited data resources. Techniques for simplifying official and administrative language using language models are also emerging, with a particular emphasis on increasing the accessibility of public transportation. Mechanisms for building trust in artificial intelligence by providing users with justifications for generated responses are gaining increasing importance. Embedding models, used to identify duplicate data, ambiguous names, and unstructured addresses, are becoming increasingly important in everyday business practice.

Business Transformation – Strategy, Data, and Organization

From a strategic perspective, artificial intelligence is becoming one of the most important elements in building a competitive advantage for enterprises. Practical experience is emerging with implementing generative AI in international organizations and managing technological transformation processes. Methods for identifying the most promising AI initiatives from among hundreds of potential projects are becoming increasingly important.

Data quality plays a significant role – proper data preparation is now a prerequisite for the effective implementation of artificial intelligence. Critical analysis of technological trends is also emerging, allowing us to separate the true capabilities of AI from marketing hype. The importance of data architecture and IT systems for the success of transformation projects is becoming increasingly clear. The debate on the future of management in the era of agent-based AI and the changes AI will bring to corporate organizational structures is particularly prominent. Examples of building scalable customer service agents operating simultaneously in multiple countries are also emerging, as are the experiences of large organizations implementing AI, developing data products, supporting business expansion, and transforming the banking sector.

AI in Software Development – Regulation, Security, and Intellectual Property

Artificial intelligence is fundamentally changing the way technology teams work. Building local systems to support programming in compliance with European regulations, including the AI Act and NIS2, is becoming increasingly important. Both the potential and limitations of modern programming assistants are emerging, including the reasons for the failure of AI agents working with enterprise data and ways to build more predictable systems.

Cybersecurity, threat modeling, and vulnerability management in AI-based systems are all important topics, as are the practical aspects of building agent platforms capable of operating in production environments. From a legal perspective, issues related to intellectual property protection, commercialization of AI-based solutions, copyright management, and building secure technological product development processes are particularly important.

Computer Vision – intelligent image analysis

Modern image analysis goes far beyond classical object recognition. New approaches are emerging to using visual models in unusual applications, including Visual RAG systems that enable automated processing of data contained in spreadsheets and corporate documents. The technological trade-offs involved in designing high-performance pipelines are increasingly understood. computer vision. Computer vision is also used in climate forecasting and analysis of environmental phenomena, as well as in automatic data extraction from Polish administrative and business documents.

Debates about the future of artificial intelligence

An integral part of the event are expert roundtable discussions. The role of software agents is discussed – whether they will become merely a tool to support specialists or will they take over some of their responsibilities. The use of AI agents as digital equivalents of junior engineers supporting data science teams is also discussed. Experts engage in debates on the labeling of AI-generated content and the transparency of AI systems.

A separate discussion is devoted to Europe’s technological sovereignty and the possibility of building an independent artificial intelligence ecosystem. The discussion concludes with a discussion on the competencies of the future and the skills that will become crucial for organizations to function in an AI-based economy.

The Data Science Summit AI Edition 2026 demonstrates that artificial intelligence is no longer just a technology of the future. It has become one of the most important tools shaping modern businesses, public administration, and the financial, energy, industrial, and technology sectors. The scale and scope of the topics covered confirm that AI development today requires not only advanced technological competencies but also appropriate risk management, security, regulatory compliance, and a responsible approach to implementing new technologies – making law firms’ participation in such events a natural part of tracking the directions in which new technologies law is heading.

#DataScienceSummit #AIEdition2026 #ArtificialIntelligence #AI #MachineLearning #GenerativeAI #LLM #GPT #AIAgents #AgenticAI #AgentToAgent #ModelContextProtocol #MCP #DeepLearning #ReinforcementLearning #ComputerVision #PredictiveAnalytics #MLOps #LLMOps #AIGovernance #ResponsibleAI #AIEthics #AISecurity #PromptInjection #Jailbreaking #SecurityByDesign #OWASP #DevSecOps #GitMLOps #CyberSecurity #DataSovereignty #AIAct #NIS2 #EURegulations #TechSovereignty #DigitalTransformation #BusinessTransformation #DataDriven #DataQuality #DataEngineering #DataScience #CloudComputing #RAG #VisualRAG #Multimodal #Multimodality #Embeddings #VectorSearch #Quantization #ModelDistillation #FineTuning #TextToSQL #KnowledgeGraphs #VoiceAgents #ConversationalAI #Chatbots #DigitalTwins #IoT #SmartBuildings #EnergyManagement #FinTech #BankingAI #LegalTech #LawFirm #IntellectualProperty #Copyright #PublicAdministration #GovTech #HealthcareAI #PharmaAI #Telecommunications #SoftwareDevelopment #AIAssistants #CodingAgents #Innovation #TechConference #Warsaw #CEE #KGLegal #KieltykaGladkowski

Artykuł Representatives of our law firm KG LEGAL KIEŁTYKA GŁADKOWSKI will take part in the Data Science Summit AI Edition 2026 – one of the largest events dedicated to artificial intelligence in Central and Eastern Europe pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The CE marking was introduced as part of the harmonization of product marking processes within the EU. It is intended to replace all existing conformity markings. The marking itself indicates that the product meets the requirements of the applicable regulations. It is affixed to products intended for introduction into the EEA and Turkish markets, regardless of where they were manufactured.

Main regulations

The main acts that regulate the CE marking of products and the conformity testing that must accompany this process are: Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (consolidated text: OJ L 218, 2008, p. 30, as amended) as well as Decision No 768/2008/EC of the European Parliament and of the Council of 9 July 2008 on a common framework for the marketing of products, and repealing Council Decision 93/465/EEC (consolidated text: OJ L 218, 2008, p. 82).

CE marking

Although the mark is generally believed to be an abbreviation of the French expression “Conformité Européenne”, no EU legal act provides such an expansion of this abbreviation.

The appearance and method of affixing the CE marking are specified in Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 and Decision No 768/2008/EC of the European Parliament and of the Council of 9 July 2008, stating that it consists of the initials “CE” presented in the form specified in the regulation. Unless other regulations specify a different height, it shall be at least 5 mm. In all cases, the proportions of the mark must be maintained. It must be affixed so that it is visible, legible, and indelible from the product. The CE marking is followed by the identification number of the notified body, if it was involved in the production control phase. If the CE marking cannot be affixed to the product, it should be affixed to the packaging or accompanying documentation.

Declaration of Conformity

Union harmonisation legislation requires the manufacturer to draw up and sign an EU declaration of conformity before placing the product on the market.

The manufacturer or its authorized representative established within the EU is required to draw up and sign an EU declaration of conformity as part of the conformity assessment procedure provided for in Union harmonisation legislation. The EU declaration of conformity is a document stating that the product complies with all relevant requirements of the applicable legislation.

By drawing up and signing the EU declaration of conformity, the manufacturer takes responsibility for the product’s compliance with the regulations.

The EU declaration of conformity must be continuously updated and kept for ten years from the date the product is placed on the market, unless a different period is specified by law.

According to the model declaration in Decision No 768/2008/EC of 9 July 2008, the declaration should include:

1. unique product identifier,

2. name and address of the manufacturer or authorized representative issuing the declaration,

3. a statement that the declaration is issued under the sole responsibility of the manufacturer,

4. Subject of the declaration (product identifier enabling the reconstruction of its history. Where appropriate, it may include a photo),

5. all relevant provisions of Union harmonisation legislation that the product must comply with, referenced standards or other technical specifications (such as national standards and technical specifications) in a precise, complete and clearly defined manner,

6. Where applicable, name and number of the notified body that issued the certificate,

7. Additional information,

8. Date of issue of the declaration, signature and position or equivalent designation of the authorized person,

Modules

The mark itself is intended to indicate that the product meets the requirements specified in the law. The product is marked with it by the manufacturer, either independently or with the participation of a national authority (conformity assessment body, notified body). For this purpose, the manufacturer assesses conformity using modules (described in the Commission Notice Blue Guide – Implementation of EU product regulations 2022 (i.e. OJ EU C. of 2022 No. 247, p. 1) and Decision No 768/2008/EC of the European Parliament and of the Council of 9 July 2008). The modules refer to both the design and production phases. Conformity assessments can be performed using one or two modules. Assessment modules can refer to one of the phases (e.g. only to the production phase), or to both. If a module refers to only one phase, the assessment consists of two modules, while if it refers to both phases, the assessment consists of one.

There are eight modules in total, but with the addition of variants, their number increases to 16 (A, A1, A2, B, C, C1, C2, D, D1, E, E1, F, F1, G, H, H1). Each subsequent module contains further requirements, along with increasing risks posed by the product. In the “least demanding” module, A, the manufacturer only prepares technical documentation and takes all necessary measures to ensure the production process ensures compliance of manufactured products with the technical documentation, and then affixes the marking to the product. In the highest module, H1, the manufacturer must have an approved quality assurance system (approved by a notified body) for design, production, and inspection and testing of finished products. It is also subject to supervision by a notified body. The notified body may also pay unannounced visits to the manufacturer, during which it may conduct or commission product tests.

Entities involved in conformity assessment

At the outset, it is worth noting that regardless of whether a notified body is involved in the conformity assessment procedure or not, the conformity assessment is the manufacturer’s responsibility, and the declaration of conformity is made under his sole responsibility.

There are three possibilities for the involvement of other entities in the conformity assessment procedure:

– No involvement of external entities. In such a case (and this usually applies to products that the legislator has deemed not to pose such a risk that the manufacturer cannot be entrusted with the independent conformity assessment), the manufacturer prepares the declaration itself (along with the appropriate tests and technical documentation), and conducts the tests, inspections, and guarantees compliance during production.

– Conformity assessment is carried out using an accredited in-house body, i.e., a part of the manufacturer. However, this body cannot perform any tasks other than conformity assessment. It must be independent of commercial, design, and manufacturing entities and must possess the same level of technical competence and impartiality as external assessment bodies. They may conduct assessments within the scope of modules A1, A2, C1, or C2.

– Conducting the assessment with the involvement of an external entity. If the legislator deems such intervention necessary, an external conformity assessment body will participate in the conformity assessment. This body must be impartial and fully independent of the organization or the product it assesses. It must not engage in any activities that might compromise its independence, and it must not have user or other interests in the product being assessed.

Member States are responsible for designating conformity assessment bodies. They must designate bodies (within their jurisdiction) that have the appropriate competence to assess product conformity.

Even though in-house bodies cannot be notified (i.e. they cannot be external conformity assessment bodies), they must demonstrate at least the same level of technical competence as external bodies through accreditation.

Notified bodies

Conformity assessment bodies (referred to as notified bodies in EU legislation) are entities designated by Member States. Appointed notified bodies must then be notified to the European Commission.

They play roles in the conformity assessment process, responsible for activities such as calibration, testing, certification, and inspection. To qualify as a notified body, a body must be a legal entity established in a Member State, but it may operate or employ personnel outside a Member State or even outside the EU.

The bodies must be accredited, which means that the relevant national accreditation body must confirm that the conformity assessment body meets the requirements set by the harmonised standards and any additional requirements for carrying out specific conformity assessment tasks.

Member States may designate a maximum of one national accreditation body. However, they may choose not to designate such a body and instead have accreditation performed in their territory by an accreditation body from another Member State. In both cases (designation or non-designation), Member States are required to notify the European Commission.

Notified bodies are subject to oversight by national notifying authorities and must keep them informed about their activities (including, for example, availability of resources, performance of conformity assessments, subcontracting of work, and conflicts of interest). They must provide, directly or through another body (e.g., a national accreditation body), all information concerning the proper implementation of the conditions under which they were notified, upon request, both to their notifying authorities and to the Commission.

The notifying authority is responsible for the activities of notified bodies. It must remain capable of ensuring monitoring. If such monitoring is not possible, the notifying authority must withdraw or limit the scope of the notification to the extent necessary.

It’s also worth mentioning that the independence requirement (which also means that notified bodies “are and must remain” third parties independent of their clients) does not mean that only state bodies can become notified bodies. On the contrary, both state and private entities can apply for this status, provided their independence, impartiality, and reliability are guaranteed, and they constitute independent legal entities with appropriate rights and obligations.

Product labeling requirement

The CE marking is not required for every product, only for those for which legislation requires it. Currently, these include toys, electrical products, machinery, personal protective equipment, and cranes. It is prohibited to affix the CE marking to products that are not covered by the CE marking regulations.

Changes in the law

There have been no significant recent changes to the legislation governing the CE marking. However, sector-specific regulations necessarily influence the use of the mark. Such as Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act) (OJ EU L 2024, item 2847, as amended) or Regulation (EU) 2025/40 of the European Parliament and of the Council of 19 December 2024 on packaging and packaging waste, amending Regulation (EU) 2019/1020 and Directive (EU) 2019/904 and repealing Directive 94/62/EC (OJ EU L 2025, item item 40) and acts requiring CE marking of products such as Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) Text with EEA relevance (OJ L 1689, 2024).

In its Annex I, Regulation (EU) 2019/1020 of the European Parliament and of the Council of 20 June 2019 lists Union harmonisation legislation.

In summary, the purpose of the CE marking is to signal that a product meets the requirements of the applicable regulations. It is affixed to the product by the manufacturer, either independently or with the involvement of accredited internal bodies or a notified body, following the conformity assessment module(s) appropriate for the level of risk posed by the product, and under their own responsibility.

CE Marking – what really stands behind those two letters?

CE marking is more than just a symbol on a product – it’s a legal declaration that the product complies with all applicable EU requirements and can be placed on the EEA and Turkish markets, regardless of where it was manufactured.

It is the result of a structured conformity assessment process defined in EU harmonisation legislation (including Regulation (EC) No 765/2008 and Decision No 768/2008/EC). Depending on the level of risk, this process may involve the manufacturer alone, internal accredited bodies, or independent notified bodies.

By affixing the CE mark, the manufacturer takes full responsibility for product compliance. In parallel, an EU Declaration of Conformity must be issued, maintained, and kept up to date, confirming that all relevant legal requirements have been met.

The system is built on risk-based modules – from basic self-assessment to highly controlled certification schemes involving external oversight. This ensures proportional control while maintaining product safety and market access across the EU.

In short: CE marking is not a quality label – it is a regulatory passport for products entering the European market.

#CEMarking #EUCompliance #RegulatoryAffairs #ProductCompliance #ConformityAssessment #CECertification #EURegulation #MarketAccess #ProductSafety #NotifiedBody #TechnicalDocumentation #QualityAssurance #ManufacturingCompliance #IndustrialCompliance #LegalMetrology #EUlaw #ProductTesting #DeclarationOfConformity #RiskAssessment #HarmonisedStandards #BlueGuide #RegulatoryCompliance #EngineeringCompliance #SupplyChainCompliance #ProductRegulations #ComplianceManagement

Artykuł CE marking pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

A family foundation is a relatively new institution in Polish law, introduced two years ago by the Act of January 26, 2023, on Family Foundations. The ability to establish such an entity was introduced primarily to enable entrepreneurs to secure the succession of their businesses in an undivided form, as well as to ensure the implementation of their own vision for managing them even longer after the founder’s death. Only a natural person with full legal capacity can be the founder of a family foundation. They can establish the foundation and designate its beneficiaries—themselves, relatives, or public benefit organizations—in their will or deed of incorporation. Both deeds should be executed by a notary. Unlike an Anglo-Saxon trust, a family foundation is not a legal relationship but a separate legal entity. Upon establishment, it acquires legal capacity and becomes a so-called “imperfect legal person.”

Tax benefits

Some use foundations to reduce, or rather optimize, their tax liabilities. According to the Corporate Income Tax Act, a foundation is exempt from, among other things, corporate income tax (CIT) if it conducts business activities. However, permissible business activities are defined by the framework set forth in Article 5 of the Family Foundation Act. Permitted forms of activity include:

– disposal of property, unless the property was acquired solely for the purpose of further disposal;

– renting, leasing or making property available for use on another basis;

– joining commercial companies, investment funds, cooperatives and entities of a similar nature, having their registered office in the country or abroad, as well as participating in these companies, funds, cooperatives and entities;

– acquisition and sale of securities, derivative instruments and rights of a similar nature (and others).

Establishment of the Family Foundation

According to the law, the establishment of a family foundation requires:

1) submitting a declaration of establishment of a family foundation in the founding act or in the will;

The documents should be in the form of a notarial deed.

2) establishing a statute that

*mandatory includes:

-name of the family foundation;

-seat of the family foundation;

-detailed purpose of the family foundation;

– the beneficiary or the method of defining it and the scope of the beneficiary’s rights;

– rules for maintaining the list of beneficiaries;

– rules, including detailed procedures, for waiving rights by the beneficiary;

-duration of the family foundation, if specified;

-value of the founding fund;

– the principles of appointment and dismissal, as well as the rights and obligations of members of the bodies of a family foundation, as well as the principles of representation of the family foundation by the management board or by other bodies of the family foundation in cases specified in the Act;

– entity authorized to approve the activities of the management board of a family foundation in the organization;

-principles of amending the statute;

– the allocation of the property of a family foundation after its dissolution, including the designation of the beneficiary entitled to the property in connection with the dissolution of the family foundation.

*may additionally contain:

– principles of cooperation or collaboration between the bodies of a family foundation;

– detailed circumstances of the dissolution of the family foundation;

– guidelines for investing the assets of a family foundation;

-provide for the establishment of a field unit or field units.

3) preparing an inventory of property which includes:

– Property rights contributed by the founder or persons other than the founder to the family foundation, with the indication of the person contributing the property and the specification of the type and value of each of the contributed property components, in the amount determined according to the condition and prices at the time of their contribution and their tax value,

-determination of the proportions used to determine the PIT exemption

– a list of property contributed to the family foundation to cover the founding fund.

4) establishing the bodies of the family foundation required by law or the statute;

– the Act enumerates: the management board, the supervisory board and the meeting of beneficiaries.

– The management board is appointed, unless the statute provides otherwise, by the founder and, after his death, by the supervisory board. In the absence of a supervisory board, the election is made by the meeting of beneficiaries. The management board’s duties include:

• managing the affairs of the family foundation and representing it;
• realization of the goals of the family foundation specified in the statute;
• taking actions related to ensuring the financial liquidity and solvency of the family foundation;
• creating, maintaining and updating the list of beneficiaries in accordance with the provisions of the Act and the principles contained in the statute;
• informing the beneficiary about the benefit he or she is entitled to;
• fulfillment of the benefit to which the beneficiary is entitled.

– A supervisory board is not mandatory if there are 25 or fewer beneficiaries. Unless the statute provides otherwise, the appointment and dismissal of supervisory board members is made by the founder, and after the founder’s death, by the meeting of beneficiaries.

5) contribution of the founding fund

 before entering the family foundation register in the case of establishing a family foundation in the founding act, or contributing the founding fund within two years from the date of entering the family foundation in the family foundation register in the case of establishing a family foundation in a will;

– the founding capital is specified in the statute, but cannot be lower than PLN 100,000

– the sole person obliged to contribute assets to cover the founding fund is the founder.

– property contributed to the founding fund cannot be returned.

– A foundation account may be established outside the territory of the Republic of Poland . This is not subject to restrictions in the European Union. Outside the EU, using such an account will constitute foreign exchange transactions and therefore require a foreign exchange permit from the President of the National Bank of Poland or a director authorized by him.

6) entry into the register of family foundations.

-The register of family foundations is maintained by the District Court in Piotrków Trybunalski, hereinafter referred to as the “registry court”.

-the proceedings are generally conducted in accordance with the provisions on non-contentious proceedings,

– the application for entry is submitted by submitting the foundation to the register by the founder or the board in the case of a foundation established in a will

-The application should include

• name of the family foundation, its registered office and address;
• the amount of the founding fund of the family foundation;
• names and surnames, PESEL numbers of the management board members, and in the absence of an obligation to have such a number – date of birth, and their addresses for correspondence, as well as the manner of representing the family foundation;
• names and surnames, PESEL numbers of the members of the supervisory board, and in the absence of an obligation to have such a number – date of birth, and their addresses for correspondence, if a supervisory board is established in the family foundation, if a board has been established at all;
• names and surnames, PESEL numbers of beneficiaries who are natural persons who are members of the group of beneficiaries, and in the absence of an obligation to have such a number – date of birth, and their addresses for service, and in the case of the beneficiary being an entity other than a natural person – name or company name and REGON identification number, and if the entity is registered in the National Court Register – also its number in that register;
• name, surname and correspondence address of the founder, if the founder is entitled to appoint the management board;
• duration of the family foundation, if specified.

-The following must be attached to the registration of a family foundation in the register of family foundations:

– the foundation’s founding act or the protocol of opening and announcing the will in which the foundation was established;

-statute

– a declaration by the founder about contributing property to cover the founding fund, and in the case of establishing a family foundation in a will – a declaration by the members of the management board that the founding fund will be contributed within two years from the date of entering the foundation in the register;

– proof of establishment of the foundation’s bodies, specifying their composition, if the composition of the family foundation’s bodies does not result from its statute

– consent to serve as a member of a family foundation body.

The notification is subject to the payment of a fee of PLN 500 in accordance with Article 64 a of the Act of 28 July 2005 on court costs in civil cases ( i.e. Journal of Laws of 2025, item 1228, as amended ).

*Before entry in the register, a company does not have legal personality, so its obligations are the responsibility of the founder or his or her representative. This responsibility ceases upon approval of their actions by a resolution of the management board.

Artykuł What is a family foundation under Polish law? pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

What essentially is GLP?

The problem of regulating diligence clauses in employment contracts in the laboratory industry is essential on the basis of Polish and EU law. These issues shall also consider the general consequences of breaching employee obligations in the form of the so-called Good Laboratory Practice (GLP) principles.

For some time in the business turnover we can observe the practice of including in employment contracts clauses concerning professionalism and professional diligence in the actions of future employees. As a rule, the clause at issue imposes an obligation on the employee to perform their tasks in a professional manner, adequate to their position and in accordance with standard operating procedures. In addition, all actions of the prospective employee must conform to the recommendations and directives of the supervisor and comply with the applicable law.

The laboratory industry is no exception in this area. It imposes an obligation on employees and contractors to act not only diligently but also based on the principles of Good Laboratory Practice. These principles have been in place since 1978 and regulate issues such as quality assurance in drug testing and development, the prevention of pharmaceutical scandals, and ensuring performance standards for laboratory areas. In addition, the principles regulate such key issues as staffing, space requirements and the quality of equipment and inspection processes for laboratory areas.

Polish GLP regulation and the consequences of violating it

On the grounds of domestic legislation, the issue of GLP is regulated in the Regulation of the Minister of Health of 3 August 2021 on Good Laboratory Practice and the performance of research in accordance with its scope. Annex I to the Regulation defines the standards of work required of the manager of a research center, the study director or members of the research staff. Attention should be paid to the last two categories, since the work standards specified for them determine the scope of diligence to which the employee may be obligated in a contractual clause. According to section 2(6) of the Annex to the said Regulation, the members of staff should be knowledgeable about the GLP of the specific research being conducted. They are required to act on the basis of the study plan and instructions contained in the documents, and to accurately record data obtained from the studies. Each employee should take care of his/her own safety and that of the environment, and report any deterioration of his/her health to his/her supervisor for the purpose of the possible removal from the study. Additional responsibilities are placed on the study supervisor as the person responsible for coordinating the team. These include, but are not limited to: overseeing the study and ensuring that it is conducted with care and accuracy; including cooperation with quality assurance programme officer, accepting the plan and standard operational procedures, and ensuring that adequate copies of the plan are available for the team to rely on when conducting the study. 

Employee actions are subject to constant scrutiny – any deviation from work standards and failure to follow GLP principles is documented and reported to the study director, according to the Regulation. This may result in various employment law consequences for the employee, such as reprimand, disciplinary responsibility, or even termination of employment contract. The detailed rules of an employee’s liability for a breach of due diligence are always defined in an individual contract constructed for them. It is worth mentioning, however, that omissions of individual employees may negatively influence the outcome of an inspection of the entire testing unit by the Inspector of Chemical Substances – the body appointed to inspect testing units at the national level.

European solutions

The basis of the Regulation of the Polish Minister of Health is to be found in the EU legal acts, which have been implemented into Polish law. Therefore, it should not be surprising that the regulations contained in the acts (created before the regulation) do not differ significantly from those adopted in the Regulation. The first of them, Directive 2004/10/EC of the European Parliament and the UE Council from 11February 2004 in Article 1 imposes on Member States the obligation to ensure that laboratories conducting tests on chemical products act in accordance with the principles of the GLP act and the Directive of 1967 on the classification, labelling and packaging of dangerous substances (67/548/EEC). Annex I of the 2004 Directive defines GLP as a quality system that relates to the organizational process and conditions under which non-clinical health and environmental safety studies are planned, conducted, monitored, recorded, archived and reported. It has been determined that the purpose of the establishment of the GLP is to take care of the quality and conditions under which non-clinical safety studies for health and the environment are carried out for the registration or authorisation of products such as pharmaceuticals, pesticides, veterinary products, industrial chemicals or food additives.

Key issue is the regulation set out in Section II, para. 1.4. of the abovementioned act, which constitutes the duties of research personnel. It imposes on personnel the obligation to know the GLP principles applicable to their participation in study being conducted. It orders the personnel to act on the basis of instructions included in study documents, as well as to maintain health protection measures in order to care for the environment and their own safety. They should also record the raw data swiftly and thoroughly. The duties of the study director set forth in this act are similar to those of the Regulation of the Polish Ministry of Health, namely such a director is responsible for supervising the diligent performance of personnel, approves study programs and instructions, and certifies that qualified personnel, familiar with GLP principles and the study plan undertake their duties.

The issue of control of research units, and consequently – their employees and their compliance with GLP principles, was regulated in Directive 2004/9/EC of the European Parliament and the EU Council of 11February 2004. It stipulates that Member States shall appoint national inspection authorities to supervise the operation of entities in accordance with the principles of professional diligence. If irregularities are detected in the implementation of GLP principles in a given unit, and employees show ignorance in the application of its principles, there will entail negative consequences (ranging from questioning the validity of the tests carried out by the unit to its removal or undertaking legal action). These consequences do not preclude additional action by the national authority, based on the specific rules of a given Member State.

It should not come as a surprise that employers in the laboratory sector are striving to enforce the highest possible degree of professionalism, accuracy and attention to professional duties from their employees – the specificity of the described branch requires the highest possible diligence in performing tasks and marginalization of mistakes, which may have serious consequences in the environmental and health dimension. EU and Polish regulations enable employers to effectively implement these obligations in the contract, with individual sanctions for failure to do so.

Artykuł DUE DILIGENCE CLAUSES IN LABORATORY EMPLOYMENT AGREEMENTS AND THE LEGAL CONSEQUENCES OF VIOLATING THEM VS. GOOD LABORATORY PRACTICE pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The development of artificial intelligence

Artificial intelligence is an interdisciplinary field of knowledge combining elements of computer science, mathematics, statistics, neuroscience, and cognitive science. Its goal is to create systems capable of performing tasks that previously required human intelligence. This includes the ability to learn from data, reason, make decisions, recognize patterns, and process and generate natural language. Unlike traditional programming, in which a computer executes strictly defined instructions, artificial intelligence aims to grant machines a degree of autonomy, allowing them to independently adapt their strategies to changing conditions. Today, AI is no longer an abstract theoretical concept, but a practical tool.

The development of artificial intelligence is one of the most dynamic phenomena in the history of science and technology. Its origins lie in simple deterministic algorithms, based on clearly defined logical and mathematical rules, used to automate repetitive calculations. However, the real breakthrough came in the second half of the 1990s, when, with the increasing availability of data and the development of computing power, machine learning began to be increasingly used. These methods allowed machines not only to perform pre-programmed tasks but, more importantly, to learn from input data and independently improve their results. The application of machine learning meant a shift from rule-based systems to statistical models capable of recognizing patterns and predicting future events. The next stage was the widespread adoption of deep learning, which gained practical significance in the second decade of the 21st century. These techniques utilize multi-layered neural networks capable of analyzing massive datasets in a manner similar to the perceptual processes occurring in the human brain. This enabled the recognition of images, speech, and natural language with unprecedented effectiveness. Deep learning is the basis of many modern solutions, such as recommendation systems.

The most recent phase of development is generative artificial intelligence, which became widely available around 2021. Unlike previous solutions, which focused on classifying and analyzing data, generative systems can create new content—text, images, sounds, and even complex economic strategies. The introduction of this type of technology has radically expanded the potential applications of AI, but it has also revealed new risks related to its impact on society and the economy. Generative models, capable of dynamically shaping information and influencing decision-making processes, can, for example, participate in market price manipulation.

Price manipulation with the help of new technologies

Price manipulation by sellers is unfair or illegal market practices that involve setting prices in a way that misleads consumers or restricts competition. One of the most commonly used strategies is price fixing. It involves agreements between independent businesses aimed at fixing or controlling prices. This can involve jointly setting minimum or maximum selling prices, coordinating price increases, or even fixing discounts. Such actions are automatically considered illegal – the mere fact of agreeing on prices is sufficient, even if the agreement is not fully implemented. The consequence of price fixing is the elimination of natural price competition. Consumers lose the opportunity to choose cheaper offers, and businesses lose the incentive to innovate.

Another form of manipulation is the abuse of a dominant position. A dominant position means that a business entity has an advantage in the relevant market, allowing it to operate largely independently of competitors, contractors, and consumers. Abuse occurs when a business entity uses its power to impose unfair pricing conditions. This can take various forms, such as setting prices that are excessively high relative to the value of the goods or using predatory pricing, i.e., underselling prices to eliminate competition. Each of these practices leads to market distortion, restricting access for new entrants, and worsening consumer conditions.

Pricing algorithms are computer programs that provide pricing recommendations or, in some cases, automatically adjust prices based on current and historical data on market conditions. These algorithms consider much of the same data that companies have always considered when making pricing decisions, including historical data as well as current supply and demand indicators. Compared to human price managers, algorithms can process significantly more data in a much shorter time. This efficiency allows companies using algorithmic pricing strategies to respond more quickly to changes in supply and demand and make pricing decisions based on a more accurate, real-time understanding of market conditions.

Ways to use algorithms

Algorithms can be used in various ways. One is to use the algorithm as a tool to achieve a goal set by the companies. In such a situation, the parties to the agreement make certain arrangements between themselves, and only their implementation is left to the algorithms. For example, two companies could agree to eliminate price competition between them. Simply using a software function that allows them to retrieve data on the prices of other market participants would be sufficient. A strategy would therefore be to automatically set prices slightly lower than other companies while simultaneously ignoring the prices of the colluding company. However, in this case, the mere fact of detecting the existence of such collusion does not raise any doubts under current competition law, as it is possible to attribute the concept of an agreement to this situation.

Another technique involves the joint use of a single price-response algorithm by several traders. This shared use of the same algorithm can lead to price alignment and less competition. One element of this type of agreement is the awareness of the participants that the information being shared will reach their competitors. Consequently, transparency regarding the future behavior of competitors is established between the recipients. Recipients are aware of the participation of their competitors at the same level of trade in the agreement and that their prices are disclosed to their competitors. However, in such cases, the use of algorithms remains a technical activity and can be assessed through the lens of the underlying conduct, to which existing provisions on anticompetitive agreements can be applied.

However, there does not always have to be any agreement between market players regarding the use of artificial intelligence in sales to raise legal concerns. An example would be the configuration of these modern tools to automatically respond to changes in competitors’ prices. This can take the form of faster price reductions, mimicking price increases, or simply adapting to current market price levels. The increasing use of specialized software by businesses that monitors websites and collects price data is making the online sales market increasingly transparent. This transparency allows for easy tracking of competitors’ pricing policies, quick detection of deviations from established price levels, and immediate response to such situations. This allows companies using algorithms to adjust their prices to rivals’ actions almost in real time. Consequently, traditional price reductions aimed at attracting customers often lose their purpose – competitors can offer the same reduction in a fraction of a second. The situation is different with price increases – if one seller decides to increase prices, others are likely to follow suit, leading to an overall price increase. As a result, prices naturally drift towards a level higher than fully competitive.

The most theoretical scenario is a situation in which self-learning algorithms, used independently by different companies, independently conclude that joint coordination is the most profitable strategy. This does not imply a formal agreement or explicit exchange of information, but rather the spontaneous development of behaviors akin to collusion. This could be facilitated by a combination of two factors: on the one hand, the vast amount of available data on competitors and consumers (e.g., thanks to the Internet of Things, transaction analysis, or online behavior tracking), and on the other, the growing capabilities of artificial intelligence algorithms that learn market strategies through experience.

Experimental environments have already demonstrated that algorithms using reinforcement learning are capable of developing stable pricing strategies that reduce competition, even when they are not explicitly programmed to do so. Research shows that such systems can gradually coordinate their behavior, balancing between exploration and exploitation of the environment in a manner resembling tacit collusion. Importantly, this phenomenon can occur even under conditions that hinder cooperation – for example, when new players enter the market or when demand fluctuates.

What is an AI algorithm?

An AI algorithm is a set of advanced mathematical rules and processes designed to solve tasks, make decisions, or imitate human behavior and thinking using a computer. An AI algorithm often leverages machine learning capabilities to analyze, process, and learn from data. This allows AI tools to more efficiently perform various tasks (predicting patterns, assessing trends, optimizing processes, etc.) that would otherwise require human intervention. AI algorithms form the foundation of artificial intelligence systems, enabling them to learn, reason, recognize patterns, process natural language, and make decisions.

AI algorithms can self-improve by adapting their actions based on the analysis of vast amounts of data. There are three major categories of AI algorithms: supervised learning, unsupervised learning, and reinforcement learning. The key differences between these algorithms lie in how they are trained and how they function.

Competition concerns – communication of algoritms

A problem that raises particular concerns among competition authorities is the potential ability of algorithms to communicate. Although there is currently no evidence that systems learn this type of interaction without human intervention, it theoretically cannot be ruled out that in the future, algorithms will develop their own mechanisms for exchanging information. The European Commission points to the risk of “novel forms of coordination” between computer systems. If such a situation were to occur, it would be easier to classify the companies’ actions as prohibited cooperation – similar to traditional information exchange between competitors.

The issue of legal liability, however, remains controversial. If algorithms merely anticipate competitors’ reactions and adapt their own strategies accordingly, companies can be said to have permitted market autonomy (pursuant to Article 101 of the TFEU). However, it is more difficult to assess cases in which the systems themselves create a “communication channel” leading to actual price coordination. Some legal doctrine proposes adopting an approach similar to that used in the case of unauthorized employee actions – the company would be liable for the tools used. This was aptly put by EU Competition Commissioner, emphasizing that “companies cannot hide behind computer code[1]“.

The current state of technology indicates that algorithms are not yet capable of concluding lasting cartel agreements in dynamic market conditions. However, the rapid development of artificial intelligence and the increasing complexity of predictive systems may enable the emergence of such practices in the future. Therefore, regulators are increasingly emphasizing the need to modernize competition law tools to effectively counter not only classic cartels but also “algorithmic collusion”. Failure to address this could lead to significant losses for consumers, a reduction in innovation, and the concentration of economic power in the hands of a few technological entities – creating a kind of “digital plutocracy.”

The effects of AI algorithmic pricing

One of the key problems with algorithmic pricing is the asymmetry in the speed of response to market changes. Companies with more advanced algorithms can update prices much more frequently—even continuously—while those with less advanced technological tools only make price adjustments at longer intervals, such as weekly. This leads to a structural competitive advantage for the former, as they can flexibly adapt to supply and demand and react almost immediately to competitive price movements. In practice, this means that companies with more advanced systems can aggressively lower prices before competitors have time to adapt their offerings, effectively driving them out of the market. This imbalance not only distorts the principles of fair competition but also leads to deeper market concentration, as smaller or technologically weaker companies gradually lose the ability to maintain their position against dominant players investing in advanced algorithmic solutions.

Predatory pricing, in which a dominant firm incurs short-term losses by deliberately pricing goods and services below cost to eliminate competitors or new entrants, is another practice that modern technology is currently employing. This strategy typically involves two stages: first, the dominant firm aggressively undercuts competitors’ prices to drive them out of the market (the predation phase), and then uses its market power to raise prices to recoup losses and generate profits after the competitors disappear (the loss recovery phase). For predatory pricing strategies to be effective, a firm must maintain low prices long enough to eliminate competitors. Pricing algorithms can help firms target specific customers of competitors by offering them prices even below cost. For example, an established firm might do this to avoid losing customers to a new competitor. An established firm might use an algorithm to target customers most likely to switch suppliers, seeking to retain them rather than offering lower prices to all its customers. This could help an established company minimize losses. These algorithms can also help companies pursue predatory pricing strategies and build a reputation for lowering prices in the future if new entrants struggle. Pricing algorithms can also help companies raise prices for consumers who are more willing to pay or less sensitive to price changes. They enable companies to simultaneously engage in predatory pricing and recover losses without the need for a human intervention, using automated means.

Finally, algorithmic pricing introduces a significant element of uncertainty for consumers, who are unable to predict how much they will ultimately pay for a product or service. These mechanisms, based on automated supply and demand analyses, lead to constant and opaque price fluctuations, undermining market trust and limiting the ability to make rational purchasing decisions. Price instability often causes consumers to feel compelled to buy quickly for fear of further cost increases, which encourages impulsive and economically unfavorable choices. In the long term, such practices destabilize the market, hinder healthy competition, and strengthen the position of dominant players who exploit technological advantages at the expense of weaker market participants.

The question of legality

However, a fundamental question arises regarding the legality of such practices under Polish law. The Act of 9 May 2014 on Information on the Prices of Goods and Services[2] imposes on businesses the obligation to clearly and unambiguously disclose the prices of their products. According to the Act, the price should be clearly displayed and allow for comparison with other market offers. However, dynamic price changes, even occurring several times a day, can raise interpretational questions regarding compliance with the requirement of unambiguous price presentation. A consumer who sees significantly different prices for the same product or service within a short period of time may be deprived of the ability to make a rational economic choice. It should be emphasized that the legislator also introduced the obligation to disclose the lowest price applicable within thirty days prior to the discount. In the context of algorithmic pricing, the question arises as to whether every short-term price change resulting from the operation of an algorithm should be treated as a discount within the meaning of the Act, or whether it should be classified as a normal market fluctuation. The lack of clear regulations in this area leads to legal uncertainty for both entrepreneurs and consumers.

The Act of 16 February 2007 on Competition and Consumer Protection[3] opens up an even wider field of interpretation. This Act provides both instruments for counteracting practices that violate the collective interests of consumers and protection against anti-competitive practices. In this context, the problem of so-called tacit algorithmic collusion is particularly significant. In this context, independently operating algorithmic systems of various businesses, monitoring and reacting to competitors’ prices, can stabilize them at an inflated level without the need for a formal agreement. This type of phenomenon, although difficult to detect and prove, can be classified as a violation of fair competition principles, potentially subject to intervention by market protection authorities. The literature indicates that the increasing automation of decision-making processes in price setting raises the risk of developing anti-competitive coordination mechanisms that fall outside the traditional categories of antitrust law.

At the same time, the Competition and Consumer Protection Act imposes an obligation on businesses to avoid misleading practices. In the case of dynamic pricing, the lack of full transparency becomes a problem. If consumers are not informed upfront that prices may fluctuate significantly depending on demand or transaction time, they may be deemed misleading, and the practice itself may be deemed to violate collective consumer interests. In this sense, the obligation of transparency takes on particular significance and should also include information about the pricing mechanism, not just the current price level.

An analysis of the applicable regulations leads to the conclusion that algorithmic pricing per se is not a prohibited practice in Poland. However, its legality depends on whether the entrepreneur complies with the obligations arising from specific laws, as well as on whether the use of algorithms does not lead to practices that restrict competition or violate consumer rights. Entrepreneurs are obligated to provide consumers with reliable and complete information and to avoid practices that may destabilize the market. In the event of a violation of these obligations, sanctions may be imposed by both the Trade Inspection Authority (in the case of incorrect pricing information) and the President of the Office of Competition and Consumer Protection (in the case of practices that violate competition rules or are misleading).

Case law review

It is also worth taking a closer look at decisions issued on algorithmic pricing by state and EU authorities.

In the Eturas case, the contested agreement was supported by a digital platform (software for selling travel online), where the system’s administrator proposed to competing travel agencies the use of a technical instrument imposing a ceiling on discounts on packages offered. The EU Court found it reasonable to assume that travel agencies that were aware of the content of messages sent via the system were participants in an anticompetitive agreement, unless they rebutted that presumption. The Commission also states that the prohibition under Article 101(1) TFEU is likely to cover cases in which “pricing rules” were defined by undertakings “in a common algorithmic tool (e.g., rules for adjusting the price to the lowest price on a specific online platform or in a specific online store), and this qualification would be accepted “even in the absence of an express agreement to adjust future prices”[4].

In commercial transactions, there are also cases in which entrepreneurs use the same algorithm to set prices for their services, yet there are no grounds to conclude that they have entered into an anticompetitive agreement. An example of a case assessed by the President of the Office of Competition and Consumer Protection (UOKiK) is the UBER app. Its use does result in the restriction or even elimination of price competition between UBER drivers, which is, after all, centrally determined by the app. This also constitutes an agreement between UBER and individual drivers. In this case, however, such algorithmic pricing is necessary for the proper functioning of the UBER system, and at the same time, it does not lead to the elimination of competition, being a proportionate measure. This justifies treating such an agreement as not violating the prohibition of Article 6, Section 1 of the UOKiK based on the construction of ancillary restrictions.

A problematic scenario can arise when a large number of businesses utilize the same or similarly functioning algorithm without any collusion between them regarding the selection of one algorithm over another. In this situation, each of these businesses uses a specific program as a tool to inform them about the market situation and enable a rapid response. In this scenario, there is a significant increase in market transparency, which can have anti-competitive effects, as the use of an algorithm allows businesses to react much more quickly to any market changes, including price reductions by competitors, which can reduce their incentive to make such reductions. In such a case, businesses merely adjust their prices to those of their competitors. Such conduct – so-called parallel conduct – has for years been viewed by EU and Polish jurisprudence as not violating antitrust rules. In fact, in this case, it cannot be said that an agreement was concluded. Moreover, under the soft law provisions issued regarding vertical relationships, the Commission itself has indicated that price monitoring using computer programs is not prohibited, or more precisely, it may benefit from an exemption from the prohibition of anticompetitive agreements. Therefore, from the Commission’s position, it can be deduced that the antitrust permissibility of such algorithmic price monitoring is determined by the lack of grounds for attributing such conduct the status of an agreement, and that it constitutes a manifestation of the parallel conduct mentioned above.

According to the authorities, it would also be possible to attribute antitrust liability to the creator of the algorithm. The VM- Remonts formula, developed in EU case law, could be particularly applicable to this. In this case, while the Court recognized as a rule that an undertaking cannot “be held liable for participating in a concerted practice on the basis of the actions of an independent service provider”[5], it also identified exceptions to this rule. Fulfilling one of these exceptions justifies the application of Article 101(1) TFEU also to the service provider, for example, the software developer. Polish legal literature also argues that the constructions of extended liability for competition law infringements developed in EU case law (especially the concept of cartel accessory liability) could also be used to attribute antitrust liability to an undertaking that provides participants in an agreement with tools (including digital tools) enabling the conclusion or implementation of a prohibited agreement.

Summary

Dynamic, algorithmic pricing lies at the intersection of two key areas of law: consumer law and competition law. This practice, while permissible, requires particular caution on the part of businesses and the development of consistent interpretative guidelines by the legislature. The lack of clear regulations creates a risk not only for consumers, who may be exposed to non-transparent and unfair practices, but also for businesses themselves, who may suffer severe financial consequences if they violate fair competition regulations. Given the growing importance of algorithmic technologies, it seems necessary to further develop and clarify the legal framework to enable businesses to use innovative price management tools, while also ensuring an adequate level of consumer protection and the integrity of market mechanisms.

The most serious challenge for competition authorities is when algorithms maintain elevated prices without formal information exchange between companies. In such cases, the classic dogmatics of antitrust law may prove insufficient, and consumers will bear the cost in the form of a loss of some of their well-being. Therefore, developing technical competencies of supervisory authorities, enabling them to understand and analyze the mechanisms of algorithms used in business practice, is particularly important.

At this stage, it seems premature to introduce new regulations on algorithmic pricing, as this could hinder the development of innovative technologies and limit their beneficial applications. Further interdisciplinary research combining law, economics, and computer science, as well as careful observation of market practice and case law, is essential.

[1] Speech of the European Commissioner for Competition M. Vestager, Berlin, 16/03/2017.

[2] Act of 9 May 2014 on providing information on prices of goods and services (consolidated text: Journal of Laws of 2023, item 168).

[3] Act of 16 February 2007 on competition and consumer protection (consolidated text: Journal of Laws of 2024, item 1616, as amended).

[4] Point 397 of Guidelines 2023/C 259/01.

[5] Point 33 of the judgment of the Court of Justice of July 21, 2016, C-542/14, SIA “VM Remonts” (formerly SIA “DIV un KO”) and others. v. Konkurences padom, ECLI:EU:C:2016:578.

Artykuł AI algorithmic pricing and its assessment under Polish and EU competition law pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The lawyers of KIELTYKA GLADKOWSKI KG LEGAL participate in the EU Info Day – EU Business Hub @ KIMES 2026 on 23 September 2025.

Topic: EU Info Day – EU Business Hub @ KIMES 2026

The EU Business Hub – Japan and the Republic of Korea is an EU-funded programme that supports EU Small and Medium-Sized Enterprises (SMEs) in the green, digital, and healthcare sectors to enter the markets of Japan and the Republic of Korea. The programme aims to strengthen EU businesses’ export and investment activities and to foster more resilient, sustainable, and technologically advanced value chains with both markets.

https://eubusinesshub.eu/en

The programme is organising 10 business missions in Japan and 10 in the Republic of Korea between 2024 and 2027, each business mission allowing a group of 50 innovative EU companies to benefit from extensive business coaching.

The Asia-Pacific region is the largest destination of Foreign Direct Investments (FDIs) globally and it is a powerhouse for global trade. The EU Business Hub – Japan and the Republic of Korea aims to boost the presence and visibility of EU companies operating in the green, digital, and healthcare sectors where potential for increased cooperation between European and Japanese and European and Korean companies exists.

The programme aims to strengthen EU businesses’ internationalisation, export and investment activities, as well as foster more resilient, sustainable, and technologically advanced value chains with the two Asian markets. Thus, significantly supporting the implementation of EU-RoK Free Trade Agreement (FTA) and the EU-Japan Economic Partnership Agreement (EPA).

Artykuł KIELTYKA GLADKOWSKI KG LEGAL – KIMES 2026. EU TRADE MISSION TO JAPAN AND KOREA pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

On September 12-14, 2025, lawyers from KIELTYKA GLADKOWSKI KG LEGAL participated in the annual Futurology Congress in Krakow.

The participants, among which there was AGH University of Science and Technology’s Artificial Intelligence Center of Excellence discussed aspects of new technologies, including:

• Optical Illusions in AI Systems: The Danger of Adversarial Attacks. Adversarial attacks on vision systems are a topic of growing interest in both science and the technology industry – not only due to autonomous vehicles but also medical systems. The panelists demonstrated how subtle, almost invisible image modifications can completely confuse AI algorithms, leading to situations where the algorithm fails to recognize a STOP road sign or makes an error when analyzing medical images. Examples of such attacks from both transportation and medicine were presented, highlighting their impact on everyday life and safety. There were explained the mechanisms behind these phenomena and their consequences for machine learning-based systems. In this area, there is a constant race between the creators of such attacks and the engineers developing protection methods, and ensuring complete security remains a major challenge for the AI industry.

• The development of the Polish space sector, combining engineering, science, and modern technologies. Domestic entities are among the leaders building Poland’s position in the global space industry supply chain. During the panel, there were discussed the most important achievements and participation of Polish teams in prestigious international missions. Representatives of key companies discussed their projects, challenges, and role in the global space ecosystem. There were also considered barriers to sector development and legislative and financial needs. The panel was an opportunity to look to the future and attempt to answer the question of Poland’s potential role in the exploration and use of space. Participants shared their experiences collaborating with the European Space Agency and other international partners.

• Modern biotechnology. Biotechnology is becoming one of the pillars of modern civilization, offering breakthrough solutions in medicine, diagnostics, agriculture, and environmental protection. Faced with global challenges such as aging societies, the growing number of lifestyle diseases, and the need for sustainable development, the dynamic development of biotechnology is opening up new opportunities to improve the quality of life. The panel discussed the potential of gene and cell therapies, the importance of innovative drugs in the fight against cancer, and the role of collaboration between science, the investment sector, and industry. Guests addressed ethical, regulatory, and social issues related to the implementation of new biological technologies. The discussion explored how biotechnology can truly benefit humanity in the coming decades.

The Congress lectures are related to specific examples and problems that scientists are struggling with in daily lives – for example, how to easily delude artificial intelligence in software in an unmanned vehicle resulting in a failure to recognize a STOP sign

source: https://www.drmalinowski.edu.pl/posts/2824-adwersarialne-ataki-na-sztuczna-inteligencje

Artykuł Optical Illusions in AI Systems, the Danger of Adversarial Attacks, Biological Technologies, Explainable AI – topics discussed during Futurology Congress 2025 pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

What is CSIRT GOV and what is its legislative environment

The Polish Computer Security Incident Response Team (CSIRT GOV), led by the Head of the Internal Security Agency, serves as the national CSIRT. The CSIRT GOV is responsible for coordinating the response process to computer incidents occurring in the area specified in Article 26, Section 7 of the Act of 5 July 2018 on the National Cybersecurity System.

The first European cybersecurity regulation is Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the European Union, known as the Network and Information System Directive (NIS). The directive imposes numerous obligations on Member States, primarily involving the establishment of appropriate institutions, the adoption of a national strategy for the security of network and information systems, and the introduction of cooperation mechanisms. This directive established a network of computer security incident response teams (CSIRTs).

The Act on the National Cybersecurity System, adopted by the Polish legislator on 28 August 2018, serves to achieve the objectives set out in the NIS Directive. Pursuant to Article 1 of the Act on the National Cybersecurity System, the act specifies: the organization of the national cybersecurity system and the tasks and responsibilities of the entities comprising this system, the method of exercising supervision and control over the application of the provisions of the act, as well as the scope of the Cybersecurity Strategy of the Republic of Poland.

The legislator, in principle, decided to create three teams:

• CSIRT GOV – Computer Security Incident Response Team operating at the national level, led by the Head of the Internal Security Agency,

• CSIRT MON – Computer Security Incident Response Team operating at the national level, led by the Minister of National Defence and

• CSIRT NASK – Computer Security Incident Response Team operating at the national level, led by the Scientific and Academic Computer Network – National Research Institute (Article 2 of the Act on the National Cybersecurity System).

The competence of CSIRT GOV and CSIRT MON is defined in Article 27 of the Act on the national cybersecurity system as follows: “CSIRT GOV is competent in the scope of incidents related to events of a terrorist nature, referred to in Article 2 point 7 of the Act of June 10, 2016 on counter-terrorist activities (Journal of Laws of 2024, item 92); CSIRT MON is competent in the scope of incidents related to events of a terrorist nature, referred to in Article 5 paragraph 1 point 2a of the Act of June 9, 2006 on the Military Counterintelligence Service and the Military Intelligence Service (Journal of Laws of 2023, items 81, 1834 and 1860).

One of the basic tasks of CSIRT NASK is to recognize, prevent, and detect threats to the security of public administration bodies’ ICT systems or ICT systems and networks covered by the uniform list of facilities, installations, devices, and services constituting critical infrastructure, as well as ICT systems of owners and holders of critical infrastructure facilities, installations, or devices, referred to in Art. 5b paragraph 7 item 1 of the Act of 26 April 2007 on Crisis Management.

CSIRT GOV Annual Report

CSIRT GOV has just published a report on the state of cybersecurity in 2024. The document comprehensively presents statistics on the number and types of incidents and threats, comparing them with data from previous years. It presents the most significant threats and undesirable cyber activity targeting the IT infrastructure of public authorities, critical infrastructure operators, and entities providing essential services. The report is based on an analysis of IT security incidents reported and identified by CSIRT GOV, data obtained using systems enabling autonomous threat detection, and information obtained from the Team’s active activities. The study also includes analyses of the changing cybersecurity landscape, significant trends, and potential security weaknesses.

The Report highlights at least two interconnected circumstances that seem to force reflection on the significance of cybersecurity threats and the systems designed to eliminate or mitigate them. On the one hand, it highlights the technological trend that is increasingly permeating our lives with each passing moment. The result is rapid digitization, which is taking place through the transfer of increasing amounts of data relating to citizens, public services, communications, and finances to the digital sphere. The undeniable convenience of such applications also means that cyberspace can be increasingly effectively used to launch attacks on a scale that seriously threatens the security of the state and its citizens.

The second factor is the geopolitical environment and context. On March 1, 2024, the CRP alert level for cyber threats was lowered from the previously applicable CHARLIE-CRP, the third of four alert levels, to the currently applicable BRAVO-CRP, the second alert level. This, however, means that we are still dealing with a state of heightened threat in Polish cyberspace, despite a slight reduction in the intensity of this threat. The changing landscape of conflicts between states was also highlighted. Unlike in the past, conflicts take the form of not only kinetic clashes but also involve the use of a full spectrum of tools, including those extending into cyberspace. Ultimately, they most often take the form of “hybrid operations or wars,” which can complement military actions, serve as an alternative, or serve as a precursor to a kinetic strike. For this reason, it is important to consider the broader context of emerging incidents.

2024 was a year of dual elections: local government and the European Parliament, which each time requires vigilance on the part of bodies like CSIRT GOV due to the much more widespread threat of disinformation. It is also necessary to ensure the proper functioning of the IT systems used to conduct elections, with citizens’ trust in the democratic process ultimately at stake.

CSIRT GOV Coordinated Incident Statistics

In 2024, a decrease in reports registered by the CSIRT GOV Team regarding potential ICT incidents was observed. Of the 17,439 reports, 3,991 were classified as actual ICT security incidents. In 2022, 26,753 reports and 4,959 incidents were recorded, followed by 19,888 reports and 4,676 incidents in 2023. These statistics do not include reports from the ARAKIS GOV system. The lack of data from ARAKIS, a dedicated, distributed early warning system for ICT threats occurring at the interface between internal networks and the internet, may be due to the need to separate these statistics, which will be discussed later in this article.

There are no significant differences in registered reports and incidents between individual quarters in 2024. However, the highest number of incidents was recorded in the second quarter, which was related to an increase in resource unavailability and the publication of sensitive data in open sources, i.e., leaks.

The CSIRT GOV team indicates that the factors that led to the decrease in incidents include: 1) proactive activities conducted by CSIRT GOV to increase user awareness through training; 2) reporting on identified vulnerabilities within the area of competence; 3) ongoing issuance of CSIRT GOV recommendations – appropriate to the CRP threat level; 4) regular distribution of compromise indicators for monitored campaigns; 5) periodic security assessments of IT systems; 6) the institution’s implementation of security solutions that mitigate attacks in their early stages.

Division of incidents reported by entities of the national cybersecurity system into categories

The highest percentage of recorded incidents, and the most significant increase, occurred in the Vulnerability category. The numbers for incidents in this category are as follows: 1,105 incidents compared to 993 in the previous year. This category refers to security vulnerabilities identified by the CSIRT GOV Team resulting from the vulnerability of resources and services accessible via the Internet by entities under the CSIRT GOV’s jurisdiction.

Vulnerability refers to a weakness in an IT system, e.g., in procedures, design, implementation, or internal controls, that can be exploited for unauthorized access, data destruction or disclosure, data alteration, system weakening, etc.

The next category is Publication. In this regard, there was a decrease in such incidents from 1,052 in 2023 to 902 in 2024. Publication refers to the disclosure of sensitive data through leaks, including login credentials for electronic services, private PGP keys, or information about the specifications of an institution’s IT infrastructure.

Among the activities recorded in the Social Engineering category, the GOV CSIRT Team identified phishing emails aimed at obtaining login credentials for electronic services or other sensitive data, infecting them with malware, or extorting funds. There was a noticeable and significant decline in incidents in this category. In 2024, 815 such incidents were recorded, compared to 1,362 in the previous year. A decrease was also noted in the

Unavailability category, which includes DoS / DDoS attacks (773 incidents in 2023 and 478 in 2024). The remaining, smaller categories, to which a similar number of incidents were assigned as in 2023, are Attack (325 in 2023 to 261 in 2024) – events recorded in this category included attempts to break security by exploiting vulnerabilities, bruteforce attacks, compromise of accounts and systems, and exfiltration of data from adopted IT resources, Cascade (235 incidents in 2024, category not presented in previous years) – referring to reports and incidents related to terrorist events, based on Article 27 of the Act on the National Cybersecurity System. These include all activities aimed at minimizing terrorist threats undertaken by CSIRT GOV in coordinating incident management.

Scanning, or reconnaissance of IT infrastructure to identify vulnerable systems and services, is a category that has seen an increase compared to the previous year (108 incidents in 2024, compared to 101 in 2023). This category includes incidents indicating the possibility of preparing offensive actions aimed at breaching security or compromising the availability of services. The two smallest incidents in terms of number of incidents are Content (53 incidents in 2023, 56 in 2024) and Virus (37 incidents in 2023, 31 in 2024). The former concerns incidents violating broadly understood public goods, such as information damaging the image of state entities or publishing disinformation content. This primarily includes the mass use of the image of persons holding leadership positions in the state, for example, to extort funds from citizens. The Virus category classifies incidents involving malware identified on workstations, servers, and network devices.

The report also includes data on the number of incidents reported by entities within the national cybersecurity system in 2024, broken down by sector. According to this data, the largest number of incidents occurred in the Institutions and Critical Infrastructure Operators sectors. The next sectors in terms of the number of recorded incidents were: State Authority, Office, Ministry, Other, and Service.

Social engineering campaigns in 2024

Social engineering campaigns identified by CSIRT GOV in 2024 most often involve attempts to obtain confidential data, such as login credentials, by impersonating various institutions (phishing), while creating various fictitious scenarios to lend credibility to requests, such as a password reset via a hyperlink sent in an email that led to a fake website. Among the most interesting social engineering campaigns cited by CSIRT GOV in the Report was a phishing campaign involving the sending of messages from a compromised email address belonging to a district office, with a terse subject line and content intended to give the impression that it was part of prior arrangements or correspondence between the sender and recipient. The messages contained attachments named additional (02).docx.exe or additional (03).docx.exe, which contained the Agent Tesla Trojan malware.

Another social engineering campaign, based on a similar theme, also stands out. The goal was to infect recipients’ devices with malware. The sender impersonated PGNiG Obrót Detaliczny sp. z o. o. in the email. The email, titled “PGNiG – Request for Offer: Suwalki Project 2025/2026,” was intended to intrigue the recipient and persuade them to interact with the attachment. The attached archive, titled “PGNIG Request for Offer: Suwalki Project 20252026.gz,” contained a VBS file with the same name. Analysis conducted by the CSIRT GOV team revealed that the script was responsible for downloading malware classified as the GuLoader Trojan from the mobiera.ro domain.

Since the end of August 2024, the CSIRT GOV team has received information about a phishing campaign in which an adversary impersonates the Chancellery of the Prime Minister to obtain login credentials for banking portals (officially used as a login method for government e-services such as mObywatel and Trusted Profile). The website in question was located in the environment.odszkodowanie-gov.com domain. The website used the image of the Chancellery of the Prime Minister and the style of the official government website, which is used by the state administration within the gov.pl domain. The website displayed information about a supposed compensation that every household was entitled to in excess of PLN 400. To receive these funds, users had to authenticate using a bank of their choice. After selecting a financial institution from the list, the fake bank’s website loaded, displaying a login panel.

The most important trends in social engineering attacks in 2024 include: the use of compromised email accounts of local, provincial, national or international institutions, including the takeover of government email accounts (including those in the gov.pl domain), the use of QR codes instead of classic links, allowing the bypassing of automatic scanning of potentially malicious content by email security filters, signing documents using services such as DocuSign and encouraging the display of shared documents on real services such as Microsoft SharePoint or Google Drive, and the use of the image (e.g. logo) of Polish and European law enforcement agencies to intimidate the recipient into taking appropriate action.

The threat from sponsored and hacktivist groups

Threats stemming from sponsored groups are typically characterized by a high level of technical sophistication and sophistication. A key characteristic of these groups is remaining hidden while simultaneously ensuring access to compromised infrastructure. Due to its geopolitical location, Poland is particularly vulnerable to these threats, stemming primarily from the activity of adversaries supporting primarily Russian goals or narratives. Furthermore, in 2024, attacks attributed to hacktivist groups continued to be a constant feature of the cyberthreat landscape. Unlike sponsored groups, these groups intensively published information about their activities on social media to reach the widest possible audience and thus promote their ideological goals. These groups focused their activities on DDoS attacks aimed at disrupting the availability of services and websites, a continuation of the activities from 2022 and 2023. In 2024, a wide range of APT activity was recorded, with the dominant actor in the CRP being the APT group known as APT28, also known as Fancy Bear, which, according to some sources, was actually part of the Russian GRU. ATPs pose a serious threat to the Polish state. ATP28’s mission is primarily to conduct espionage operations, and its targets primarily include government and military institutions, international organizations, and strategic sectors of the economy. ATP activity was characterized by the use of advanced, multi-stage techniques aimed at obtaining credentials, installing malware, and providing persistent access to victim systems.

Example of an ATP28 attack using… Windows Calculator

Perhaps the most spectacular attack involved the distribution of the HEADLACE malware. According to the report, the attack began with an email containing a malicious link, simulating an offer to sell a car from the diplomatic fleet. The email was sent from an email address in the bigmir.net domain, which indicated a Ukrainian email provider. The message encouraged users to open a link under the guise of an Audi car for sale, when in reality the link referred to a webhook.site website. The website’s script verified the value of the browser’s UserAgent header. If the victim was using a non-Windows system, a benign image was displayed; otherwise, a ZIP archive containing three files was downloaded to the victim’s computer: EXE, DLL, and BAT. The executable file had a double.jpg.exe extension to imitate a graphic file, as in previous campaigns. The image in question was a so-called decoy file:

Most interestingly, the file with the .jpg.exe extension was a copy of the authentic Windows Calculator application. However, the Windows Calculator was vulnerable to the so-called DLL Side-Loading technique. (Malware readily exploits the characteristics of dynamic link libraries ( .dll ). The fundamental characteristic of dll libraries is that they require a process to execute the code contained within them. This is where all the abuses in the form of injecting malicious .dll libraries into trusted program processes occur. If Windows or an installed application only checks the name of the .dll library to be loaded, without verifying the checksum or digital signature, it is possible to replace such a .dll library with a malicious one). The purpose of the library in question was to execute the last of the three files, a BAT script. As a result of executing the BAT file, a file with the .jpg20 extension was downloaded from a resource in the webhook [.] site domain using Microsoft Edge. This file was then transferred to another location, changing the file extension to .cmd using the script for execution. Following the attack, some artifacts were deleted to minimize the risk of detection. The final payload returned information from the victim’s workstation, including a list of files from the Desktop and Downloads folders, as well as the IP address.

What else is the ATP28 group responsible for?

ATP28 activity also included another type of phishing activity, involving impersonating email administrators and persuading users to provide their login credentials in a fake Outlook Web Access panel. In 2024, several such campaigns targeted government administrations, including password change panels in both Polish and English, as well as those designed to increase the size of email inboxes. This type of phishing is a classic method of obtaining sensitive data, and the effectiveness of the attack is related to the maturity of individual entities in terms of their cybersecurity measures, which are also within the actor’s area of interest.

Among the activities that most likely fit into the APT28 cluster of activity were password bruteforce attacks, spraying and credential stuffing email accounts and VPN services27 to gain access to email and other resources processed by employees of entities targeted by Russian-sounding APT groups. To conceal the attempted breach, the actor used access through anonymizing networks and residential proxies, using compromised network devices belonging to private users or small businesses, usually geolocated in the same country. In 2024, the actor also reportedly used the DCSync technique to mass replicate user login data within a domain controller, the so-called credential dump. This may result in ensuring the actor’s long-term access to the infrastructure by creating the so-called Golden Ticket -ui to carry out the Pass the Ticket attack. These activities are consistent with the group’s modus operandi, which, after gaining access to infrastructure, employs so-called living- off-the-land techniques, involving the use of available system tools to escalate privileges or exfiltrate data.

Hacktivists and Cybercrime

Following the outbreak of the war in Ukraine, numerous groups and collectives emerged, conducting a kind of guerrilla activity in cyberspace. The term “hacktivism” itself comes from a combination of the words “hack” and “activism,” and is—as the name suggests—the transference to cyberspace of the activities of activists fighting for various political or ideological goals. In the case of pro-Russian ” hacktivists ,” the motivation they present on social media is primarily support for Russian military actions and “punishing” NATO alliance members for their military support of Ukraine. The most well-known groups include Killnet , Anonymous Sudan (despite its name, it aligns with Russia’s narrative), Cyber Army of Russia Reborn , XAKNET, Solntsepek , UserSec , NoName057(16), Zarya , Beregini, and Z- Pentest. Their primary method of operation is DDoS attacks, usually technically unsophisticated but heavily publicized for propaganda purposes. In 2024, the CSIRT GOV team also recorded malicious activity targeting domestic entities, including attempted hacks into IIoT ( Industrial Internet of Things ) systems with remote access over the internet, including through HMI (Human-Machine Interface) panels. This is a new manifestation of hacktivist threats, which have somehow become a focus of interest for these groups. Attacks on such devices were often due to the lack of adequate remote access protection. These weaknesses were also noticed by hacktivist groups. These groups, taking advantage of online login panels, engaged in activities aimed at gaining unauthorized access, primarily through the use of default login credentials. This threat particularly affected facilities such as sewage treatment plants, water treatment plants, waste incineration plants, and facility management facilities.

In 2024, CSIRT GOV also noted cybercriminal activity, including Chinese groups belonging to the Quad7 botnet using vulnerable TP-Link devices. The botnet was used to anonymize attacks, including attempts to take over Microsoft 365 accounts. The UAC-0050 ( DaVinci Group) group also operated, conducting widespread phishing campaigns, including in Poland. Unlike APT groups, which strive to remain hidden and attack precisely selected targets, the DaVinci Group’s modus operandi is different. The group prefers broad attacks and pays little attention to effectiveness. An example of this type of attacks was a campaign recorded in 2024, in which messages were sent to recipients in Poland in Kazakh, which did not fit into any Polish context. This group was also responsible for a disinformation campaign from the end of 2024, in which false threats were sent to plant explosives on government buildings in Poland and Ukraine (as Fire Cells Group). It was a psychological operation intended to cause panic, not an actual attack.

Malware

The CSIRT GOV team analyzed over 15,000 files reported by entities in the national cybersecurity system, 650 of which were deemed malicious. The dominant categories among the analyzed malware samples in 2024 were HTML Phisher, Snake Keylogger, Formbook, and Remcos. HTML Phisher is used in phishing attacks. This type of software is most often distributed by sending victims spoofed emails containing HTML/HTM attachments. After opening the attachment, the user sees a page imitating the service (e.g., online banking or an email login panel). The page is designed to closely resemble the original website. An HTML Phisher attack is also dangerous because it is often able to bypass spam filters and can operate partially offline, as it is opened locally on the victim’s device. Snake Keylogger is software that records all keyboard input by the user. Of course, this also includes login credentials. Snake Keylogger is often distributed via malicious email attachments or as part of a bundle with other software. Once installed, it runs in the background and is often able to evade detection by standard antivirus programs.

Formbook is a popular infostealer malware that focuses on stealing user data, such as login credentials, files, and information stored in web browsers (e.g., saved passwords and cookies). Formbook is sold, among other things, as malware -as-a-service, making it easily accessible to cybercriminals. It is primarily distributed via infected attachments (e.g., PDF files, Office documents) or links in phishing emails. Once a computer is infected, Formbook saves data in hidden files and uploads it to attacker-controlled servers. This type of malware supports functions such as keylogging, taking screenshots, and downloading and executing additional files sent by the attacker. Another malware family is Remcos. Remcos is a remote administration tool that can be used to gain complete control over an infected system. This software allows it to perform a range of actions, such as keylogging, screenshots, webcam and microphone monitoring, and even run arbitrary programs and commands on the victim’s computer. Remcos was initially promoted as a legitimate computer management tool, but quickly became a popular tool used by cybercriminal groups. It is most commonly distributed through phishing campaigns, where victims are tricked into opening infected attachments. Its features include the ability to run in stealth mode, making it difficult for standard security systems to detect.

ARAKIS GOV

The ARAKIS GOV system, mentioned earlier, is included separately in the statistics for a reason. The system’s primary purpose is to detect and automatically describe threats occurring in IT networks based on the aggregation, analysis, and correlation of data from various sources. In 2024, the system generated 5,446,734 alerts, including 3,322,068 with urgent priority, meaning they required an immediate response from administrators. A small percentage of alerts were high and medium priority, while nearly 40% were low priority, meaning they were purely informational alerts regarding the current situation at the interface between the internal network and the internet. Each recorded alert has precise technical data allowing for its verification and is classified in detail by the system. 56.60% of alerts were type 1 (communication to malicious addresses). These alerts resulted from attempts to establish communication with IP addresses or domains deemed malicious or potentially posing a threat.

Safety Assessment Summary

One of the tasks carried out by the CSIRT GOV Team is to assess the security of government administration institutions’ information and communication systems and critical infrastructure. In 2024, in accordance with the plan adopted for this year, assessments were conducted at 14 institutions, assessing a total of 64 network/IT system segments and 26 domains/subdomains and websites. As part of the security assessments, the CSIRT GOV Team conducted a series of tests to identify significant vulnerabilities affecting the security of the assessed entities’ information and communication infrastructure. These tests included passive and active data collection, identifying vulnerabilities in the architecture of network systems and services, web applications, exploiting vulnerabilities, and analyzing the impact of social engineering. As a result of the security assessments, the CSIRT GOV Team identified a range of vulnerabilities, ranging from low to critical. Critical and high threats were identified as the most important groups of vulnerabilities. These vulnerabilities included, for example: outdated software versions present in a number of systems and services used by entities, primarily concerning Apache HTTP Server, OpenSSL, VMware, use of unsupported software versions (Microsoft Windows 2008 R2 std . – end of support January 14, 2020, Microsoft SQL Server 2008 R2 – end of support July 9, 2019, VMware 6.7.x – end of support November 15, 2023), anonymous access, without required authentication or based on default passwords, etc.

Security Assessment – Examples of detected vulnerabilities:

1. Unsecured access to the Docker API – Access equivalent to accessing the server as a user with the highest privileges – root.

2. Discovery of the primary domain administrator’s credentials on the sysvol share.

3. High-privilege MSSQL user – As a result of a Password Spraying attack, access was gained to a network share containing the source code of a web application. A configuration file containing the credentials of the MSSQL service user was found within the code structure. During reconnaissance of the database engine using the compromised credentials, it was discovered that this user had high privileges, allowing them to reconfigure the database server. This was used to execute commands directly on the operating system.

4. Credential disclosure through fuzzing and directory listing: The HP Web Jetadmin service version 10.5.114213 (10.5 SR1) was detected on port 8085/tcp. As a result of the fuzzing tools (wfuzz), unsecure access to the log directory was detected. By enabling the Directory listing option, it was possible to quickly identify resources in a given path and proceed directly to further analysis and attacks on subsequent resources.

5. RCE – Java DebugWireProtocol (JDWP): Java DebugWireProtocol (JDWP) is a protocol used for communication between the debugger and the Java virtual machine. It does not use any authentication and can be exploited to execute remote commands (Remote Code Execution, RCE).

6. Cross-Site Scripting (XSS): By sending a POST request to https://[redacted]/4ses/servlet/

MainServlet?wbts:page=core.search.results.list, it was possible to inject JavaScript code into the search_text parameter. The lack of server-side validation caused the injected code returned in the HTTP response to be executed by the victim’s browser (Reflected XSS).

7. Sensitive data was included in the application logs.

8. DEBUG mode was enabled in the production application.

To properly protect an organization against incidents related to supply chain attacks (depending on the type of cooperation between entities), appropriate security measures may include:

● Risk assessment – a process aimed at identifying, assessing, and managing risks in the existing supply chain, as well as its new/potential connections;

● Regular audits and inspections – tasks confirming or denying the supplier’s ability to safely perform contractual activities;

● Controlling necessary authorizations – an activity involving regular verification of granted resource authorizations, solely on the basis of the so-called Least Privilege;

● Business continuity planning – developing business continuity plans and mitigating the effects of an incident should it occur;

● Data encryption – encrypting data during transmission and storage to ensure its proper security;

● Continuous monitoring – the use of threat and incident monitoring and reporting systems to ensure prompt action;

● Selection of suppliers who meet standards, such as those developed by the International Organization for Standardization (ISO).

Artykuł CSIRT GOV Poland – Computer Security Incident Response Team recently published a very interesting and insightful report on the state of cybersecurity in Poland in 2024. pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.