Artificial intelligence is increasingly used in business activities -
from customer service and marketing, through data analysis, to automated decision-making in areas such as recruitment, creditworthiness assessment and business process management. The dynamic development of these technologies has necessitated the introduction of uniform legal regulations defining the principles for the design, implementation and use of artificial intelligence systems. In the European Union, this role is played by the Artificial Intelligence Act, i.e. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024, laying down harmonised rules on artificial intelligence (AI Act).

The aim of this act is to create a uniform legal framework for the development, placing on the market and use of AI systems in the internal market of the European Union, while ensuring a high level of protection of health, safety and fundamental rights of individuals. The regulation is also intended to prevent fragmentation of national legislation and ensure the free movement of artificial intelligence-based technologies within the EU internal market.

Scope of application of the regulation

The Artificial Intelligence Regulation applies directly in all Member States of the European Union, which means that its provisions are binding without the need for implementation into national law. The regulation covers a wide range of entities participating in the so-called artificial intelligence value chain, and its addressees are both entities creating AI technologies and those that use them in their activities.

According to the provisions, the AI Act applies to:

1. providers of AI systems who develop or place on the market artificial intelligence systems or general purpose AI models in the European Union market, regardless of whether they are established in or outside the EU,

2. users of AI systems, i.e. organisations using artificial intelligence in their economic, administrative or public activities, which are established or located in the territory of the European Union,

3. providers and users of AI established outside the European Union, if the output of their artificial intelligence systems is used in the territory of the EU;

4. importers and distributors of AI systems who place such technologies on the EU market,

5. manufacturers of products using artificial intelligence who place products containing AI systems on the market under their own name or trademark,

6. authorised representatives of providers not established in the European Union, who act on their behalf in the EU market,

7. individuals located in the territory of the Union who may be affected by the operation of artificial intelligence systems.

Such a broad personal scope of the regulation means that the Regulation covers virtually the entire ecosystem related to the design, placing on the market and use of artificial intelligence systems in the European Union. The regulation also has extraterritorial character, which means that it may also apply to entities outside the EU, if the effects of AI systems affect persons or entities located in the territory of the Union.

Timeline for the application of the AI Act

The Artificial Intelligence Act entered into force on 1 August 2024, but its provisions started to apply gradually in subsequent years.

The most important stages of implementing the regulation include:

• 2 February 2025 - commencement of application of provisions concerning prohibited practices in artificial intelligence, in particular systems manipulating user behaviour or so-called social scoring;

• 2 August 2025 - commencement of application of provisions concerning general purpose artificial intelligence models and the functioning of supervisory institutions at the European Union level;

• 2 August 2026 - commencement of application of most of the AI Act provisions, including obligations concerning high-risk artificial intelligence systems.

As a result, from August 2026, most of the regulations provided for in the AI Act will already be applicable in practice, and entrepreneurs using artificial intelligence systems will be obliged to adapt their activities to the new legal requirements.

Risk-based regulatory approach

A key principle adopted in the AI Act is a risk-based approach. This means that the scope of legal obligations depends on the potential impact of a given AI system on human rights and safety.

The regulation distinguishes four basic categories of artificial intelligence systems:

1. minimal risk systems, e.g. spam filters. In their case, the regulation does not provide for specific regulatory obligations directly arising from the AI Act. However, this does not mean a complete absence of regulation - their use is still subject to general legal provisions.

2. limited risk systems, e.g. chatbots or text generators - for such systems, transparency obligations apply primarily,
   in particular the need to inform the user that they are interacting
   with an artificial intelligence system;

3. high-risk systems include, for example, AI systems used in healthcare, education, recruitment and creditworthiness assessment;

4. unacceptable risk systems, the use of which is prohibited. These include, among others, systems using manipulation of human behaviour, exploiting the vulnerabilities of certain groups of people or using so-called social scoring.

This approach allows adapting the scope of regulations to the actual level of threat resulting from the application of a given technology.

Prohibited practices using artificial intelligence

The AI Act introduces an absolute ban on the use of certain practices employing artificial intelligence. This applies in particular to AI systems using manipulative or subliminal techniques that can significantly influence human behaviour in a way that infringes on their autonomy or decision-making ability.

The use of systems that exploit the vulnerabilities of certain groups of people - for example, due to age, disability or a specific social situation - in a way that could lead to serious harm is also prohibited.

The regulation also prohibits the use of so-called social scoring systems, which evaluate or classify individuals based on their social behaviour or predicted personality traits. Such solutions can lead to discrimination, social exclusion or unjustified restriction of access to services.

High-risk AI systems

Artificial intelligence systems classified as high-risk systems are subject to a special regulatory regime. This category includes systems that can significantly affect the fundamental rights, safety or life situation of individuals.

This category includes, among others:

• systems used in recruitment processes and employee management,

• creditworthiness assessment systems,

• solutions used in education,

• systems used in healthcare,

• technologies used in critical infrastructure,

• systems used by public administration bodies.

In the case of such systems, businesses must meet a number of regulatory requirements. The most important include:

• implementation of a risk management system,

• ensuring adequate quality of data used to train models,

• maintaining technical documentation for the AI system,

• ensuring human oversight of the system's operation,

• monitoring the system's operation even after it has been placed on the market or put into service.

The purpose of these requirements is to reduce the risk of erroneous decisions made by AI systems and to ensure accountability for their operation.

.Transparency in the use of artificial intelligence

The Regulation also introduces obligations related to the transparency of artificial intelligence use. In certain situations, users should be informed that they are interacting with an AI system. This applies in particular when the system:

• conducts automatic communication with the user (e.g., a chatbot),

• generates content in the form of text, images, or sound,

• analyzes biometric data or user emotions.

The purpose of these obligations is to ensure transparency of technology operations and to enable users to consciously use services based on artificial intelligence.

Sanctions for infringement

From the perspective of entrepreneurs, the new regulations mean the necessity of analysing the technologies used and assessing their compliance with the requirements resulting from the AI Act.

Implementing artificial intelligence systems without proper legal preparation can lead to serious financial consequences. The Regulation provides for administrative penalties of up to 35 million euros or 7% of the total annual worldwide turnover of the enterprise – depending on the type of infringement.

Such high penalties are intended to ensure effective enforcement of the provisions and to encourage entrepreneurs to responsibly design and use AI systems.

The importance of the AI Act for entrepreneurs

Adapting operations to new regulations is becoming not only a legal obligation but also an important element of risk management in an enterprise.

Proper implementation of artificial intelligence requires taking into account both technological and legal aspects, including:

• assessing the risk level of the AI system,

• preparing appropriate documentation,

• implementing system supervision procedures,

• ensuring the transparency of AI systems' operation towards users and clients.

In practice, this means the need for a comprehensive approach to managing artificial intelligence technology within an organisation and taking into account the requirements of the AI Act already at the stage of designing and implementing new technological solutions.

Polish regulation concerning artificial intelligence

It is worth noting that the Artificial Intelligence Act takes the form of a European Union regulation, which means that its provisions apply directly in all Member States, including Poland, without the need for their implementation into national law. This means that entrepreneurs operating in Poland will be obliged to apply the provisions of the AI Act regardless of the adoption of additional national regulations.

At the same time, Member States are obliged to adopt national provisions regulating organisational issues related to the supervision of the application of artificial intelligence. In particular, it is necessary to identify the competent authorities responsible for controlling compliance with the provisions of the AI Act, define supervisory procedures and the principles for imposing administrative penalties.

In Poland, work is underway on the Artificial Intelligence Systems Act, which is intended to supplement the application of the AI Act by establishing national supervisory bodies and procedures for enforcing the provisions of the regulation.

However, the planned regulations will not constitute a separate comprehensive legal system concerning artificial intelligence. Their main purpose will be to supplement the provisions of the AI Act with institutional solutions enabling effective supervision of the application of artificial intelligence at the national level.

In practice, this means that the AI Act will remain the primary legal act regulating the use of artificial intelligence in Poland, while the national act will have an organisational and executive character.

Article prepared by Maciej Olejnik, e-commerce lawyer.legal