New Polish AI Commission to Launch in November, Regulatory Sandbox Rules Revealed

It's now clear when Poland's new artificial intelligence oversight body will actually start working. Deputy Digitalization Minister Dariusz Standerski laid out a concrete timeline: in October 2026, a chairperson will be appointed to the Commission for the Development and Security of Artificial Intelligence (Komisja ds. Rozwoju i Bezpieczeństwa Sztucznej Inteligencji, KRiBSI), and a month later, in November, the commission will begin operating.

President Karol Nawrocki signed the law implementing the EU AI Act in late July. Now the government has spelled out how, in practice, the launch of the institution responsible for enforcing these rules in Poland will unfold. Until now, only the law's general framework was known; only now has the government released concrete deadlines and mechanisms for how the new authority will operate.

Who Will Sit on the Commission

The Commission for the Development and Security of Artificial Intelligence, or KRiBSI for short, will consist of a chairperson appointed for a five-year term, two deputies, and four members. Candidates for membership will be nominated by the president of the Office of Competition and Consumer Protection (UOKiK), the Polish Financial Supervision Authority (KNF), the National Broadcasting Council (KRRiT), and the president of the Office of Electronic Communications (UKE). The chairperson will be appointed by the Sejm with the Senate's consent.

This composition is meant to give the commission expertise across the various fields where AI systems already raise concerns today: competition and consumer protection, financial markets, media, and telecommunications. The new body will get real enforcement tools, not just an advisory role.

Powers and Penalties

The commission will be able to inspect companies using artificial intelligence systems, impose financial penalties, review user complaints, and in extreme cases order a given system to be withdrawn from the market or its use discontinued. Such a decision will be made when a system poses a direct threat to citizens' life, health, safety, or fundamental rights.

Any citizen who believes an AI system has violated their rights will be able to file a complaint with the commission. The standard review period is 30 days, extending to 60 days for more complex cases, with the entire complaint process not expected to exceed six months. Commission decisions can be appealed to the Court of Competition and Consumer Protection in Warsaw.

Sandboxes for Businesses

The second pillar of the new rules is regulatory sandboxes, controlled environments where businesses will be able to test innovative AI systems under regulator supervision before bringing them to market. The sandboxes are set to launch at full scale within three months of the law's publication, with no pilot phase, going straight to full operation.

Participation in the sandbox will be free for micro, small, and medium-sized enterprises. Fees for other entities will be set by the digitalization minister in a regulation. Companies will be admitted to the sandbox through a competitive process with scored applications.

That means there will be a chairperson in October, and the commission will begin operating in November - Dariusz Standerski, Deputy Digitalization Minister

Whoever wins the AI race today wins the economic race tomorrow - Krzysztof Gawkowski, Minister of Digitalization

What It Means for Businesses

For Polish businesses deploying artificial intelligence systems, the timeline means they still have a few months before the new regulator becomes fully operational, but rules on labeling AI-generated content take effect as early as August 2, regardless of when the commission starts work. Companies planning to test new AI solutions can already begin preparing to apply for the regulatory sandbox, keeping in mind the competitive selection process.

The law excludes from the commission's scope AI systems used in defense and national security by intelligence services. This mirrors the approach taken in other EU countries, where the defense sector remains outside civilian AI oversight.

Poland is one of the first EU countries to lay out a precise timeline for launching the national oversight body required under the AI Act. Many member states are still working on their own implementing legislation, so the concrete November date gives Polish companies and users clarity on when they will be able to file complaints and expect real consequences for AI system providers that violate the rules.