The AI Act and Polish Startups: Compliance, Liability and Competitive Advantage Under the New Regulation of the Artificial Intelligence Market

An analysis of the AI Act in the context of Polish technology startups - compliance, liability, competitive advantage
25 July 2026 · Reading time: approx. 22 minutes

Introduction: The AI Act as a regulation reshaping the conditions of product creation

The AI Act belongs to that category of regulations which cannot be credibly described either as a simple brake on innovation or as a neutral instrument for ordering the market. Such framings are too facile, because they overlook what proves most consequential for technology startups: the Artificial Intelligence Act does not operate solely at the level of abstract norms but penetrates directly into the economics of product creation, into the architecture of liability, and into a company's capacity to transform a technological experiment into a credible business model. In essence, the AI Act does not merely alter the boundaries of what may be sold and deployed. It also changes the conditions under which a solution based on artificial intelligence can be recognised as a market-mature product, capable of functioning in an environment where the mere effect of a model's operation ceases to suffice as a commercial argument, and where predictability, transparency, controllability and accountability acquire ever greater significance.

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, commonly known as the AI Act, entered into force on 1 August 2024, thereby inaugurating a process of gradual implementation of successive categories of regulatory obligations across the entire European Union. For the Polish startup ecosystem, this means the necessity of confronting a regulation that not only establishes a legal framework for artificial intelligence systems but simultaneously redefines the very concept of product maturity in the sector of technologies based on machine learning, natural language processing and autonomous systems. It should be emphasised that this regulation did not emerge in a legislative vacuum - it constitutes an element of the European Union's broader digital strategy, encompassing also the Data Act, the Data Governance Act, the Digital Services Act (DSA) and the Digital Markets Act (DMA), collectively creating a regulatory framework of unprecedented complexity with which all participants in the European technology market must contend.

Temporality of regulation: phased implementation and the startup's design decisions

From the startup's perspective, what proves crucial is that the AI Act enters the organisational logic of a company far earlier than the formal calendar of provisions would suggest. The Ministry of Digital Affairs indicated that the first provisions of the AI Act became applicable from 2 February 2025, covering among other things prohibited practices and the obligation to ensure an adequate level of AI competence on the part of providers and entities deploying such systems. This means that the problem of compliance does not begin only at the moment when the regulator knocks on the entrepreneur's door. It begins when the project team makes its first decisions concerning the application of the model, the nature of the data, the degree of system autonomy, and what real function the product is to perform vis-à-vis the end user or the client institution. In this sense, the AI Act should be understood as a pre-emptive regulation, because even obligations implemented in stages influence how a system should rationally be designed at an early stage of development.

This temporal dimension proves particularly important when one considers the full phasing of EU implementation. The calendar of application of the regulation provides the following sequence: from 2 February 2025, prohibitions concerning unacceptable AI practices and requirements regarding AI competence (Article 4 of the regulation) apply; from 2 August 2025, obligations concerning general-purpose AI models (GPAI - Articles 51-56) enter into force; from 2 August 2026, the majority of the regulation's provisions become fully applicable, including requirements for high-risk systems listed in Annex III; and from 2 August 2027, requirements for high-risk AI systems constituting safety components of products covered by EU harmonisation legislation listed in Annex I begin to apply. For a startup, this means that the formal distribution of regulation over time does not automatically provide strategic comfort. Technical decisions taken in 2025 or 2026 - concerning the logging of system actions, the manner of describing use cases, the role of the human in the decision loop, the boundaries of permissible autonomy and the contractual model vis-à-vis the client - will determine the subsequent cost of adaptation to the full scope of requirements that will become enforceable in successive stages of the regulation's application.

The problem of regulatory temporality has yet another dimension which rarely appears in industry discussions but which holds fundamental practical significance for startups. This concerns the phenomenon which may be termed regulatory market pre-emption: institutional clients - particularly from the financial, insurance, healthcare and public sectors - begin to enforce AI Act compliance requirements in their relationships with AI technology suppliers far earlier than the formal application calendar would indicate. This occurs because these entities are themselves subject to due diligence obligations vis-à-vis their sectoral regulators (the Polish Financial Supervision Authority, the Patient Rights Ombudsman, the President of the Office of Competition and Consumer Protection) and must demonstrate that the process of selecting and implementing an AI system was conducted in accordance with appropriate regulatory risk management standards. Consequently, a startup that formalistically invokes the fact that a given obligation "does not yet apply" may lose a tender to a competitor that voluntarily meets these requirements and can document this.

The classification problem: who is liable for the system in a layered architecture

The most serious problem facing Polish startups does not lie in the mere existence of obligations but in the uncertainty of classification. In the artificial intelligence ecosystem, the boundaries between provider, deployer, importer, distributor and professional user are far more fluid than in the classic software house service model. The vast majority of young AI firms do not develop their own foundation models on a scale requiring enormous capital expenditure but instead create products as layered arrangements, built upon external models (most commonly supplied by OpenAI, Anthropic, Google DeepMind, Mistral AI or Meta), proprietary orchestration logic, retrieval-augmented generation mechanisms, analytical components, a specialised interface and adaptation to a specific business process. This architecture was until recently the primary source of startup advantage, because it enabled rapid market entry without the need to compete with the largest entities at the level of training infrastructure. However, from a regulatory perspective, it is precisely this layered quality that complicates the answer to the question of who actually bears responsibility for the system and its effects on the market.

This is not an academic question in the narrow sense but a problem with direct contractual, reputational and capital consequences. If a startup builds a product on someone else's model but itself defines the use scenario, designs the decision interface, organises the data flow and promises the client a specific outcome, it is difficult to maintain that full liability materially remains with the upstream provider. The market does not, after all, purchase an abstract model as such. It purchases a function, predictability, deployability and the capacity to assign responsibility in a situation where the system generates an error, harm or a result inconsistent with the declared purpose. It is precisely for this reason that the AI Act strikes at one of the most characteristic features of startup culture in recent years, namely the possibility of selling technological agency while maintaining relatively limited transparency regarding the boundaries of that agency and responsibility for its consequences. Article 25 of the regulation indicates unequivocally that a deployer of a high-risk AI system who makes a substantial modification to the system or changes its intended purpose becomes de facto its provider and assumes the full scope of regulatory obligations - which in the case of startups building solutions on foundation models may have far-reaching legal and business consequences, including the obligation to conduct a full conformity assessment before placing the product on the market.

This problem is further complicated in the context of general-purpose AI models (GPAI), which from 2 August 2025 are subject to separate obligations under Articles 51-56 of the regulation. The provider of a GPAI model is obliged to prepare and maintain technical documentation of the model, develop a policy for compliance with EU copyright law, prepare a sufficiently detailed summary of the content used to train the model, and cooperate with the AI Office at the European Commission. However, these obligations do not relieve the startup utilising a GPAI model as a component of its product from independent liability for the manner in which that model is used in a specific application. As a result, a kind of "liability gap" emerges - the model provider is responsible for the model as such, but not for its specific application, while the startup-integrator is responsible for the application but does not always have full insight into the limitations and risks of the model itself. This gap represents one of the greatest regulatory challenges for Polish AI startups in the coming years.

The economics of compliance: regulatory cost as a regulator of iteration pace

For Polish startups this problem holds particular significance, because they typically operate under conditions of limited capital, shorter financing horizons and greater pressure for rapid validation than entities from the most mature technology ecosystems. In such an environment, the cost of regulation is not felt primarily as a deferred threat of penalty. Far more frequently, it operates as the cost of shifting resources from development to demonstration. Every hour devoted to risk classification, organising documentation, establishing liability relationships with technology suppliers or describing system limitations is an hour taken from product development, sales or preparation for the next funding round. In a large organisation, this cost can be distributed among legal, compliance, product governance and security functions. In a startup, it typically concentrates on the same individuals who are simultaneously responsible for technical architecture, business development and investor relations. For this reason, the AI Act should also be analysed as a regulator of iteration pace - not because it prohibits innovation, but because it imposes a more cognitively and organisationally costly path to achieving a market-ready product.

An analysis of compliance costs in the startup context requires consideration not only of direct expenditures on legal advice or technical audits but also of opportunity costs resulting from delays to the development cycle. Under conditions of the Polish ecosystem, where the median seed funding according to PFR Ventures and European Innovation Council data oscillates around amounts significantly lower than in Western European ecosystems, every shift of a milestone by a quarter may mean the necessity of securing additional bridge financing or abandoning a market segment that will in the meantime be occupied by a competitor possessing greater resources for servicing regulatory requirements. In this sense, the AI Act may paradoxically reinforce the Matthew effect in the startup ecosystem - firms already possessing compliance resources pass more easily through the regulatory gate, while entities at an earlier stage of development are confronted with a cost that, relative to their operating budget, constitutes a proportionally far greater burden.

One cannot overlook the psychological and organisational dimension of this problem. In startup culture, shaped by a decade of dominance of the "move fast and break things" paradigm, the requirement for systematic documentation, ex ante risk assessment and formal compliance verification before introducing a product to market represents a fundamental challenge that is not so much technical as mental. Teams accustomed to rapid iterations, continuous deployment and market validation are confronted with the necessity of incorporating into the development cycle stages that, from the perspective of traditional startup culture, may appear as "bureaucracy" slowing innovation. The task of leaders of Polish AI startups is therefore not only the technical fulfilment of the regulation's requirements but above all a cultural transformation of the way product creation is conceived - from a model based exclusively on iteration speed to a model combining speed with systematic accountability.

Product maturity under regulatory conditions: a new definition of market readiness

Against this background, the concept of product maturity acquires particular importance. In the classical startup understanding, a mature product is one that finds repeatable application, maintains cost parameters and generates a sufficiently strong demand signal. In an environment shaped by the AI Act, such a definition proves insufficient. Maturity begins to encompass also the capacity to demonstrate what the system is intended for, what its limitations are, how risks are identified and mitigated, who performs the supervisory function and on what basis the client can trust that the solution is fit for use in a real organisational environment. This shifts the centre of gravity from the technology itself to the architecture of its justification. A startup can no longer rely solely on the demonstrative effect of the model to defend the product's value. It must be able to explain why the system operates in a particular manner, what the boundaries of its application are, and what liability looks like for its incorporation into the client's processes.

If a firm builds a solution as though it were to remain merely an auxiliary tool, and the market subsequently shifts it into the domain of more sensitive applications, the problem will no longer be mere compliance with the norm. The problem will become the necessity of rewriting the product architecture, reorganising the liability process and rebuilding market trust. Such cases are known from the history of the fintech sector, where solutions initially designed as informational tools became over time instruments supporting credit or insurance decisions, thereby transitioning from the category of limited-risk systems to the category of high-risk systems within the meaning of Annex III of the regulation. For Polish AI startups designing solutions in the domains of HR-tech, legal-tech, med-tech or ed-tech, the risk of such classificatory shift is particularly high, because the boundary between a supporting tool and a system making or materially influencing decisions concerning natural persons is in these sectors notoriously difficult to maintain as the product matures and its applications expand.

Article 6 of the regulation in conjunction with Annex III defines a catalogue of areas in which an AI system is classified as a high-risk system, encompassing among others: biometric identification, management of critical infrastructure, education and vocational training, employment and worker management, access to private and public services, law enforcement, migration management and border control, and the administration of justice and democratic processes. For the Polish startup ecosystem, the categories concerning employment (AI systems used for recruitment, employee evaluation, decisions on promotion or dismissal), education (systems evaluating students or determining access to education) and access to services (systems used for creditworthiness assessment, insurance scoring or prioritisation of public services) are of particular relevance. Many Polish AI startups operate precisely in these domains, often without realising that their product - designed as a "supporting tool" - may be subject to classification as a high-risk system by virtue of its actual influence on decisions concerning natural persons.

The epistemic and communicative dimension: the end of the era of slogan rhetoric

It is precisely for this reason that the AI Act is not solely a legal challenge but also a communicative and epistemic one. In B2B relationships, particularly with enterprise clients or public sector entities, the question "do you use AI?" very quickly gives way to more demanding questions: what is the degree of decision automation, how does human oversight work, what are the failure scenarios, how are model changes documented and what guarantees does the supplier actually assume. For a startup, this means the necessity of developing a new type of competence, consisting in translating technological complexity into language comprehensible to the market and defensible before an audit by the client, investor or supervisory authority. In practice, it also means the end of a certain era of startup rhetoric in which advantage derived from the mere slogan "we have AI." In the new environment, value is increasingly created by the capacity to articulate how that AI works, what exactly it does, where its competences end and how the consequences of error are managed.

Article 13 of the AI Act establishes the obligation to ensure transparency of high-risk AI systems in a manner enabling deployers to interpret the system's outputs and use it appropriately. For startups, this means not only the technical necessity of implementing explainability mechanisms but above all a cultural change in the manner of communicating product value. The technical documentation required by Article 11 and Annex IV of the regulation encompasses among other things: a general description of the AI system, a detailed description of the system's elements and its development process, detailed information on monitoring, functioning and control of the system, a description of the appropriateness of performance metrics, a description of risk management measures, a description of changes made to the system throughout its lifecycle, a list of applied harmonised standards, and a detailed description of the quality management system. For a team of several people in a startup, producing and maintaining such documentation at the level required by the regulation constitutes an organisational challenge comparable in scale to the product development process itself - and requires competences that have not traditionally been part of the skill set of a typical engineering team in a technology startup.

The communicative dimension of AI Act problems also encompasses investor relations. As regulatory awareness matures in the venture capital community, funds increasingly incorporate regulatory readiness assessment into their due diligence process. A startup that cannot answer questions concerning the risk classification of its system, its compliance strategy or the potential impact of regulation on its business model exposes itself to valuation reduction or outright refusal of financing. Conversely, a startup demonstrating a mature approach to AI governance - possessing an internal AI system card, risk assessment procedures, a compliance plan aligned with the regulation's timeline - signals to the investor professionalism and the capacity to scale under regulated conditions, which may constitute a significant differentiating factor in the fundraising process.

The AI Act as a source of competitive advantage: inverting the cost perspective

The entire problem should not, however, be reduced to cost. Such a perspective would be incomplete, because for some startups the AI Act may become a source of competitive advantage. In the B2B segment and in more regulation-sensitive sectors, the client no longer purchases functionality alone. The client also purchases the possibility of deployment without destabilising their own organisational environment, without ambiguity regarding liability and without the transfer of all legal risk to the purchaser. A Polish startup will not likely defeat a global player through model scale or infrastructure budget, but it may prevail through the quality of product embedding in a specific industry, readiness to meet the client's formal requirements and documentary transparency. From this perspective, the AI Act selects not so much ideas as the manner of organising work on them. The teams that will be rewarded are those capable of combining engineering competence with design discipline and the ability to build institutional trust.

This mechanism operates with particular clarity in markets where purchasers are themselves subject to regulatory requirements and seek suppliers capable of demonstrating compliance in an auditable manner. Financial institutions subject to supervision by the Polish Financial Supervision Authority, healthcare entities operating under the regime of the Act on Medical Activity, public administration units obliged to comply with public procurement and freedom of information legislation - all these purchasers need AI technology suppliers who not only deliver a functioning system but simultaneously enable the purchaser to demonstrate to their own regulator that the deployment was conducted in accordance with appropriate risk management standards. A Polish startup that can deliver a complete AI system card, documentation of a fundamental rights impact assessment (required by Article 27 of the regulation for public law bodies and private entities providing public services) and a transparent model of contractual liability gains an advantage over a competitor offering a perhaps more technically advanced but less well-documented product that is harder to embed within the purchaser's compliance framework.

It is worth emphasising that this advantage is particularly durable under Polish market conditions, where closer contact with the client, knowledge of local sectoral regulations, the ability to communicate in Polish and understanding of the specifics of the national legal environment constitute barriers to entry for foreign competitors. A global AI solutions provider may possess a more advanced model, but its compliance documentation will necessarily be generic, unadapted to the specifics of Polish labour law, Polish sectoral regulations or the requirements of Polish public administration. A Polish startup knowing these conditions and capable of delivering an AI product "ready for deployment" in a specific Polish regulatory context creates value that cannot easily be replicated through technological scale or marketing budget.

Structural risk: regulation as a mechanism of market consolidation

At the same time, one cannot overlook the structural risk that regulation will reinforce the advantage of the largest market actors. Analyses and commentaries concerning the AI Act's impact on startups have noted that for some young firms the new requirements may increase the cost of entry and limit the pace of development, and part of the community feared outright weakening of European competitiveness vis-à-vis jurisdictions less burdened by regulation - particularly vis-à-vis the United States, where the Trump administration undertook a series of deregulatory actions in the AI sector in 2025, and vis-à-vis East and Southeast Asian states adopting more permissive approaches to technology regulation. Such concerns are not without foundation, because large model and platform providers possess the personnel, infrastructure and capital enabling them relatively more easily to produce documentation standards, security procedures and compliance resources. As a result, the AI Act may operate in two ways: on the one hand, it increases market transparency and may improve client trust in smaller providers capable of demonstrating compliance; on the other hand, it may raise the entry threshold where compliance becomes economically more easily achievable for entities of the greatest scale.

For Polish startups, the problem therefore does not reduce solely to the question of how to meet the provisions, but how to maintain the capacity for growth in a situation where regulation ceases to be background and becomes one of the mechanisms shaping the structure of competition. Empirical observations from sectors that have previously undergone analogous regulatory processes - such as the financial sector after the entry into force of PSD2 and the DORA regulation, or the personal data sector after GDPR implementation - indicate that regulation does not eliminate startups as a category of market entities but changes their profile. It rewards those that can make compliance an element of the value proposition, and marginalises those whose business model was based on regulatory arbitrage or on the tacit assumption that supervision would not reach entities below a certain threshold of market visibility. In the context of the AI Act, this last strategy is particularly risky, because the regulation does not provide general exemptions for SMEs regarding obligations concerning high-risk systems - only limited facilitations regarding proportional application of certain documentation requirements (recital 145 of the regulation) and preferential access to regulatory sandboxes (Article 57(4)).

The national institutional environment: KRiBSI and regulatory sandboxes

Against this background, the national institutional environment acquires particular significance. The government already at the drafting stage announced that the Polish act on artificial intelligence systems is to not only ensure the application of the AI Act but also create a supervisory authority, complaint mechanisms and instruments supporting innovation, including regulatory sandboxes. From publicly available communications it emerged that this function is to be performed by the Commission for the Development and Security of Artificial Intelligence (KRiBSI), capable of verifying system compliance, applying supervisory measures and co-creating a more predictable regulatory environment. This is important, because startups operating under conditions of high technological uncertainty need not only sanctions for violations but also clear interpretive channels. Without them, the AI Act will be perceived as a source of arbitrariness rather than as a standard ordering the market.

The signing by President Karol Nawrocki on 24 July 2026 of the act on artificial intelligence systems has significance greater than the purely formal closing of one legislative stage. According to consistent reports from press sources and earlier project assumptions, the act creates in Poland a national model for enforcing the AI Act, providing for the establishment of KRiBSI as the central supervisory authority, a mechanism for handling complaints from citizens and entities affected by the operation of AI systems, supervisory measures enabling an order to cease making available a system not meeting requirements, administrative sanctions reaching 35 million euros or 7% of annual global turnover (depending on the category of violation), and regulatory sandboxes enabling the testing of innovative AI solutions in a controlled environment under the authority's supervision. For startups, regulatory sandboxes constitute potentially the most important support instrument, because they enable product validation against regulatory requirements before full market deployment - which may significantly reduce the cost and risk associated with subsequent adaptation of the product to the regulation's requirements.

The institution of individual opinions provided for in the draft act constitutes another mechanism of significant practical importance for startups. The possibility of applying to KRiBSI for an opinion on the qualification of a specific AI system - whether it constitutes a high-risk system, whether it is subject to specific obligations, how it should be classified in the context of the regulation - allows reduction of the legal uncertainty that, under conditions of innovative AI applications, represents one of the most serious brakes on investment and product decisions. A startup that obtains a positive individual opinion concerning the classification of its system gains not only legal certainty but also a commercial argument vis-à-vis clients and investors - confirmation by the supervisory authority that the product has been correctly classified and meets the relevant requirements constitutes a signal of credibility difficult to obtain by other means at an early stage of company development.

One should, however, draw attention to the potential institutional risks associated with the functioning of KRiBSI. Experience with GDPR implementation in Poland - where the Personal Data Protection Office for years struggled with shortages of human and financial resources, resulting in long case processing times and limited capacity to issue binding interpretations at a pace corresponding to market needs - counsel caution in forecasting the effectiveness of the new authority. If KRiBSI does not receive appropriate funding, expert staff in both law and AI technology, and a mandate to issue interpretations within a reasonable timeframe, there is a risk that regulatory sandboxes and individual opinions will remain instruments theoretically available but practically difficult to access for startups that need the regulator's answer in weeks, not months or quarters.

The fundamental tension: the culture of experiment versus the requirement of systemic accountability

From an analytical perspective, the central problem of the AI Act for Polish startups reveals itself as a tension between the culture of rapid experiment and the requirement of systemic accountability. This tension will not disappear, because artificial intelligence increasingly leaves the level of auxiliary tools and begins to participate in processes that affect people, organisations and access to resources. The more AI becomes an agentive layer in social and economic processes, the less the rhetoric of innovation suffices and the greater the significance acquired by the capacity to manage the consequences of that agency in a manner that is predictable, transparent and accountable to the persons whom that agency concerns.

For this reason, the AI Act is not for startups merely a problem of compliance. It is a test of the maturity of the entire model of building a product based on artificial intelligence. In the coming years, advantage will be achieved not solely by those teams that can rapidly deploy the next model layer, but by those that can with equal facility combine technology, accountability, documentability and market trust into a coherent value proposition. Polish startups - operating under conditions where for the first time a national AI regulator possesses real supervisory instruments, and simultaneously where regulatory sandboxes offer a validation pathway without full market risk - face an opportunity that is both technological and institutional in character. The exploitation of this opportunity will depend on the capacity to transform regulatory requirements from a cost into an element of advantage, from a barrier into a quality standard, from an obligation into a commercial argument.

Ultimately, it should be emphasised that the AI Act problem for Polish startups is not a static but a dynamic one - evolving together with the maturation of regulatory practice, KRiBSI case law, harmonised standards developed by European standardisation organisations CEN and CENELEC (in particular the ISO/IEC 42001 standard concerning the artificial intelligence management system) and experience arising from the first regulatory sandboxes. A startup that today takes a conscious decision to incorporate AI Act requirements into the architecture of its product does not eliminate all future regulatory risks but builds adaptive capacity - the ability to respond to the evolution of standards without the necessity of fundamental reconstruction of the product, contracts and market relationships. In this sense, compliance under AI Act conditions is not a one-off project but a continuous organisational practice whose value grows proportionally to the pace of change in the regulatory, technological and market environment in which Polish AI startups will operate in the coming decade.