Most AI Act provisions apply from 2 August 2026. Does your company have readiness evidence?

Yes. As a “deployer” you have obligations: ensuring employees' AI literacy (Article 4), overseeing how AI is used and — depending on the use case — further requirements. The key is establishing what AI is really used for in your company, including “shadow AI”.

Maximum fines reach EUR 35M or 7% of global annual turnover (prohibited practices) and EUR 15M or 3% (other violations). Beyond fines, the practical risk is disputes with business partners, who increasingly require compliance in contracts.

With an inventory: what uses AI, where and why — including tools employees adopted on their own. Then risk classification and a gap-closing plan. That is exactly the scope of our audit.

AI tools used by employees outside the company's knowledge and control — private ChatGPT accounts, plugins, automations. The risks: leakage of company and customer data, and harder AI Act or GDPR compliance, especially where personal data or high-risk AI are involved. A shadow-AI inventory is the first week of our audit.

Typically 2–4 weeks, depending on the number of systems and the size of the organisation. It ends with a report containing risk classification and an action plan — a working document, not a decorative one.

Any company in the EU that develops or uses AI systems in a professional context — in practice almost every company using tools like ChatGPT, Copilot or a custom model. You are a “deployer” even when you only use off-the-shelf AI, and deployers have their own obligations. An audit is most urgent where AI touches personal data, regulated decisions or high-risk use cases.

An inventory of the AI systems in use (including shadow AI), each system’s deployer/provider classification and risk category, evidence of AI literacy measures for staff (Article 4), human-oversight and AI usage policies, and — for systems whose obligations apply by then — the technical documentation those obligations require. A compliance audit maps exactly what each system needs and where the gaps are, with a plan to close them.

GPAI (general-purpose AI) models — large models like GPT or Gemini — carry AI Act obligations such as technical documentation, a copyright policy and a training-data summary. These apply from 2 August 2025 and, as a rule, fall on the model provider (e.g. OpenAI, Google), not on a company that merely uses the model. Your company can itself become a GPAI provider if it fine-tunes or substantially modifies such a model and places it on the market under its own name. Models with systemic risk carry extra obligations (evaluations, testing, incident reporting). The audit determines whether you are only a deployer or cross the GPAI-provider threshold.

Yes. It was published on 27 July 2026 as Journal of Laws 2026, item 1003. Article 125(4) applies from 28 July 2026; most remaining provisions take effect on 11 August 2026; Articles 8–18 and Chapters 3–5, 8 and 9 on 28 October 2026. It establishes KRiBSI and national supervision procedures. Official record: https://api.sejm.gov.pl/eli/acts/DU/2026/1003.

In four weeks you can build the readiness foundation: a register of the AI systems you use (including shadow AI), role and risk classification, the scope of AI literacy (Art. 4) and human oversight (Art. 14), and a prioritised gap backlog. It is not a guarantee of full compliance — gaps are closed through implementation and documentation, and timing depends on role and system class. Most provisions apply from 2 August 2026; full duties for some high-risk systems fall later.