5 key takeaways
- The EU AI Act, GDPR and cybersecurity rules (NIS2, DORA) are frequently treated as three separate compliance projects, but for most technology companies they apply to the same system and the same data — and should be addressed together
- An AI Act lawyer in Poland helps technology companies establish, for each AI-enabled product: its AI Act risk classification, its GDPR legal basis and data flows, and whether NIS2 or DORA cybersecurity obligations apply
- Common gap: companies run a GDPR compliance programme and an AI Act classification exercise as parallel, disconnected workstreams, leading to inconsistent documentation and duplicated effort
- Polish enforcement sits with UODO for data protection and, for AI Act matters affecting financial services, increasingly intersects with KNF’s supervisory expectations for regulated entities
- Technology companies that get ahead of this — building a single compliance narrative covering AI governance, data protection and cybersecurity — spend materially less time and legal budget than those that address each requirement reactively
As an AI Act lawyer in Poland advising international technology and fintech companies on AI governance, data protection and cybersecurity regulation, I increasingly see companies come to me with three separate, disconnected compliance workstreams — one for GDPR, one for the AI Act, one for cybersecurity – that were built without reference to each other. This post explains why that approach creates unnecessary risk, and how to build a single, coherent compliance framework instead.
AI Act Lawyer Poland: Why These Three Frameworks Belong in One Compliance Plan
Most AI-enabled technology products sit at the intersection of all three regulatory frameworks:
| Question | Regulation that answers it |
|---|---|
| Is this AI system classified as high-risk, and what obligations does that trigger? | EU AI Act |
| What is the legal basis for processing the personal data this system uses, and what rights do data subjects have? | GDPR |
| What operational resilience, incident reporting and risk management obligations apply to the entity deploying this system? | NIS2 (for essential/important entities) or DORA (for financial entities) |
Because these questions are all being asked about the same underlying system, answering them separately — with separate advisers, separate documentation, and no shared source of truth — creates two problems: duplicated work, and inconsistent answers that create genuine legal exposure if a regulator compares the AI Act documentation against the GDPR records of processing activities and finds they do not match.
For dedicated advice on the EU AI Act, see AI Act legal advice in Poland.
AI Act Classification: Where to Start
Under the EU AI Act, the starting point for any AI-enabled product is classification: is the system prohibited, high-risk, limited-risk (subject to transparency obligations), or minimal-risk? This classification is not a one-off exercise — it needs to be revisited whenever the system’s functionality, data inputs or deployment context materially changes.
Common gap: companies classify their AI system once, at launch, and do not revisit the classification as the product evolves — a system that started as a low-risk internal tool can become high-risk if its outputs start feeding into decisions about individuals (creditworthiness, employment, access to services).
For financial services and technology companies specifically, high-risk classification most often arises in the context of credit scoring, fraud detection, and employee or customer-facing decision-making tools. If you are unsure whether your AI system falls into this category, see Is Your AI System High-Risk? A Practical Guide for Financial Services and Technology Companies.
GDPR: The Data Layer Underneath Every AI System
Every AI system that processes personal data needs a documented legal basis, and — for most AI systems used at scale — a Data Protection Impact Assessment (DPIA). Specifically:
- Legal basis: many companies default to “legitimate interest” for AI processing without properly documenting the balancing test UODO expects to see
- Data minimisation: AI systems are often built on broader datasets than strictly necessary for the stated purpose — this is a frequent focus of UODO inquiries
- International transfers: where AI models or infrastructure are hosted outside the EEA, the transfer mechanism (SCCs, adequacy decision, or otherwise) needs to be documented, not assumed
Common gap: DPIAs written for an AI system’s initial design that are never updated as the model is retrained or its use case expands — an outdated DPIA offers little protection if the system’s actual operation has moved beyond what was originally assessed.
Cybersecurity: NIS2 and DORA Overlay
Depending on the sector and size of the entity deploying an AI or technology system:
- NIS2 applies to a broad range of “essential” and “important” entities (including many digital infrastructure and technology service providers), requiring risk management measures and incident reporting
- DORA applies specifically to financial entities and their critical ICT third-party providers, with more prescriptive requirements around operational resilience testing and ICT risk management
Common gap: technology vendors serving financial-sector clients often do not realise that DORA’s third-party risk management requirements flow down to them contractually, even though DORA does not directly regulate the vendor itself.
Frequently Asked Questions
Does the EU AI Act apply to my company if we are based outside the EU?
Yes, if your AI system is placed on the EU market or its output is used in the EU — including in Poland — the AI Act’s obligations can apply regardless of where your company is established, in a manner similar to GDPR’s extraterritorial reach.
Can one AI Act lawyer in Poland advise on GDPR and cybersecurity together, or do I need separate specialists?
Both approaches exist in the market. The advantage of working with an AI Act lawyer in Poland who also covers GDPR and cybersecurity is a single, consistent compliance narrative and documentation set — which materially reduces the risk of contradictions between your AI Act classification, your GDPR records and your cybersecurity risk assessments.
What is the most common mistake technology companies make with AI Act compliance?
Treating classification as a one-time exercise completed at launch, rather than an ongoing assessment that is revisited as the system, its data inputs, or its use case evolve.
Do NIS2 and DORA apply to the same companies?
No — NIS2 has a broader scope covering essential and important entities across multiple sectors, while DORA applies specifically to financial entities and their critical ICT providers. A company can be in scope for one, both, or neither, depending on its sector and role in the value chain.
Building One Compliance Framework Instead of Three
- Map every AI-enabled system against all three frameworks (AI Act classification, GDPR legal basis and DPIA status, applicable cybersecurity regime) in a single register
- Assign one internal owner responsible for keeping the register current as systems change
- Align documentation — the risk assessment used for AI Act purposes and the DPIA used for GDPR purposes should tell a consistent story about the same system
- Review the register whenever a system’s functionality, data sources or deployment context changes materially
If your company needs an AI Act lawyer in Poland to build or review a compliance framework spanning AI governance, data protection and cybersecurity regulation, get in touch. For more, see Artificial Intelligence & the EU AI Act, Data Privacy & GDPR, and Cybersecurity, NIS2 & DORA.
Related posts:
- Is Your AI System High-Risk? A Practical Guide for Financial Services and Technology Companies
- Fintech, AI Act and NIS2 Lawyer in Poland
- DORA Compliance Poland KNF
- Technology Lawyer in Poland: What They Do and When You Need One
Katarzyna Szczudlik is a Partner at Schoenherr in Warsaw and an AI Act lawyer in Poland, ranked by Chambers & Partners and Legal 500. She advises international technology and fintech companies on AI governance, data protection and cybersecurity regulation across Poland and the EU. Get in touch.
