Artificial intelligence has become a key element of modern business. It is used by both large corporations and small companies, which automate processes, analyze data, and serve customers using chatbots. However, as the role of AI grows, so does the need to regulate this technology. The European Union has introduced Regulation 2024/1689, which sets out the rules for using AI in Europe. The new regulations are intended to ensure user safety, protect fundamental rights, and promote transparency in the operation of artificial intelligence systems.

What does this mean for small businesses? Will the new regulations be a challenge or rather an opportunity for them? What steps should be taken to avoid problems?

What does the new regulation change?

The AI Regulation introduces uniform rules for all companies operating in the European Union. It applies both to businesses developing their own AI systems and to those using ready-made solutions. In short, its main objectives are:

ensuring the safety of AI users,
preventing manipulation and discrimination,
creation of a legal framework for innovation,
harmonization of regulations in all Member States.

One of the key elements of the new regulations is the classification of AI systems according to their level of risk.

Risk levelExamples of AI systemsCompany obligationsProhibitedSocial scoring, subliminal advertising manipulation, real-time biometric identificationTotal banHigh riskAI used in recruitment, medicine, the judiciary, and critical infrastructure managementTechnical documentation, audits, control systemsLimited riskChatbots, AI for content analysis, text generatorsInforming users that AI is being usedMinimal riskAI in games, spam filters, recommendation systemsNo additional regulationsIf a company uses AI in decision-making processes that affect people (e.g. evaluating job candidates or medical systems), it must expect additional requirements. If, however, AI serves only an auxiliary function, the requirements are significantly less stringent.

About the Regulation

Although the text itself is a regulation—that is, an important document that is automatically implemented in Member States (without the need to enact separate laws in each country)—in practice, it can be classified as so-called “soft law,” consisting more of recommendations than typical hard law. Nevertheless, it cannot be ignored.

Michał Nowakowski explains this more thoroughly in his article.

Who is affected by the new regulations? Does my company need to worry about them?

Not every company needs to fear the new regulations. Many businesses use AI in a way that does not require them to meet the strict requirements of the new AI Regulation. However, it is worth checking whether your business falls within the scope of the new regulations.

Does AI Make Decisions About People?

If an AI system evaluates job candidates, decides whether to grant credit, or analyzes insurance risk, it may be classified as high-risk AI. This requires:

Technical documentation – a description of how the system and algorithms work.
AI performance monitoring – detecting errors and mitigating risk.
Human oversight – AI must not operate completely autonomously in decisions that are critical for people.

Does the AI analyze sensitive data or operate in critical areas?

AI that processes medical, financial, or biometric data is subject to stricter regulations. Examples include:

✅ AI system analyzing X-ray images – supports diagnosis but requires physician oversight. ✅ AI detecting banking fraud – processes financial data, so it must operate in accordance with the new rules.

Does the company use AI for decision-making processes in key areas?

If AI automatically grants loans, conducts recruitment, or assesses risk, this means the need to comply with regulations on:

Transparency – users must know that the decision was made by AI.
Risk management – AI must not discriminate or make unclear decisions.
Incident reporting – companies must report serious system errors.

What if AI serves a supportive role?

If AI is used for customer service, sales analysis, or product recommendations, the regulations are less demanding. It is enough to:

Monitor system performance and assess its impact on customers.

Inform users that they are interacting with AI (e.g., chatbots).

What obligations do companies have?

Companies using high-risk AI will have to adapt their systems to the new standards. This includes:

Risk management system – AI must be regularly tested and monitored.
Technical documentation – a detailed description of the system’s operation, data sources, and decision-making methods must be maintained.
Human oversight – AI decisions must not be fully autonomous; a mechanism enabling their control is required.
Incident reporting – if the AI malfunctions, the company is required to report the problem to the relevant supervisory authorities.

Companies using limited-risk AI will have fewer obligations. It will be sufficient to inform users that they are interacting with AI, for example through a notice accompanying chatbots or generated content.

What are the penalties for non-compliance with the regulations?

The regulation provides for high financial penalties for companies that fail to comply with the new requirements.

Type of infringementMaximum penaltyUse of prohibited AI systemsEUR 35 million or 7% of global turnoverViolation of regulations concerning high-risk AI EUR 15 million or 3% of global turnoverLack of transparency and documentation errorsEUR 7.5 million or 1.5% of global turnoverFor SMEs and startups, lower penalties are предусмотр, adjusted to the scale of their operations. These provisions are intended to prevent new regulations from hindering the growth of small businesses.

How Does the European Union Support Small Businesses?

The EU recognizes that implementing the new regulations may be challenging, especially for startups. Therefore, a range of support programs has been provided:

Regulatory sandboxes – companies can test AI in controlled conditions before deploying it on the market.
Subsidies and grants – EU funds may cover part of the costs of adapting AI to new regulations.
Free consultations – national AI support points offer advice on regulatory compliance.
Phased implementation – companies have 24 months to comply with the regulations, giving them time to prepare.

What should companies do to prepare?

The best way to avoid problems is to gradually adapt to the new regulations. Here are the key steps:

Check whether your AI is subject to regulations – if the system affects people, it may be classified as high-risk AI.
Contact an AI support centre – national institutions will help assess the system’s compliance with the new regulations.
Prepare documentation – even if the AI poses a low risk, it is worth maintaining basic information about how the system operates. More information on the general principles of using AI, which will help you understand how the system works, can be found here.
Track support programs – the EU offers funding for companies adapting their AI to regulations.
Make use of the transition period – you have two years to prepare, so it is worth starting now.

Regulatory sandboxes – what are they and how do they work in Poland?

What are regulatory sandboxes?

Regulatory sandboxes are specially created testing environments in which companies can experiment with new technologies without the immediate risk of violating regulations. They are supervised by regulatory institutions that help businesses adapt their solutions to applicable legal standards. Thanks to them, innovative systems can be tested in real-world conditions before they are brought to market.

Benefits for companies include:

the possibility of testing products and services without the full regulatory burden,
cooperation with supervisory authorities that help ensure compliance with regulations,
reducing legal risk by identifying potential problems early,
access to EU and national innovation support programmes.

Regulatory sandboxes are particularly effective in sectors requiring precise regulation, such as finance, energy, or artificial intelligence.

Which regulatory sandboxes operate in Poland?

In Poland, regulatory sandboxes operate primarily in two key sectors: finance and energy.

KNF Regulatory Sandbox (Polish Financial Supervision Authority) – has been operating since 2018 and allows fintech companies and startups to test innovative financial services in a controlled environment. Businesses can verify their solutions before launching on a large scale, minimizing the risk of non-compliance with regulations.
Regulatory sandboxes in the energy sector – The Ministry of Climate and Environment is introducing solutions enabling the testing of new energy technologies, including renewable energy sources. The planned amendment to the Energy Law and the Act on Renewable Energy Sources (UC74) provides for the implementation of regulatory sandboxes to support innovation in this sector.

Both initiatives enable companies to develop innovative solutions under the supervision of regulators, increasing the safety of bringing them to market.

Regulatory Sandboxes and Artificial Intelligence – What Is the Situation in Poland?

Currently, Poland does not yet have a dedicated regulatory sandbox exclusively for AI, but work is underway to implement one.

The Ministry of Digital Affairs is conducting analyses as part of the Working Group on Artificial Intelligence (GRAI), whose goal is to create a testing environment for AI in various sectors of the economy.
In 2021, the report “Recommendations for Implementing Regulatory Sandboxes for Artificial Intelligence in Transport and Mobility” was published, suggesting that AI in transport could be tested under controlled conditions before being introduced to the market.
AI Act, i.e. the EU Artificial Intelligence Act, provides for the establishment of regulatory sandboxes in all EU countries, including Poland. This means that in the future, companies developing AI will be able to test their systems in compliance with European regulations before they are made available for widespread use.

Although at present there is no specific Polish AI sandbox, entrepreneurs can use existing solutions in the financial and energy sectors, as well as monitor the development of EU regulations, which will likely require the creation of such programmes in Poland as well.

Summary

New regulations concerning AI are not an obstacle, but an opportunity to regulate the market and establish transparent rules for all participants. Small businesses do not need to fear excessive restrictions, provided that their AI does not make key decisions concerning people.

The most important thing is to understand the regulations, take advantage of the available incentives, and prepare for the upcoming changes. This will enable AI to develop in a responsible and safe manner.

New AI Regulation – How Should Small Businesses Prepare? Regulation 2024/1689

Table of Contents