Legal Updates
Polish Labour Inspectorate Reform: New Risks Associated with B2B Contracts
From 8 July 2026, the Polish National Labour Inspectorate will have broader powers to assess whether a working arrangement based on a B2B or civil-law contract in fact displays the characteristics of an employment relationship.
For this purpose, it is not only the wording of the contract that matters, but also how the work is actually performed, including the degree of subordination, the place and hours of service provision, the manner in which instructions are issued, the use of company equipment and the assumption of business risk.
Businesses operating under a B2B model should therefore review both their contracts and their day-to-day working practices.
AI Act: Further Obligations from 2 August 2026
A further set of obligations under the AI Act will become applicable from 2 August 2026, including transparency obligations relating to certain systems and content generated or manipulated by artificial intelligence.
Businesses using AI should determine which systems are deployed within their organisation, the purposes for which they are used and the regulatory role attributed to the business under the applicable legislation.
The scope of the applicable obligations will depend, among other factors, on the type of system, the manner in which it is used and the associated level of risk.
New Cybersecurity Obligations: Amendment to the KSC Act and NIS2
The amendment to the Polish National Cybersecurity System Act, implementing measures arising from the NIS2 Directive, has been in force since 3 April 2026.
The new legislation expands the range of entities subject to obligations concerning risk management, system security and incident reporting.
Businesses should determine whether they meet the criteria for classification as essential or important entities.
Entities that met those criteria on the date the legislation entered into force should verify, among other matters, whether they are required to register in the KSC register and the deadlines for implementing the prescribed organisational and technical measures.
New Rules for Handling Complaints Concerning Electronic Communications Services
A regulation specifying the detailed procedure for handling complaints concerning electronic communications services and the information to be included in responses provided to users has been in force since 14 March 2026.
Service providers should review their terms and conditions, forms, acknowledgements of receipt, response templates and the procedures applied by their customer service departments.
The changes may also require adjustments to the IT systems used to record and process complaints.
Information and Neutrality in the Recruitment Process
Since 24 December 2025, job applicants must be provided with information concerning the initial salary or salary range sufficiently early to allow for informed and transparent negotiations.
This information may be provided in the job advertisement, before the interview or—if it has not been provided earlier—before the employment relationship is established.
Job advertisements and job titles must be gender-neutral, and employers may not request information about an applicant’s pay in their current or previous employment.
These changes require a review of job advertisements, application forms and recruitment procedures.
e-Delivery: Another Deadline for Businesses
Businesses registered in the Polish Central Register and Information on Economic Activity (CEIDG) before 1 January 2025 must have an e-Delivery address from 1 October 2026. This obligation may arise earlier if an amendment is made to the relevant CEIDG registration.
The creation of an electronic mailbox should be accompanied by the establishment of appropriate handling procedures, the appointment of responsible persons and arrangements ensuring that incoming correspondence is monitored regularly. Failure to organise this process properly may result in legally significant documents or deadlines being overlooked.
European Health Data Space: Preparing for the New Framework
The Regulation on the European Health Data Space entered into force on 26 March 2025, although its provisions will become applicable in stages.
The European Commission is expected to adopt important implementing acts by March 2027, with the first set of key obligations becoming applicable in 2029.
The changes will be relevant to healthcare providers, research organisations, pharmaceutical companies and providers of IT solutions for the healthcare sector.
The transitional period may be used to review data flows, the systems in use, access arrangements and agreements relating to the use of health data.