AI incident response
When an AI system fails or confidential data ends up in an AI tool, time matters. We identify reporting obligations, limit legal consequences and prepare the company for claims.
Reporting obligations
- Personal data breach – notification to the Polish DPA within 72 hours (Article 33 GDPR).
- Serious incident involving a high-risk system – reported by the provider to the market surveillance authority (Article 73 AI Act).
- Deployer's duty to inform the provider and authority (Article 26(5) AI Act).
- Significant incidents at essential and important entities under the Polish KSC Act.
Frequently asked questions
When does AI Act serious incident reporting apply?
Article 73 AI Act concerns high-risk systems and applies together with those rules – after the Digital Omnibus, from 2 December 2027 or 2 August 2028.
Guides
Practical explanations of the rules related to this service.
Let us discuss your matter
The first conversation is used to define the scope of the matter and the fee.