Cybersecurity Policy Report, Poland Issues Nonbinding Guidance on AI Compliance With GDPR, (Aug 7, 2026)
By Tony Foley
A list of initial questions related to personal data processing that organizations should ask before deciding to create or use AI (artificial intelligence) systems has been released by the Polish data protection authority, Urzad Ochrony Danych Osobowych (UODO).
In a news release yesterday, UODO cited a survey it conducted in January showing that 41% to 58.5% of entities didn’t perceive a connection between AI tools and the processing of personal data. In addition, as many as 95.9% of respondents said they considered themselves unprepared to implement AI in accordance with the European Union’s General Data Protection Regulation (GDPR). UODO noted that data protection compliance questions usually were asked after an AI tool was operational and decisions regarding the data used had already been made. Accordingly, the initial questions are designed to encourage organizations to ask them prior to an AI system launch.
The questions, which may be downloaded from the news release but are available only in Polish, are separated into sets tailored to specific groups as follows:
A set dedicated to small and medium enterprises (SMEs) using ready-made AI systems that do not undergo a training phase and do not have extensive legal knowledge;
A set intended for public sector entities that take into account the principle of legality and the rules of administrative procedure; and
A set called “Version 0” addressed to organizations that do not fall into the categories listed above, including those building and training their own AI models.
The lists also include an “Extended Version” that applies to all three groups, taking into account the requirements of the GDPR as well as obligations under the EU AI Act, including risk classification and the impact on fundamental rights. The extended version should be consulted when the lists above are completed and demonstrate conditions where additional review is required.
UODO emphasized that the lists didn’t replace risk analysis, data protection impact assessment, or fundamental impact rights impact assessment but rather provided a starting point for these analyses. When using the lists, the answers to the questions presented do not need to be submitted to the UODO. The agency has invited the submission of comments and experiences from using the lists to pyta_inicjalne@uodo.gov.pl, where they will be used to update the materials.
News: InternationalLegislation DataPrivacy DataSecurity GDPR AINews