AI in Poland’s public sector and local government: uses, AI Act, GDPR and funding

The best first uses have three features. They recur every day, they concern internal work and they do not decide on residents’ rights. That way, an official catches any AI error before anything leaves the office.

The table below lists typical uses, with the split of work between AI and the official. The last column shows how such a use usually looks from the AI Act’s point of view. However, the final assessment always has to be made for the specific system.

The AI Act does not treat every system in a public office as high-risk. Annex III lists specific areas. For public administration, point 5 matters most: systems used by an authority to assess eligibility for essential public assistance benefits and services, and to grant, reduce or revoke those benefits.

High-risk systems also include, among others, those used in recruitment (point 4) and in migration and asylum matters (point 7). By contrast, a system that performs only a narrow supporting task, such as routing letters, is usually not high-risk (Article 6(3)). The condition is that it must not replace human assessment or materially influence it.

If an office uses a high-risk system, it has the deployer obligations under Article 26. It must use the system in line with its instructions, ensure human oversight and keep the system’s automatically generated logs. As a body governed by public law, it must also assess the impact on fundamental rights before putting the system into use (Article 27).

The deadlines are spread out over time. Some obligations already apply, while others will only apply from December 2027. The key dates are below.

The Polish Code of Administrative Procedure (KPA) does not mention AI, but it sets clear deadlines. Under Article 35, a case is to be dealt with without undue delay. A case that requires investigation must be dealt with within one month at the latest, and a particularly complex one within two months.

AI can help meet these deadlines. It sends reminders when a deadline is approaching, compiles the case documents and prepares a draft decision. However, it should not issue decisions on its own.

GDPR also limits this. Article 22 gives everyone the right not to be subject to a decision based solely on automated processing if it produces legal effects. In public administration, an exception usually requires an explicit legal basis, and for typical local government decisions there is none. That is why the official must genuinely assess the case, not just approve the AI’s proposal.

Today, the biggest risk does not lie in advanced systems but in everyday habits. An official who pastes the content of an application into a free chatbot on a private account is passing a resident’s data to a company the office has no contract with.

That is why the first step should be rules for using AI and a tool the office controls. Many offices already have Microsoft 365. In that case, it is worth checking which AI tools the current agreement covers and what data protection terms it includes.

For every new use, go through the points below with your data protection officer. Every public office is required to have one, so there is no need to look for an external adviser to get started.

A municipality, together with its budgetary units, is a VAT taxpayer, so it is covered by KSeF, Poland’s National e-Invoicing System. Since 1 February 2026, all taxpayers have received invoices from businesses through KSeF. Taxpayers with sales above PLN 200 million in 2024 had to issue invoices in KSeF from that date, and everyone else from 1 April 2026.

Most invoices from domestic suppliers therefore arrive as structured data rather than PDFs. Here, AI is useful for writing the invoice’s substantive description, matching it to a contract and checking whether the amount agrees with the order.

JPK_CIT, the accounting books sent electronically to the tax office, usually does not apply to the municipality itself. The Corporate Income Tax Act exempts local government units from tax on income defined in the Act on Local Government Revenue, and budgetary units entirely. The JPK_CIT obligation may, however, apply to municipal companies, which are ordinary corporate income tax payers.

AI tools translate simple texts well and can make it easier to talk to a foreign national at the counter. They also help to understand a letter in a foreign language before it goes to a translator.

There is a limit, however. The Polish Language Act (Article 5) requires bodies performing public tasks to carry out official acts in Polish, unless a specific provision states otherwise. AI translation can therefore help with communication, but it does not replace the Polish version of a letter or a sworn translation where one is required.

For information materials for residents, such as leaflets or websites, AI works well for a first draft. Before publication, however, the text should be reviewed by someone who knows the language.

The National Recovery Plan (KPO) is in its final stage, and it is not worth planning a new project around it today. Calls for proposals for local governments in digitalisation are announced by, among others, the Ministry of Digital Affairs and the Digital Poland Projects Centre (CPPC), which runs the European Funds for Digital Development programme (FERC). One example is the Digital Development Clubs (Kluby Rozwoju Cyfrowego), funded from the European Funds for Social Development programme (FERS).

Some calls are also run by regional (voivodeship) authorities under regional programmes. The easiest way to check the current list is the grant search tool on funduszeeuropejskie.gov.pl, filtering by applicant type.

Also remember public procurement law. Buying implementation services and licences worth PLN 130,000 net or more (the threshold in Article 2 of the Public Procurement Law, Pzp) requires a procurement procedure. Below the threshold, the office’s internal rules apply.

The plan below assumes that the office is starting from scratch and wants to limit risk. Order matters more than pace: first rules and knowledge, then one pilot, and only then expansion.

Take a hypothetical municipality with 60 people working in its office. For the pilot, it chooses routing incoming correspondence, because this concerns every unit and decides nobody’s rights.

AI projects in public offices rarely fail for technical reasons. More often, the obstacles are people’s concerns and a lack of clear responsibility. The risks below can be reduced before you even start.