Polish universities have entered a new compliance era: since 2 August 2026, key AI Act rules apply to them as users of artificial intelligence systems. Instead of only watching technology giants, higher education institutions must now audit their tools, organise training and review how AI is used in admissions and assessments.
The regulation is directly applicable across the European Union, so no separate Polish implementation act is needed. As Łukasz Faber, director of the AGH Information Security Centre, explained, the legislation reaches far beyond technical universities and beyond laboratories working on advanced AI research.
– In practice, every university that uses AI tools in any way is subject to the AI Act. The regulation imposes, among other things, the obligation to ensure an appropriate level of knowledge and competence among people using such systems – said Faber.
Many institutions are still underestimating how much of their daily work is affected. Chatbots in dean’s offices, text generators used by lecturers, data analysis tools and algorithms supporting student recruitment all fall within the scope of the new rules. For a large part of the academic sector, this means staff training, a detailed inventory of AI applications and, in some cases, changes to procedures for admitting students or grading their work.
What the 2 August deadline changes
The first set of obligations under Article 4 of the AI Act concerns AI literacy. Providers and users of AI systems must be able to show that their employees understand the capabilities and limitations of the tools they work with. The regulation does not require certificates or one mandatory training, but universities must be ready to demonstrate that responsible use of AI is embedded in their organisational practice.
Since 2 August 2026, transparency requirements and most of the remaining provisions of the regulation are already in force. More demanding duties for high-risk AI systems used in education have a later start: they will apply from 2 December 2027. Faber warns against waiting for that moment, because the preparation itself is a complex process.
– As experience shows, changes of this type at universities are not easy and require involvement of many people from various departments. I would recommend starting earlier than at the last minute – said Faber.
– A large part of universities will rather be users of AI systems, so a narrow scope of requirements applies to them. These requirements, mainly training and supervision over high-risk systems, still mean that universities must prepare and change processes, e.g. those related to public procurement – said Faber.
High-risk systems and the provider trap
Using ChatGPT in a lecture does not automatically make a university’s AI system high-risk. The AI Act, however, lists education as a sensitive area. Under Annex III point 3, high-risk solutions include tools used for recruiting candidates for studies, assigning students to programmes, assessing learning outcomes and determining the appropriate level of education.
If a university deploys such a system, Article 26 of the AI Act requires oversight by competent persons, continuous monitoring, event logs and similar safeguards. A separate provision built into Article 25(1) is easy to miss: when a university puts its own name or trademark on a high-risk AI system, it automatically becomes the provider of that system. That status brings registration in the EU database, conformity assessment and a full risk-management system.
Faber says the financial burden does not have to be dramatic, especially for institutions that have already gone through cybersecurity compliance. Identifying high-risk AI systems is connected with ICT supply-chain management from KSC2. At AGH, cybersecurity training already includes information about working with AI systems and related threats.
– I would risk saying that these costs will not be very large if the university has previously approached well the implementation of requirements from NIS2/KSC2. Identification of high-risk AI systems is actually an element of ICT supply chain management that appears in KSC2 – said Faber.
– At AGH, we already place information about working with AI systems and related threats in cybersecurity training – said Faber.
A conference called „Nauka. Rozwój. Biznes” is planned in Warsaw on 25-26 November to discuss cooperation between universities and business, which may help institutions navigate the new reality.
Źródło: WNP.PL, Fot. Gorodenkoff / Shutterstock
