Can a company put a customer on an undesirable persons list after they publish a critical review of its services? This is a question that many entrepreneurs and consumers have been asking themselves in recent weeks, triggered by the high-profile case of one Polish hotel. The answer requires looking at several independent legal regimes simultaneously – and taking into account that neither party to such a dispute is automatically in the right.

What is a customer blacklist in practice, versus in the eyes of the law?

In practice, it is often nothing formalized, such as a note in a booking system or just a verbal instruction passed to the reception shift, which is enough to ensure a customer is no longer welcome. The reasons can be clear-cut, such as theft or aggression towards staff, but just as often they are subjective, such as a dispute over a bill, a conflict with service personnel, and sometimes… simply an inconvenient review online.

The problem affects not only hotel services. It also occurs on the internet, for example in shops looking for ways to deal with customers who, in their view, abuse the right of withdrawal, return damaged goods, and expect a refund.

From a legal perspective, however, this is not just an ordinary office memo; it is a set of personal data. This means that its existence, purpose, and storage period are subject to exactly the same rigours as any other data processing within a company. What looks like a simple precautionary measure to a manager is, under data protection regulations, an operation requiring a separate legal basis and a clear time limit.

Three legal regimes to bear in mind simultaneously

The GDPR does not recognize the concept of storing data “just in case”. In accordance with the principles of purpose limitation and storage limitation (Article 5(1)(b) and (e) of the GDPR), data can only be processed for as long as a specific, current purpose exists, and the basis for the entry is usually the legitimate interest of the controller (Article 6(1)(f) of the GDPR). This interest must, however, realistically outweigh the rights of the data subject – the mere fact of a conflict with a customer is not enough. Consumer law operates separately. Freedom of contract (Article 353¹ of the Civil Code) does not mean arbitrary freedom in refusing service, so a refusal without a specific justification previously outlined in the terms and conditions carries the risk of allegations of consumer rights violations, and in extreme cases, even discrimination.

Another layer is personal rights, meaning the relationship between the consumer’s right to criticism and the entrepreneur’s right to protection of good name, protected under Articles 23 and 24 of the Civil Code in conjunction with Article 43 of the Civil Code, applied mutatis mutandis to legal persons. A company may defend its reputation, but substantive criticism falling within the limits of permissible service evaluation does not constitute an unlawful violation of personal rights, even if it is inconvenient for the company.

On top of all this comes a thread that is only just emerging: automation. An increasing number of companies support the management of problematic customer registries with scoring systems that flag accounts as risky based on the number of complaints or behavioral patterns. If such a decision is made fully automatically and produces a tangible legal effect for the customer, Article 22 of the GDPR comes into play, limiting the permissibility of such decisions and requiring human intervention. The AI Act itself does not classify the maintenance of a customer list as a high-risk system, but if tools that systematically assess the behavior of natural persons are used to create it, it is worth checking already at the implementation stage whether it approaches a category subject to additional transparency obligations.

Where lies the risk, and where the real benefit?

The registry of undesirable persons itself is not prohibited and is often fully justified, because the protection of staff, property, and other customers is a legitimate interest of the entrepreneur. Trouble begins only when it is run without clear rules. Most often, companies fail to define the purpose and retention period of data, treat criticism or a complaint as an automatic basis for an entry without determining whether a breach of rules actually occurred, extend the ban to third parties who were not party to the dispute, or stop at vague regulatory provisions instead of a closed catalogue of refusal grounds. A well-designed registry has a clear purpose, a specific catalogue of events, and a defined data retention period; only then does it become an effective tool for protecting the business rather than a source of additional risk.

When theory meets practice: The Hotel Gołębiewski case

A good, recent example is the high-profile case of Hotel Gołębiewski and Szymon Nyczke, a YouTuber known as Książulo. It all started with an ordinary consumer dispute. Faulty air conditioning in a newly opened suite costing nearly PLN 5,000 per night, bedroom temperatures reaching over 32 degrees Celsius, and yellow water with sediment. Gołębiewski Holding admitted that such a situation should not have happened and honored the complaint by refunding the stay, while the Office of Competition and Consumer Protection (UOKiK) directly referred to the case on Instagram, pointing to Książulo’s stance as an example of enforcing consumer rights.

A few days later, the matter took a completely different turn. A letter was sent to the network’s facility directors indicating that Książulo and accompanying persons had been entered onto the list of undesirable guests, covering accommodation, restaurants, and water parks. Upon attempting to make a reservation, reception refused, citing a violation of the facility’s rules without specifying what that violation was supposed to be. The ban was lifted the same day following intervention by the management and the network’s owner, Jarosław Gołębiewski, and the chain has yet to publicly present a detailed stance on the list itself.

It is hard to find a better illustration of the mistakes described above. The lack of a clear purpose and retention period for the entry, treating a critical material as an event justifying a ban without establishing whether the regulations were actually breached, and extending the ban to accompanying persons who were not party to any dispute. However, the case is not exclusively unfavorable to the hotel. Jarosław Gołębiewski assessed Książulo’s material as harmful, and the creator himself emphasized that he did not wish to wage a campaign against the hotel – which clearly shows that justified consumer criticism and the protection of an entrepreneur’s good name are two independent threads requiring separate legal assessment. They cannot be resolved with a single hasty entry on a list.

Practical conclusions

Maintaining a registry of undesirable persons is not inherently impermissible, but it requires meeting several conditions simultaneously. There must be a specific event forming the basis of the entry, a clearly defined purpose and retention period for the data, restriction of the entry solely to the person actually involved in the event, and a precise catalogue of service refusal grounds in the terms and conditions rather than vague reservations. The Hotel Gołębiewski case clearly demonstrates how quickly a lack of such rules can turn a simple consumer dispute into a legal issue encompassing the GDPR, consumer rights, and personal rights all at once. It is worth checking this in advance, rather than only when the topic hits the media – especially where automated customer profiling by scoring systems is involved, which additionally requires evaluation under Article 22 of the GDPR and the AI Act.

If you run a service company and wonder whether your terms and conditions and internal procedures comply with the GDPR and consumer law, contact us. We will help you verify it.

The post The customer blacklist. When can a company use it, and when does it bring trouble upon itself? first appeared on Kancelaria LBKP.

For most businesses, the mailbox has long ceased to be merely a communication tool. It has become an archive of business knowledge. This is precisely where client arrangements, project histories, management board decisions, and case documentation are kept. From a business perspective, it is hardly surprising that organisations are reluctant to delete such information.

The larger the archive, the greater the risk

The problem is that almost every such message also contains personal data. The larger the archive, the wider the scope of data that could be exposed in the event of mailbox takeover, employee error, or a cyberattack. Therefore, data retention is not merely an obligation arising from the GDPR; it is also one of the fundamental mechanisms for limiting the impact of a potential security incident.

This is, of course, nothing new. The principle of limiting the storage period for personal data has been in force for years. What is new, however, is that the President of the Personal Data Protection Office (UODO), in his latest bulletin, practically demonstrates how to secure mailboxes in situations where an organisation, for various reasons, stores messages longer than would be optimal.

Specific technical and organisational solutions

The authority does not limit itself to reminding organisations of their obligations under the GDPR. It points to specific technical and organisational solutions which – in its view – reduce the risk of breaches. These include multi-factor authentication (MFA), attachment encryption, and the so-called “3-second rule”, which involves a brief verification of the recipient and attachments before sending a message.

Why does this matter? Because UODO explicitly shows which security measures it currently considers appropriate. This means it is precisely through the prism of such safeguards that the authority may subsequently assess an organisation during an audit or following a personal data breach.

Undoubtedly, this is a valuable tip for entrepreneurs. GDPR regulations do not provide an exhaustive list of specific safeguards, limiting themselves to the obligation to implement “appropriate technical and organisational organisational measures”. In practice, assessing what is “appropriate” remains one of the greatest difficulties for data controllers. The latest bulletin partially fills this gap. It does not create new obligations, but it shows which solutions – from the supervisory authority’s perspective – correspond to the proper level of electronic mail security today.

Significance from the accountability perspective

This is also significant from the perspective of accountability. In the event of a personal data breach, the mere occurrence of an incident does not yet predetermine the controller’s liability. What is also crucial is whether the organisation was able to demonstrate that it had previously implemented measures adequate to the identified risk. If the President of UODO points out specific solutions today, such as MFA, attachment encryption, or the “3-second rule”, it is difficult to assume that they will remain without consequence during an audit or explanatory proceeding.

Practical checklist of actions to verify

From the perspective of entrepreneurs, this material should therefore be treated not as yet another reminder of obligations arising from the GDPR, but as a practical checklist of actions that are worth verifying within one’s own organisation right away. All the more so because all UODO recommendations relate to risks that have for years been among the most common causes of personal data breaches – mailbox takeovers, misaddressed messages, or unauthorised disclosure of data. In practice, these are solutions that not only reduce the likelihood of an incident, but can also constitute a significant argument confirming the exercise of due diligence if a breach occurs despite the implemented safeguards.

You can read more on this topic in the article published in Gazeta Prawna. If you wish to discuss how to build a compliance trail that can withstand a UODO audit or check whether your organisation’s data retention policy covers electronic mail, please feel free to contact us.

The post UODO takes a closer look at mailboxes. UODO takes a closer look at mailboxes. Not because you store too many emails. Because every additional message increases the risk. first appeared on Kancelaria LBKP.

In this issue, we have also gathered the most interesting materials from the past month – from expert analyses and event reports to selected publications as part of the TechnoLegals programme. We hope this bulletin will be a convenient way for you to quickly catch up on July’s most important topics.

Our bulletin summarises July, but since you are reading it in August on LinkedIn, we couldn’t skip the AI Act. Therefore, at the end, we are leaving a brief reminder of the most important rules regarding the publication of content using artificial intelligence.

The AI Act and LinkedIn – who needs to label AI-generated content?

Here is the translation of the newsletter into British English, with formatting added to enhance readability:

July at LBKP was dominated by employment law. There was no shortage of significant legislative changes, expert commentary, and practical analyses. The spotlight was also on AML-related topics, as well as NIS2 and the AI Act, which consistently remain among the most crucial areas for business.

In this issue, we have also gathered the most interesting materials from the past month – from expert analyses and event reports to selected publications as part of the TechnoLegals programme. We hope this bulletin will be a convenient way for you to quickly catch up on July’s most important topics.

Our bulletin summarises July, but since you are reading it in August on LinkedIn, we couldn’t skip the AI Act. Therefore, at the end, we are leaving a brief reminder of the most important rules regarding the publication of content using artificial intelligence.

The AI Act and LinkedIn – who needs to label AI-generated content?

Since 2 August, new AI Act regulations regarding transparency in the use of artificial intelligence have been in force. A lot of questions and misunderstandings have arisen around the new regulations, which is why we have prepared a practical guide showing what actually changes for companies, experts, and participants in employee advocacy programmes.

1. It is the publisher who is responsible for labelling the content The obligation of transparency rests with the person or organisation publishing the material – not with LinkedIn or the AI tool you are using.
2. Not every text written with the help of AI needs to be labelled If the text has been verified, edited, and consciously published by a specific person, in most cases, it will not require a label. It may be different in the case of content concerning matters of public interest.
3. Particular attention should be paid to graphics and video Realistic images, video recordings, or audio materials generated by AI may be subject to the labelling obligation. In the case of clearly fictional illustrations, the regulations provide for exceptions.
4. Employee advocacy is also a professional activity Publishing content as part of an ambassador programme – even on a private LinkedIn profile – can be considered a professional activity. It is the nature of the publication that matters, not the type of account.
5. It is worth establishing clear rules for using AI The new regulations do not prohibit the use of artificial intelligence in communication. However, they “encourage” greater transparency, so companies operating on LinkedIn should develop consistent rules for using AI when creating content.

This is a topic that will be relevant not only for marketing departments but also for HR, communications, and anyone building an expert brand on social media.

Summer Academy of GDPR Leaders: Practical Aspects of Audits and Implementations

Grzegorz Lesniewski has joined the panel of experts of the Summer Academy of GDPR Leaders organised by the Personal Data Protection Office. During a lecture dedicated to the practical aspects of GDPR audits, he will share his experience gained while carrying out compliance implementations and projects in organisations.

EmpCo: Will products prepared before 27 September 2026 need to be withdrawn from the market?

The Consumer Protection Cooperation (CPC) network has published a practical position regarding the so-called old stock situations, i.e., products, packaging, and marketing communication prepared before the EmpCo directive becomes applicable. The document indicates how authorities may approach the transitional period and the enforcement of new obligations.

Key takeaways for businesses:

• The mere fact of having stock does not exempt you from the obligation to adapt communication to the new requirements. The priority should be updating online content and gradually introducing changes to packaging and marketing materials.
• The authorities announce a pragmatic approach to the transitional period, taking into account, among other things, the scale of stocks and the realistic capabilities of businesses. However, it will be crucial to demonstrate that the organisation is actively preparing to ensure compliance with the regulations.

A well-negotiated settlement does not always mean the best financial outcome.

Dispute resolution strategy

The Supreme Court has confirmed that an out-of-court settlement does not always constitute a basis for the refund of the entire statement of claim fee. In practice, this means that when planning to end a dispute, not only the content of the agreement matters, but also the manner and timing of its conclusion.

What is worth paying attention to?

• The choice between an out-of-court settlement, a court settlement, or mediation can have a significant impact on the settlement of the proceedings’ costs.
• The dispute resolution strategy should take into account not only the business interests of the parties but also the procedural and financial consequences of the chosen solution.

Terminating Cooperation with an Employee

The date of posting the notice is not the date of its submission.

Delivering a termination notice by post or courier might seem like a simple solution, but in practice, the moment the statement is submitted depends on its effective delivery to the employee. It is this very stage that often becomes a source of costly mistakes and disputes.

What should you remember?

• A statement on the termination of an agreement produces legal effects only when the employee has had a real opportunity to familiarise themselves with its content – the mere posting of the parcel is not sufficient.
• Problems with delivery, leaving a missed delivery card (aviso), or a lost parcel can affect the effectiveness of the agreement’s termination, so it is worth considering more secure forms of delivery, including electronic solutions.

New Employer Obligations: Changes in Mobbing Regulations (November 2026)

The amendment will come into force 3 months after its publication (i.e. on 5.11.2026). From that moment, we have its new definition, and employers will bear the brunt of the changed obligations.

Including the most important one – the obligation to SYSTEMATICALLY counteract violations of the principle of equal treatment in employment. A longer deadline is envisaged for adjusting or introducing internal company regulations on counteracting undesirable behaviour – 6 months from the date the act comes into force (i.e. by 5.05.2027).

Why is it worth preparing now?

• The amendment changes not only the definitions but also increases the importance of preventive measures. Employers should review current procedures, training, and how they respond to reports.
• The changes should be analysed in conjunction with the new powers of the National Labour Inspectorate (PIP), as their practical application may significantly affect how risk is managed in the HR area.

A “disciplinary termination” submitted by an employee? The employer cannot reject it.

The termination of an employment contract by an employee under Article 55 of the Labour Code takes effect upon the effective submission of the statement. This means that the employer cannot refuse to terminate the employment relationship, even if they consider the employee’s decision to be unjustified.

What can the employer do?

• Despite the obligation to issue an employment certificate, the employer may question the legitimacy of the contract’s termination, refuse to pay compensation, or – in specific cases – claim compensation from the employee for the unjustified termination of the employment relationship.
• However, the employer’s claims are limited. The regulations provide for the possibility of seeking compensation, but do not provide grounds to demand the employee’s reinstatement to work.

“The employee is on sick leave (L4), so there is nothing we can do.”

This is one of the most frequently repeated myths in employment law. Natalia Wojciechowska-Chałupińska, in a commentary for Gazeta Prawna, explains when the protection of an employee on sick leave is not absolute and what exceptions the regulations provide for.

What does this mean for employers?

• Sick leave does not preclude the termination of an agreement in every situation – the regulations provide for exceptions, e.g. in the event of long-term incapacity for work or a severe breach of employee duties.
• Every decision requires an individual assessment of the factual state and the correct application of the regulations, as mistakes at this stage often lead to court disputes.

Reclassification of B2B Contracts: What to pay attention to during an audit?

During an inspection, it is not only the content of the contract that matters, but above all, the way it is performed.

An audit of B2B contracts should not be limited to analysing contractual provisions. Controlling bodies also verify the practice of cooperation – procedures, rules applicable in the organisation, and the actual way duties are performed. It is on this basis that they assess whether the relationship is indeed of a B2B nature.

What is worth paying attention to?

• An effective audit covers not only contracts but also processes, internal documentation, and the daily practice of cooperation. These often determine the risk of reclassifying the contract into an employment relationship.

Free webinars concerning audits of B2B contracts and the practical aspects of preparing an organisation for an inspection are also available on the LBKP website.

DORA: new EBA guidelines for the financial sector. The EBA expands its approach to supplier risk management.

Financial institutions that have completed the implementation of DORA should not treat it as a closed project. The European Banking Authority (EBA) has just launched consultations on new guidelines concerning the management of risks related to external suppliers. This is another step showing the direction in which supervision will develop.

The most important conclusion? Supplier risk management is ceasing to be the exclusive domain of IT and cybersecurity departments.

The new guidelines indicate that financial institutions should pay even more attention to:

• the entire lifecycle of cooperation with a supplier – from selection and risk assessment, through ongoing monitoring, to the termination of cooperation,
• managing concentration risk, i.e., identifying situations where too many critical services rely on a single supplier or the same group of suppliers,
• governance and business responsibility – supplier risk management is to be a process involving not only IT, but also compliance, risk management, procurement, and the management board.

Although the guidelines are still at the consultation stage, they already show the direction of European regulators’ expectations. For banks and other financial institutions, this means it is worth taking another look at the supplier management model, the division of responsibilities, and the processes for monitoring services provided by external entities.

DORA is increasingly clearly demonstrating that digital operational resilience does not end with the security of IT systems. It encompasses the entire ecosystem of suppliers upon whom the continuity of the organisation’s operations depends.

AML is no longer the domain of banks. It is increasingly becoming the responsibility of management boards.

AML (Anti-Money Laundering) – New EU regulations and the expansion of the list of obliged institutions mean that AML is covering further sectors of the economy. At the same time, expectations towards organisations regarding effective risk management and supervision of the compliance system are growing.

Why is this important? AML is becoming an element of corporate governance. The obligations of management boards and their responsibility for ensuring an effective anti-money laundering system are of growing importance.

Merely having procedures is not enough. Organisations should regularly update their risk assessments, adapt their AML system to their operations, and demonstrate that the solutions applied work in practice.

NIS2: the first deadlines are already running. Does your organisation know that it is covered by the new obligations?

The new regulations cover a much broader catalogue of organisations than previous cybersecurity regulations. The sectors covered by the act include, among others, energy, transport, banking and financial market infrastructure, healthcare, digital infrastructure, telecommunications, ICT service management, postal services, waste management, chemicals and food production, as well as selected types of manufacturing and digital services.

In practice, this means that the regulations may apply to, among others, banks, hospitals, energy companies, cloud service providers, data centres, managed service providers (MSPs), managed security service providers (MSSPs), telecommunications undertakings, trust service providers, marketplace platforms, internet search engines, postal and courier companies, electronics and medical device manufacturers, or companies from the chemical, food, and waste management sectors.

Podmiot kluczowy czy ważny?

An essential or important entity? The industry itself does not yet determine the organisation’s status.

When determining whether a given organisation is an essential entity, an important entity, or is not subject to the act at all, one must primarily analyse:

• the actual scope of operations and services provided,
• the sector and type of entity indicated in Annex 1 or 2 to the act,
• the size of the enterprise, taking into account partner and linked enterprises,
• specific rules arising from Article 5 of the act.

In simplified terms: entities operating in the sectors indicated in Annex 1 can be essential or important entities depending on, among other things, their size. Entities from Annex 2 meeting the appropriate size criteria are generally important entities. However, the act provides for exceptions and special rules for, among others, electronic communications undertakings, DNS service providers, trust service providers, or managed security service providers.

Therefore, a cloud provider, data centre, or company providing IT services does not automatically become an essential or important entity solely due to the type of its operations.

This is important because the new regulations are not based on an individual notification from the authority. It is the entrepreneur themselves who should analyse their operations and assess whether they meet the criteria for being deemed an essential or important entity. If so, specific obligations and deadlines arise. One of the closest is 3 October 2026, by which many entities will have to register in the KSC (National Cybersecurity System) Register. Another significant deadline is 3 April 2027, when the period for implementing the obligations arising from the act and starting to use the S46 system expires.

In practice, however, preparation for NIS2 does not come down to registration. Organisations should verify, among other things, the way cybersecurity risk is managed, incident reporting procedures, business continuity plans, supply chain security, and the division of responsibilities between the management board, IT, compliance, and business. It is these areas that will be of crucial importance when assessing compliance with the new requirements.

If your organisation has not yet checked whether it falls within the scope of NIS2, it is worth doing so as soon as possible. In many cases, the greatest risk will not be the lack of a single procedure, but starting the entire adaptation process too late.

Coldplay in Fortnite. When music becomes a gameplay element

On the occasion of the premiere of the Moon Music album, the band Coldplay appeared in the playable iHeartLand experience in Fortnite. This is an interesting example showing that the use of music in games increasingly goes beyond the classic soundtrack and becomes an integral element of gameplay mechanics. From a legal perspective, this means much more complex issues related to the licensing of copyright.

Why is this important?

• When using music in games, it is necessary to properly secure the rights to the compositions, recordings, and artistic performances, as well as define the rules for using the works in trailers, live broadcasts, or materials published on social media.
• The more tightly music is integrated with the game mechanics – e.g. triggered by the player’s actions, looped, or constituting a gameplay element – the more important it becomes to precisely define the scope of the licence and ensure compliance with the requirements of distribution platforms.

A publishing agreement is not a formality. It is one of the most important stages of a game’s commercialisation.

For many game development studios, negotiations with a publisher are their first experience of this kind. Meanwhile, publishers conclude similar agreements regularly and know perfectly well which provisions are of the greatest importance for the project’s future. As a result, it is during the negotiation stage that decisions are often made that affect how the game is commercialised and the scope of rights remaining with the studio.

Why is this important?

• Well-prepared negotiations allow for a conscious determination of the rules regarding intellectual property rights, revenue sharing, the parties’ obligations, or the possibilities for further project development. It is these provisions that often have a greater impact on the studio’s future success than the mere signing of the agreement.
• In practice, it is worth remembering that experience in game development does not always go hand in hand with experience in negotiating publishing contracts. Proper preparation for talks allows the studio’s interests to be better protected and avoids the consequences resulting from unknowingly accepted clauses.

Does “buying a game” mean owning it?

The Stop Killing Games initiative has sparked a broad discussion about players’ rights and publishers’ obligations after ending support for games. Although the European Commission’s response does not mean imposing an obligation on publishers to maintain online infrastructure for an unlimited time, the debate has once again drawn attention to the issue of transparency towards consumers using digital products.

A question worth asking yourself: Players should know already at the purchase stage whether they are buying a game or merely a licence to use it, how long the product will be supported, and what will happen to it after the servers are shut down. Clear rules regarding the access model and the publisher’s obligations can reduce the risk of misunderstandings and increase trust in the market.

The discussion around the Stop Killing Games initiative will probably not end with the European Commission’s response. The planned Digital Fairness Act may become the next step towards strengthening information obligations towards consumers and setting new standards for the digital games industry.

LBKP’s Plans for August: HR, Employment Law, and Webinars

August promises to be equally intense. In the coming weeks, we will be sharing further materials for entrepreneurs, HR departments, and the new technologies industry, as well as working on new initiatives that will respond even better to your needs.

It is worth following our profiles if you are interested in:

→ further analyses and commentary on employment law, AI, cybersecurity, AML, and GameDev,

→ new publications dedicated to legislative changes and their practical impact on business,

→ a new bulletin dedicated to HR specialists and employers, in which we will focus on the practical aspects of employment law, team management, and the most important challenges facing HR departments,

→ the return of our webinars as early as September – we are preparing further online meetings dedicated to the most current issues in the areas of law, tax, and business.

Thank you for reading the July issue of LBKP Inside. See you in the next edition!

The post July Round-up at LBKP: Employment Law, the AI Act, NIS2 and GameDev first appeared on Kancelaria LBKP.

1. The bank is no longer the sole gatekeeper
2. A procedure is no longer a “shelf-ware alibi”
3. “Should you have known?”
4. A company’s problem can quickly become a board member’s problem
5. AML is becoming an element of enterprise management
6. The new boundary of liability
7. AML is entering new sectors today. But above all, it is entering boardrooms.

For years, anti-money laundering (AML) was primarily associated with banks, financial institutions, beneficial owner forms, and a million questions about where the client got their money from. It was a world of procedures, transaction alerts, and specialists locked away in compliance departments. That world is now definitively coming to an end.

AML is increasingly ceasing to be the exclusive domain of the financial sector. Meanwhile, its core requirements are making their way into law firms, tech companies, accounting offices, estate agencies, crypto market operators, luxury goods traders, and even professional sports. The EU AML package further expands the catalogue of obliged entities to include, among others, a significant portion of the crypto sector, luxury goods dealers, as well as professional football clubs and agents.

At the same time, the European Anti-Money Laundering Authority (AMLA) has been established to strengthen and harmonise supervision across the entire system. However, this is not just about adding more industries to the legislation. Much more important is the shift in how liability is perceived.

The bank is no longer the sole gatekeeper

The AML system is based on the premise that it is not only the state that is supposed to “hunt down” criminals. Private entities standing between the client and the transaction are also expected to assist.

A bank sees the flow of money. An accountant knows the settlement structure. An estate agent sees who is buying the apartment. An advisor helps structure a transaction. A law firm may be involved in setting up a company, acquiring a business, or managing a client’s assets. In the eyes of the European legislator, each of these entities is a gatekeeper to the legitimate economy.

In Poland, advocates, attorneys-at-law, foreign lawyers, and tax advisors are already obliged entities when they provide assistance concerning, inter alia, the buying and selling of real estate or enterprises, managing assets, opening accounts, making contributions, and creating or managing companies. This does not mean that every piece of legal advice is subject to AML. It does mean, however, that a law firm participating in certain transactions can no longer assume that the issue of the origin of funds is solely the bank’s problem.

The same applies to entrepreneurs. Not every entrepreneur is directly an obliged entity. However, almost anyone can encounter AML as a bank client, a participant in a transaction, an entity disclosing its ultimate beneficial owner, or a contractor whose ownership structure, funding source, or payment routing starts to raise questions.

AML is therefore spilling beyond the formal statutory catalogue. It enters ordinary business operations through the back door, via banks, contractors, audits, financing, and corporate group requirements. The only limitation here is the “processing capacity” of the supervisory authorities.

A procedure is no longer a “shelf-ware alibi”

Even a few years ago, many organisations treated compliance quite simply: we write a voluminous procedure that is essentially unreadable, conduct some generic training, collect signatures, and place the document in a suitably thick binder or a beautifully named folder on a shared drive.

The binder had one fundamental advantage: it looked professional, and the drive was backed up.

The problem is that regulators are increasingly less likely to ask merely whether a procedure existed. They ask whether it was tailored to the actual business model, whether it identified specific risks, whether it was updated, and whether anyone checked if it was working.

In the current approach, risk assessment cannot be reduced to labelling a client as “low”, “normal”, or “high”. The risk category must influence the scope and intensity of the actions actually taken. A change in product, distribution channel, geographical area, client structure, or political situation may require an immediate update of the assessment. The authority also expects the documentation to allow for the verification of the effectiveness of the measures applied, and for the risk assessment to be approved by responsible persons at the management level.

In other words, a procedure sitting on a server proves at most that someone knew how to write or outsource writing. It does not prove that the organisation knows how to manage risk.

“Should you have known?”

This is where the most dangerous shift occurs.

Liability is increasingly not based solely on the question of whether someone actually knew about the suspicious nature of a transaction. The question of whether you should have noticed it under a properly organised system is becoming ever more crucial.

Did the client’s profile match the nature of the transaction? Was the source of funds credible? Did the ownership structure make commercial sense? Was the sudden change in payment routing explained? Did the intermediary have a genuine business justification? Did anyone connect several seemingly neutral pieces of information?

This is no longer a classic document check. It is an obligation to draw conclusions.

The regulator does not expect clairvoyance. However, they do expect the organisation to know its own business well enough to spot anomalies. And when something is missed, a very uncomfortable question will arise: was it a failure of the employee, the procedure, the IT system, or perhaps the management board that approved an operational model without adequate safeguards? This is precisely where the boundary between compliance and personal liability blurs.

A company’s problem can quickly become a board member’s problem

The Polish AML Act does not leave this solely in the realm of best practices.

In an obliged entity where a management board operates, a person responsible for the implementation of AML duties must be designated from among its members. This is not an honorary function or a mere footnote in an organisational resolution. The Act allows for financial penalties to be imposed on persons responsible for fulfilling AML obligations. It also provides for the possibility of a temporary ban on holding managerial positions. In specific cases, breaches of reporting obligations may even lead to criminal liability.

Naturally, a board member is not expected to personally analyse every transaction. However, they are expected to ensure that there is an efficient system, adequate resources, a clear division of responsibilities, and a realistic escalation path.

Therefore, it is not enough to say, “We have an AML officer for that”.

The board may delegate the execution of tasks. It cannot delegate the entire problem and then pretend that AML reports were just an exotic, graphically pleasing addition to the board meeting materials.

Situations where the compliance unit has been signalling staff shortages, inefficient tools, backlogs in client reviews, or data quality issues for months, while the management merely notes the information and calmly moves on to the sales agenda, become particularly risky.

Such a meeting minute may one day turn out to be more interesting than many a procedure.

AML is becoming an element of enterprise management

The biggest mistake today is treating AML as an isolated regulatory island. Money laundering risk is intertwined with sanctions risk, corruption, tax, reputational, cyber risks, and the criminal liability of management.

A new product, expansion into a foreign market, a company acquisition, a venture into digital assets, serving clients from high-risk countries, or a change in the payment model are not purely business decisions. They should also trigger questions about AML implications.

Therefore, a properly functioning system cannot be built once and for all. It must respond to changes in the company’s operations. If the business has changed but the risk assessment remains the same, it usually does not mean the risk has been stable. It means nobody has looked at the document.

The new boundary of liability

AML is no longer just about fighting a suitcase of cash brought into a bank by a man in dark glasses looking like someone from a B-movie gangster film. Today’s risk hides in multi-level ownership structures, cross-border payments, digital assets, seemingly legitimate investments, brokerage agreements, and transactions, each of which looks perfectly innocent on its own.

Consequently, the expectations towards those responsible for the organisation are also changing. It is not enough not to know. You also have to demonstrate that the organisation did everything that could reasonably be expected of it to find out. And this is exactly where the comfortable world of compliance understood as a set of documents ends. What begins is accountability for decisions, omissions, lack of resources, and risks that nobody wanted to see.

AML is entering new sectors today. But above all, it is entering boardrooms.

AML is entering new sectors today. But above all, it is entering boardrooms, and it is there that the decision is made as to whether the company truly understands its risks or merely possesses a document covering them. If you are not sure which side your organisation stands on, we will help you find out before the regulator asks.

The post AML is “sailing” into broader waters. Do you know who is responsible for it today? first appeared on Kancelaria LBKP.

In LBKP Inside, we have brought together the most interesting materials published in June – from expert analyses and events to selected publications from the #TechnoLegals programme. We hope this newsletter serves as a convenient way for you to quickly catch up on the month’s key topics.

LBKP Among the Most Innovative Law Firms

This was an exceptional month for us.

During the gala of the 24th Rzeczpospolita Law Firm Ranking, we were awarded distinction in the “Most Innovative Law Firms of 2025” category.

This distinction is particularly valuable as it was awarded not for a single tool or technology, but for the way we collaborate with clients – based on Embedded Legal, Business First Policy, and Legal Solutions Not Hours.

Additionally, we once again ranked in the TOP 10 largest law firms in Lower Silesia.

On the Regulatory Radar

AI Act with Important Changes: EU Council Approves Simplification of Rules (Omnibus VII)

At the end of June, the Council of the European Union gave its final approval to a package of amendments simplifying the application of the AI Act. This is one of the most important regulatory decisions concerning artificial intelligence since the adoption of the regulation.

The new rules aim to reduce administrative burdens on businesses, clarify obligations related to high-risk AI systems, and better coordinate the AI Act with sector-specific regulations.

In brief:

• Postponed deadlines: Obligations concerning high-risk AI systems have been pushed back – for some systems, they will apply from 2 December 2027, and for systems embedded in products, from 2 August 2028.
• Bans: From December 2026, using AI to create non-consensual sexual deepfakes and child sexual abuse material will be strictly prohibited.
• Guidance: The European Commission will prepare additional guidance to help businesses implement AI Act requirements and reduce administrative burdens.

This is a topic we will be monitoring closely in the coming months, as the changes are of significant importance for organisations developing or utilizing AI systems.

Expert Appearances & Events

Marek Czwojdziński spoke at the Game Industry Conference, where he discussed the legal risks associated with using assets in video games and how studios can effectively protect their projects as early as the production stage.

Two key aspects to keep in mind:

• Not every “free” asset can be used without restrictions – before using one, it is advisable to verify licence terms and rights for further use.
• Proper intellectual property management at the production stage helps mitigate the risk of disputes and costly problems after the game’s release. View the event coverage.

Meanwhile, Paweł Kempa-Dymiński took part in the Re:Mind 2026 conference, joining a panel dedicated to lawyers’ well-being to discuss the impact of organisational culture, AI, and generational shifts on the modern job market.

Key takeaways for organisations:

• Employee well-being is increasingly becoming a core element of organisational strategy – affecting not only team satisfaction, but also work quality, reduced staff turnover, and business growth.
• Newer generations define professional success differently, making the creation of a healthy work environment one of the key challenges for modern employers.

Cardboard Doesn’t Always Mean Eco

“Eco” Is Not Enough: How to Protect Your Company from Greenwashing Allegations?

Anna Żmidzińska and Andrzej Miziołek showed how to prepare an organisation for changes resulting from the EmpCo Directive, PPWR, and EPR (ROP), and how to reduce the risk of greenwashing when designing packaging.

What does this mean for businesses?

• Environmental claims must be specific, documentable, and backed by evidence – general terms like “eco” or “environmentally friendly” may soon no longer suffice.
• Safe packaging optimisation requires collaboration not just within marketing, but also across legal, ESG, procurement, and product development departments.

Estonian CIT Debunked

Katarzyna Kot explained when Estonian CIT (corporate income tax) can truly be a beneficial solution, and when the classic taxation model remains the safer choice. The webinar served as a practical guide for entrepreneurs planning a change in their taxation model.

Key takeaways from the webinar:

• Estonian CIT is not a one-size-fits-all solution – the decision to change tax models should be preceded by an analysis of the company’s operational profile and business goals.
• Prior to implementation, it is essential to verify entry conditions and potential risks associated with hidden profits and non-business expenses.
• When structured properly, Estonian CIT offers numerous opportunities.

Must-Read Publications

AI Does Not Relieve You of Responsibility

Katarzyna Kot commented on the widely discussed Supreme Administrative Court (NSA) ruling regarding the use of artificial intelligence in drafting court pleadings. This is an important voice in the debate on the responsible use of AI in professions of public trust.

What does this mean in practice?

• AI can support a lawyer’s work, but it does not assume responsibility for verifying sources, the correctness of legal arguments, or the quality of the service provided.
• Professionalism in the era of AI lies not in abandoning new technologies, but in using them consciously and responsibly.

Cross-Border Disputes – Before Filing a Lawsuit

Is a judgment alone enough to recover debts from a foreign contractor? In our June publication, we explain why, in cross-border disputes, planning effective enforcement in advance and analysing procedures in other jurisdictions is just as critical as drafting the lawsuit itself.

In brief:

• Obtaining a judgment alone does not guarantee debt recovery – planning effective enforcement abroad in advance is equally important.
• The earlier procedural and international issues are analysed, the greater the chances of actual debt recovery.

Labour Market Collusion Under the UOKiK Spotlight

Can non-poaching clauses violate competition law? This topic is increasingly emerging in day-to-day business practice.

In brief:

• Non-poach / non-solicitation clauses, which were standard contract terms just a few years ago, may now carry significant legal risks and attract scrutiny from UOKiK (Office of Competition and Consumer Protection).
• Protecting company interests today requires solutions that are not only effective but also legally compliant – it is worth periodically reviewing standard agreements and clauses.

What Lies Ahead?

July promises to be just as intensive.

In the coming weeks, we will be sharing further materials for entrepreneurs and HR departments, as well as continuing our expert series.

Follow our profiles if you are interested in:

• ➔ A new series by Paweł Kempa-Dymiński dedicated to practical aspects of employment law and the termination of employment relationships,
• ➔ Upcoming tax webinars hosted by Katarzyna Kot,
• ➔ Further events and publications on ESG, EmpCo, PPWR, and EPR (ROP) with Anna Żmidzińska,
• ➔ Expert commentary on AI and new technologies in business – check out Jacek Cieśliński, Mateusz Borkiewicz, Grzegorz Leśniewski, and Ewa Knapińska for the latest insights on AI, e-commerce, and GDPR (RODO),
• ➔ Speaking engagements by our experts at industry conferences.

See you in the next edition of LBKP Inside!

The post July in LBKP first appeared on Kancelaria LBKP.

On 30 April 2026, the Sejm passed the first of three amendments to the Tax Ordinance, which included significant standardisation for the publication of tax rulings issued by local government tax authorities.

Subsequently, on 15 May 2026, the Sejm passed two further amendments to the Tax Ordinance. Their main part was due to come into force on 1 October 2026. The scope of the planned changes was broad and included both deregulatory solutions that were favourable to taxpayers, and regulations raising major doubts – primarily in the area of the statute of limitations for tax liabilities and penal fiscal liability.

Ultimately, the fate of some of the amendments turned out differently.

Amendments providing for:

1. The extension of the obligation to publish local government tax rulings in the EUREKA system,
2. Simplifications for entrepreneurs, including changes to the reporting of domestic tax schemes,

were signed by the President of the Republic of Poland.

On the other hand, the act encompassing changes to the suspension of the statute of limitations for tax liabilities and penal fiscal liability was vetoed.

What does this mean for entrepreneurs and what changes should they prepare for in the coming months?

Vetoed Tax Changes: Statute of Limitations and Penal Fiscal Code

One of the key proposals provided for the repeal of the controversial Article 70 § 6 point 1 of the Tax Ordinance. This provision concerns the suspension of the statute of limitations for a tax liability in connection with the initiation of penal fiscal proceedings.

In practice, this mechanism has raised doubts among taxpayers and legal representatives for years. The initiation of penal fiscal proceedings could lead to the suspension of the statute of limitations, and thus extend the period during which the taxpayer remained in uncertainty regarding the final settlement of their tax liabilities.

The vetoed act also included a change to the Penal Fiscal Code concerning Article 44 § 2 (specifically, its repeal). Currently, this provision serves a significant protective function, as it links the possibility of conducting penal fiscal proceedings with the expiry of the tax due itself. In other words, in certain cases, the expiry of the tax liability also limits the possibility of further prosecution for a penal fiscal offence related to that liability.

The planned repeal of this provision sparked critical voices from some business circles. It was pointed out that the change could lead to an extension of the period of penal fiscal liability, even when the tax liability itself had already expired. The Ministry of Finance, on the other hand, argued that the proposed solution was systemically coherent and justified from the point of view of the structure of penal fiscal liability.

Why Did the Polish President Veto the Tax Law Amendments?

The President of the Republic of Poland decided to veto the act encompassing changes to the Tax Ordinance and the Penal Fiscal Code. The justification for the decision emphasised the need to protect the legal security of citizens and the predictability of the state’s actions towards taxpayers.

From the perspective of entrepreneurs, this means that the planned changes in this area will not enter into force at this point. At the same time, it should be borne in mind that the legislative procedure may still be continued. The Sejm has the power to override the President’s veto if it obtains a 3/5 majority vote in the presence of at least half of the statutory number of MPs.

What the Presidential Veto Means for Businesses in Poland

The veto – in the context of one of the planned amendments – has a twofold meaning for taxpayers:

• Firstly, the controversial Article 70 § 6 point 1 of the Tax Ordinance, used by tax authorities to instrumentally extend the statute of limitations, remains in force.
• Secondly, the current wording of Article 44 § 2 of the Penal Fiscal Code is preserved. For entrepreneurs, this means maintaining a favourable solution which, in certain situations, limits the possibility of conducting penal fiscal proceedings after the tax liability has expired.

In practice, taxpayers have therefore avoided one of the more controversial changes, but at the same time, there will be no repeal of the provision which has raised objections for years due to the possibility of extending tax proceedings.

New Tax Regulations: Amendments Signed by the President

Regardless of the vetoed act, the President of the Republic of Poland signed two further amendments to the Tax Ordinance.

This is a package of deregulatory and standardising changes aimed at simplifying some of the taxpayers’ obligations, streamlining day-to-day relations with the tax administration and standardising tax knowledge bases.

The End of Domestic MDR Reporting in Poland

One of the most important changes is the abolition of the obligation to report domestic tax schemes, i.e., so-called domestic MDRs (Mandatory Disclosure Rules).

Until now, MDR obligations were a significant organisational burden for many entrepreneurs, advisors, and accountants. They required the analysis of many economic events in terms of a potential reporting obligation, even in situations concerning exclusively domestic transactions.

The amendment aims to limit this obligation. It should be clearly emphasised, however, that the simplification concerns domestic tax schemes. The obligation to report cross-border schemes remains in force.

Simplified Tax Settlements and Facilitations with the Tax Office

The amendment also provides for a number of minor changes aimed at simplifying day-to-day tax settlements.

One of them is raising the limit of the tax amount that can be paid on behalf of another taxpayer – from PLN 1,000 to PLN 5,000. This change may have practical significance, e.g., in corporate groups, family businesses, and in situations where tax settlements are organisationally handled by another entity.

The new regulations are also to concern the rules of accounting for interest and procedures related to the refund of stamp duty and tax overpayments. The aim of these changes is to reduce minor formalities and speed up the handling of simpler tax matters.

EUREKA System: A Centralised Database for Local Tax Rulings

Additionally, the amendment provides for the standardisation of the rules for publishing tax rulings concerning local taxes and charges. Rulings issued by heads of rural municipalities (wójts), mayors, and city presidents are to be made available in a single database maintained by the Director of the National Revenue Information (the so-called EUREKA System).

This solution should make it easier for taxpayers to search for them and compare the positions of individual authorities. Until now, the publication of such rulings was dispersed across the websites of the administrative offices supporting the local government authorities issuing the rulings.

How to Prepare for the Upcoming Tax Changes in Poland?

Entrepreneurs should, first and foremost, verify how the signed amendment will affect their obligations regarding MDR and day-to-day settlements with the tax office.

It is also worth monitoring the further fate of the vetoed act, as a potential overriding of the veto by the Sejm could reopen the path to changes in the scope of the statute of limitations and penal fiscal liability.

At LBKP, we continuously analyse tax changes and their impact on entrepreneurs. Contact us if you want to streamline your tax procedures, verify your MDR obligations, or prepare your company for the new regulations.

The post Tax Ordinance 2026 – a review of changes following the decisions of the President of the Republic of Poland first appeared on Kancelaria LBKP.

In practice, most questions arise during dividend payouts. This is precisely when tax obligations arise for both the company and the shareholder. Properly establishing the tax base and correctly applying the PIT deduction mechanism provided for in the PIT Act is therefore of key importance.

How is a Dividend Taxed Under Estonian CIT? 

Under the Estonian CIT model, taxation at the corporate level occurs, as a rule, only at the time of profit distribution. As long as the funds remain within the company and are used for its business operations, no tax liability arises from the distributed profit. However, it is important to remember that the law also provides for other categories of taxable income, such as hidden profits or expenses unrelated to business activities.

When it comes to Estonian CIT on profit distribution, the lump-sum tax rate depends on the taxpayer’s status. For small taxpayers and start-ups, it is 10% of the tax base. Other taxpayers apply a 20% rate.

However, the settlement does not end there. A dividend payout also generates income for a shareholder who is an individual. This income is subject to a 19% flat-rate PIT.

Nevertheless, this does not mean that the same profit is fully taxed twice. The structure of the Estonian CIT includes a mechanism that limits the economic burden of double taxation. It consists of reducing the PIT due from the shareholder by a corresponding portion of the lump-sum tax paid by the company.

How Does the PIT Deduction Work? 

In the case of a dividend paid from profits earned during the period of Estonian CIT taxation, the shareholder’s PIT can be reduced by a portion of the corporate lump-sum tax components attributable to that shareholder.

In practice, this means that:

• With a 10% corporate tax rate, the shareholder can deduct 90% of their share of the corporate lump-sum tax.
• With a 20% corporate tax rate, the shareholder can deduct 70% of their share of the corporate lump-sum tax.

The amount of the deduction is therefore linked to the shareholder’s share in the profit and the lump-sum tax rate applied by the company.

A condition for applying this mechanism is, among other things, that the payout concerns profits generated during the period of corporate lump-sum taxation and properly separated within the company’s equity.

Gross Profit Amount or the Amount After Estonian CIT Deduction? 

In practice, taxpayers often wonder what amount should be used to calculate PIT on a dividend paid from profits taxed under Estonian CIT. The doubt boils down to the question: is the PIT base the gross amount of profit allocated for distribution, or the amount reduced by the lump-sum tax due from the company?

The current approach of tax authorities and administrative courts is quite clear in this regard. The PIT tax base should be the full (gross) amount of profit allocated for distribution, without prior reduction by the Estonian CIT due from the company. 

Consequently, the correct order of settlement is as follows:

1. The company determines the net profit amount allocated for distribution.
2. The company calculates the corporate lump-sum tax due on this amount.
3. The company calculates the shareholder’s 19% PIT based on the full dividend amount.
4. Finally, the company reduces the PIT by the appropriate portion of the lump-sum tax paid by the company.

Therefore, it would be incorrect to first reduce the dividend by the Estonian CIT and only then calculate the 19% PIT on that reduced amount. Such an action could lead to an underpayment of the tax collected by the company acting as the tax remitter.

Tax Calculation Example

Assume that a company allocates PLN 100,000 of profit generated during the Estonian CIT period for payout to its sole shareholder.

Scenario 1: The company applies the 10% rate

Corporate lump-sum tax:

$$10\% \times \text{PLN } 100,000 = \text{PLN } 10,000$$

PIT on dividend before deduction:

$$19\% \times \text{PLN } 100,000 = \text{PLN } 19,000$$

Deduction:

$$90\% \times \text{PLN } 10,000 = \text{PLN } 9,000$$

PIT to be collected from the shareholder:

$$\text{PLN } 19,000 – \text{PLN } 9,000 = \text{PLN } 10,000$$

Total tax burden: PLN 20,000, which constitutes 20% of the profit allocated for distribution.

Scenario 2: The company applies the 20% rate 

Corporate lump-sum tax:$$20\% \times \text{PLN } 100,000 = \text{PLN } 20,000$$

PIT on dividend before deduction:$$19\% \times \text{PLN } 100,000 = \text{PLN } 19,000$$

Deduction:$$70\% \times \text{PLN } 20,000 = \text{PLN } 14,000$$

PIT to be collected from the shareholder:$$\text{PLN } 19,000 – \text{PLN } 14,000 = \text{PLN } 5,000$$

Total tax burden: PLN 25,000, which constitutes 25% of the profit allocated for distribution.

Summary 

When paying out a dividend from profits taxed under Estonian CIT, the correct sequence of calculations is critical. The shareholder’s PIT must be calculated from the full amount of profit allocated for distribution, and only then should the statutory deduction of a portion of the corporate lump-sum tax be applied.

In practice, this means that Estonian CIT does not eliminate dividend taxation on the shareholder’s side, but it significantly reduces the overall tax burden. For small taxpayers, the effective taxation of distributed profit is generally 20%, and for other taxpayers, it is 25%.

Got Questions?

Do you need support with Estonian CIT or have doubts regarding the taxation of profit distribution? Contact us. We will help analyze your company’s situation, correctly establish the tax base, and safely settle your dividend.

The post Estonian CIT and Dividend Payouts: Tax Base and PIT Deduction Mechanism first appeared on Kancelaria LBKP.

A few key points to take away from this article

Protection against dismissal and termination of the contract takes effect from the moment of conception – not from the doctor’s appointment, not from informing the employer, and not from the medical certificate. The lack of documentation does not invalidate this protection. This is one of the most common mistakes made by employers.

Did the employee hand in her notice herself, and then find out she was pregnant at the time?

She can effectively withdraw it. What’s more, she can invoke a mistake and avoid the consequences of her statement without the employer’s consent. This also applies to termination by mutual agreement.

Disciplinary action against a pregnant employee?

Formally possible, but the courts set a much higher bar for employers. The arguments must be truly compelling.

The abolition of a post ≠ the winding up of the company.

If the company continues to operate, simply abolishing a post does not remove the protection. This distinction is of enormous practical importance – protection against dismissal still applies.

Does a fixed-term contract end during pregnancy?

If after the third month – it is automatically extended until the date of childbirth. Failure to extend it is another common mistake made by employers.

Key takeaway for employers:

Protection for pregnant women under Polish labour law is very broad, though not absolute. Mistakes in this area can be costly – an employee may demand reinstatement or compensation, and during the proceedings, the court may secure her claims by ordering her to be allowed to return to work.

If you are facing a difficult HR decision and an employee’s pregnancy is involved – consult a lawyer before taking any action.

Link to the full article in GP.

The post Did you give notice without knowing that the employee was pregnant? She may be able to get her job back. first appeared on Kancelaria LBKP.

CUDA – the AI engine that is changing the rules of the game

At the heart of NVIDIA’s transformation into a global leader in artificial intelligence is CUDA (Compute Unified Device Architecture), a proprietary programming platform that enables the full power of GPUs to be harnessed for scientific, industrial and commercial applications. CUDA is not just a technology layer – it is a critical infrastructure for the scalability and efficiency of AI models.

It is not without reason that this platform is sometimes referred to as the ‘invisible AI operating system.’ It is a key element in the lifecycle of AI-based systems: from training and validation to the deployment of models in real-world applications. In practice, it is CUDA that defines how quickly and at what scale modern AI systems can be developed.

GPU vs CPU – why are graphics processing units crucial for artificial intelligence?

In the context of training large language models and processing data on a massive scale, classic processors (CPUs) are becoming insufficient. The key features of GPUs – especially those from NVIDIA – give them an advantage in AI environments:

• Parallel architecture – GPUs such as the NVIDIA H100 contain thousands of cores that enable simultaneous processing of large data sets – ideal for the matrix operations used in neural networks.
• Energy efficiency – next-generation graphics chips offer up to 25 times higher energy efficiency compared to previous solutions, which translates into lower operating costs and greater scalability.
• High-bandwidth memory – technologies such as HBM2 (High Bandwidth Memory) enable lightning-fast processing of terabytes of data – essential for real-time and critical applications.

The closed CUDA ecosystem – both a strength and a weakness

As a closed solution, CUDA offers huge performance gains – up to 1,000 times faster over the last decade. However, the fact that this technology is controlled by a single company raises concerns:

• Technological dominance – over 80% of AI models – including all major foundation models – are trained in the CUDA environment.
• Lack of alternatives – open solutions such as AMD ROCm and Intel oneAPI have less than 10% market share, mainly due to weaker optimisation and lack of full compatibility with popular AI libraries.
• Network effect – the more developers use CUDA, the more difficult it is to switch to competing solutions – this creates a closed ecosystem that is difficult for the market to counterbalance.

AI infrastructure and European law: a gap in the AI Act?

The AI Act (EU 2024/1689) is the first comprehensive piece of legislation regulating the use of artificial intelligence in Europe. However, it focuses mainly on the algorithmic level – on training data, model transparency and the risks of their use.

Meanwhile, the computational layer – the infrastructure without which these systems cannot exist – remains outside its direct scope.

CUDA is not classified as a standalone AI system, but its impact on the compliance, auditability and security of AI systems is undeniable. Without the ability to verify the operation of the infrastructure – both in terms of hardware (black-box GPUs) and closed software – it is difficult to talk about full implementation of the principles of transparency and accountability.

Legal consequences – monopoly, dependency, lack of audit

The lack of regulation in the field of computing infrastructure raises specific legal and systemic issues:

• Limited auditability – the closed nature of CUDA makes it difficult to meet the requirements of Article 13 of the AI Act regarding transparency and verifiability.
• Monopoly risk – a price increase of over 300% for GPUs between 2020 and 2024 may indicate abuse of a dominant position (Article 102 TFEU).
• Lack of EU technological sovereignty – as many as 98% of European AI data centres use NVIDIA technology, raising serious questions about infrastructure independence and resilience to external disruption.

Is accountability without transparency possible?

The AI Act establishes chain liability – responsibilities apply not only to system developers, but also to users and distributors. However, market reality shows that end users have no real way of assessing the CUDA infrastructure they use indirectly. There are no technical standards or requirements disclosing the details of how closed platforms operate.

Recommendations for regulators and the AI industry

Although not formally classified as an AI system, CUDA should be recognised as a component that affects compliance, auditability and security. Recommendations:

• EC guidelines and AI Office – it is necessary to develop legal interpretations that take into account the impact of computing platforms on AI systems, as is the case with cloud computing and the GDPR.
• Promoting technological neutrality – EU technology support programmes (e.g. Digital Europe) should favour open, interoperable technologies.
• Revision of the scope of the AI Act – in the long term, it is worth considering updating the AI Act to also cover technological infrastructure as a factor determining the safety and compliance of AI systems.

CUDA – a technological marvel or a legal risk?

CUDA is undoubtedly a technology that has enabled unprecedented progress in the field of AI. However, its closed structure, market dominance and lack of regulatory oversight may mean that responsibility for AI systems becomes illusory. For the EU, which is committed to transparency, ethics and digital sovereignty, this is a challenge that can no longer be ignored.

* * *

ART. 13 AI Act

Transparency and information sharing with users

1. High-risk AI systems shall be designed and developed in a manner that ensures sufficient transparency of their performance, enabling users to interpret the results of the system and use them appropriately. The appropriate type and level of transparency shall be ensured in order to enable the supplier and the user to fulfil their respective obligations set out in Section 3.
2. High-risk AI systems shall be accompanied by a user manual in an appropriate digital or other format containing concise, complete, accurate and clear information that is relevant, accessible and understandable to users.
3. The user manual shall contain at least the following information:
4. (a) the identity and contact details of the supplier and, where applicable, its authorised representative;
5. (b) the characteristics, capabilities and limitations of the performance of the high-risk AI system, including:

(i) its intended use;

(ii) the level of accuracy, including its indicators, the level of robustness and cybersecurity referred to in Article 15, against which the high-risk AI system has been tested and validated and which can be expected, as well as any known and foreseeable circumstances that may affect those expected levels of accuracy, robustness and cybersecurity;

(iii) any known or foreseeable circumstances related to the use of the high-risk AI system in accordance with its intended purpose or under reasonably foreseeable conditions of misuse that could give rise to a risk to health and safety or fundamental rights as referred to in Article 9(2);

(iv) where applicable, the technical capabilities and features of the high-risk AI system to provide information relevant to the explanation of its performance;

(v) where applicable, the performance of the system in relation to specific individuals or groups of individuals for whom it is intended to be used; (vi) where applicable, specifications regarding input data or any other relevant information regarding the training, validation and testing data sets used, taking into account the intended use of the high-risk AI system; (vii) where applicable, information enabling users to interpret the results of the high-risk AI system and to use those results appropriately;

1. (c) changes to the high-risk AI system and its performance that have been planned in advance by the supplier at the time of the initial conformity assessment;
2. (d) the human oversight measures referred to in Article 14, including technical measures introduced to facilitate the interpretation of the results of high-risk AI systems by users;
3. e) the necessary computing and hardware resources, the expected life cycle of the high-risk AI system and any necessary maintenance and servicing measures, including their frequency, to ensure the proper functioning of that AI system, including software updates;
4. f) where applicable, a description of the mechanisms included in the high-risk AI system that enable entities using it to correctly collect, store and interpret event logs in accordance with Article 12.

ART. 12 TFEU

Prohibition of abuse of a dominant position

Any abuse by one or more undertakings of a dominant position within the internal market or in a significant part thereof shall be prohibited as incompatible with the internal market in so far as it may affect trade between Member States.

Such abuse may, in particular, consist in:

1. a) directly or indirectly imposing unfair purchase or selling prices or other unfair trading conditions;
2. b) limiting production, markets or technical development to the prejudice of consumers;
3. c) applying dissimilar conditions to equivalent transactions with other trading partners, thereby placing them at a competitive disadvantage;
4. d) making the conclusion of contracts subject to acceptance by the other parties of supplementary obligations which, by their nature or according to commercial practice, do not relate to the subject of such contracts.

The post CUDA and NVIDIA’s dominance – invisible AI infrastructure beyond the scope of regulation? first appeared on Kancelaria LBKP.

The MiCA (Markets in Crypto-Assets) Regulation is the first European Union legal act that comprehensively regulates the rights and obligations of issuers and service providers related to crypto-assets. The aim of MiCA is to ensure a high level of investor protection, particularly for retail investors, to increase the transparency of the crypto-asset market and to harmonise the rules governing this market across the European Union. Thanks to MiCA, the crypto-asset market is gaining clear rules, which promotes investment security and the development of the industry.

The post Types of crypto assets regulated by MiCA first appeared on Kancelaria LBKP.