Can a company put a customer on an undesirable persons list after they publish a critical review of its services? This is a question that many entrepreneurs and consumers have been asking themselves in recent weeks, triggered by the high-profile case of one Polish hotel. The answer requires looking at several independent legal regimes simultaneously – and taking into account that neither party to such a dispute is automatically in the right.

What is a customer blacklist in practice, versus in the eyes of the law?

In practice, it is often nothing formalized, such as a note in a booking system or just a verbal instruction passed to the reception shift, which is enough to ensure a customer is no longer welcome. The reasons can be clear-cut, such as theft or aggression towards staff, but just as often they are subjective, such as a dispute over a bill, a conflict with service personnel, and sometimes… simply an inconvenient review online.

The problem affects not only hotel services. It also occurs on the internet, for example in shops looking for ways to deal with customers who, in their view, abuse the right of withdrawal, return damaged goods, and expect a refund.

From a legal perspective, however, this is not just an ordinary office memo; it is a set of personal data. This means that its existence, purpose, and storage period are subject to exactly the same rigours as any other data processing within a company. What looks like a simple precautionary measure to a manager is, under data protection regulations, an operation requiring a separate legal basis and a clear time limit.

Three legal regimes to bear in mind simultaneously

The GDPR does not recognize the concept of storing data “just in case”. In accordance with the principles of purpose limitation and storage limitation (Article 5(1)(b) and (e) of the GDPR), data can only be processed for as long as a specific, current purpose exists, and the basis for the entry is usually the legitimate interest of the controller (Article 6(1)(f) of the GDPR). This interest must, however, realistically outweigh the rights of the data subject – the mere fact of a conflict with a customer is not enough. Consumer law operates separately. Freedom of contract (Article 353¹ of the Civil Code) does not mean arbitrary freedom in refusing service, so a refusal without a specific justification previously outlined in the terms and conditions carries the risk of allegations of consumer rights violations, and in extreme cases, even discrimination.

Another layer is personal rights, meaning the relationship between the consumer’s right to criticism and the entrepreneur’s right to protection of good name, protected under Articles 23 and 24 of the Civil Code in conjunction with Article 43 of the Civil Code, applied mutatis mutandis to legal persons. A company may defend its reputation, but substantive criticism falling within the limits of permissible service evaluation does not constitute an unlawful violation of personal rights, even if it is inconvenient for the company.

On top of all this comes a thread that is only just emerging: automation. An increasing number of companies support the management of problematic customer registries with scoring systems that flag accounts as risky based on the number of complaints or behavioral patterns. If such a decision is made fully automatically and produces a tangible legal effect for the customer, Article 22 of the GDPR comes into play, limiting the permissibility of such decisions and requiring human intervention. The AI Act itself does not classify the maintenance of a customer list as a high-risk system, but if tools that systematically assess the behavior of natural persons are used to create it, it is worth checking already at the implementation stage whether it approaches a category subject to additional transparency obligations.

Where lies the risk, and where the real benefit?

The registry of undesirable persons itself is not prohibited and is often fully justified, because the protection of staff, property, and other customers is a legitimate interest of the entrepreneur. Trouble begins only when it is run without clear rules. Most often, companies fail to define the purpose and retention period of data, treat criticism or a complaint as an automatic basis for an entry without determining whether a breach of rules actually occurred, extend the ban to third parties who were not party to the dispute, or stop at vague regulatory provisions instead of a closed catalogue of refusal grounds. A well-designed registry has a clear purpose, a specific catalogue of events, and a defined data retention period; only then does it become an effective tool for protecting the business rather than a source of additional risk.

When theory meets practice: The Hotel Gołębiewski case

A good, recent example is the high-profile case of Hotel Gołębiewski and Szymon Nyczke, a YouTuber known as Książulo. It all started with an ordinary consumer dispute. Faulty air conditioning in a newly opened suite costing nearly PLN 5,000 per night, bedroom temperatures reaching over 32 degrees Celsius, and yellow water with sediment. Gołębiewski Holding admitted that such a situation should not have happened and honored the complaint by refunding the stay, while the Office of Competition and Consumer Protection (UOKiK) directly referred to the case on Instagram, pointing to Książulo’s stance as an example of enforcing consumer rights.

A few days later, the matter took a completely different turn. A letter was sent to the network’s facility directors indicating that Książulo and accompanying persons had been entered onto the list of undesirable guests, covering accommodation, restaurants, and water parks. Upon attempting to make a reservation, reception refused, citing a violation of the facility’s rules without specifying what that violation was supposed to be. The ban was lifted the same day following intervention by the management and the network’s owner, Jarosław Gołębiewski, and the chain has yet to publicly present a detailed stance on the list itself.

It is hard to find a better illustration of the mistakes described above. The lack of a clear purpose and retention period for the entry, treating a critical material as an event justifying a ban without establishing whether the regulations were actually breached, and extending the ban to accompanying persons who were not party to any dispute. However, the case is not exclusively unfavorable to the hotel. Jarosław Gołębiewski assessed Książulo’s material as harmful, and the creator himself emphasized that he did not wish to wage a campaign against the hotel – which clearly shows that justified consumer criticism and the protection of an entrepreneur’s good name are two independent threads requiring separate legal assessment. They cannot be resolved with a single hasty entry on a list.

Practical conclusions

Maintaining a registry of undesirable persons is not inherently impermissible, but it requires meeting several conditions simultaneously. There must be a specific event forming the basis of the entry, a clearly defined purpose and retention period for the data, restriction of the entry solely to the person actually involved in the event, and a precise catalogue of service refusal grounds in the terms and conditions rather than vague reservations. The Hotel Gołębiewski case clearly demonstrates how quickly a lack of such rules can turn a simple consumer dispute into a legal issue encompassing the GDPR, consumer rights, and personal rights all at once. It is worth checking this in advance, rather than only when the topic hits the media – especially where automated customer profiling by scoring systems is involved, which additionally requires evaluation under Article 22 of the GDPR and the AI Act.

If you run a service company and wonder whether your terms and conditions and internal procedures comply with the GDPR and consumer law, contact us. We will help you verify it.

The post The customer blacklist. When can a company use it, and when does it bring trouble upon itself? first appeared on Kancelaria LBKP.

For most businesses, the mailbox has long ceased to be merely a communication tool. It has become an archive of business knowledge. This is precisely where client arrangements, project histories, management board decisions, and case documentation are kept. From a business perspective, it is hardly surprising that organisations are reluctant to delete such information.

The larger the archive, the greater the risk

The problem is that almost every such message also contains personal data. The larger the archive, the wider the scope of data that could be exposed in the event of mailbox takeover, employee error, or a cyberattack. Therefore, data retention is not merely an obligation arising from the GDPR; it is also one of the fundamental mechanisms for limiting the impact of a potential security incident.

This is, of course, nothing new. The principle of limiting the storage period for personal data has been in force for years. What is new, however, is that the President of the Personal Data Protection Office (UODO), in his latest bulletin, practically demonstrates how to secure mailboxes in situations where an organisation, for various reasons, stores messages longer than would be optimal.

Specific technical and organisational solutions

The authority does not limit itself to reminding organisations of their obligations under the GDPR. It points to specific technical and organisational solutions which – in its view – reduce the risk of breaches. These include multi-factor authentication (MFA), attachment encryption, and the so-called “3-second rule”, which involves a brief verification of the recipient and attachments before sending a message.

Why does this matter? Because UODO explicitly shows which security measures it currently considers appropriate. This means it is precisely through the prism of such safeguards that the authority may subsequently assess an organisation during an audit or following a personal data breach.

Undoubtedly, this is a valuable tip for entrepreneurs. GDPR regulations do not provide an exhaustive list of specific safeguards, limiting themselves to the obligation to implement “appropriate technical and organisational organisational measures”. In practice, assessing what is “appropriate” remains one of the greatest difficulties for data controllers. The latest bulletin partially fills this gap. It does not create new obligations, but it shows which solutions – from the supervisory authority’s perspective – correspond to the proper level of electronic mail security today.

Significance from the accountability perspective

This is also significant from the perspective of accountability. In the event of a personal data breach, the mere occurrence of an incident does not yet predetermine the controller’s liability. What is also crucial is whether the organisation was able to demonstrate that it had previously implemented measures adequate to the identified risk. If the President of UODO points out specific solutions today, such as MFA, attachment encryption, or the “3-second rule”, it is difficult to assume that they will remain without consequence during an audit or explanatory proceeding.

Practical checklist of actions to verify

From the perspective of entrepreneurs, this material should therefore be treated not as yet another reminder of obligations arising from the GDPR, but as a practical checklist of actions that are worth verifying within one’s own organisation right away. All the more so because all UODO recommendations relate to risks that have for years been among the most common causes of personal data breaches – mailbox takeovers, misaddressed messages, or unauthorised disclosure of data. In practice, these are solutions that not only reduce the likelihood of an incident, but can also constitute a significant argument confirming the exercise of due diligence if a breach occurs despite the implemented safeguards.

You can read more on this topic in the article published in Gazeta Prawna. If you wish to discuss how to build a compliance trail that can withstand a UODO audit or check whether your organisation’s data retention policy covers electronic mail, please feel free to contact us.

The post UODO takes a closer look at mailboxes. UODO takes a closer look at mailboxes. Not because you store too many emails. Because every additional message increases the risk. first appeared on Kancelaria LBKP.

From 2nd August 2026, the AI Act regulations regarding transparency obligations for the use of artificial intelligence come into force. In practice, this means, among other things, the obligation to inform users when they are interacting with an AI system and to label certain content generated or altered with the help of artificial intelligence.

These regulations impose obligations on both providers of specific AI systems and entities that use them. In practice, they are particularly relevant for businesses using chatbots and companies utilising generative AI in marketing, advertising, media, e-commerce, or when creating texts, graphics, audio recordings, and video materials.

This does not mean that from 2nd August every graphic generated in Midjourney, text prepared with the help of ChatGPT, or photo retouched using AI requires a special label. The scope of obligations depends on how the AI was used and what the final output is.

The user should know they are talking to AI

One of the obligations laid down in the AI Act is to ensure that people using AI systems intended for direct interaction with users know that they are communicating with artificial intelligence. This obligation rests on the providers of such systems and applies, amongst others, to customer service chatbots, voicebots, virtual assistants, or AI agents.

The information should appear no later than at the first interaction with the user. Therefore, if a customer opens a chat on an online shop’s website and starts a conversation with a bot, they should know from the outset that there is no human on the other side.

Above all, this means verifying whether the implemented system actually transmits the appropriate information to the user and whether it does so at the right moment. Hiding a mention of AI solely within the terms and conditions or the privacy policy may fail to achieve the purpose of these regulations.

Labelling content generated by AI

The mere fact of using artificial intelligence does not automatically trigger an obligation to label the material. A text prepared with the help of ChatGPT must be approached differently from a realistic human image generated for an advertising campaign, and differently again from a photograph where AI has merely improved sharpness or removed noise.

In the case of images, audio recordings, and video materials, it is of particular importance whether the created content can be classified as a deepfake. According to the AI Act, this refers to content generated or manipulated by AI in the form of image, sound, or video that resembles existing persons, objects, places, entities, or events and may falsely appear authentic or true. The disclosure obligation applies precisely to such content.

A deepfake does not necessarily mean only a video with a politician’s or celebrity’s face swapped. In practice, the problem may also arise in much more everyday applications of generative AI: a realistic human image generated by AI, a synthetic voiceover, a generated realistic scenery, or a product photo placed by AI into a new environment.

However, not every AI intervention in a material will lead to such a result. Tools utilising artificial intelligence are nowadays part of ordinary photo, graphic, or sound editing software. Quality enhancement, noise reduction, or other technical actions should not automatically be treated the same way as creating a new, realistic situation that did not actually take place in reality.

What should the labelling look like?

The information about the use of AI should be clear and noticeable to the recipient no later than upon their first contact with the given content. It is therefore not about hiding information in metadata, terms and conditions, or at the end of a long description that the recipient might never read.

In the case of graphics, the label can be placed directly on the image or presented in an equivalent manner within the interface. For video material, it should be visible to the person watching the material, and the method of labelling audio content should allow the recipient to know that the heard material has been generated or modified by AI.

The European Commission has prepared a set of EU icons to facilitate content labelling. They distinguish, amongst others, between materials generated entirely by AI and content that existed previously but was subsequently partially modified using artificial intelligence. For instance, a realistic image generated from scratch will fall into the fully generated content category, whereas a real photograph of an empty flat that AI subsequently “furnished” is given by the Commission as an example of partially modified content.

EU icons for labelling AI content prepared by the European Commission:

The use of EU icons is voluntary. One can also apply their own understandable designation, such as “image generated by AI” or “voice generated using AI”. Choosing one’s own label does not exempt one from the necessity of ensuring that the information is legible and meets the requirements of the AI Act.

Korzystanie z unijnych ikon jest dobrowolne. Można zastosować również własne, zrozumiałe określenie, np. „obraz wygenerowany przez AI” czy „głos wygenerowany przy użyciu AI”. Wybór własnego oznaczenia nie zwalnia z konieczności zadbania o to, aby informacja była czytelna i spełniała wymagania AI Act.  

Texts prepared using AI

The rules regarding texts look different. The AI Act does not introduce a general obligation to label every email, product description, LinkedIn post, or article just because generative AI was used in preparing it.

The obligation applies to texts generated or manipulated by AI and published with the aim of informing the public on matters of public interest. In practice, these might be, for example, materials concerning politics, security, public health, the environment, or other matters significant from the point of view of public debate. Ordinary sales or marketing texts will not, as a rule, automatically fall into this category.

At the same time, the AI Act provides an important exception. Labelling is not required if the AI-generated text has undergone human review or editorial control, and editorial responsibility for the publication is assumed by a natural or legal person.

However, such control should not be reduced solely to correcting typos and commas. If AI prepares material concerning matters of public interest, human verification should be of a genuine nature, meaning it should encompass content assessment, fact-checking, and the final decision to publish.

Responsibility for labelling

The AI Act distinguishes between the obligations of AI system providers and the entities that use those systems. Providers are responsible, amongst others, for certain technical mechanisms enabling the detection of content generated or modified by AI, whilst deploying entities face obligations such as disclosing deepfakes and specific texts concerning matters of public interest.

In practice, cooperation with advertising agencies, production studios, or freelancers requires special attention. If materials are prepared by an external entity, it is wise to establish in advance whether and to what extent they may use AI, as well as how content requiring labelling will be identified.

Technical content labelling by AI providers

As for the obligations of AI system providers, these primarily concern the technical labelling of content generated by those systems. On the providers’ side, the obligation is therefore primarily of a technical nature and does not have to be visible to the recipient. Article 50(2) of the AI Act requires systems generating synthetic text, image, audio, or video to mark the outputs in a machine-readable format, enabling the detection that they have been generated or manipulated by AI. The regulations do not mandate a single technology: these could be, for example, digital watermarks, provenance metadata, cryptographic solutions, or fingerprinting.

For systems placed on the market before 2nd August 2026, however, the AI Act provides a transitional period; their providers have until 2nd December 2026 to adapt to this obligation. For systems placed on the market from 2nd August 2026, this obligation applies from the moment of their introduction.

AI system providers are already beginning to implement such solutions in practice. An example is Anthropic, which announced the use of two types of markings in Claude: user-invisible watermarks embedded in the generated text and digitally signed provenance metadata for supported graphic files. In the case of text, this is not about adding invisible watermarks or hidden information to a ready-made response. The mechanism operates already at the generation stage. The way the model chooses subsequent words creates a specific pattern that the user is unable to notice during normal reading, but which can later be detected using an appropriate tool, which Anthropic has announced it is already working on. The tool is intended to allow verification of whether the pattern characteristic of Claude is present in the analysed text, and thus assessment of whether the content was processed by the model. However, the result of such an analysis itself will not constitute unequivocal proof of the text’s origin.

Content published before 2nd August 2026

Companies do not have to revisit all materials generated and made available before 2nd August 2026 solely to label them in accordance with the new rules. The Commission has confirmed that the obligation is not retroactive in this respect, although it encourages voluntary labelling of earlier content where possible.

It is worth approaching materials prepared earlier but still used after the new regulations come into force with caution, however, especially in actively run campaigns. In such cases, the manner of applying the rules may require an assessment of the specific scenario.

Sanctions 

Infringing transparency obligations can incur administrative fines reaching up to EUR 15 million or 3% of the company’s total worldwide annual turnover for the preceding financial year.

However, a fine under the AI Act is not the only risk associated with the improper use of AI-generated content. Unlabelled material may also cause reputational issues or lead to allegations related to misleading communication.

On top of this, entirely different areas of law may apply. Using a specific person’s likeness may require analysis from the perspective of personality rights, processing personal data from the GDPR perspective, and using other people’s materials when creating content may raise copyright questions. Simply adding an “AI Generated” label does not automatically mean that the way the material is used complies with the law.

Transparency of AI usage

The AI Act does not prohibit the use of generative artificial intelligence in marketing, customer service, or content creation. The new regulations are primarily intended to ensure that, in specific situations, the recipient knows they are in contact with artificial intelligence or that the material presented to them has been generated or modified with its help.

For enterprises, this means above all the need to organise how they use AI: determining where synthetic content is created, who is responsible for its assessment, and how information obligations will be fulfilled in practice.

Author:

Wojciech Kulig

Junior associate

He supports clients in matters related to new technology law, in particular in the areas of personal data protection, intellectual property and issues related to artificial intelligence.

The post AI Act from 2nd August 2026: How to label content created with AI? first appeared on Kancelaria LBKP.

In this issue, we have also gathered the most interesting materials from the past month – from expert analyses and event reports to selected publications as part of the TechnoLegals programme. We hope this bulletin will be a convenient way for you to quickly catch up on July’s most important topics.

Our bulletin summarises July, but since you are reading it in August on LinkedIn, we couldn’t skip the AI Act. Therefore, at the end, we are leaving a brief reminder of the most important rules regarding the publication of content using artificial intelligence.

The AI Act and LinkedIn – who needs to label AI-generated content?

Here is the translation of the newsletter into British English, with formatting added to enhance readability:

July at LBKP was dominated by employment law. There was no shortage of significant legislative changes, expert commentary, and practical analyses. The spotlight was also on AML-related topics, as well as NIS2 and the AI Act, which consistently remain among the most crucial areas for business.

In this issue, we have also gathered the most interesting materials from the past month – from expert analyses and event reports to selected publications as part of the TechnoLegals programme. We hope this bulletin will be a convenient way for you to quickly catch up on July’s most important topics.

Our bulletin summarises July, but since you are reading it in August on LinkedIn, we couldn’t skip the AI Act. Therefore, at the end, we are leaving a brief reminder of the most important rules regarding the publication of content using artificial intelligence.

The AI Act and LinkedIn – who needs to label AI-generated content?

Since 2 August, new AI Act regulations regarding transparency in the use of artificial intelligence have been in force. A lot of questions and misunderstandings have arisen around the new regulations, which is why we have prepared a practical guide showing what actually changes for companies, experts, and participants in employee advocacy programmes.

1. It is the publisher who is responsible for labelling the content The obligation of transparency rests with the person or organisation publishing the material – not with LinkedIn or the AI tool you are using.
2. Not every text written with the help of AI needs to be labelled If the text has been verified, edited, and consciously published by a specific person, in most cases, it will not require a label. It may be different in the case of content concerning matters of public interest.
3. Particular attention should be paid to graphics and video Realistic images, video recordings, or audio materials generated by AI may be subject to the labelling obligation. In the case of clearly fictional illustrations, the regulations provide for exceptions.
4. Employee advocacy is also a professional activity Publishing content as part of an ambassador programme – even on a private LinkedIn profile – can be considered a professional activity. It is the nature of the publication that matters, not the type of account.
5. It is worth establishing clear rules for using AI The new regulations do not prohibit the use of artificial intelligence in communication. However, they “encourage” greater transparency, so companies operating on LinkedIn should develop consistent rules for using AI when creating content.

This is a topic that will be relevant not only for marketing departments but also for HR, communications, and anyone building an expert brand on social media.

Summer Academy of GDPR Leaders: Practical Aspects of Audits and Implementations

Grzegorz Lesniewski has joined the panel of experts of the Summer Academy of GDPR Leaders organised by the Personal Data Protection Office. During a lecture dedicated to the practical aspects of GDPR audits, he will share his experience gained while carrying out compliance implementations and projects in organisations.

EmpCo: Will products prepared before 27 September 2026 need to be withdrawn from the market?

The Consumer Protection Cooperation (CPC) network has published a practical position regarding the so-called old stock situations, i.e., products, packaging, and marketing communication prepared before the EmpCo directive becomes applicable. The document indicates how authorities may approach the transitional period and the enforcement of new obligations.

Key takeaways for businesses:

• The mere fact of having stock does not exempt you from the obligation to adapt communication to the new requirements. The priority should be updating online content and gradually introducing changes to packaging and marketing materials.
• The authorities announce a pragmatic approach to the transitional period, taking into account, among other things, the scale of stocks and the realistic capabilities of businesses. However, it will be crucial to demonstrate that the organisation is actively preparing to ensure compliance with the regulations.

A well-negotiated settlement does not always mean the best financial outcome.

Dispute resolution strategy

The Supreme Court has confirmed that an out-of-court settlement does not always constitute a basis for the refund of the entire statement of claim fee. In practice, this means that when planning to end a dispute, not only the content of the agreement matters, but also the manner and timing of its conclusion.

What is worth paying attention to?

• The choice between an out-of-court settlement, a court settlement, or mediation can have a significant impact on the settlement of the proceedings’ costs.
• The dispute resolution strategy should take into account not only the business interests of the parties but also the procedural and financial consequences of the chosen solution.

Terminating Cooperation with an Employee

The date of posting the notice is not the date of its submission.

Delivering a termination notice by post or courier might seem like a simple solution, but in practice, the moment the statement is submitted depends on its effective delivery to the employee. It is this very stage that often becomes a source of costly mistakes and disputes.

What should you remember?

• A statement on the termination of an agreement produces legal effects only when the employee has had a real opportunity to familiarise themselves with its content – the mere posting of the parcel is not sufficient.
• Problems with delivery, leaving a missed delivery card (aviso), or a lost parcel can affect the effectiveness of the agreement’s termination, so it is worth considering more secure forms of delivery, including electronic solutions.

New Employer Obligations: Changes in Mobbing Regulations (November 2026)

The amendment will come into force 3 months after its publication (i.e. on 5.11.2026). From that moment, we have its new definition, and employers will bear the brunt of the changed obligations.

Including the most important one – the obligation to SYSTEMATICALLY counteract violations of the principle of equal treatment in employment. A longer deadline is envisaged for adjusting or introducing internal company regulations on counteracting undesirable behaviour – 6 months from the date the act comes into force (i.e. by 5.05.2027).

Why is it worth preparing now?

• The amendment changes not only the definitions but also increases the importance of preventive measures. Employers should review current procedures, training, and how they respond to reports.
• The changes should be analysed in conjunction with the new powers of the National Labour Inspectorate (PIP), as their practical application may significantly affect how risk is managed in the HR area.

A “disciplinary termination” submitted by an employee? The employer cannot reject it.

The termination of an employment contract by an employee under Article 55 of the Labour Code takes effect upon the effective submission of the statement. This means that the employer cannot refuse to terminate the employment relationship, even if they consider the employee’s decision to be unjustified.

What can the employer do?

• Despite the obligation to issue an employment certificate, the employer may question the legitimacy of the contract’s termination, refuse to pay compensation, or – in specific cases – claim compensation from the employee for the unjustified termination of the employment relationship.
• However, the employer’s claims are limited. The regulations provide for the possibility of seeking compensation, but do not provide grounds to demand the employee’s reinstatement to work.

“The employee is on sick leave (L4), so there is nothing we can do.”

This is one of the most frequently repeated myths in employment law. Natalia Wojciechowska-Chałupińska, in a commentary for Gazeta Prawna, explains when the protection of an employee on sick leave is not absolute and what exceptions the regulations provide for.

What does this mean for employers?

• Sick leave does not preclude the termination of an agreement in every situation – the regulations provide for exceptions, e.g. in the event of long-term incapacity for work or a severe breach of employee duties.
• Every decision requires an individual assessment of the factual state and the correct application of the regulations, as mistakes at this stage often lead to court disputes.

Reclassification of B2B Contracts: What to pay attention to during an audit?

During an inspection, it is not only the content of the contract that matters, but above all, the way it is performed.

An audit of B2B contracts should not be limited to analysing contractual provisions. Controlling bodies also verify the practice of cooperation – procedures, rules applicable in the organisation, and the actual way duties are performed. It is on this basis that they assess whether the relationship is indeed of a B2B nature.

What is worth paying attention to?

• An effective audit covers not only contracts but also processes, internal documentation, and the daily practice of cooperation. These often determine the risk of reclassifying the contract into an employment relationship.

Free webinars concerning audits of B2B contracts and the practical aspects of preparing an organisation for an inspection are also available on the LBKP website.

DORA: new EBA guidelines for the financial sector. The EBA expands its approach to supplier risk management.

Financial institutions that have completed the implementation of DORA should not treat it as a closed project. The European Banking Authority (EBA) has just launched consultations on new guidelines concerning the management of risks related to external suppliers. This is another step showing the direction in which supervision will develop.

The most important conclusion? Supplier risk management is ceasing to be the exclusive domain of IT and cybersecurity departments.

The new guidelines indicate that financial institutions should pay even more attention to:

• the entire lifecycle of cooperation with a supplier – from selection and risk assessment, through ongoing monitoring, to the termination of cooperation,
• managing concentration risk, i.e., identifying situations where too many critical services rely on a single supplier or the same group of suppliers,
• governance and business responsibility – supplier risk management is to be a process involving not only IT, but also compliance, risk management, procurement, and the management board.

Although the guidelines are still at the consultation stage, they already show the direction of European regulators’ expectations. For banks and other financial institutions, this means it is worth taking another look at the supplier management model, the division of responsibilities, and the processes for monitoring services provided by external entities.

DORA is increasingly clearly demonstrating that digital operational resilience does not end with the security of IT systems. It encompasses the entire ecosystem of suppliers upon whom the continuity of the organisation’s operations depends.

AML is no longer the domain of banks. It is increasingly becoming the responsibility of management boards.

AML (Anti-Money Laundering) – New EU regulations and the expansion of the list of obliged institutions mean that AML is covering further sectors of the economy. At the same time, expectations towards organisations regarding effective risk management and supervision of the compliance system are growing.

Why is this important? AML is becoming an element of corporate governance. The obligations of management boards and their responsibility for ensuring an effective anti-money laundering system are of growing importance.

Merely having procedures is not enough. Organisations should regularly update their risk assessments, adapt their AML system to their operations, and demonstrate that the solutions applied work in practice.

NIS2: the first deadlines are already running. Does your organisation know that it is covered by the new obligations?

The new regulations cover a much broader catalogue of organisations than previous cybersecurity regulations. The sectors covered by the act include, among others, energy, transport, banking and financial market infrastructure, healthcare, digital infrastructure, telecommunications, ICT service management, postal services, waste management, chemicals and food production, as well as selected types of manufacturing and digital services.

In practice, this means that the regulations may apply to, among others, banks, hospitals, energy companies, cloud service providers, data centres, managed service providers (MSPs), managed security service providers (MSSPs), telecommunications undertakings, trust service providers, marketplace platforms, internet search engines, postal and courier companies, electronics and medical device manufacturers, or companies from the chemical, food, and waste management sectors.

Podmiot kluczowy czy ważny?

An essential or important entity? The industry itself does not yet determine the organisation’s status.

When determining whether a given organisation is an essential entity, an important entity, or is not subject to the act at all, one must primarily analyse:

• the actual scope of operations and services provided,
• the sector and type of entity indicated in Annex 1 or 2 to the act,
• the size of the enterprise, taking into account partner and linked enterprises,
• specific rules arising from Article 5 of the act.

In simplified terms: entities operating in the sectors indicated in Annex 1 can be essential or important entities depending on, among other things, their size. Entities from Annex 2 meeting the appropriate size criteria are generally important entities. However, the act provides for exceptions and special rules for, among others, electronic communications undertakings, DNS service providers, trust service providers, or managed security service providers.

Therefore, a cloud provider, data centre, or company providing IT services does not automatically become an essential or important entity solely due to the type of its operations.

This is important because the new regulations are not based on an individual notification from the authority. It is the entrepreneur themselves who should analyse their operations and assess whether they meet the criteria for being deemed an essential or important entity. If so, specific obligations and deadlines arise. One of the closest is 3 October 2026, by which many entities will have to register in the KSC (National Cybersecurity System) Register. Another significant deadline is 3 April 2027, when the period for implementing the obligations arising from the act and starting to use the S46 system expires.

In practice, however, preparation for NIS2 does not come down to registration. Organisations should verify, among other things, the way cybersecurity risk is managed, incident reporting procedures, business continuity plans, supply chain security, and the division of responsibilities between the management board, IT, compliance, and business. It is these areas that will be of crucial importance when assessing compliance with the new requirements.

If your organisation has not yet checked whether it falls within the scope of NIS2, it is worth doing so as soon as possible. In many cases, the greatest risk will not be the lack of a single procedure, but starting the entire adaptation process too late.

Coldplay in Fortnite. When music becomes a gameplay element

On the occasion of the premiere of the Moon Music album, the band Coldplay appeared in the playable iHeartLand experience in Fortnite. This is an interesting example showing that the use of music in games increasingly goes beyond the classic soundtrack and becomes an integral element of gameplay mechanics. From a legal perspective, this means much more complex issues related to the licensing of copyright.

Why is this important?

• When using music in games, it is necessary to properly secure the rights to the compositions, recordings, and artistic performances, as well as define the rules for using the works in trailers, live broadcasts, or materials published on social media.
• The more tightly music is integrated with the game mechanics – e.g. triggered by the player’s actions, looped, or constituting a gameplay element – the more important it becomes to precisely define the scope of the licence and ensure compliance with the requirements of distribution platforms.

A publishing agreement is not a formality. It is one of the most important stages of a game’s commercialisation.

For many game development studios, negotiations with a publisher are their first experience of this kind. Meanwhile, publishers conclude similar agreements regularly and know perfectly well which provisions are of the greatest importance for the project’s future. As a result, it is during the negotiation stage that decisions are often made that affect how the game is commercialised and the scope of rights remaining with the studio.

Why is this important?

• Well-prepared negotiations allow for a conscious determination of the rules regarding intellectual property rights, revenue sharing, the parties’ obligations, or the possibilities for further project development. It is these provisions that often have a greater impact on the studio’s future success than the mere signing of the agreement.
• In practice, it is worth remembering that experience in game development does not always go hand in hand with experience in negotiating publishing contracts. Proper preparation for talks allows the studio’s interests to be better protected and avoids the consequences resulting from unknowingly accepted clauses.

Does “buying a game” mean owning it?

The Stop Killing Games initiative has sparked a broad discussion about players’ rights and publishers’ obligations after ending support for games. Although the European Commission’s response does not mean imposing an obligation on publishers to maintain online infrastructure for an unlimited time, the debate has once again drawn attention to the issue of transparency towards consumers using digital products.

A question worth asking yourself: Players should know already at the purchase stage whether they are buying a game or merely a licence to use it, how long the product will be supported, and what will happen to it after the servers are shut down. Clear rules regarding the access model and the publisher’s obligations can reduce the risk of misunderstandings and increase trust in the market.

The discussion around the Stop Killing Games initiative will probably not end with the European Commission’s response. The planned Digital Fairness Act may become the next step towards strengthening information obligations towards consumers and setting new standards for the digital games industry.

LBKP’s Plans for August: HR, Employment Law, and Webinars

August promises to be equally intense. In the coming weeks, we will be sharing further materials for entrepreneurs, HR departments, and the new technologies industry, as well as working on new initiatives that will respond even better to your needs.

It is worth following our profiles if you are interested in:

→ further analyses and commentary on employment law, AI, cybersecurity, AML, and GameDev,

→ new publications dedicated to legislative changes and their practical impact on business,

→ a new bulletin dedicated to HR specialists and employers, in which we will focus on the practical aspects of employment law, team management, and the most important challenges facing HR departments,

→ the return of our webinars as early as September – we are preparing further online meetings dedicated to the most current issues in the areas of law, tax, and business.

Thank you for reading the July issue of LBKP Inside. See you in the next edition!

The post July Round-up at LBKP: Employment Law, the AI Act, NIS2 and GameDev first appeared on Kancelaria LBKP.

1. The bank is no longer the sole gatekeeper
2. A procedure is no longer a “shelf-ware alibi”
3. “Should you have known?”
4. A company’s problem can quickly become a board member’s problem
5. AML is becoming an element of enterprise management
6. The new boundary of liability
7. AML is entering new sectors today. But above all, it is entering boardrooms.

For years, anti-money laundering (AML) was primarily associated with banks, financial institutions, beneficial owner forms, and a million questions about where the client got their money from. It was a world of procedures, transaction alerts, and specialists locked away in compliance departments. That world is now definitively coming to an end.

AML is increasingly ceasing to be the exclusive domain of the financial sector. Meanwhile, its core requirements are making their way into law firms, tech companies, accounting offices, estate agencies, crypto market operators, luxury goods traders, and even professional sports. The EU AML package further expands the catalogue of obliged entities to include, among others, a significant portion of the crypto sector, luxury goods dealers, as well as professional football clubs and agents.

At the same time, the European Anti-Money Laundering Authority (AMLA) has been established to strengthen and harmonise supervision across the entire system. However, this is not just about adding more industries to the legislation. Much more important is the shift in how liability is perceived.

The bank is no longer the sole gatekeeper

The AML system is based on the premise that it is not only the state that is supposed to “hunt down” criminals. Private entities standing between the client and the transaction are also expected to assist.

A bank sees the flow of money. An accountant knows the settlement structure. An estate agent sees who is buying the apartment. An advisor helps structure a transaction. A law firm may be involved in setting up a company, acquiring a business, or managing a client’s assets. In the eyes of the European legislator, each of these entities is a gatekeeper to the legitimate economy.

In Poland, advocates, attorneys-at-law, foreign lawyers, and tax advisors are already obliged entities when they provide assistance concerning, inter alia, the buying and selling of real estate or enterprises, managing assets, opening accounts, making contributions, and creating or managing companies. This does not mean that every piece of legal advice is subject to AML. It does mean, however, that a law firm participating in certain transactions can no longer assume that the issue of the origin of funds is solely the bank’s problem.

The same applies to entrepreneurs. Not every entrepreneur is directly an obliged entity. However, almost anyone can encounter AML as a bank client, a participant in a transaction, an entity disclosing its ultimate beneficial owner, or a contractor whose ownership structure, funding source, or payment routing starts to raise questions.

AML is therefore spilling beyond the formal statutory catalogue. It enters ordinary business operations through the back door, via banks, contractors, audits, financing, and corporate group requirements. The only limitation here is the “processing capacity” of the supervisory authorities.

A procedure is no longer a “shelf-ware alibi”

Even a few years ago, many organisations treated compliance quite simply: we write a voluminous procedure that is essentially unreadable, conduct some generic training, collect signatures, and place the document in a suitably thick binder or a beautifully named folder on a shared drive.

The binder had one fundamental advantage: it looked professional, and the drive was backed up.

The problem is that regulators are increasingly less likely to ask merely whether a procedure existed. They ask whether it was tailored to the actual business model, whether it identified specific risks, whether it was updated, and whether anyone checked if it was working.

In the current approach, risk assessment cannot be reduced to labelling a client as “low”, “normal”, or “high”. The risk category must influence the scope and intensity of the actions actually taken. A change in product, distribution channel, geographical area, client structure, or political situation may require an immediate update of the assessment. The authority also expects the documentation to allow for the verification of the effectiveness of the measures applied, and for the risk assessment to be approved by responsible persons at the management level.

In other words, a procedure sitting on a server proves at most that someone knew how to write or outsource writing. It does not prove that the organisation knows how to manage risk.

“Should you have known?”

This is where the most dangerous shift occurs.

Liability is increasingly not based solely on the question of whether someone actually knew about the suspicious nature of a transaction. The question of whether you should have noticed it under a properly organised system is becoming ever more crucial.

Did the client’s profile match the nature of the transaction? Was the source of funds credible? Did the ownership structure make commercial sense? Was the sudden change in payment routing explained? Did the intermediary have a genuine business justification? Did anyone connect several seemingly neutral pieces of information?

This is no longer a classic document check. It is an obligation to draw conclusions.

The regulator does not expect clairvoyance. However, they do expect the organisation to know its own business well enough to spot anomalies. And when something is missed, a very uncomfortable question will arise: was it a failure of the employee, the procedure, the IT system, or perhaps the management board that approved an operational model without adequate safeguards? This is precisely where the boundary between compliance and personal liability blurs.

A company’s problem can quickly become a board member’s problem

The Polish AML Act does not leave this solely in the realm of best practices.

In an obliged entity where a management board operates, a person responsible for the implementation of AML duties must be designated from among its members. This is not an honorary function or a mere footnote in an organisational resolution. The Act allows for financial penalties to be imposed on persons responsible for fulfilling AML obligations. It also provides for the possibility of a temporary ban on holding managerial positions. In specific cases, breaches of reporting obligations may even lead to criminal liability.

Naturally, a board member is not expected to personally analyse every transaction. However, they are expected to ensure that there is an efficient system, adequate resources, a clear division of responsibilities, and a realistic escalation path.

Therefore, it is not enough to say, “We have an AML officer for that”.

The board may delegate the execution of tasks. It cannot delegate the entire problem and then pretend that AML reports were just an exotic, graphically pleasing addition to the board meeting materials.

Situations where the compliance unit has been signalling staff shortages, inefficient tools, backlogs in client reviews, or data quality issues for months, while the management merely notes the information and calmly moves on to the sales agenda, become particularly risky.

Such a meeting minute may one day turn out to be more interesting than many a procedure.

AML is becoming an element of enterprise management

The biggest mistake today is treating AML as an isolated regulatory island. Money laundering risk is intertwined with sanctions risk, corruption, tax, reputational, cyber risks, and the criminal liability of management.

A new product, expansion into a foreign market, a company acquisition, a venture into digital assets, serving clients from high-risk countries, or a change in the payment model are not purely business decisions. They should also trigger questions about AML implications.

Therefore, a properly functioning system cannot be built once and for all. It must respond to changes in the company’s operations. If the business has changed but the risk assessment remains the same, it usually does not mean the risk has been stable. It means nobody has looked at the document.

The new boundary of liability

AML is no longer just about fighting a suitcase of cash brought into a bank by a man in dark glasses looking like someone from a B-movie gangster film. Today’s risk hides in multi-level ownership structures, cross-border payments, digital assets, seemingly legitimate investments, brokerage agreements, and transactions, each of which looks perfectly innocent on its own.

Consequently, the expectations towards those responsible for the organisation are also changing. It is not enough not to know. You also have to demonstrate that the organisation did everything that could reasonably be expected of it to find out. And this is exactly where the comfortable world of compliance understood as a set of documents ends. What begins is accountability for decisions, omissions, lack of resources, and risks that nobody wanted to see.

AML is entering new sectors today. But above all, it is entering boardrooms.

AML is entering new sectors today. But above all, it is entering boardrooms, and it is there that the decision is made as to whether the company truly understands its risks or merely possesses a document covering them. If you are not sure which side your organisation stands on, we will help you find out before the regulator asks.

The post AML is “sailing” into broader waters. Do you know who is responsible for it today? first appeared on Kancelaria LBKP.

In LBKP Inside, we have brought together the most interesting materials published in June – from expert analyses and events to selected publications from the #TechnoLegals programme. We hope this newsletter serves as a convenient way for you to quickly catch up on the month’s key topics.

LBKP Among the Most Innovative Law Firms

This was an exceptional month for us.

During the gala of the 24th Rzeczpospolita Law Firm Ranking, we were awarded distinction in the “Most Innovative Law Firms of 2025” category.

This distinction is particularly valuable as it was awarded not for a single tool or technology, but for the way we collaborate with clients – based on Embedded Legal, Business First Policy, and Legal Solutions Not Hours.

Additionally, we once again ranked in the TOP 10 largest law firms in Lower Silesia.

On the Regulatory Radar

AI Act with Important Changes: EU Council Approves Simplification of Rules (Omnibus VII)

At the end of June, the Council of the European Union gave its final approval to a package of amendments simplifying the application of the AI Act. This is one of the most important regulatory decisions concerning artificial intelligence since the adoption of the regulation.

The new rules aim to reduce administrative burdens on businesses, clarify obligations related to high-risk AI systems, and better coordinate the AI Act with sector-specific regulations.

In brief:

• Postponed deadlines: Obligations concerning high-risk AI systems have been pushed back – for some systems, they will apply from 2 December 2027, and for systems embedded in products, from 2 August 2028.
• Bans: From December 2026, using AI to create non-consensual sexual deepfakes and child sexual abuse material will be strictly prohibited.
• Guidance: The European Commission will prepare additional guidance to help businesses implement AI Act requirements and reduce administrative burdens.

This is a topic we will be monitoring closely in the coming months, as the changes are of significant importance for organisations developing or utilizing AI systems.

Expert Appearances & Events

Marek Czwojdziński spoke at the Game Industry Conference, where he discussed the legal risks associated with using assets in video games and how studios can effectively protect their projects as early as the production stage.

Two key aspects to keep in mind:

• Not every “free” asset can be used without restrictions – before using one, it is advisable to verify licence terms and rights for further use.
• Proper intellectual property management at the production stage helps mitigate the risk of disputes and costly problems after the game’s release. View the event coverage.

Meanwhile, Paweł Kempa-Dymiński took part in the Re:Mind 2026 conference, joining a panel dedicated to lawyers’ well-being to discuss the impact of organisational culture, AI, and generational shifts on the modern job market.

Key takeaways for organisations:

• Employee well-being is increasingly becoming a core element of organisational strategy – affecting not only team satisfaction, but also work quality, reduced staff turnover, and business growth.
• Newer generations define professional success differently, making the creation of a healthy work environment one of the key challenges for modern employers.

Cardboard Doesn’t Always Mean Eco

“Eco” Is Not Enough: How to Protect Your Company from Greenwashing Allegations?

Anna Żmidzińska and Andrzej Miziołek showed how to prepare an organisation for changes resulting from the EmpCo Directive, PPWR, and EPR (ROP), and how to reduce the risk of greenwashing when designing packaging.

What does this mean for businesses?

• Environmental claims must be specific, documentable, and backed by evidence – general terms like “eco” or “environmentally friendly” may soon no longer suffice.
• Safe packaging optimisation requires collaboration not just within marketing, but also across legal, ESG, procurement, and product development departments.

Estonian CIT Debunked

Katarzyna Kot explained when Estonian CIT (corporate income tax) can truly be a beneficial solution, and when the classic taxation model remains the safer choice. The webinar served as a practical guide for entrepreneurs planning a change in their taxation model.

Key takeaways from the webinar:

• Estonian CIT is not a one-size-fits-all solution – the decision to change tax models should be preceded by an analysis of the company’s operational profile and business goals.
• Prior to implementation, it is essential to verify entry conditions and potential risks associated with hidden profits and non-business expenses.
• When structured properly, Estonian CIT offers numerous opportunities.

Must-Read Publications

AI Does Not Relieve You of Responsibility

Katarzyna Kot commented on the widely discussed Supreme Administrative Court (NSA) ruling regarding the use of artificial intelligence in drafting court pleadings. This is an important voice in the debate on the responsible use of AI in professions of public trust.

What does this mean in practice?

• AI can support a lawyer’s work, but it does not assume responsibility for verifying sources, the correctness of legal arguments, or the quality of the service provided.
• Professionalism in the era of AI lies not in abandoning new technologies, but in using them consciously and responsibly.

Cross-Border Disputes – Before Filing a Lawsuit

Is a judgment alone enough to recover debts from a foreign contractor? In our June publication, we explain why, in cross-border disputes, planning effective enforcement in advance and analysing procedures in other jurisdictions is just as critical as drafting the lawsuit itself.

In brief:

• Obtaining a judgment alone does not guarantee debt recovery – planning effective enforcement abroad in advance is equally important.
• The earlier procedural and international issues are analysed, the greater the chances of actual debt recovery.

Labour Market Collusion Under the UOKiK Spotlight

Can non-poaching clauses violate competition law? This topic is increasingly emerging in day-to-day business practice.

In brief:

• Non-poach / non-solicitation clauses, which were standard contract terms just a few years ago, may now carry significant legal risks and attract scrutiny from UOKiK (Office of Competition and Consumer Protection).
• Protecting company interests today requires solutions that are not only effective but also legally compliant – it is worth periodically reviewing standard agreements and clauses.

What Lies Ahead?

July promises to be just as intensive.

In the coming weeks, we will be sharing further materials for entrepreneurs and HR departments, as well as continuing our expert series.

Follow our profiles if you are interested in:

• ➔ A new series by Paweł Kempa-Dymiński dedicated to practical aspects of employment law and the termination of employment relationships,
• ➔ Upcoming tax webinars hosted by Katarzyna Kot,
• ➔ Further events and publications on ESG, EmpCo, PPWR, and EPR (ROP) with Anna Żmidzińska,
• ➔ Expert commentary on AI and new technologies in business – check out Jacek Cieśliński, Mateusz Borkiewicz, Grzegorz Leśniewski, and Ewa Knapińska for the latest insights on AI, e-commerce, and GDPR (RODO),
• ➔ Speaking engagements by our experts at industry conferences.

See you in the next edition of LBKP Inside!

The post July in LBKP first appeared on Kancelaria LBKP.

On 30 April 2026, the Sejm passed the first of three amendments to the Tax Ordinance, which included significant standardisation for the publication of tax rulings issued by local government tax authorities.

Subsequently, on 15 May 2026, the Sejm passed two further amendments to the Tax Ordinance. Their main part was due to come into force on 1 October 2026. The scope of the planned changes was broad and included both deregulatory solutions that were favourable to taxpayers, and regulations raising major doubts – primarily in the area of the statute of limitations for tax liabilities and penal fiscal liability.

Ultimately, the fate of some of the amendments turned out differently.

Amendments providing for:

1. The extension of the obligation to publish local government tax rulings in the EUREKA system,
2. Simplifications for entrepreneurs, including changes to the reporting of domestic tax schemes,

were signed by the President of the Republic of Poland.

On the other hand, the act encompassing changes to the suspension of the statute of limitations for tax liabilities and penal fiscal liability was vetoed.

What does this mean for entrepreneurs and what changes should they prepare for in the coming months?

Vetoed Tax Changes: Statute of Limitations and Penal Fiscal Code

One of the key proposals provided for the repeal of the controversial Article 70 § 6 point 1 of the Tax Ordinance. This provision concerns the suspension of the statute of limitations for a tax liability in connection with the initiation of penal fiscal proceedings.

In practice, this mechanism has raised doubts among taxpayers and legal representatives for years. The initiation of penal fiscal proceedings could lead to the suspension of the statute of limitations, and thus extend the period during which the taxpayer remained in uncertainty regarding the final settlement of their tax liabilities.

The vetoed act also included a change to the Penal Fiscal Code concerning Article 44 § 2 (specifically, its repeal). Currently, this provision serves a significant protective function, as it links the possibility of conducting penal fiscal proceedings with the expiry of the tax due itself. In other words, in certain cases, the expiry of the tax liability also limits the possibility of further prosecution for a penal fiscal offence related to that liability.

The planned repeal of this provision sparked critical voices from some business circles. It was pointed out that the change could lead to an extension of the period of penal fiscal liability, even when the tax liability itself had already expired. The Ministry of Finance, on the other hand, argued that the proposed solution was systemically coherent and justified from the point of view of the structure of penal fiscal liability.

Why Did the Polish President Veto the Tax Law Amendments?

The President of the Republic of Poland decided to veto the act encompassing changes to the Tax Ordinance and the Penal Fiscal Code. The justification for the decision emphasised the need to protect the legal security of citizens and the predictability of the state’s actions towards taxpayers.

From the perspective of entrepreneurs, this means that the planned changes in this area will not enter into force at this point. At the same time, it should be borne in mind that the legislative procedure may still be continued. The Sejm has the power to override the President’s veto if it obtains a 3/5 majority vote in the presence of at least half of the statutory number of MPs.

What the Presidential Veto Means for Businesses in Poland

The veto – in the context of one of the planned amendments – has a twofold meaning for taxpayers:

• Firstly, the controversial Article 70 § 6 point 1 of the Tax Ordinance, used by tax authorities to instrumentally extend the statute of limitations, remains in force.
• Secondly, the current wording of Article 44 § 2 of the Penal Fiscal Code is preserved. For entrepreneurs, this means maintaining a favourable solution which, in certain situations, limits the possibility of conducting penal fiscal proceedings after the tax liability has expired.

In practice, taxpayers have therefore avoided one of the more controversial changes, but at the same time, there will be no repeal of the provision which has raised objections for years due to the possibility of extending tax proceedings.

New Tax Regulations: Amendments Signed by the President

Regardless of the vetoed act, the President of the Republic of Poland signed two further amendments to the Tax Ordinance.

This is a package of deregulatory and standardising changes aimed at simplifying some of the taxpayers’ obligations, streamlining day-to-day relations with the tax administration and standardising tax knowledge bases.

The End of Domestic MDR Reporting in Poland

One of the most important changes is the abolition of the obligation to report domestic tax schemes, i.e., so-called domestic MDRs (Mandatory Disclosure Rules).

Until now, MDR obligations were a significant organisational burden for many entrepreneurs, advisors, and accountants. They required the analysis of many economic events in terms of a potential reporting obligation, even in situations concerning exclusively domestic transactions.

The amendment aims to limit this obligation. It should be clearly emphasised, however, that the simplification concerns domestic tax schemes. The obligation to report cross-border schemes remains in force.

Simplified Tax Settlements and Facilitations with the Tax Office

The amendment also provides for a number of minor changes aimed at simplifying day-to-day tax settlements.

One of them is raising the limit of the tax amount that can be paid on behalf of another taxpayer – from PLN 1,000 to PLN 5,000. This change may have practical significance, e.g., in corporate groups, family businesses, and in situations where tax settlements are organisationally handled by another entity.

The new regulations are also to concern the rules of accounting for interest and procedures related to the refund of stamp duty and tax overpayments. The aim of these changes is to reduce minor formalities and speed up the handling of simpler tax matters.

EUREKA System: A Centralised Database for Local Tax Rulings

Additionally, the amendment provides for the standardisation of the rules for publishing tax rulings concerning local taxes and charges. Rulings issued by heads of rural municipalities (wójts), mayors, and city presidents are to be made available in a single database maintained by the Director of the National Revenue Information (the so-called EUREKA System).

This solution should make it easier for taxpayers to search for them and compare the positions of individual authorities. Until now, the publication of such rulings was dispersed across the websites of the administrative offices supporting the local government authorities issuing the rulings.

How to Prepare for the Upcoming Tax Changes in Poland?

Entrepreneurs should, first and foremost, verify how the signed amendment will affect their obligations regarding MDR and day-to-day settlements with the tax office.

It is also worth monitoring the further fate of the vetoed act, as a potential overriding of the veto by the Sejm could reopen the path to changes in the scope of the statute of limitations and penal fiscal liability.

At LBKP, we continuously analyse tax changes and their impact on entrepreneurs. Contact us if you want to streamline your tax procedures, verify your MDR obligations, or prepare your company for the new regulations.

The post Tax Ordinance 2026 – a review of changes following the decisions of the President of the Republic of Poland first appeared on Kancelaria LBKP.

In practice, most questions arise during dividend payouts. This is precisely when tax obligations arise for both the company and the shareholder. Properly establishing the tax base and correctly applying the PIT deduction mechanism provided for in the PIT Act is therefore of key importance.

How is a Dividend Taxed Under Estonian CIT? 

Under the Estonian CIT model, taxation at the corporate level occurs, as a rule, only at the time of profit distribution. As long as the funds remain within the company and are used for its business operations, no tax liability arises from the distributed profit. However, it is important to remember that the law also provides for other categories of taxable income, such as hidden profits or expenses unrelated to business activities.

When it comes to Estonian CIT on profit distribution, the lump-sum tax rate depends on the taxpayer’s status. For small taxpayers and start-ups, it is 10% of the tax base. Other taxpayers apply a 20% rate.

However, the settlement does not end there. A dividend payout also generates income for a shareholder who is an individual. This income is subject to a 19% flat-rate PIT.

Nevertheless, this does not mean that the same profit is fully taxed twice. The structure of the Estonian CIT includes a mechanism that limits the economic burden of double taxation. It consists of reducing the PIT due from the shareholder by a corresponding portion of the lump-sum tax paid by the company.

How Does the PIT Deduction Work? 

In the case of a dividend paid from profits earned during the period of Estonian CIT taxation, the shareholder’s PIT can be reduced by a portion of the corporate lump-sum tax components attributable to that shareholder.

In practice, this means that:

• With a 10% corporate tax rate, the shareholder can deduct 90% of their share of the corporate lump-sum tax.
• With a 20% corporate tax rate, the shareholder can deduct 70% of their share of the corporate lump-sum tax.

The amount of the deduction is therefore linked to the shareholder’s share in the profit and the lump-sum tax rate applied by the company.

A condition for applying this mechanism is, among other things, that the payout concerns profits generated during the period of corporate lump-sum taxation and properly separated within the company’s equity.

Gross Profit Amount or the Amount After Estonian CIT Deduction? 

In practice, taxpayers often wonder what amount should be used to calculate PIT on a dividend paid from profits taxed under Estonian CIT. The doubt boils down to the question: is the PIT base the gross amount of profit allocated for distribution, or the amount reduced by the lump-sum tax due from the company?

The current approach of tax authorities and administrative courts is quite clear in this regard. The PIT tax base should be the full (gross) amount of profit allocated for distribution, without prior reduction by the Estonian CIT due from the company. 

Consequently, the correct order of settlement is as follows:

1. The company determines the net profit amount allocated for distribution.
2. The company calculates the corporate lump-sum tax due on this amount.
3. The company calculates the shareholder’s 19% PIT based on the full dividend amount.
4. Finally, the company reduces the PIT by the appropriate portion of the lump-sum tax paid by the company.

Therefore, it would be incorrect to first reduce the dividend by the Estonian CIT and only then calculate the 19% PIT on that reduced amount. Such an action could lead to an underpayment of the tax collected by the company acting as the tax remitter.

Tax Calculation Example

Assume that a company allocates PLN 100,000 of profit generated during the Estonian CIT period for payout to its sole shareholder.

Scenario 1: The company applies the 10% rate

Corporate lump-sum tax:

$$10\% \times \text{PLN } 100,000 = \text{PLN } 10,000$$

PIT on dividend before deduction:

$$19\% \times \text{PLN } 100,000 = \text{PLN } 19,000$$

Deduction:

$$90\% \times \text{PLN } 10,000 = \text{PLN } 9,000$$

PIT to be collected from the shareholder:

$$\text{PLN } 19,000 – \text{PLN } 9,000 = \text{PLN } 10,000$$

Total tax burden: PLN 20,000, which constitutes 20% of the profit allocated for distribution.

Scenario 2: The company applies the 20% rate 

Corporate lump-sum tax:$$20\% \times \text{PLN } 100,000 = \text{PLN } 20,000$$

PIT on dividend before deduction:$$19\% \times \text{PLN } 100,000 = \text{PLN } 19,000$$

Deduction:$$70\% \times \text{PLN } 20,000 = \text{PLN } 14,000$$

PIT to be collected from the shareholder:$$\text{PLN } 19,000 – \text{PLN } 14,000 = \text{PLN } 5,000$$

Total tax burden: PLN 25,000, which constitutes 25% of the profit allocated for distribution.

Summary 

When paying out a dividend from profits taxed under Estonian CIT, the correct sequence of calculations is critical. The shareholder’s PIT must be calculated from the full amount of profit allocated for distribution, and only then should the statutory deduction of a portion of the corporate lump-sum tax be applied.

In practice, this means that Estonian CIT does not eliminate dividend taxation on the shareholder’s side, but it significantly reduces the overall tax burden. For small taxpayers, the effective taxation of distributed profit is generally 20%, and for other taxpayers, it is 25%.

Got Questions?

Do you need support with Estonian CIT or have doubts regarding the taxation of profit distribution? Contact us. We will help analyze your company’s situation, correctly establish the tax base, and safely settle your dividend.

The post Estonian CIT and Dividend Payouts: Tax Base and PIT Deduction Mechanism first appeared on Kancelaria LBKP.

Our experts Paulina Jeziorska and Zuzanna Prandecka-Walek have analysed this topic in Dziennik Gazeta Prawna. In the article, they discuss step by step what the amendment means in practice for local authorities – from determining who is subject to the new regulations, through the catalogue of obligations, to the sanctions regime.

A few points worth noting:

A new classification of entities. The previous model, which distinguished between operators of key services and digital service providers, is being replaced by a classification into key entities and important entities. In the case of local authorities, the decisive factor is not the scale of their operations, but the type of authority and its position within the structure. Key entities include, amongst others, district authorities and local councils employing at least 50 people. Important entities, in turn, include local government budgetary units, budgetary institutions, cultural institutions and municipal companies – provided they carry out public tasks using information systems.

The obligations go far beyond mere formalities. Implementing an information security management system, handling and reporting incidents, ensuring business continuity, and streamlining relations with suppliers – this is not a one-off project, but a permanent change in the way the organisation operates. For important entities that are public bodies, the legislator has also provided a specific list of minimum requirements in an annex to the Act.

The penalties are substantial. Fines can reach up to €10 million for critical entities and €7 million for important entities. The head of the entity is held personally liable – up to 100% of their salary in the case of public entities. The regulations grant the authority some flexibility in determining the penalty, taking into account, among other things, the entity’s financial capacity, but the lower thresholds are set by law.

A key point of interpretation: is a key entity that does not use information systems to carry out public tasks completely exempt from these obligations? The wording of the regulations does not provide a clear answer, which in practice may create uncertainty for local authorities.

For many local authorities, the coming months will test their ability to rapidly build up the expertise and structures that they simply have not needed until now. Putting this off is no longer an option.

The full article by Paulina Jeziorska and Zuzanna Prandecka-Walek is available in Dziennik Gazeta Prawna:

The post Cybersecurity in local government – from a technical issue to a board agenda item first appeared on Kancelaria LBKP.

In 2018, the Belgian Gaming Commission classified loot boxes as gambling and banned their sale for real money. Not because they were illegal under gambling law (lawyers argued about this for a long time), but because a mechanism that requires payment for a random chance of winning, aimed at children, is in practice a slot machine. Major studios, including Blizzard and EA, had to withdraw paid loot boxes from the Belgian market. However, enforcing the ban proved difficult and loot boxes continue to operate in Belgium to this day, but the precedent was clear – the regulator stated that the gaming industry’s business model could constitute gambling, and they were right. Despite strict regulations, research from 2021–2022 suggested that the ban was not fully enforced across all mobile games; however, the major studios (EA, Blizzard, Nintendo) complied with the requirements to avoid heavy financial penalties or even criminal liability.

In a few months’ time, a similar debate on the limits of the law will take place across the European Union, but this time it is not about gambling but the AI Act. A system that matches opponents to a player’s profile, a shop displaying offers at the perfect moment, a mechanism that calibrates difficulty so that the player does not give up – all of the above – if it analyses user data and makes decisions on that basis – constitutes AI within the meaning of the AI Act and falls under the scope of that legislation.

When a game algorithm ceases to be a mechanic and becomes an AI system in the legal sense

The AI Act defines an AI system by what it does, not by what it is called. If a system analyses user data and, on that basis, generates predictions, recommendations or decisions that influence the user’s behaviour, we have an AI system within the meaning of the law – regardless of whether the studio has called it an algorithm, a recommendation engine, or anything else. The line is not drawn where the industry is accustomed to drawing it, and this is precisely the source of a problem that most studios have yet to recognise.

Over the years, player matching algorithms have evolved from simply comparing statistics to models that analyse behavioural data, a player’s frustration levels, their spending history and susceptibility to a loss of control. As long as they served to improve gameplay quality, nobody had a problem with such mechanisms. The problem arises when the same data begins to be used to influence purchasing decisions, because that is when we enter an area that is explicitly prohibited by the AI Act. Systems designed to alter a user’s behaviour without their knowledge in a way that could cause them harm have been banned since February 2025, and the line between personalisation and manipulation is rarely clear-cut; it is precisely this line that will be the subject of the first major disputes between the regulator and the industry.

Dynamic pricing has been used in games for years and is rarely seen as a legal issue; however, players should be aware that the offer they see is not the same as the one someone else sees, and that the algorithm has made this decision based on their data. At the moment the player makes their choice, no one points this out to them or informs them of it.

As research published by BeGambleAware shows, just 5% of players generate half of the market revenue from loot boxes, suggesting that these systems exploit the behavioural biases of a specific group of users rather than relying on the informed purchasing decisions of the player base as a whole. If the algorithm adjusts the probability of items being drawn to match a player’s profile and spending history, the studio must be able to prove that the system does not employ manipulative techniques.

Children’s games – a separate category of risk that must not be ignored

This is the most challenging area and the one where the consequences could be the most serious. Games aimed at children or those played by large numbers of children, which use algorithms to optimise engagement and retention, may require a fundamental rights impact assessment before they are placed on the EU market, as the AI Act treats systems that may affect minors particularly strictly. An algorithm that analyses a child’s behaviour in order to extend their gaming session and increase the likelihood of a purchase is a system that may affect the fundamental rights of a minor. The situation is complicated by the fact that the GDPR and the DSA both impose their own obligations on users under the age of eighteen, meaning that a studio developing a children’s game with an advanced retention system could find itself subject to three different regulatory regimes at the same time, and none of them will be willing to accept that it was merely an innocent part of the game.

What do game developers need to document and report?

For low-risk AI systems, the requirements are modest, but they do exist, as users interacting with a generative AI system must be aware of this, and a shop powered by a recommendation algorithm should operate in a way that is understandable to the user. In contrast, for systems classified as high-risk, the scope of obligations is much broader, as it includes implementing a risk management system throughout the product lifecycle, maintaining technical documentation, ensuring automatic event logging and human oversight of important system decisions, and registering the system in the EU database prior to deployment. All of this requires planning at the level of the entire game development process.

There is one further issue that the industry regularly overlooks. A studio that uses off-the-shelf AI tools from an external supplier and implements them under its own brand or adapts them to its own purposes may be considered an AI system provider rather than merely a user, thereby bearing the full scope of a provider’s responsibilities, including conformity assessment and registration. A studio that takes a ready-made AI tool and configures it for its own use cannot assume that the responsibility for regulatory compliance lies with the provider, as this is not the case under the AI Act.

How can a game development studio prepare for the requirements of the AI Act before the regulations come into force?

The starting point is to identify which elements of the game actually analyse player data and do something with it, as this is where risk classification begins. For each such element, it is worth checking whether it could influence the player’s financial decisions, whether it is aimed at children, whether it analyses behavioural or emotional data, and whether it might operate in ways of which the player is unaware. The more affirmative answers there are, the higher the risk classification and the broader the scope of obligations.

Added to this is a review of contracts with external AI tool providers, as those signed before 2025 almost certainly do not regulate the division of liability in the event of a query from the regulator. This is a mistake that is easy to rectify now but difficult to explain later. For years, the game development industry had plenty of scope for innovation before regulation caught up with technology. In the case of the AI Act, that window has closed; the regulations are in force and penalties can reach 7% of global annual turnover. A studio that carries out an analysis now has time to adapt calmly. One that waits will only discover the extent of the problem when it already has to act quickly.

If you would like to discuss this, please do not hesitate to contact us. 

The post Your game could be a high-risk system. The AI Act and what game developers don’t yet know first appeared on Kancelaria LBKP.