Before you deploy an AI tool: Poland's UODO questions for companies

What does UODO say, in short?

What are UODO's initial question lists for AI?

Four question sets UODO published on 6 August 2026: one for small and medium-sized businesses using ready-made AI systems, one for the public sector, a "version 0" for other organizations (including those building or fine-tuning their own models), and an extended version that also flags AI Act obligations. They were written by Prof. Dominik Lubasz (University of Łódź) with members of the Social Team of Experts to the UODO President and UODO staff.

What must be in place before an AI tool sees customer or employee data?

According to the SME version: a contract with the provider, an established legal basis for the processing, information for the people whose data goes into the tool, and knowledge of where that data is stored. If the tool affects people's situation, also review of the output by an employee. Team training, data-entry rules and an error procedure can run in parallel.

Does a completed list mean GDPR compliance?

No. UODO says the questions replace neither a risk analysis, a data protection impact assessment nor a fundamental rights impact assessment, are not a binding interpretation of the law and do not determine GDPR compliance. The answers don't have to be sent to the supervisory authority, but the completed list should be kept as evidence that the company checked these points before deploying.

What did UODO publish, and for whom?

Zanim wdrożysz narzędzie AI, sprawdź czy jest ono zgodne z zasadami RODO (Polish), UODO, 6 August 2026

• A survey by the Social Team of Experts to the UODO President found that 41 to 58.5% of organizations see no link between AI tools and processing personal data, and 95.9% do not consider themselves ready to deploy AI in line with the GDPR.
• The compliance question usually comes up once the tool is already running and the decisions about data and provider have been made. The lists are meant to get organizations to ask it before an AI system goes live.
• Four sets: for SMEs using ready-made AI systems, for the public sector (with the legality principle and administrative procedure rules), a version 0 for other organizations, including those building or fine-tuning their own models, and a shared extended version.
• The extended version covers the GDPR and flags AI Act duties: risk classification and the fundamental rights impact assessment. It is used when the entry-level list points to, for example, building or fine-tuning a model or an effect on people's legal situation.
• UODO encourages passing the material to data protection officers and to the people responsible for technology purchasing and deployment.

What does the SME version check?

Wersja dla MŚP: praktyczna checklista RODO dla wdrażania AI (DOCX, Polish), UODO, 6 August 2026

The list is for a company using a ready-made AI tool without training a model, and it is filled in separately for each use. The main questions, in the order of its sections:

• Purpose and AI system: what problem the AI should solve, whether the goal can be reached without AI, whether outputs affect customers or employees, and whether the company knows the system's architecture and configuration.
• Personal data: whether the tool processes data about customers, employees or business contacts (including AI inferences about people), whether that includes sensitive data or children's data, who in the company is responsible for data put into the AI, and what data may be entered.
• Legal basis: which Article 6(1) GDPR basis covers processing in the AI. If unknown, consult the DPO or a lawyer.
• AI provider: a processing agreement (Article 28 GDPR), the country where data is stored and any transfer outside the EU (Articles 44–49), open or closed model, whether the provider may train its models on the data entered and whether that can be switched off, and how long it keeps data and chat history and whether they can be deleted.
• If the provider uses the data for its own purposes, it no longer acts only on the company's instructions and becomes a controller for that part (Article 28(10) GDPR).
• Security and breaches: who has access to the account and the data (named accounts, two-factor authentication, Article 32) and who is responsible for reporting a breach within 72 hours (Articles 33–34).
• Protecting people: information that processing involves AI (Articles 13–14), handling rights over AI outputs, and real review of the output by an employee who can change it, not only approve it (Article 22).
• Documentation and risk: an updated record of processing activities (Article 30), data protection by design (Article 25), whether a DPIA is required (Article 35), the DPO's involvement, staff training and periodic review, because the provider may change the model and staff may change how they use the tool.
• AI Act: whether the system may be high-risk, whether the use is a prohibited practice (Article 5) and whether the transparency rules are met (Article 50).
• More than three "no" answers mean consulting a specialist before continuing to use the tool. If the tool is to make decisions about people on its own, without an employee, the way it is used has to change or it has to be dropped.
• The list is not enough when the company trains or fine-tunes a model, when the tool affects people's legal situation (recruitment, employee evaluation, customer scoring), when sensitive or children's data is involved, or when data leaves the EEA. Then the extended version or a specialist is needed.

What do the questions mean for a company, and which controls answer them?

A practical reading of the list for a company deploying ready-made AI tools: each block of questions, what it requires of the organization, and the controls that make it possible.

1. A reason for every use

   For each AI use, a stated purpose, expected benefits and its own completed list. Control: a register of AI uses and a separate key for each app, so it is clear what uses what.

2. Data-entry rules

   A named owner and written rules on what may and may not go into the tool (sensitive data, children's data). Control: an AI usage policy and team training.

3. Legal basis and notices

   An Article 6(1) GDPR basis and privacy notices that mention AI. Control: an updated record of processing activities and updated notices.

4. Processing agreement and location

   A signed processing agreement with the provider, a known storage country and an assessment of any transfer outside the EU. Control: DPA, sub-processor list and a restriction on where data is processed.

5. No training, defined retention

   Confirmation that the provider doesn't train on the company's data, and a known retention period for data and chat history. Control: a contract clause and zero data retention with the inference provider.

6. Access and breaches

   Named accounts, two-factor authentication, access only for those who need it, and an owner for 72-hour breach reporting. Control: single sign-on with the company's identity provider and a breach procedure.

7. An employee reviews the output

   Outputs about a person are checked by an employee who can change them. Control: a process description and staff instructions.

8. DPIA, DPO and review

   A decision on whether a DPIA is required, the DPO's involvement, and someone who periodically checks whether the tool or its use has changed. Control: assessment records and a log of configuration changes.

9. AI Act

   A check that the use is neither high-risk nor a prohibited practice, and that Article 50 transparency is met. Control: classification in the register of AI uses.

Which part does an AI gateway handle?

The legal basis, privacy notices, DPIA and employee review of outputs remain the company's work. Standard Compute, an AI gateway to frontier and open-source models, answers part of the "AI provider" and "Security" questions: where prompts go, who keeps them, which providers and models each key may use, who has access, and what record remains.

Questions from IT, data protection and security

Does UODO ban AI tools at work?

No. The lists ban nothing. They help a company establish before deployment whether using a given tool complies with the GDPR and what has to be done first.

Are UODO's lists mandatory?

They are not a binding interpretation of the law, and the answers don't have to be sent to the supervisory authority. The obligations come from the GDPR and the AI Act; the lists help organize them before a tool is bought or switched on.

Does an AI gateway make a company GDPR compliant?

No. A gateway handles a technical part: where data is processed, retention, approved providers and models, budgets and logs. The legal basis, the DPIA, privacy notices, the internal policy and employee review of outputs remain the company's responsibility.

Does Standard Compute keep the content of requests?

We process your prompts in memory to serve each request and never write them to storage or logs. Request records hold metadata only: model, provider, tokens, cost and status.

Official sources

Summary based on these documents, read on 9 November 2026. It replaces neither the documents themselves nor legal advice.

• Zanim wdrożysz narzędzie AI, sprawdź czy jest ono zgodne z zasadami RODO (Polish) (UODO, 6 August 2026)
• Wersja dla MŚP: praktyczna checklista RODO dla wdrażania AI (DOCX, Polish) (UODO, 6 August 2026)

Related