The Polish authority for the protection of personal data (UODO) publishes initial question lists intended to guide organizations before creating or using artificial intelligence systems.

This initiative follows a study revealing that between 41% and 58.5% of entities do not perceive the link between artificial intelligence and the processing of personal data, and that 95.9% do not consider themselves ready for GDPR-compliant implementation. These questionnaires aim to encourage a compliance analysis upstream of tool deployment. The authority specifies that these lists do not replace a risk analysis or a data protection impact assessment, nor do they constitute a binding legal interpretation of the applicable provisions.

Four sets of questions are proposed, adapted to different contexts: one for small and medium-sized enterprises using ready-made AI systems, one for entities in the public sector, and a "Version 0" for organizations developing or retraining their own models. An "Extended Version," common to all, also addresses future obligations of the AI Act, such as risk classification and impact assessment on fundamental rights. Feedback on the use of these lists can be submitted to the authority until September 30, 2026.