The core regulatory stack for most companies with Polish entities includes: GDPR (data protection, applies from day one of EU data processing); the EU AI Act (phased obligations from 2025 through 2027 depending on system type); NIS2 (cybersecurity incident reporting and supply chain requirements for companies in or supplying to covered sectors); CSRD (sustainability reporting obligations for larger entities and, indirectly, for smaller companies in their supply chains); and sector-specific requirements if the operation is in financial services, healthcare, energy, or other regulated industries. The applicable set depends on the entity’s size, sector, and operational footprint.

Yes. The EU AI Act applies to providers and deployers of AI systems when those systems are placed on the EU market or used in the EU — regardless of where the company is incorporated. A US company that deploys an AI system in its Polish entity, or that provides an AI product to EU customers, can be subject to AI Act obligations. The specific requirements depend on the risk classification of the system. Prohibited practices and AI literacy requirements became applicable in February 2025; most other obligations phase in through 2026 and 2027.

CSRD obligations are triggered at the entity level based on size thresholds (number of employees, balance sheet, net turnover) and, for EU subsidiaries of non-EU groups, can apply even when the Polish entity doesn’t independently meet the thresholds if the parent group does. The practical effect is that US companies with larger EU operations may face EU sustainability reporting obligations — including double materiality assessment and ESRS-aligned disclosure — even though the legal entity is a Polish subsidiary of a US parent. We assess applicability based on the specific group structure and operational numbers.

NIS2 applies to entities in 18 critical sectors and important sectors — including digital infrastructure, cloud services, managed service providers, energy, financial market infrastructure, health, and others. The obligation extends to the supply chains of covered entities, which means a US company that provides ICT services or software to a NIS2-covered Polish entity may face contractual compliance requirements even if it isn’t directly covered. Polish NIS2 transposition requires covered entities to implement risk management measures, report incidents within defined timelines (24 hours for early warning, 72 hours for initial notification), and manage their supply chain security.

Policies and procedures are documents. A compliance program is a functioning system: someone owns it, it maps to actual obligations, it’s updated when regulations change, it connects to how operations actually run, and it produces the documentation you need to demonstrate compliance to a regulator, auditor, or investor. Most US companies with EU operations have policies. Fewer have programs. The distinction matters in enforcement and diligence: a regulator or acquirer can assess whether a program was functioning; they can only read whether a policy existed.

We start with a regulatory scope assessment — a structured review of what the Polish entity does, what data and systems it operates, what sectors it participates in, how it manages vendors, and what its size thresholds are. From that, we produce an obligation map: which regulations apply, which are currently live, which are approaching, and where the entity stands against each. The assessment typically takes two to three weeks and produces the prioritized action plan we then use to scope any program-building work.