Poland
8 regulators · 13 laws & regulations · 3 obligations · 47 enforcement actions
Poland is a parliamentary republic and has been a member of the European Union since 1 May 2004, with Warsaw as its capital.
Regulatory pulse · 90 days
Laws & Regulations Enforcement NewsOverview
Poland is a parliamentary republic and has been a member of the European Union since 1 May 2004, with Warsaw as its capital. It is outside the euro area and uses the złoty (PLN). In 2025 its GDP per capita was EUR 33,800, below the EU average of EUR 41,600, and it produced 4.9 per cent of EU GDP. Its legal system follows the civil-law tradition, and Art. 87 of the Constitution lists the Constitution, statutes, ratified international agreements and regulations as universally binding law.
The IMF's 2025 Article IV assessment (February 2026) says inflation had returned to target and names the fiscal deficit, projected at 7 per cent of GDP in 2025, as the main vulnerability, with public debt at 59 per cent of GDP. MONEYVAL's 2021 mutual evaluation lists tax offences, corruption, drug trafficking, human trafficking and migrant smuggling among the main proceeds-generating crimes in Poland's 2019 national risk assessment. It describes Poland as a transit country for illegal immigration and drug trafficking, treats casinos as among the riskiest non-financial sectors, and rated the effectiveness of confiscating criminal proceeds as low. Poland entered MONEYVAL's compliance enhancing procedures in December 2025, and a report of 27 May 2026 kept it at step 1 because Recommendations 5 and 20 were still rated partially compliant.
The Commercial Companies Code of 15 September 2000 governs the limited liability company and the joint-stock company. According to the Polish Investment and Trade Agency's 2023 guide, a joint-stock company has a management board and a supervisory board, while a limited liability company needs a supervisory board or audit committee only where its capital exceeds PLN 500,000 and it has more than 25 shareholders. Warsaw Stock Exchange listed companies follow the Best Practice for GPW Listed Companies 2021, in effect from 1 July 2021, and must disclose whether they apply its voluntary principles. The Central Register of Beneficial Owners (CRBR) under the Act of 1 March 2018 is a public electronic register, kept under the minister responsible for public finance, to which companies, cooperatives, foundations, associations and certain trusts report their beneficial owners.
EU sanctions regulations apply directly in Poland, and MONEYVAL found in 2021 that Poland implements UN Security Council resolutions 1267 and 1373 without delay through EU and national law, though DPRK proliferation measures could still be delayed. The Act of 13 April 2022 on special solutions to counter support for aggression against Ukraine adds a national sanctions list kept by the minister responsible for internal affairs, and makes the Head of the National Revenue Administration (KAS) responsible for national tasks under EU Regulations 765/2006 and 269/2014. Failure to meet the freezing duty can bring a financial penalty of up to PLN 20 million, and breaching specified prohibitions of Regulation 765/2006 is a criminal offence. GIIF also keeps a national list of specific restrictive measures under the Act of 1 March 2018 and must be told of any UN-based freeze within two business days. The sources reviewed do not describe how non-EU sanctions reach firms operating in Poland.
Recent enforcement
Open tracker →| Date | Entity | Regulator | Action | Source |
|---|---|---|---|---|
| Oct 2026 | Allied Funds Towarzystwo Funduszy Inwestycyjnych SA | KNF | Settlement | official |
| Oct 2026 | Towarzystwo Funduszy Inwestycyjnych Agro SA | KNF | Monetary Penalty | official |
| Oct 2026 | Compensa Towarzystwo Ubezpieczeń Spółka Akcyjna Vienna Insurance Group | KNF | Monetary Penalty | official |
| Sep 2026 | Amathus Towarzystwo Funduszy Inwestycyjnych SA | KNF | Monetary Penalty | official |
| Sep 2026 | AgioFunds Towarzystwo Funduszy Inwestycyjnych SA | KNF | Monetary Penalty | official |
Industry compliance
Essential obligations
All obligations →| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Internal whistleblowing channel and handling of reports | Acknowledge within 7 days; feedback within 3 months | Rzecznik Praw Obywatelskich (Commissioner for Human Rights) | source | |
Art. 23(1) requires an internal reporting procedure in legal entities with at least 50 people performing paid work; Art. 23(3) removes the threshold for certain sectors such as financial services. Art. 25(1)(5) requires acknowledgement within 7 days and Art. 25(1)(7) feedback within 3 months. Retaliation is prohibited (Art. 11), and failing to set up a procedure is punishable by a fine (Art. 58). |
||||
| Notify the President of UODO of the appointment of a data protection officer | Within 14 days of designation or change | UODO | official | |
Art. 10(1) requires the entity to notify the President of UODO within 14 days of designating a data protection officer; Art. 10(4) applies the same 14 days to changes and recall. Notification is electronic with a qualified or ePUAP trusted signature (Art. 10(6)), and the officer's details must be published on the entity's website (Art. 11). |
||||
| Personal data breach notification to the President of UODO | Without undue delay and, where feasible, within 72 hours of becoming aware | UODO | official | |
UODO states that the controller must notify the supervisory authority 'without undue delay' under Art. 33(1) GDPR unless the breach is unlikely to result in a risk to individuals, and must record the reasons for any decision not to notify; high-risk breaches also require notice to the individuals (Art. 34). Recital 85 of the GDPR on EUR-Lex adds 'where feasible, not later than 72 hours after having become aware of it'. Art. 55 of the national act lets the President run an ICT system for breach notifications. |
||||
| No obligations match these filters. | ||||
Quick links — official sites
- GIIF — Generalny Inspektor Informacji Finansowej (General Inspector of Financial Information)
- KNF — Komisja Nadzoru Finansowego (Polish Financial Supervision Authority)
- NBP — Narodowy Bank Polski (National Bank of Poland)
- UODO — Urząd Ochrony Danych Osobowych (Personal Data Protection Office)
- CBA — Centralne Biuro Antykorupcyjne (Central Anticorruption Bureau)
- CERT Polska — CERT Polska (CSIRT NASK), operated by NASK National Research Institute
- Rzecznik Praw Obywatelskich (Commissioner for Human Rights) — Rzecznik Praw Obywatelskich (Commissioner for Human Rights)
- UOKiK — Urząd Ochrony Konkurencji i Konsumentów (Office of Competition and Consumer Protection)
Newsletter
Get CRCGS Weekly
A free weekly email from the Centre for Risk, Compliance & Governance Studies: the week's regulatory news, new regulations, updated country profiles, and the Knowledge Hub's latest reading and events.