Regulation Watch: Poland, the UK and Japan - three routes to AI rules
Three of the markets we work in are on three different routes to AI rules. Poland built a national supervisor on top of the EU AI Act. The UK still regulates through existing regulators. Japan promotes first and relies on soft law.
Poland: a statute, a supervisor and a date
The Act of 3 July 2026 on artificial intelligence systems (Dz.U. 2026 poz. 1003) entered into force on 11 August 2026. It creates the Komisja Rozwoju i Bezpieczeństwa Sztucznej Inteligencji (KRiBSI) as market surveillance authority and single point of contact under the AI Act.
28 October 2026 is the date to note. From then, the provisions on individual opinions, inspections, proceedings, leniency settlements and fines apply. No enforcement action is possible before that.
The chair is in place: the Sejm resolution is dated 18 September 2026 and the Senate consented on 24 September. The first KRiBSI meeting must be convened by 11 November 2026.
A company can ask KRiBSI for an individual opinion on how the rules apply to its case. The deadline is 30 days, or 60 in particularly complex cases; if KRiBSI misses it, an opinion in line with the applicant's position is deemed issued. Lawyers quoted by Prawo.pl warn that opinions can later be revoked or expire.
United Kingdom: no AI statute, existing regulators
The UK has no AI-specific statute and no government AI bill. The King's Speech of 13 May 2026 contained no AI legislation. On 21 July 2026 the government announced the abolition of the science and technology department (DSIT). AI strategy, public sector AI adoption and the AI Security Institute move to the Cabinet Office. The Institute remains non-statutory and has no enforcement powers.
What binds companies today sits elsewhere:
Automated decisions. Since 5 February 2026 the Data (Use and Access) Act 2025 has replaced Article 22 UK GDPR with Articles 22A to 22D. ICO guidance is expected in winter 2026.
Financial services. The FCA's Mills Review of 6 July 2026 recommends no new AI-specific rules. It asks the FCA to clarify how the Consumer Duty and the Senior Managers Regime apply to distributed and agentic decision-making. The Bank of England and the PRA also decline AI-specific rules; the model risk management principles (SS1/23) apply.
Japan: promotion first, soft law
Japan's AI Promotion Act, passed on 28 May 2025 and fully effective since 1 September 2025, is a framework law with no fines. The Cabinet adopted the Second AI Basic Plan on 14 July 2026, seven months after the first, and will update it annually.
The operative guidance is the AI Guidelines for Business version 1.2 (MIC and METI, 31 March 2026). It adds AI agents and physical AI and is voluntary.
On 10 July 2026 the Diet passed a privacy law amendment that allows personal information to be acquired and provided without consent where the purpose is limited to statistics or AI development. It takes effect, in principle, within two years of promulgation.
What this means for a group active in all three
Build one AI inventory and one control set to the most demanding regime, the EU AI Act, and map local differences onto it.
Poland: decide before 28 October who answers a KRiBSI inspection, and whether any grey-zone use case merits an individual opinion.
UK: map where automated and agentic decisions occur and which senior manager is accountable.
Japan: align with the AI Guidelines for Business version 1.2 and watch the annual plan cycle. Keep EU and UK personal data under their own regimes.
Sources
This is information, not legal advice.