Since 28 October, a Polish state commission can order a company to stop using an AI system.
Who inside your company can stop one before the commission has to?
In a Polish company, one body exists to check that someone can: the supervisory board. The management board runs the company. The supervisory board, made up of non-executives, oversees it. So I read what the supervisory boards of the twenty largest companies on the Warsaw Stock Exchange, the WIG20, say about AI.
Two documents, one answer
For each company I read the annual report for 2025. Where the company has a supervisory board, I also read the board's own report to the general meeting. Polish law requires that report every year, with the board's assessment of the company's risk management, internal control and compliance. If a supervisory board oversees AI, that is where it would say so.
Seventeen of the twenty are Polish joint-stock companies with a supervisory board. Allegro.eu, Pepco Group and Żabka Group, registered abroad, have a single board of directors, and none of them says that its non-executive directors oversee AI.
Not one of the seventeen supervisory boards says that it oversees AI, either in the annual report or in its own report.
The closest annual report is mBank's. The chair of its supervisory board writes that the board keeps continuous oversight of the bank's operational resilience. The next sentence says that using technology, AI included, safely and responsibly is one of the key conditions of long-term value. Two sentences, side by side. Neither says the board oversees AI.
Eleven of the boards' own reports do not mention AI at all. Two mention it in passing: staff training at Alior Bank, a diversity policy at mBank. KRUK's report lists work on AI risk among the year's risk-management tasks.
Three boards took note. Pekao's board took note that its management board had adopted an AI policy as part of the risk management system. PKO BP's strategy and IT committee took note of information on the bank's AI competence. ORLEN's security committee took note of information on AI in the group.
Taking note is a board's lightest act. The board reads a paper and decides nothing about it. None of the three reports says what the board asked about AI, or what it would do if a system went wrong.
Where an annual report clearly places oversight of AI on a board, it is the management board: at CD PROJEKT, KRUK and PZU.
Two companies show the gap best. PZU's management board adopted or updated a data and AI governance policy in 2025, and PZU's supervisory board report does not mention AI. Budimex's annual report holds the only rule among the twenty that can end an AI tool, and Budimex's supervisory board report does not mention AI either.
A report shows what a company discloses, not what it does. Some of these boards may discuss AI at every meeting. Pekao's supervisory board, for one, approved the bank's tolerance for model risk in 2025, the risk that the bank's own models get it wrong. Its report does not connect that to AI.
Every score is in the scoring sheet, with the report page and passage behind each answer.
Boards elsewhere say it
In the United States, EY reviews the filings of the Fortune 100. Of the 80 companies that had filed by July 2025, 40% disclosed that at least one board committee oversees AI. A year earlier, 11% did.
In Britain, Deloitte read the annual reports of the FTSE 100. In 2025, 62% of the boards mentioned AI in their governance disclosures. In 2023, four boards did.
The comparison is rough. American and British companies have a single board, and their disclosure rules differ. For the European Union, the law firm Freshfields notes, there are no reliable figures yet on how companies assign oversight of AI.
The direction is still clear. Within a year or two, four in ten of America's largest companies and most of Britain's largest boards started to say something about AI. In the WIG20, eleven of seventeen supervisory boards say nothing about it in their own reports.
How AI starts, and how it ends
One question shows oversight better than any other. What would make us stop?
The annual reports split most clearly on that question. Nine describe a review, a test or a gate for AI. They explain how tools are classified by risk, tested, validated and scaled. None of the nine says what would stop one.
PZU names a management board member whose remit includes AI and a management committee for data and AI governance, and it describes testing under continuous monitoring. It states no rule for stopping. mBank describes an organised process for testing, validating and scaling its generative AI solutions. In the report, the process ends at scaling.
One report describes how AI ends. Budimex writes that its innovation office rigorously measures the economic impact of the AI tools it tests and recommends whether to keep using each one or drop it. It does not say who makes the final call. It is still the only rule among the twenty that can end an AI tool.
The pattern has a plain cause. An annual report rewards the start, because investors read new tools and pilots as progress. A stop rule reads as a cost. The supervisory board is the one body whose job is to ask for it, and none of the seventeen says it asked.
To be fair to the twenty, these reports were written before the act was passed in July. The next ones will be written with the commission's powers in force.
What changed on 28 October
Poland's act on AI systems has been in force since 11 August. It created the supervisor, the Commission for the Development and Security of Artificial Intelligence (KRiBSI in Polish). Its chapters on inspections, proceedings and fines took effect on 28 October.
The commission can now inspect. Inspections run remotely by default, after at least seven days' notice. When the commission has good reason to suspect harm to people, it can inspect on site and without the wait. Inspectors can demand access to IT systems, cloud included. Obstructing them is an offence, also for anyone acting for the company.
Anyone can file a complaint, online. A warning can name the steps a company should take, such as blocking users' access to a system, and the company then has 21 days to report what it did. Fines follow the EU AI Act: up to €15 million or 3% of worldwide annual turnover, whichever is higher, for breaching most duties of companies that supply or use AI, and up to €35 million or 7% for banned practices. Each AI system fined goes on a public list, with the company's name.
Under Article 63 of the act, the commission needs grounds to stop a system: a direct risk to people's life, health, safety or fundamental rights. With those grounds, its order can take effect at once.
Two facts keep this in proportion. The heaviest duties, for high-risk systems such as credit scoring and hiring tools, apply from December 2027 after this year's EU changes. The commission's first meeting is due by mid-November. Nobody should expect an inspector next week.
What changed is who can ask the question. Until October, "who can stop this system?" came mostly from inside the company, if it came at all. Now a state body can ask it, with the power to answer it itself. A supervisory board that only takes note has left the answer to someone else.
Put three answers on the board's agenda
Run the test on your own company. One page, three answers, from the management board to the supervisory board:
- Who decides. For each AI system in use, one person by name. A committee can advise, but one named person decides.
- Who oversees. Which board body looks at AI, how often, and when it last did. Ask whether the supervisory board has ever seen the list of AI systems.
- What stops it. The criterion that ends a system or a pilot, the person who can pull it, and how fast that person can act.
An empty line on that page shows where the first hard question will land. Take the page, empty lines included, to the next meeting of your supervisory board or non-executive directors. Next spring the board writes its report on 2026. Let that report say how it oversees AI.
The Stop and Pause rows of the AI Decision Rights Map give you the format: one holder, one trigger and one deadline for each right.
Write down your three answers before an inspector asks.
Your move.