UODO report: 95.9% of organizations not ready for GDPR-compliant AI
Many companies and public institutions do not connect the use of chatbots with the processing of personal data. On October 28, the provisions of the AI systems act concerning inspections and penalties will come into force.
Only 4.1% of organizations consider themselves very well prepared to apply the GDPR when using artificial intelligence. The remaining 95.9% do not feel fully ready. This is according to the report "Study of organizations' needs in the use of artificial intelligence and the protection of personal data." It was prepared by the Working Group on Artificial Intelligence within the Social Expert Team under the President of the UODO (opens in a new tab) (Personal Data Protection Office).
The survey was conducted from October 21 to November 24, 2025 on a sample of 492 organizations. In January 2026, a qualitative stage was held with the participation of seven industry organizations. The sample was dominated by the public sector, which accounted for 89.2% of respondents. Private companies and social organizations made up a total of about 11%. The largest share of respondents, 44.9%, answered "hard to say," while 25% assess themselves as "rather prepared."
From 41% to 58.5% of organizations do not see the connection between AI tools and the processing of personal data. 42.7% of respondents do not use AI at all, while 16.7% use it every day. The report's co-author, legal counsel and associate professor Dominik Lubasz, points out, as quoted by Prawo.pl, the issue of "shadow AI." This means employees using tools such as ChatGPT without the employer's knowledge, which exposes data even in organizations that formally do not use AI. Karolina Praszek-Gołębiewska, CEO of Kancelaria Bezpieczeństwa, expressed a similar view in a statement for My Company Polska.
The riskiest situation is when an organization does not know which tools its employees are using.
On August 6, 2026, the President of the UODO published four sets of inspection questions to verify AI tools before deployment. One of them is intended for small and medium-sized companies using ready-made systems. The questions do not replace a data protection impact assessment (DPIA) and do not guarantee GDPR compliance.
On October 28, 2026, the provisions of the AI systems act concerning inspections, proceedings, and penalties will come into force. Oversight will be handled by the new Commission for the Development and Safety of Artificial Intelligence. For managers, this is a signal to check which chatbots the team uses, what data goes into them, and whether the company has written rules for the use of AI.