POLAND Law and Practice Contributed by: Barbara Kiełtyka, Jakub Gładkowski and Małgorzata Kiełtyka, Kieltyka Gladkowski KG Legal
Establishing a risk management system proportion - ate to the risk is crucial. The system should be regu - larly reviewed, updated and properly documented to maximise the protection of fundamental rights and minimise health risks. High-quality training, valida - tion and testing data is essential, especially when personal data is involved (Article 10 of the AI Act). A quality management mechanism is also essential. The required documentation must be kept available to national authorities for ten years (Article 18 of the AI Act). 10.2 Contracting and Liability Allocation In the context of AI, it is particularly important to pre - cisely define the scope of the parties’ liability for sys - tem errors or defects. Contracts should specify who is responsible for the input data and whether the AI is intended to be supportive or decision-making. Therefore, it is important to specify the scope of licenc - es and intellectual property rights. A system user can become the creator of industrial property, the rights to which can be transferred to a contractor. Article 28 of the GDPR requires a contract or other legal instrument in situations where the provider comes into contact with a patient’s personal data in any way, and whether they can use the data for further model training. It is worth updating contracts with employees using AI to include clauses on training and liability. Clauses regarding damage coverage and conducting audits and inspections may be important. A set of model contract clauses (“MCC-AI-High- Risk”) for public procurement is regularly updated. It includes, among other things, the necessary con - ditions and obligations in the context of high-risk AI systems, such as healthcare AI systems. 10.3 Insurance Considerations In the absence of a specific act addressing the issue of liability for AI (the EU has withdrawn the proposed AI Liability Directive), different views are held on the entity responsible for the damage caused by AI, par - ticularly in healthcare sector (with multiple players):
• producer liability – eg, liability for a dangerous product; • operator’s responsibility; • end-user liability – if the end user uses AI inappro - priately or contrary to the manufacturer’s recom - mendations; and • insurance liability. Article 25 of Regulation 2024/1689 only defines a high-risk AI provider and obliges persons providing such a system to provide information in order to use the system. In the absence of a specific legal act dedicated to AI- related insurance issues, Directive 2009/138/EC on insurance and healthcare will apply, with the indication that the AI Act requires a risk assessment. 10.4 Best Practices for Implementation One of the most popular ways to implement AI sys - tems is to use algorithms based on such systems. Furthermore, AI systems can be widely used in places where information is collected, such as databases, as they enable rapid information flow and easy access. Another solution could be the creation or designation of a special centre as an additional advisory and sup - port entity. For example, the WHO recently designated the Digital Ethics Centre at Delft University of Technol - ogy as a centre for co-operation in the field of AI and healthcare management. Currently, medical personnel are not required to use AI during their training. Howev - er, it is worth noting that, by law, physicians must pos - sess professional qualifications (including a university degree) and specialisations. Similar requirements apply to physiotherapists and laboratory diagnosti - cians. Using AI for educational purposes could be part of the acquisition of knowledge. Pursuant to Polish law, physicians undertake postgraduate internships to improve their theoretical knowledge and practical skills, and this could also be an important element. 10.5 Cross-Border Considerations AI content providers in medicine must meet numer - ous requirements imposed by European-wide legisla - tion (AI Act, GDPR, MDR, IVDR). Additionally, national regulations may shape liability rules.
106 CHAMBERS.COM
Powered by FlippingBook