POLAND Law and Practice Contributed by: Barbara Kiełtyka, Jakub Gładkowski and Małgorzata Kiełtyka, Kieltyka Gladkowski KG Legal
• For AI SaMD, there are additional specific require - ments for AI algorithms that function as diagnostic or therapeutic tools. Their degree depends on the functionality of the SaMD. A prime example is a general-purpose AI SaMD where the total num - ber of calculations used to train it, measured in floating-point operations, is greater than 10^25. In such a case, the SaMD will be subject to special requirements due to the systemic threat (Article 51 of the AI Act). In this respect, regulations such as the guidelines of the International Medical Device Regulators Forum (IMDRF) are important. In 2025, it published an impor - tant document for AI-based medical devices and SaMD titled ‘Good Machine Learning Practice (GMLP) for Medical Devices’ (N88, 2025). 2.5 Data Protection and Privacy The two primary sources of regulations for data pro - tection and privacy are the GDPR and the AI Act. They have a particular impact on the development and implementation of AI in healthcare because, within the conceptual framework of these acts, training AI systems in the healthcare system involves processing sensitive patient data, such as: • operating on the basis of data about a patient’s past, present or possible future physical or mental condition as part of medical procedures; and • processing data revealing information about a person’s health, including data collected during registration for healthcare services or during the provision of healthcare services. Importantly, data protection standards do not dis - tinguish between the source of data, which may be, for example, a database entered by a doctor or other sources within the healthcare system, hospitals, medi - cal devices or in vitro diagnostic tests. By introducing a system and principles of accountabil - ity, the GDPR significantly impacts the collection, pro - cessing, storage and sharing of data for the training and operation of AI. The GDPR is complemented by official European Data Protection Board (EDPB) guide - lines, most recently Guidelines 02/2024 on Article 48 of the GDPR, finalised on 4 June 2025, which, in the
context of cross-border transfer, indicate additional safeguards for sensitive data and ensure an independ - ent mechanism for redress and oversight. 2.6 Interoperability and Standards AI systems in healthcare use techniques that involve training AI models with sensitive data. Therefore, the following standards and interoperability requirements apply to them, which are considered high-risk under the AI Act: • quality criteria for training, validation and test data - sets (including bias and anonymity) (Article 10 of the AI Act); • rules for the technical documentation of the AI system in writing before placing it on the market and rules for updating such documentation (Article 11 of the AI Act); • mandatory functionality of automatic event logging throughout the entire life cycle of a given system (Article 12 of the AI Act); and • the obligation to design the AI healthcare system and human–machine interface tools so that they can be effectively supervised by natural persons during the period of their use of the AI system (Arti - cle 14 of the AI Act). The mandatory obligations of a supplier of high-risk AI systems also include the introduction of a quality management system. White papers also apply in this respect, such as, for example, ‘Good Machine Learning Practice (GMLP) for Medical Devices’ (N88, 2025), which mandates, for example, that clinical data should be represent - ative and free from bias, that AI models should be trained on diverse datasets, and that AI models must be monitored for performance degradation, errors and unexpected risks after deployment. In relation to AI systems used within the medical data space and in the administrative procedures of health - care services, the GMLP applies to the interpretation and application of the EHDS Regulation. In Poland, the regulatory body overseeing these aspects will likely be the planned Commission for the Development and Security of Artificial Intelligence, to
94
CHAMBERS.COM
Powered by FlippingBook