Chapter | Chambers | 2026
We wrote for Chambers and Partners about IT outsourcing contracts in Poland and the new rules reshaping them: from DORA and the NIS2 amendment to the National Cybersecurity System Act, through the Data Act and the AI Act, to the transfer of staff to the supplier.
Chambers Technology & Outsourcing 2026 is part of the Chambers Global Practice Guides series published by Chambers and Partners. Law firms from each jurisdiction describe the law of IT and business process outsourcing under a common structure, so you can compare Poland with other jurisdictions point by point.
The Poland chapter was written by Michał Wołoszański, Łukasz Kudela, Marta Solarska-Kaleńczuk and Kinga Miller of Wołoszański & Partners. It consists of a Law and Practice section in five parts (market conditions, regulatory environment, model outsourcing contracts, contract terms and employment matters) and a Trends and Developments article on reviewing and renegotiating critical IT contracts. The publisher gives 27 October 2026 as the date of the last update. You can read the full text on the Chambers website (opens in a new tab).
Poland has no general outsourcing statute: IT outsourcing contracts rest on freedom of contract under the Civil Code. Sector rules add requirements, above all in financial services, telecommunications, healthcare and the public sector.
A typical IT outsourcing contract in Poland is a mixed contract. Implementation usually follows the rules on contracts for specific work, the run phase the rules on services, and software the rules on licences or copyright assignment. The classification matters. Under a contract for specific work, the customer has statutory warranty rights and may withdraw before completion by paying the agreed fee less the supplier's savings. Under a services contract, either party may terminate, and on the prevailing view the right to terminate for important reasons cannot be waived in advance.
Form matters too. An assignment of economic copyright in software and an exclusive licence must be made in writing, meaning a handwritten or qualified electronic signature; a simple or advanced electronic signature is not enough. The contract covers only the fields of exploitation it lists expressly.
The scale of the market is shown by ABSL figures cited in the chapter: at the end of Q1 2026, Poland had 2,179 service centres run by 1,303 companies, and the sector employed around 500,000 people.
DORA, the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554), has applied since 17 January 2025 to banks, payment institutions, insurers, investment firms and other financial entities. The Polish implementing act, which gives the Polish Financial Supervision Authority (KNF) the corresponding supervisory powers, has been in force since 7 August 2025. ICT providers designated as critical are supervised directly at EU level, but for most IT suppliers DORA applies indirectly: its requirements flow down through contracts with financial customers, and how far they go depends on whether the service supports a critical or important function.
The amendment to the National Cybersecurity System Act (KSC), which implements the NIS2 Directive (EU) 2022/2555, has been in force since 3 April 2026. Essential and important entities existing on that date had to apply for registration by 3 October 2026. They have until 3 April 2027 to implement their obligations, including an information security management system.
The act treats managed service providers and managed security service providers as a distinct category. According to Ministry of Digital Affairs guidance described in the chapter, this includes a company providing security services only within its group, and a helpdesk is a managed service.
Fines can reach millions of euros or a set percentage of annual revenue, and are higher for essential than for important entities. Managers can also be held personally liable. According to the chapter, fines will generally not be imposed before April 2028, but the deferral does not cover the extraordinary fine for the most serious cases.
The Minister of Digital Affairs may designate a supplier as a high-risk vendor, and the products concerned must be withdrawn within the prescribed period. According to the chapter, no such list had been published when the act entered into force.
Banks also have a separate outsourcing regime under the Banking Law, which prescribes the contract content and requires notice to the KNF, which may object. For banks, DORA takes precedence over the national KSC rules on cybersecurity risk management and incident reporting, but the high-risk vendor procedure still applies to them. We cover crypto-assets separately in our overview of the Chambers chapter on crypto-asset regulation in Poland.
The EU Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025. It gives customers of data processing services, including cloud, a statutory right to switch providers, export their data in a structured format and receive assistance with the move.
The notice period for switching may not exceed two months, and the default transitional period is 30 days. From 12 January 2027, providers may not charge switching fees, subject to limited exceptions, including a lighter regime for custom-built services. The ban does not affect ordinary service fees or agreed early termination charges.
The Polish Act on Artificial Intelligence Systems, which supplements the EU AI Act (Regulation (EU) 2024/1689), has been in force since 11 August 2026. Its provisions on supervision, inspections and penalties have applied since 28 October 2026. The market surveillance authority is the Commission for the Development and Security of Artificial Intelligence (KRiBSI).
The Digital Omnibus Regulation ((EU) 2026/1744) postponed obligations for high-risk AI systems to 2 December 2027 and 2 August 2028, depending on the category of system. The chapter stresses that the AI Act's reach depends on actual AI use and the parties' roles: a supplier using an AI coding assistant does not by itself make the customer a provider or a deployer of an AI system. We explain how to prepare an AI rollout on our law of new technologies page.
A contractual penalty in a Polish IT outsourcing contract is payable without proof of loss, but as a rule only for non-monetary obligations; a penalty for late payment risks being invalid. A court may reduce a grossly excessive penalty, or one for an obligation largely performed. You can usually claim damages above the penalty only if the contract expressly allows it.
According to the chapter, the market usually caps delay penalties at a percentage of the contract value, with a right for the customer to withdraw once the cap is reached. Service credits are usually a price reduction, so the contract should state whether they are the customer's sole remedy.
The Polish Civil Code does not distinguish direct from indirect loss: the test is adequate causation, and damages cover both actual loss and lost profits. Clauses carried over from English-law contracts therefore need to be defined in Polish legal terms. Liability for intentional harm cannot be excluded in advance, and caps of 100% of annual fees or of the total contract value are common in the market.
Claims between businesses are generally time-barred after three years, counted to the end of the calendar year, and after two years for contracts for specific work and certain claims of service providers. A licensor may terminate an indefinite-term licence on one year's notice, effective at the end of a calendar year, unless the contract provides otherwise. A licence granted for more than five years is treated as indefinite once five years have passed.
An IT contract must allow the customer to meet three reporting clocks. A personal data breach must be notified to the supervisory authority without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to people's rights and freedoms (GDPR). The KSC requires an early warning within 24 hours and an incident notification within 72 hours, followed by a final report. A major incident under DORA requires an initial notification within four hours of its classification as major, and no later than 24 hours after becoming aware of it.
These notifications can overlap, so the incident clause should state what information the supplier provides at each deadline and what its assistance costs. According to the chapter, the market also expects recovery tests at least once a year, with the results shared with the customer.
A data processing agreement must be in writing, which includes electronic form; a qualified electronic signature is not required. Poland has no general data localisation requirement, but DORA requires the contract to state where services are provided and data processed. Transfers outside the European Economic Area (EEA) require a Commission adequacy decision, standard contractual clauses or another GDPR transfer mechanism.
Where a workplace or part of it moves to the supplier together with the function, employees transfer by operation of law on their existing terms (Article 231 of the Labour Code, transfer of an undertaking). The test is whether the economic entity retains its identity: activity, assets, staff, customers and continuity. A change of contractor alone does not transfer employees.
The transfer cannot be a reason for dismissal. Where the employer has no trade union, the employers must inform employees at least 30 days before the transfer, and within two months of the transfer an employee may terminate their employment without notice, giving seven days' advance warning. On a transfer of part of a workplace, the old and new employers are jointly and severally liable for pre-transfer obligations. Self-employed B2B contractors are not covered by the transfer rules.
Outsourcing reduces employment risk only if it is genuine. Since 8 July 2026, the National Labour Inspectorate (PIP) can issue a decision declaring an employment relationship where a civil law or B2B contract shows the features of subordinate work. Day-to-day direction of the supplier's people by the customer increases that risk.
From 5 November 2026, a new definition of workplace bullying (mobbing) in the Labour Code, based on persistent harassment, will apply. According to the chapter, it will also cover conduct by people working under contracts other than employment contracts, such as members of a supplier's team. Where the customer's and the supplier's people work side by side, the contract should therefore set out rules of conduct and escalation. Poland has not yet fully implemented the EU Pay Transparency Directive ((EU) 2023/970), although the deadline passed on 7 June 2026. Remote work has been regulated in the Labour Code since April 2023, including up to 24 days of occasional remote work a year at the employee's request, which the employer may refuse.
The chapter's Trends and Developments article identifies four regulatory clocks that hit existing IT contracts at the same time: DORA, the Data Act, the KSC amendment and the AI Act with its Polish implementing act. The first step is to establish which of these regimes apply to each contract and function at all.
According to the authors, older contracts most often fall short in five places: audit rights without reports or regulator access, an unknown subcontracting chain, an incident clause without 4, 24 and 72-hour deadlines, an exit without data, formats, a transition period and a price, and an undefined notion of indirect loss.
The chapter advises starting with the rights you already have under the contract and the law, including the statutory right to terminate a services contract for important reasons and the option of interim relief. Then negotiate as a package, for example full subcontractor visibility and a Data Act-compliant exit in exchange for an extended term. Distinguish three kinds of change: documenting existing controls, new capabilities the supplier can price, and obligations it already owes, which are not a paid extra.
Customers also ask for a high-risk vendor clause: a statement on the origin of critical components, a duty to notify a designation, replacement at the supplier's cost or on agreed terms, and a right to terminate without penalty where replacement is impossible. Suppliers, for their part, seek a right to substitute components and a reasonable period to do so. In the public sector, the Public Procurement Law limits contract changes, so review clauses need to be in the first version of the contract.
The chapter ends with a checklist for 2026 and 2027. Start with a map: which regimes (DORA, KSC, Data Act, AI Act) apply to which contract and function, and which contracts support critical or important functions, essential services or large-scale processing of personal data.
Then check each important IT contract. Does it name every subcontractor, its location and the rules for changing it? Does the incident clause deliver information within 4, 24 and 72 hours, and is the supplier's assistance priced? Does the exit plan specify data, formats, interfaces, a transition period and a price, and has the data export been tested?
Finally, liability and contingencies. Are liability concepts defined in Polish legal terms, and are data restoration costs and regulatory fines clearly allocated? Do you have a procedure for a high-risk vendor designation, a change of service location or a subcontractor's insolvency? In the public sector: does the change fit within public procurement rules?
The authors expect reviewing and renegotiating existing contracts to remain the main form of outsourcing work in Poland through 2027.
Legal position: as described in the chapter last updated by the publisher on 27 October 2026. The rules may change, so check the current position with us before you decide.
Chapter published in: Chambers Global Practice Guides - Technology & Outsourcing 2026, Poland (opens in a new tab) (Chambers and Partners).
Usually indirectly: DORA places obligations mainly on financial entities, and they reach the IT supplier through its contract with the financial customer.
What matters is whether the service supports a critical or important function of the customer. A supplier of digital or data services to a financial entity is an ICT third-party service provider under DORA and appears in the customer's register of information. Services delivered by people, such as customer support, are assessed by their actual nature, not their label.
Separately from DORA, a cloud, managed service or managed security service provider may itself be covered by the KSC.
From 12 January 2027, no: the Data Act abolishes switching charges for data processing services, subject to limited exceptions.
A lighter regime applies to services custom-built for the customer. The ban does not cover ordinary service fees or early termination charges agreed in the contract.
Check that your exit plan specifies data, formats, interfaces, a transition period and a price. Test the data export before you start negotiating.
Yes: since 8 July 2026, the National Labour Inspectorate (PIP) can issue a decision declaring an employment relationship where a B2B contract shows the features of subordinate work.
The decision is preceded by an order to remedy the breach. Only if the order is not complied with does the inspectorate issue a decision, which can be appealed to the labour court.
The risk grows where the customer directs the supplier's contractors day to day, for example in body leasing. Reclassification also has tax and social security consequences.
No: an administrative fine falls on the regulated entity and cannot be transferred to the supplier by contract.
According to the chapter, it is also contested whether the customer can recover the amount of such a fine from the supplier as damages. The contract should therefore allocate risk clearly: the supplier's incident duties, data restoration costs and cooperation with the regulator.
In banking outsourcing, the supplier cannot exclude its liability to the bank for loss caused to the bank's customers.
In the state courts or in arbitration: for larger contracts, options include the Court of Arbitration at the Polish Chamber of Commerce and the Lewiatan Court of Arbitration.
According to the chapter, commercial litigation in Warsaw usually takes several years to a first-instance judgment. A Polish court can grant interim relief in support of both court and arbitration proceedings if you substantiate the claim and a legal interest.
The statutory right to terminate a services contract for important reasons and the option of interim relief strengthen your hand in negotiations.
Related service
We draft and negotiate IT, SaaS and cloud contracts, including IT outsourcing agreements, taking into account the rules described in the chapter. See how we work with IT businesses, or read the full chapter at the publisher.
