AI Digital Likeness in Poland: What's Permitted and What Creates Liability

September 21, 2026 · Bartłomiej Spasowski, Founder, modulla · EN

What AI digital likeness is and why companies need to understand it

AI digital likeness is any synthesis or modification of a real person's appearance, voice, or behavior using generative artificial intelligence models. It covers deepfake videos, voice cloning, photorealistic avatars, and digital face replicas. It falls simultaneously under copyright law, the civil code, GDPR, and the AI Act. Deploying these technologies without understanding the legal framework is a real financial and reputational risk.

Why this matters right now: August 2026 changes the rules

As of 2 August 2026, the new transparency requirements under Art. 50 of the AI Act are in force [3]. This is not a distant regulation to plan for. These are current requirements that apply to every agency, brand, and content creator operating in the Polish market.

Let's be direct: the market is not ready for this. A study conducted by the President of the Personal Data Protection Office found that nearly 96% of organizations consider themselves unprepared to deploy AI tools in compliance with GDPR [12]. Close to 50% of companies do not see any connection at all between using AI tools and processing personal data [12].

At the same time, the scale of abuse is growing. Between July 2025 and June 2026, Meta removed 380,000 items violating its policies and 137,000 fake ads from the Polish market, including deepfake campaigns featuring the likenesses of well-known public figures [2]. The case of Rafał Brzoska and Omenaa Mensah ended with the UODO issuing binding decisions against Meta and forcing the implementation of special protection mechanisms for public figures in Poland [2].

For companies, this means one thing: regulatory pressure and market pressure are operating simultaneously.

Three layers of law protecting likeness in Poland

Likeness in Poland is protected by several provisions simultaneously, which means that violating one law often triggers violations of the others.

Layer 1: copyright law

Art. 81 of the Act on Copyright and Related Rights requires explicit consent from a person for the dissemination of their likeness [26]. The key point most companies overlook: consent for a traditional photo shoot does not automatically cover the right to create a digital avatar, train an AI model, or generate a deepfake [1]. Each new field of exploitation requires a separate clause in the contract.

Layer 2: personal rights

Arts. 23 and 24 of the Civil Code treat likeness and voice as personal rights of a human being subject to absolute protection [6]. Violation of these provisions entitles the injured party to demand cessation of the activity, removal of the effects of the violation, and financial compensation. Courts in deepfake cases are increasingly rejecting the argument of "passive intermediation" by platforms [6].

Layer 3: GDPR and the AI Act

A digital rendering of a face identifies a person, so it constitutes personal data. When technically processed, it becomes biometric data within the meaning of Art. 4(14) GDPR. The AI Act adds another layer on top: prohibitions on high-risk practices have been in force since February 2025, and the transparency obligations under Art. 50 entered into force on 2 August 2026 [3].

What's permitted and what isn't: an admissibility matrix


Area of activity	What is permitted	What is prohibited
Marketing and advertising	Digital avatars based on written consent with precise fields of exploitation [1]	Publishing a synthetic likeness of a real person in an advertisement without their knowledge and consent [2]
Graphic processing	Cosmetic retouching, contrast adjustment, cropping, color correction [7]	Photorealistic deepfakes without labeling, generating false statements [3]
AI-written content	AI-assisted articles and posts that have undergone human editorial review with full responsibility [7]	Synthetic texts on matters of public interest without labeling the source [31]
Customer service	A chatbot that informs users at the outset that they are speaking with an automated assistant [22]	A bot with a false human persona, an employee's name, or a human avatar photo [22]
HR and recruitment	AI-assisted CV screening with the final decision remaining on the human side [25]	Emotion analysis in video job interviews, mass downloading of candidate photos [25]
Model training	Training AI on proprietary materials or properly licensed databases [1]	Web scraping of photos and biometric data to build facial recognition databases [25]
Satire and fiction	Clearly abstract graphics, parody that does not pretend to be reality [5]	Intimate or compromising material featuring the likenesses of real people [9]

How to implement compliance step by step

This is where the difference begins between companies that treat the AI Act as a risk buffer and those that approach it as a process quality standard.

Step 1: inventory of AI tools

The first step is listing all algorithms used internally and by subcontractors and agencies. The goal is to establish who in the supply chain is the "provider" of the tool (the entity creating the AI system) and who is the "deployer" (the company implementing the tool for its own purposes) [2]. This distinction determines the allocation of legal responsibility.

Step 2: audit of contracts with models and talent

Standard consent for a photo shoot is not enough. Contracts with models, influencers, and employees must contain precise clauses covering: digital synthesis of likeness, voice cloning, specified fields of exploitation, and distribution channels [1]. A missing clause is an open liability gap.

Step 3: implementing a two-layer labeling system

AI Act Art. 50 imposes obligations at two levels simultaneously [3]:

Technical layer (backend): the tool provider must ensure machine-readable metadata or digital watermarks in generated files [3].
Consumer layer (frontend): the company publishing the content must provide a clear, visible label for the end recipient — for example, an "AI-generated" tag or a narrator's disclosure in video content [7].

Exceptions apply to minor technical retouching and texts for which a human has taken full editorial responsibility [7].

Step 4: deepfake incident response protocol

When a CEO's likeness or a brand's image is used without consent in a deepfake campaign, the materials disappear and reappear under changing URLs [37]. A screenshot is not enough. A company needs a procedure that includes producing a notarized record of the page opening, capturing network headers, and obtaining full account data within the first 48 hours — before the campaign trail vanishes [37].

Step 5: UODO pre-deployment checklist

The President of the UODO has published sets of preliminary self-assessment questions for AI tools. The SME version contains 26 diagnostic questions, and the extended version for advanced deployments covers 73 questions [12]. Completing this checklist before launching a tool — not after — provides concrete protection against an allegation of negligence.

Common mistakes and how to avoid them

Mistake 1: the analogy to traditional photography

Companies often assume that because a model signed consent for a product photo shoot, those photos can freely be fed into an AI tool to generate a synthetic avatar. This is incorrect. Consent for a traditional photo shoot does not transfer rights to digital syntheses [1]. A missing field of exploitation is a potential claim.

Mistake 2: confusing retouching with deepfaking

Color correction and cropping do not require AI labels. Generating a photorealistic scene featuring a real person's face does [7]. The line is drawn where the technology creates something that never existed and the recipient could believe it actually happened.

Mistake 3: leaving responsibility "with the agency"

A brand commissioning a campaign from an agency is the deployer within the meaning of the AI Act. If the agency fails to label content correctly, liability falls across the entire supply chain [2]. Without contractual clauses clearly dividing responsibilities, the advertiser is liable for the subcontractor's error.

Mistake 4: no response plan

The absence of a response protocol is the most expensive mistake. When a deepfake video featuring a CEO's likeness appears on Facebook, the first hour matters. Companies without a ready plan lose the evidentiary window and waste time figuring out who in the organization should contact the platform [37].

The scale of the problem: data worth knowing

The numbers from the Polish market speak for themselves. Between July 2025 and June 2026, Meta removed 380,000 items violating platform policies and 137,000 fake ads from Poland, with 88% detected proactively following binding UODO decisions [2]. This is not a fringe issue. It is a mass fraud campaign based on the likenesses of real people.

On the other side, organizational readiness looks concerning. The President of the UODO conducted a survey among data controllers: nearly 96% of entities considered themselves unprepared to deploy AI tools in compliance with GDPR, and close to half see no connection at all between using AI and processing personal data [12]. The most common practice is assessing compliance after deploying a tool, not before [12].

The core issue is something else: it's not only about fines. Penalties for violating AI Act transparency rules reach €15 million or 3% of annual global turnover [3], and for prohibited biometric practices up to €35 million or 7% of turnover [4]. It's also that companies which build a credible AI likeness management process now gain a reputational advantage that translates directly into brand value in the eyes of customers.

Poland is implementing the AI Act through a draft Act on Artificial Intelligence Systems, which creates the Commission for the Development and Safety of Artificial Intelligence (KRiBSI) as the central market supervision authority [4]. Under the draft, companies will be able to obtain individual opinions — binding interpretations of planned AI deployments [19]. This is a concrete risk-mitigation tool worth using before launching a project, not after the first audit.

Criminal liability: when prosecution follows

Polish criminal law does not yet have a standalone provision named "deepfake." The President of the UODO formally called on the Ministry of Digitization to introduce such provisions, pointing to the inadequacy of existing regulations [18]. Until they are enacted, prosecutors rely on general provisions: Art. 190a §2 of the Penal Code for impersonating a person, Art. 212 for defamation through falsely attributed statements, and Art. 286 for using a cloned voice to defraud money [9].

For comparison: Italy became the first EU member state to introduce a standalone criminal offense for non-consensual deepfakes, with penalties ranging from one to five years of imprisonment [20]. Poland is in the process of drafting analogous provisions [18].

Summary and CTA

The regulations governing AI digital likeness in Poland create an interlocking body of law that touches every company using generative tools in marketing, HR, or customer service. Two dates are key: February 2025 brought a ban on mass biometric data collection, and August 2026 introduced transparency obligations with specific financial penalties.

Companies that build this process now have an advantage: they not only avoid risk, but also gain credibility in the eyes of customers and partners for whom "how you do it" is becoming an increasingly important purchasing question.

If you want to review which of your current AI tools require adjustments to contracts, labeling, or internal procedures, talk to us. We start with an inventory, not a ready-made template.

FAQ: questions about AI digital likeness in Poland

Do AI-generated text pieces on a company blog need to be labeled as "created by AI"?

No, if they have undergone full human editorial review by someone who takes responsibility for them. Art. 50(4) of the AI Act provides an exception for texts that have undergone human editorial review [7]. The condition: the editor must genuinely make substantive changes and sign the publication with their name or position. Raw output from an AI model without revision does not meet this condition.

What are the consequences of using a model's likeness in an AI campaign without the proper clause in the contract?

The company violates Art. 81 of the Copyright Act, which requires separate consent for each new field of exploitation [26]. The injured party may demand cessation, removal of the effects of the violation, and compensation through civil proceedings. In parallel, there is a potential GDPR violation if biometric data was processed without a legal basis [14]. In practice, courts are increasingly willing to uphold claims where there is a clear absence of a digital synthesis clause in contracts with talent.

Who is responsible for labeling deepfake material in an advertisement: the agency or the brand?

Both. The AI tool provider is responsible for the embedded technical metadata (Art. 50(2) of the AI Act), and the deployer — the agency or brand distributing the creative — is responsible for the visible label for the consumer (Art. 50(4) of the AI Act) [2]. Without a contractual division of roles, liability is joint and several, which in practice means an audit can reach any link in the chain.

Is it legal to create a digital avatar of an employee or brand face?

Yes, provided that the contract with that person contains precise clauses covering digital synthesis of likeness, voice cloning, and the specified fields and channels of exploitation [1]. Consent must be voluntary, given before the source materials are recorded, and must not be "buried" in a general copyright clause covering the shoot. Materials published after 2 August 2026 must additionally be labeled in accordance with Art. 50 of the AI Act [3].