What's new in Attestia

Attestia has a module for governing AI agents. Each agent gets a card in six layers: mandate, outcome, guardrails, autonomy, escalation and improvement. It begins the controlled launch after passing the Pre-Flight check and then goes through regular reviews. The owner signs off the card in the agent passport, and the board receives a quarterly report.

The module runs in organisations led by an Attestia - Consulting advisor and is not part of the Free, Starter, Pro or Team plans. The AI agent governance page describes all of it. If you would first like to see how ready your organisation is for agents, start with the free survey.

The agent card and the Pre-Flight record document operational readiness. They are not documents required by the AI Act, nor legal advice.

Poland has a national act implementing the AI Act in force. The Act of 3 July 2026 on artificial intelligence systems (Journal of Laws 2026, item 1003) has applied since 11 August 2026, and its provisions on individual opinions, inspections, proceedings and penalties since 28 October 2026.

The market surveillance authority and single point of contact is the Commission for the Development and Safety of Artificial Intelligence (KRiBSI). The EU AI Act hub describes this in its Poland section, and the FRIA and the serious-incident notification for systems deployed in Poland name KRiBSI as the designated authority.

For companies operating in Poland this means AI Act supervision has a national addressee, and the procedures for inspections and for imposing penalties are set out in the Polish act.

The Art. 50 transparency obligations are not a separate risk category — they apply on top of the others. Classification in Attestia now assesses them independently of the category the system lands in.

In practice: a high-risk system that, for example, talks to people or generates content gets the high-risk requirements and the Art. 50 obligations. The same goes for an Annex III system relying on the Art. 6(3) exemption. The obligation cards on the result screen, the required documents and the deadlines follow from your answers about what the system does, not from the category alone.

Basis: Art. 50(6) of the AI Act and the Commission's Art. 50 guidelines (C(2026) 5054 final, point 25), under which the obligations of both regimes are cumulative.

There is a new free self-assessment on the site: Is your organisation ready for AI agents? It asks 21 questions across 7 layers: data, technology foundation, knowledge, trust and governance, processes, people, customer.

You get the result immediately, without signing in and without giving an email address: a score for each layer, context readiness and a readiness level from L1 to L3. It is one person's self-assessment — inside an organisation it is worth collecting several, because the gaps between them show what needs to be discussed.

The result is indicative and is not legal advice.

A system with a recorded legal review can be classified again — for example after its intended purpose changes. Attestia now tells you what will happen to the verdict before you start.

The lawyer's verdict does not disappear. On the system card, in the system report and in the procurement package it is marked as relating to an earlier version of the classification, and the classification PDF shows the content version the verdict is pinned to.

A legal assessment covers specific content. After the classification changes, a reader of the report should see that the assessment exists — and that it was made for the previous version.

Three additions after which Art. 50 decisions leave a trail, not just a result.

A register of relied-on exceptions. If you conclude that one of the Art. 50 exceptions applies to your system, you record it on the obligation card: which exception, on what basis, who approved it and from when. The register is included in the exported system report. Attestia does not decide whether the exception is available to you — it preserves your decision and its reasoning.

Section review has an author and a date. Approving a document section records who reviewed it and when. A finished document therefore shows not only that a review took place, but whose it was.

Verdicts and declarations remember what they covered. A legal review and an exception declaration are pinned to the version of the content the approver saw. If the content changes later, Attestia shows it and suggests a fresh review.

Until now the system card counted down to the nearest deadline. It now shows the full set of dates that apply to that system — including 2 December 2026, the end of the transitional period for marking generative AI content in systems placed on the market before 2 August 2026.

It is an easy deadline to miss, because all the attention is currently on August.

We moved to a new model in a European region and tuned the analysis time budget — classification now finishes noticeably faster, with no change in the quality of the result.

The generated transparency notice now covers text published on matters of public interest (Art. 50(4), second subparagraph) together with the conditions of the editorial exception. If you publish AI-written text about public matters, you have an obligation that is easy to forget.

Four changes that together close the Art. 50 path before the 2 August deadline.

"I'm not sure" is now a first-class answer in the transparency questions — and it is treated conservatively. The system lands in limited risk with an explicit note that the category follows from the uncertainty and may be lowered once you clarify. Guessing "no" on a compliance platform is the most expensive error available.

Your role determines your obligations. Providers and deployers carry different duties under Art. 50 — documents and reports now show your set, with the addressee marked on each section. If you are both, you get both.

Legal review requires reasons. Signing off a classification requires a substantive note — without it the verdict cannot be saved. The Commission's guidelines warn explicitly against rubber-stamp review.

The legal verdict is visible in the exported report — who approved it, from which firm, when and on what basis. That is the part a market surveillance authority looks at.

When you buy a plan you can enter your EU VAT ID, and tax is calculated automatically for your country — with reverse charge applied where relevant.

For companies filing in another member state, that means an invoice ready to book, without after-the-fact corrections.