Finance

The position of the financial sector in Poland 2026

Poland's banking sector comprises the top commercial banks (PKO BP, Santander, ING, BNP Paribas, mBank, Pekao, Millennium, Alior, Citi, Credit Agricole) plus the cooperative banking sector. The insurance sector is dominated by PZU, with the remaining places held by Warta, Generali, Allianz and Compensa. The Polish fintech scene includes neobanks, payment platforms (BLIK as the first global example of success) and lending platforms.

Poland's financial sector has historically been one of the most digitized in Europe. BLIK as a mobile payment standard, open PSD2 banking since 2019, advanced AML and fraud detection systems. That makes it an attractive target for AI implementation, but at the same time the most heavily regulated sector of the Polish economy.

Why finance is specific for AI

The European Central Bank, in its reports on AI in banking from 2024-2025, systematically tracks the spread of AI in the sector. Most areas of AI use in a bank fall into the high-risk category under the AI Act of February 2026: credit scoring, creditworthiness assessment, AML, fraud detection, HR decisions.

That means most AI deployments in a Polish bank require a documented risk assessment, human oversight, explainability of decisions, and log retention. The cost of compliance is significant and rises with each deployment.

Five key areas of AI implementation

A synthesis of McKinsey's "The State of AI in Banking" (annual report) and ECB materials.

Credit scoring. ML models instead of classic scorecards. Better accuracy, but it requires rigorous documentation of the explainability of decisions per client in line with KNF Recommendation S. Without XAI, scoring is unlawful in Polish banking.

Anti-Money Laundering. AI detection of suspicious transactions. Higher accuracy than the rule-based systems of the previous generation, a significant reduction in false positives. Polish banks have deployed this widely in recent years, in many cases as the first AI use case in the organization.

Real-time fraud detection. AI that analyzes transactions in milliseconds and blocks suspicious ones before authorization. A standard for card payments for several years. Newer AI layers add behavioral analysis of the client (mouse movement, typing patterns) as an additional signal.

Offer personalization. Recommendation engines that match products to the client. The economic ROI is undeniable, but bias risks are significant and require a compliance review.

RAG-based customer service and employee support. Chatbots with access to the bank's procedures and regulations. This is the least regulated use case (beyond the transparency requirement) and offers the fastest ROI. A recommendation for banks that want to start with something low-risk.

DORA and new regulations 2025-2026

The Digital Operational Resilience Act (DORA) has applied since January 2025 to financial entities. It requires documentation of ICT risk management, resilience testing and incident reporting to the regulator within 24 hours. Impact on AI: every AI system in banking production must be in the ICT register, have defined contingency procedures and an operational continuity plan.

Poland's KNF interprets DORA through its own recommendations. Failure to comply with DORA carries administrative penalties proportionate to the entity's global turnover.

Three areas requiring particular caution

First, AI-based credit scoring without XAI. Without documentation of the explainability of decisions per client, it breaches Recommendation S and may be challenged by the Financial Ombudsman.

Second, the use of LLM models without hallucination control in communication with clients. A chatbot answering a question about the regulations must be based on RAG with verified sources, not on an LLM alone without context.

Third, sending client data to public AI models (ChatGPT, Claude in consumer versions). This breaches GDPR and banking secrecy. It requires either enterprise contracts with no-training guarantees or local LLM deployments.

What yesfor.ai brings that is specific

A yesfor.ai audit for a financial entity takes six to ten weeks (longer than typical, because of the compliance layer). The standard scope: an AI Act risk classification per use case, a map of Recommendation S and DORA requirements, an XAI implementation plan, and a 12 to 24 month roadmap.

The first recommendation often is: do not start with high-risk use cases. A RAG-based assistant for employees is a safe first project on which to build compliance competence before moving into scoring or fraud.