A Mature Market Moving Up the Value Chain

Poland is one of Europe’s largest destinations for IT and business services, and the market has moved well beyond labour-cost arbitrage. Customers increasingly buy specialised engineering, cloud operations, cybersecurity and data services rather than headcount, and Polish delivery centres now own entire processes for international groups.

Regulation is Reopening Existing Contracts

The most visible development of the past 18 months has been regulatory rather than commercial. The Digital Operational Resilience Act (DORA), which has been applicable to financial entities since 17 January 2025 and supported by Polish implementing legislation since 7 August 2025, and the amended National Cybersecurity System Act implementing NIS2, in force since 3 April 2026, have prompted customers to revisit legacy agreements (see 2.1 Restrictions of Technology Transactions or Outsourcing and 2.2 Industry-Specific Restrictions). Renegotiations now routinely address audit and access rights, incident notification, subcontracting chains, security requirements and exit assistance – areas that older contracts often left to general terms.

Impact of New Technologies

Generative AI is changing how suppliers deliver and price their services. Customers are moving away from time-and-materials and headcount-based pricing towards outcome-based models. At the same time, they increasingly ask suppliers to disclose where AI tools are used in delivery, who owns the outputs and whether customer data may be used to train models. Points that were rare in IT contracts three years ago are now regular items on the negotiating agenda.

Scale and Specialisation

Business services remain a pillar of the Polish economy. According to the Association of Business Service Leaders (ABSL), 2,179 service centres run by 1,303 companies operated in Poland at the end of the first quarter of 2026, with employment stabilising at around half a million jobs. The sector’s share of GDP has reached 6.1%, and ABSL describes a shift towards “generative business services”, in which centres combine process ownership with automation and AI.

Intra-Group Centres Under NIS2

A development many groups have not yet absorbed is that captive centres can fall within Poland’s implementation of the NIS2 Directive (Directive (EU) 2022/2555), transposed through amendments to the National Cybersecurity System Act in force since 3 April 2026. NIS2 treats managed service providers and managed security service providers as regulated entities in their own right. Ministry of Digital Affairs guidance confirms that a company providing managed security services only to other members of its own group is still covered, because it serves separate legal entities, and that helpdesk services qualify as managed services. Groups running shared service centres in Poland should therefore review their status. The deadline for registration of in-scope entities existing on 3 April 2026 passed on 3 October 2026.

Outsourcing of Compliance Processes

In financial services and payments, regulated firms increasingly outsource customer onboarding, merchant due diligence and transaction monitoring support. Regulatory responsibility always remains with the regulated entity, so contracts for these services must give the customer real control over methodology, quality assurance and escalation, not just a right to receive reports.

Artificial Intelligence

The Polish Act on Artificial Intelligence Systems, which supplements the EU AI Act, entered into force on 11 August 2026, with its provisions on supervision, inspections and penalties applicable since 28 October 2026. The Act establishes the Commission for the Development and Security of Artificial Intelligence (KRiBSI) as the market surveillance authority. For technology contracts, the practical consequence is that the parties must decide early who acts as provider and who as deployer of an AI system, and must allocate documentation, transparency and co-operation duties accordingly.

Chatbots and robotic process automation raise more familiar questions of consumer information, data protection and liability for automated errors, which customers address through testing, human oversight and service credit provisions.

Blockchain, Crypto-Assets and Smart Contracts

The EU Markets in Crypto-Assets Regulation (MiCA) applies directly in Poland, but at the time of writing the Polish implementing act designating the supervisory authority has not entered into force; successive versions were vetoed by the President in December 2025, February 2026 and June 2026. Crypto-asset businesses therefore often obtain authorisation in another EU member state and serve Polish clients through the MiCA passport, while relying heavily on outsourced custody, onboarding and IT services, which MiCA subjects to specific outsourcing requirements. Smart contracts are used as a mechanism of performance within conventional written agreements rather than as standalone contracts.

Fintech

For banks, payment institutions and other financial entities, DORA is now the main lens through which any new technology is procured: introducing a new technology supplier triggers risk assessment, register-of-information and contractual requirements before the service goes live (see 2.2 Industry-Specific Restrictions).

The most commonly outsourced services in Poland include:

• application development and maintenance, including software for banks, insurers and the automotive sector;
• cloud infrastructure, hosting and data centre services;
• IT helpdesk and end user support;
• managed security services, including security operations centres;
• finance and accounting, HR and payroll;
• customer service and multilingual contact centres; and
• back office operations, complaints handling and support for customer due diligence in financial services.

The outsourcing of security functions is expressly accommodated by the regulatory framework. NIS2 recognises managed service providers and managed security service providers as a distinct category, and requires in-scope entities to manage the security of their supply chain, rather than to perform every security function in-house. The Polish implementation follows the same approach: according to Ministry of Digital Affairs guidance, entities may meet their obligations through external commercial providers or through capabilities built in-house or within their group. Responsibility for compliance, however, always remains with the in-scope entity. This has made security operations one of the fastest-growing outsourced services in Poland.

No General Outsourcing Statute

Polish law contains no general statute governing outsourcing or technology transactions. Such contracts are concluded under the principle of freedom of contract in the Civil Code and are usually classified as contracts for specific work, contracts for services or mixed contracts. The classification matters in practice, because it determines the statutory warranty regime and the parties’ termination rights (see 4.2 Termination). Restrictions therefore derive from specific legislation rather than from a single regime.

Intellectual Property Formalities

A constraint that often surprises foreign parties is that a transfer of copyright, including copyright in software, must be made in writing and covers only the fields of exploitation expressly listed in the contract. A transfer drafted on common law lines, without such a list, may leave the customer without rights to key uses of the software (see 4.4 Implied Terms).

NIS2 and the Supply Chain

The most significant development of the last year was the implementation of NIS2 through the amended National Cybersecurity System Act, in force since 3 April 2026. The Act extends cybersecurity obligations to a much wider range of essential and important entities, including providers of managed ICT services, and requires them to manage risks arising from their suppliers. In-scope entities had to register by 3 October 2026 and must have their information security management systems in place by 3 April 2027. Fines can reach EUR10 million or 2% of worldwide turnover, whichever is higher, for essential entities and EUR7 million or 1.4% for important entities, and managers may be personally fined up to 300% of their remuneration. In most cases, fines may not be imposed before April 2028, although this deferral does not extend to a separate extraordinary fine reserved for the most serious cases.

High-Risk Vendors

The Act also introduces a procedure under which the Minister for Digital Affairs may designate a supplier of ICT products or services as a high-risk vendor. A designation covers the specific types of hardware or software identified in the decision, which in-scope entities must then withdraw from use within the prescribed period. No list was published when the Act entered into force, but customers now commonly seek contractual protection against the risk that a supplier, or a component in its supply chain, is designated.

Other Developments

The Polish Act on Artificial Intelligence Systems entered into force on 11 August 2026 (see 1.3 New Technology). The EU Data Act, applicable since 12 September 2025, introduced rules that directly affect cloud and data processing contracts, including the abolition of switching charges from 12 January 2027 (see 4.7 Digital Transformation).

Financial Services: DORA as the Primary Framework

Since 17 January 2025, banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and other financial entities have been subject to DORA’s rules on ICT third-party risk. Before entering into an arrangement for ICT services, a financial entity must assess the provider, record the arrangement in its register of information and include mandatory contractual provisions. These provisions are more extensive where the service supports critical or important functions, and include audit and access rights, termination rights and exit strategies. The Polish implementing act, in force since 7 August 2025, equips the Polish Financial Supervision Authority (KNF) with the corresponding supervisory powers.

Overlapping Sectoral Regimes

Sector-specific outsourcing rules continue to apply alongside DORA. The Banking Law contains a separate regime for the outsourcing of banking activities, with prescribed contractual content and a notification procedure allowing the KNF to object, and comparable rules apply to insurers, payment institutions and investment firms. The European Banking Authority guidelines on outsourcing continue to apply, as adjusted to DORA, whereas the European Insurance and Occupational Pensions Authority has withdrawn its cloud and ICT-security guidelines and the KNF has announced the withdrawal of its own cloud communication and Recommendation D for entities covered by DORA. Older supervisory documents should therefore not be assumed to apply alongside DORA without checking their current status, and the requirements that do apply should be mapped before negotiations begin.

Interaction With NIS2

For banks and financial market infrastructure, DORA takes precedence over the Polish NIS2 rules on cybersecurity risk management and incident reporting. Ministry of Digital Affairs guidance makes clear, however, that certain provisions of the National Cybersecurity System Act, including the high-risk vendor procedure (see 2.1 Restrictions on Technology Transactions or Outsourcing), still apply to these entities, and that activities of a financial entity outside its financial sector business may fall under the Act.

Crypto-Assets

Crypto-asset service providers face an additional difficulty. MiCA imposes specific requirements on outsourcing by such providers, and DORA applies to them, but in the absence of a Polish implementing act there is no domestic authority to authorise them (see 1.3 New Technology). Providers serving Polish clients under a passport from another member state must meet the outsourcing expectations of their home regulator.

Other Regulated Sectors

Healthcare providers must reconcile outsourcing with medical confidentiality and patient data rules; telecommunications operators are subject to the Electronic Communications Law and to NIS2; and public bodies must procure IT services under the Public Procurement Law, which significantly limits changes to contracts once awarded. That limitation makes the initial drafting of public sector IT contracts, including change and exit mechanisms, particularly important.

Personal Data

Outsourcing that involves personal data is governed by the GDPR, supplemented by the Polish Personal Data Protection Act of 2018 and enforced by the President of the Personal Data Protection Office (UODO). The supplier usually acts as a processor, which requires a data processing agreement in writing, including electronic form (unlike a copyright assignment, it does not require a qualified electronic signature), customer control over sub-processors and the assistance obligations prescribed by the GDPR. Where the supplier determines purposes of its own (for instance, by using customer data to improve its services or to train AI models), it may become a controller, which changes both the legal basis required and the allocation of responsibility.

Cross-Border Data Flows

Transfers outside the EEA require an adequacy decision, standard contractual clauses or another GDPR transfer mechanism, supported where relevant by a transfer impact assessment. Transfers to US providers certified under the EU–US Data Privacy Framework can rely on the European Commission’s adequacy decision of July 2023. Polish law imposes no general data localisation requirement, and neither does DORA, which instead requires contracts to identify where services are provided and data processed and to provide for notification of changes. In practice, many regulated and public sector customers nonetheless require EEA locations as a matter of their own risk policy.

Professional Secrecy

Banking, insurance and medical secrecy rules limit what may be disclosed to a supplier, and require the supplier and its staff to be bound by equivalent confidentiality obligations. These rules apply in addition to the GDPR and must be reflected in the contract chain, including subcontractors.

Data Security

Security requirements now flow from several overlapping sources: the GDPR, DORA for financial entities and the Polish NIS2 rules for essential and important entities, each with its own incident-reporting timelines. A supplier serving clients in different sectors may therefore face several notification regimes for a single incident.

Developments: the EU Data Act

The EU Data Act, applicable since 12 September 2025, extends regulation beyond personal data. It introduces rules on access to and sharing of data generated by connected products, obligations facilitating switching between cloud and data processing providers (see 4.7 Digital Transformation) and safeguards against unlawful access to non-personal data by third-country governments.

A Framework Agreement with Operational Schedules

The usual Polish model is a master or framework agreement supported by statements of work and schedules covering service levels, charges, security, data processing, governance and exit. The framework fixes the legal relationship for the whole term; the schedules carry the detail that changes. Large customers in banking, insurance and automotive distribution insist on their own templates; suppliers of standard software and SaaS start from their own terms; and integrators sit between the two.

Why the Civil Code Classification Matters

Polish law has no “outsourcing contract” as a named type. An outsourcing agreement is a mixed contract that usually combines a contract for specific work (umowa o dzieło) for implementation and defined deliverables, a contract for services, to which the Civil Code rules on mandate apply, for ongoing operation, a licence or assignment of copyright for software, and sale or lease for hardware. The classification sets the default rules. For specific work, the customer has statutory warranty rights and may withdraw before completion against payment; for services, each party has a statutory right to terminate which, on the prevailing view, cannot be waived in advance for important reasons (see 4.2 Termination). Well-drafted agreements therefore separate the implementation phase from the run phase, and say expressly which regime governs each.

Acceptance, Pricing and Governance

Acceptance procedures receive particular attention, because acceptance of the work marks the moment from which warranty periods run and payment milestones fall due. Customers negotiate staged acceptance, defined defect categories and a right to conditional acceptance with a remediation list. Pricing typically combines a fixed implementation fee tied to milestones, recurring fees per user, transaction or environment, and a rate card for changes, with PLN indexation or currency clauses where the supplier buys cloud capacity in EUR or USD. Governance follows a familiar pattern of steering committee, operational meetings, change procedure and escalation, and the agreement sets an order of precedence so that supplier standard terms and online documentation cannot override negotiated provisions.

Form Requirements

One formality regularly catches foreign parties. Under Polish law, “written form” means a handwritten signature or a qualified electronic signature; a simple or advanced electronic signature is not sufficient. Because an assignment of copyright and an exclusive licence require written form to be effective (see 4.4 Implied Terms), IT contracts in Poland are signed with wet-ink or qualified electronic signatures even where the rest of the deal could be concluded by e-mail.

Multi-Sourcing and the Integration Gap

Multi-sourcing is common in large Polish organisations, usually with the customer or a lead supplier acting as service integrator. The recurring legal problem is the gap between suppliers: no single provider owns the interface, so incidents at the boundary are disputed and service levels are excused by reference to another party. Workable contracts define the interface, oblige each supplier to co-operate in diagnosis regardless of fault, and provide for an evidence-based allocation of responsibility after the event rather than a stand-off during it.

Multi-party arrangements also raise competition law issues in distribution networks. In one engagement led by the authors, a nationwide automotive importer renegotiated the IT platform used with some 60 independent dealers and two national software providers, so that the standards of its international network could be implemented in Poland. The negotiation ran in parallel on legal, technical, commercial and management levels, and had to respect the dealers’ independence, including the limits on information exchange between competitors under Polish and EU competition law.

Captive Centres, Build-Operate-Transfer and Joint Ventures

Poland’s large shared-services sector means that captive centres remain a frequent alternative to third-party outsourcing. Build-operate-transfer structures are used where a customer wants a dedicated team built by a supplier and later taken in-house. The transfer step should be planned from the outset: where the activity, assets and team pass to the customer, the statutory rules on transfer of a workplace will often apply (see 5.1 Employee Transfers); software licences in Poland are generally not transferable without the licensor’s consent, and intra-group pricing raises transfer pricing and VAT questions. Joint ventures are used for knowledge-based services where both parties contribute methodology and data.

Staff Augmentation and the B2B Contractor Model

Staff augmentation (“body leasing”) is widespread in Polish IT, and many specialists work as self-employed contractors on business-to-business terms rather than as employees. This flexibility carries two risks. Where the customer directs the contractor’s staff on a day-to-day basis, the arrangement may be reclassified as employment or as temporary agency work, with tax, social security and employment consequences. In addition, a body-leasing contract gives the customer no service levels or outcome guarantees, so it should not be described as a managed service in regulatory documentation.

From Bespoke Contracts to Standard Platforms

Cloud, SaaS and IaaS have shifted the balance of drafting power towards suppliers. Hyperscalers and major SaaS vendors negotiate little, and Polish customers increasingly accept standard terms supplemented by a negotiated addendum. For the financial sector, the main cloud providers now offer DORA addenda, but these reflect the provider’s reading of the regulation and still need to be checked against the customer’s own risk assessment, the register-of-information requirements and the expectations of the KNF. The Polish Bank Association’s “Polish Cloud” standard is used as a reference for sector practice.

Layers of Providers

A typical cloud transaction involves a platform provider, a reseller, an implementation partner and sometimes a managed service provider. Their obligations rarely fit together by default. A promise by the integrator cannot expand the rights granted by the platform provider, and Ministry of Digital Affairs guidance under the amended National Cybersecurity System Act indicates that an entity which only resells cloud capacity, without itself providing the service or processing data in the cloud, is not a cloud provider for regulatory purposes; the label alone does not decide the classification. Customers therefore map which entity performs each function before accepting a single point of contact.

Change, Consumption and Exit

Subscription and consumption pricing requires definitions of users, environments and chargeable events, as well as rules on price changes and currency. Product updates follow the provider’s roadmap, so the agreement should give notice and remedies for material reductions in functionality instead of an unrealistic right to approve each release. The EU Data Act, applicable since 12 September 2025, imposes minimum switching obligations on providers of data processing services, and prohibits switching charges from 12 January 2027, subject to a lighter regime for certain services built to a customer’s individual specifications and without affecting ordinary service fees or agreed early termination charges. Exit has therefore become a design question answered at signature, not a negotiation held when the relationship fails (see 4.7 Digital Transformation).

Defining the Result First

Protection begins with a clear description of the scope, acceptance criteria, service levels and customer dependencies. Under Polish law, the customer may claim damages for non-performance or improper performance, unless the supplier shows that the failure was due to circumstances for which it is not responsible, so the burden of exculpation generally lies with the supplier. The statutory remedies are supplemented by the contractual mechanisms described below.

Contractual Penalties and Service Credits

Contractual penalties (kary umowne) are the most common remedy in Polish IT contracts. They are payable without proof of loss, but as a rule may be reserved only for non-monetary obligations, so a penalty for late payment is at risk of being held invalid. A court may reduce a penalty that is grossly excessive or where the obligation has largely been performed, and damages above the penalty are generally available only if the contract expressly says so. Penalties for delay are commonly capped at a percentage of the contract value, with a right to withdraw once the cap is reached. Service credits are usually structured as a price reduction rather than a penalty, and the agreement should state whether they are the sole remedy for the relevant failure.

Warranty, Guarantee and Step-In

Deliverables accepted as specific work carry statutory warranty rights for defects, which between businesses may be extended, limited or excluded, except for defects fraudulently concealed. A separate quality guarantee is usually negotiated for software, with defect categories, response and fix times.

Step-in rights are agreed for critical services, but their value depends on the customer actually being able to use the systems: third-party licences, cloud subscriptions and administrative credentials should be held in a way that permits step-in. Source-code escrow with a Polish escrow agent or notary is used for bespoke business-critical software, with release on abandonment of support or persistent breach.

Security and Court Protection

Performance bonds and bank guarantees are standard in public procurement, where security of 5% of the contract value is typically demanded, and are increasingly requested by private customers for large implementations. Where the relationship breaks down, Polish courts may grant interim measures securing non-monetary claims, which can include ordering a supplier to continue services or hand over data for the duration of a dispute. The applicant must show a prima facie claim and a legal interest; the measure is at the court’s discretion and timing varies, but in exit disputes the possibility of seeking such relief is a practical lever.

Termination for Convenience

For the services element of an outsourcing contract, as a rule each party has a statutory right to terminate at any time. The parties may regulate ordinary termination, but the prevailing view is that the right to terminate for important reasons cannot be waived in advance, and a party terminating without an important reason may be liable for the resulting loss. Agreements therefore usually list what counts as an important reason and set notice periods, typically three to 12 months for outsourcing, together with termination fees that reflect unrecovered transition investment. For specific work, the customer may generally withdraw before completion against payment of the agreed fee minus what the supplier saved.

Termination for Breach

Statutory withdrawal for breach generally requires setting an additional deadline for performance, although the Civil Code provides exceptions – for example, where the contract fixed a strict deadline or the supplier declares that it will not perform. Contracts shorten the process with defined termination events, such as repeated service-level failure, a serious security incident or a change of control. Two features of Polish law deserve attention here.

• First, where the parties agree a contractual right of withdrawal, it should be exercisable within a defined period, because open-ended withdrawal rights are at risk of being held invalid; this does not apply to ordinary termination of continuing services on notice.
• Second, clauses providing for termination or modification of a contract upon a bankruptcy filing or declaration are generally ineffective under Polish insolvency law, so termination triggers are based on actual non-performance or cessation of payments rather than on insolvency status.

Regulatory Termination Rights

DORA requires contracts for ICT services to allow a financial entity to terminate on grounds including breach of law, impediments to supervision and weaknesses in the provider’s ICT risk management, and to provide for exit strategies for critical or important functions. The Data Act limits the notice period for initiating a switch of data processing services to two months and sets a default transitional period of 30 days. Neither regime affects the ordinary fee for services actually rendered, but both make exit a mandatory part of the contract.

The Customer’s Position on Exit

Customers negotiate exit assistance for a defined period, return of data in agreed formats, knowledge transfer and transitional licences. One point specific to Polish copyright law deserves attention: unless the contract provides otherwise, a licence granted for an indefinite period may be terminated by the licensor on one year’s notice taking effect at the end of a calendar year, and a licence granted for more than five years is treated as indefinite after five years. Whether termination can be excluded altogether is debated, and a long fixed term does not solve the problem on its own, since it is treated as indefinite after five years. Customers seeking a lasting position therefore usually seek an assignment of the economic rights where the supplier will agree, or accept a licence with express provisions on duration and termination and plan for the residual uncertainty, rather than relying on the word “perpetual”.

Recoverable Loss

Polish law compensates loss within the normal consequences of the event, including both actual loss and lost profits. The Civil Code draws no distinction between direct and indirect loss; the test is adequate causation. English-language labels such as “indirect” or “consequential” loss have no fixed meaning under Polish law and should be defined in the contract; otherwise, a court will have to interpret them. Punitive damages are not available, and courts may estimate the amount where loss is proven but cannot be precisely quantified.

Market Practice

Lost profits, loss of business and loss of goodwill are routinely excluded in IT and outsourcing contracts, and courts generally respect a clear exclusion. Aggregate caps of 100% of annual fees or of the total contract value are common, with higher caps or no cap for breach of confidentiality, data protection and intellectual property infringement, and uncapped liability for wilful misconduct. Customers increasingly insist that costs of restoring data and procuring replacement services are expressly treated as recoverable, because a broad “consequential loss” exclusion may otherwise swallow the main risk they are buying protection against.

Limits that Cannot be Contracted Away

Liability for loss caused intentionally cannot be excluded in advance. Gross negligence is a frequent negotiating point: the prevailing view is that it may be limited, but suppliers rarely obtain this and courts scrutinise such clauses closely. Between the contracting parties, a limitation can – in principle – extend to tort claims arising from the same facts if the contract says so, because Polish law allows concurrent contractual and tort claims unless the parties provide otherwise; limitation clauses should therefore address both regimes expressly. Limitations do not bind third parties, and exclusions of liability for personal injury are generally regarded as unenforceable in practice. In banking outsourcing, the Banking Law draws a distinction: the supplier’s liability towards the bank for loss caused to the bank’s customers cannot be excluded, while the bank’s own liability towards its customers cannot be excluded or limited.

Regulatory Fines and Limitation Periods

Administrative fines under the GDPR, DORA or the National Cybersecurity System Act are imposed on the regulated entity and cannot be transferred. Whether a fine may be recovered from a supplier as damages is contested, and indemnities are usually drafted “to the extent permitted by law”. Contractual penalties for breach of security or confidentiality obligations are a more reliable tool. Claims under business contracts generally become time-barred after three years, counted to the end of the calendar year, but shorter two-year periods apply to claims under contracts for specific work and to certain claims of service providers, so claims procedures should be checked against the period relevant to each part of the contract.

Statutory Default Rules

Polish law does not imply terms in the common law sense, but a contract produces the effects that follow from statute, established custom and the principles of social coexistence, in addition to its express wording. A professional supplier is held to a standard of care that takes account of its professional character, and the customer owes a duty to co-operate. The rules of the applicable contract type then fill the gaps: for specific work these include statutory warranty for defects and the customer’s right to withdraw before completion, and for services the termination rules described in 4.2 Termination.

Payment Terms

Statutory rules on payment in commercial transactions also apply by default. Payment terms longer than 60 days are generally permitted only if they are not grossly unfair to the creditor, and are not available where a large enterprise owes a small or medium-sized one. Late payment attracts statutory interest at a rate well above commercial borrowing costs, plus fixed recovery costs. Outsourcing invoices from Polish suppliers are therefore due faster than many international customers expect.

Copyright and Software

The copyright rules are the most important “implied” terms in Polish technology contracts. An assignment or exclusive licence requires written form, covers only the fields of exploitation expressly listed and cannot extend to fields unknown when it was signed. An employer acquires the economic rights to software created by employees in the course of their duties, but no equivalent rule covers self-employed contractors, so a supplier relying on B2B developers needs assignments from each of them to pass clean title to the customer.

Moral rights are limited for computer programs but apply to related works, such as documentation and interface design, so customers often obtain undertakings that authors will not exercise such rights. A legitimate user of software has certain statutory entitlements, including to correct errors where necessary to use it as intended; the parties may agree how such corrections are carried out but, following the Court of Justice’s Top System judgment, may not exclude the possibility altogether. Delivery of software does not, however, give a right to the source code.

Consumer-Facing and Online Services

Where an outsourced platform serves consumers, the Polish Consumer Rights Act and the rules on abusive clauses apply to the customer’s terms, and the Act on Providing Services by Electronic Means requires published terms of service for any online service. These requirements flow down to the supplier through the service description, and platform reviews frequently reveal terms that would be difficult to enforce against Polish consumers.

Baseline Security Requirements

Customers typically require:

• ISO/IEC 27001 certification or SOC 2 reports;
• annual penetration tests;
• encryption in transit and at rest;
• multi-factor authentication for privileged access;
• logging;
• vulnerability management; and
• segregation of the customer’s environment.

Financial entities add the DORA requirements, including threat-led penetration testing for designated institutions, and the right to audit or to rely on pooled audits. Under the amended National Cybersecurity System Act, in-scope entities must manage supply chain risk, so suppliers to essential and important entities are now asked for evidence of their own security management, for subcontractor lists and for co-operation with the customer’s risk assessments.

Incident Reporting Timelines

The contract should let the customer meet overlapping statutory deadlines:

• 72 hours to the data protection authority under the GDPR;
• an early warning within 24 hours and an incident notification within 72 hours under the Polish NIS2 rules, followed by a final report; and
• under DORA, an initial notification within four hours of classifying an incident as major and, as a rule, no later than 24 hours after becoming aware of it.

Supplier clauses therefore require notification of suspected incidents within a few hours, with progressive updates, preservation of evidence and support in investigations, and specify whether this support is included in the fee or charged at pre-agreed rates, as DORA requires.

Supply Chain and High-Risk Vendors

Clauses on subcontractors have moved from consent rights to full chain visibility: identification of each subcontractor supporting critical functions, flow-down of security obligations, notice of material changes and a right to object. Since April 2026, customers also seek protection against a supplier, or a component in its supply chain, being designated a high-risk vendor under the National Cybersecurity System Act, including a right to require replacement and to terminate without penalty. Trade secret protection depends on the holder taking reasonable steps to keep information confidential, so confidentiality clauses and access controls are evidence as well as obligations.

Business Continuity

Suppliers demonstrate continuity through:

• recovery time and recovery point objectives;
• geographically separate data centres within the EEA;
• immutable back-ups as a defence against ransomware;
• documented recovery procedures; and
• at least annual recovery tests, with results shared with the customer.

Financial sector customers require participation in their own continuity testing and alignment of the supplier’s plans with the exit strategy, so that a failed supplier can be replaced rather than merely sued.

Service Levels that Measure the Business Outcome

Service levels in Polish contracts have moved beyond availability to measures the customer actually needs:

• transaction success rates;
• response and resolution times by priority;
• backlog;
• batch completion deadlines; and
• successful recovery tests.

Each metric is defined with its measurement period, data source and calculation method, and exclusions for planned maintenance, customer-caused failures and third-party dependencies are made specific. Because the supplier usually operates the monitoring tools, customers negotiate access to raw measurement data so that disputes can be verified.

Governance and Consequences

Monthly reporting, operational and executive reviews and a remediation plan mechanism for repeated failures are standard. Service credits provide the immediate consequence, while defined thresholds of persistent failure trigger step-in or termination rights. Benchmarking clauses appear in longer contracts but work only where comparable inputs and a defined consequence are agreed in advance. For AI-enabled services, quality metrics now cover error rates and the volume of human correction, not only speed and cost.

Dispute Escalation

Escalation to senior management and mediation precede litigation in most agreements. Commercial litigation in Warsaw typically takes several years to a first-instance judgment, which makes contractual evidence and escalation records decisive. Arbitration before the Court of Arbitration at the Polish Chamber of Commerce or the Lewiatan Court of Arbitration is chosen for larger contracts, and Polish courts can grant interim relief in support of both routes (see 4.1 Customer Protections).

Shared Responsibility

Cloud contracts allocate responsibility between the provider’s platform and the customer’s configuration, and identity management and use; the allocation differs between IaaS and SaaS, and changes again when a managed service provider is added. Polish regulators expect the customer to understand and document that allocation. Security and service-level schedules should mirror it rather than restate a generic shared responsibility statement.

Audit, Location and Sub-Processors

Physical audit of hyperscale facilities is impractical, so customers rely on independent assurance reports and pooled audits. DORA preserves the audit and access rights of financial entities and supervisors, so reliance on certifications cannot entirely replace them. Data location (which most regulated customers restrict to the EEA as a matter of their own risk policy), lists of sub-processors with notice of changes, and the Data Act’s safeguards against unlawful access by third-country authorities are now standard requirements. Public sector customers sometimes prefer domestic offerings, including the national cloud operator established by the state development fund and a major bank.

Change, Suspension and Pricing

Unilateral changes to the service, suspension rights and auto-renewal need the most attention. Customers obtain notice of material functionality changes with a right to terminate without penalty, a distinction between suspension for security reasons and suspension for payment disputes, and continued access to data during any suspension. Consumption pricing in EUR or USD transfers currency risk to the Polish customer, which is addressed through fixed-rate periods or PLN pricing.

Exit and Switching

The Data Act now gives customers of data processing services statutory rights to switch, export data in a structured format and receive assistance, with switching charges abolished from 12 January 2027, subject to the exceptions noted in 3.3 Digital Transformation. Exit schedules therefore list exportable data and configurations, formats, interfaces and the transitional period. Liability is assessed against the function the service supports: a standardised SaaS product may run a critical process, and the customer’s back-ups and ability to switch then matter as much as the negotiated cap.

When Employment Transfers Automatically

Under the Labour Code, a transfer of a workplace or part of it to a new employer transfers the employees by operation of law, on their existing terms. Whether an outsourcing transaction amounts to such a transfer depends on whether an economic entity retains its identity, applying the factors developed by the Court of Justice and followed by the Polish Supreme Court: the type of activity, transfer of assets, takeover of staff, transfer of customers and continuity of operations.

In asset-light services such as IT support or back-office processing, the decisive factor is usually whether the new provider takes over a major part of the workforce. A change of contractor alone does not transfer employees, but a new supplier that hires most of the outgoing team may find that it has inherited them with their seniority and terms.

Consequences

The transfer itself may not be used as a reason for dismissal, and the parties cannot avoid it by stating in the contract that no employees will move. For a transfer of part of a workplace, the old and new employers are jointly and severally liable for obligations arising before the transfer. Employees must be informed, in paper or electronic form, at least 30 days before the planned transfer where there is no trade union, and within two months of the transfer they may end their employment without notice by giving seven days’ advance warning. Terms of a collective agreement bind the new employer for one year.

Market Practice

Transfers are common when banks, insurers and corporate groups move back-office or IT functions to a supplier or shared service centre, and when outsourcing is reversed. The outsourcing agreement allocates pre-transfer liabilities, accrued holiday and bonus entitlements, and the cost of redundancies through indemnities, and provides for workforce due diligence carried out under data protection rules.

Self-employed B2B contractors, who form a large part of Polish IT teams, are not covered by the transfer rules; their contracts do not pass automatically and either need to be assigned to the new supplier, with the contractor’s consent, or concluded afresh.

Non-solicitation clauses between customer and supplier are generally enforceable and are routinely used to protect transferred teams, provided they are necessary for and proportionate to the outsourcing relationship. Broader no-poach arrangements are a competition law risk: on 2 June 2025, the European Commission imposed a fine of EUR329 million on Delivery Hero and Glovo for a cartel that included a no-poach agreement, in its first decision of this kind. Post-employment non-competes with individual employees require compensation of at least 25% of the remuneration the employee received before the employment ended, calculated over a period corresponding to the duration of the restriction.

Trade Unions

Where trade unions operate at the employer, the Trade Unions Act requires both the current and the new employer to inform them in writing, at least 30 days before the expected transfer, of its date, its reasons, the legal, economic and social consequences, and any intended measures affecting employment. If measures are intended, the employer must negotiate with the unions with a view to reaching an agreement within 30 days; if no agreement is reached within that period, the employer may act on its own, taking into account the arrangements made with the unions during the negotiations. Where there is no union, the same information goes directly to the employees.

Works Councils and Collective Redundancies

Works councils exist only where employees have established one, at employers with at least 50 employees, and are entitled to information and consultation on changes in work organisation and employment, including outsourcing. Where an outsourcing project leads to dismissals, the collective redundancies regime applies to employers with at least 20 employees once statutory thresholds are reached within 30 days (ten employees where fewer than 100 are employed, 10% between 100 and 300, and 30 above 300). It requires consultation with unions or employee representatives, notification of the labour office and a minimum period before dismissals take effect.

Practical Effect

None of these procedures gives employee representatives a veto over outsourcing, but their timing shapes the transaction calendar. The information period runs before the planned transfer date, not before signature, so the outsourcing contract can be signed earlier, provided the transfer date leaves room for information and, where required, consultation. Setting a transfer date that does not allow for this may expose the employer to sanctions and to claims by affected employees. In practice. the employment workstream is planned alongside the commercial negotiations, with the transfer date fixed accordingly.

Poland as a Nearshore Destination

Poland is one of Europe’s largest nearshore locations for business and IT services, serving customers in Germany, the Nordics, the United Kingdom and the United States, with Germany being the sector’s largest export market according to ABSL. Demand has shifted from volume to specialised engineering, data and cybersecurity services, and the inflow of IT professionals from Ukraine and Belarus since 2022 has deepened the talent pool. For Polish customers, delivery is largely onshore, with offshore capacity in India and other locations used for first-line support and round-the-clock coverage.

Regulation as a Location Driver

The clearest recent change is regulatory. The GDPR, DORA and the Polish NIS2 rules make the location of delivery and data a contractual issue, and most regulated customers now restrict both to the EEA as a matter of policy, while the high-risk vendor procedure under the National Cybersecurity System Act adds the origin of hardware and software to the agenda. EU sanctions prohibit the provision of IT consultancy and related services to recipients in Russia, and the use of suppliers from Russia and Belarus is constrained by sanctions listings, export and payment restrictions. Customers now specify permitted delivery locations in the contract and treat relocation as a change requiring consent.

The Statutory Framework

Remote work has been regulated in the Labour Code since April 2023. It may be performed wholly or partly from a location agreed with the employer, under rules set in a collective agreement, workplace regulations or an individual agreement. The employer must provide equipment or pay a cash equivalent, and must cover the costs of electricity and telecommunications, usually through a tax-free lump sum. Employees may request up to 24 days of occasional remote work a year, which the employer may but need not grant.

Certain groups, including pregnant employees and parents of children up to four years old, are entitled to remote work unless the organisation or type of work makes it impossible. Health and safety obligations continue to apply, and the employer may inspect the remote workplace in agreement with the employee.

Cross-Border Remote Work

Working from abroad raises social security, tax and immigration questions. Poland participates in the multilateral framework agreement on cross-border telework, which allows employees to work from their state of residence for a substantial part of their time while remaining insured in the employer’s state, subject to an application. Employers also assess whether an employee working from another country creates a permanent establishment for corporate tax, and whether the destination country’s employment law applies through its mandatory rules.

Customer Requirements

Outsourcing customers focus on data security and location. Typical requirements are:

• a prohibition on working from outside the EEA;
• approved devices with endpoint protection;
• secure connections;
• clean-desk and screen-privacy rules; and
• restrictions on printing and personal devices.

Regulated customers add that privileged administration of their systems must be performed from the supplier’s premises or an approved location. Suppliers must implement these requirements through their own employment arrangements, including rules on monitoring that respect employees’ privacy, and the same discipline should extend to self-employed contractors, who are outside the Labour Code but inside the customer’s security perimeter.