AI consultancy in Poland: seven questions first

The number of firms offering "AI consulting" in Poland has grown sharply in recent years. Most are generalist IT consultancies that added a slide about large language models to their existing deck. Some are former Big Four risk teams that pivoted to AI governance. A small number are engineers who have shipped AI systems into regulated EU industries and turned their practice into a consultancy.

This post is for the buyer at a regulated SME who has decided they need external help and now has to choose between them. Seven questions will filter out most candidates, ordered from "must pass" to "nice to have."

In short. Seven questions filter out unserious AI consultancies: does the candidate map AI Act Article 6 onto your use case, where does inference run, what do they deliver in the first six weeks, can they give a reference with the same regulatory profile, what happens after the engagement, how do they measure success, and what does it cost at fixed scope. Failing question 1 or 2 is enough to drop a candidate.

1. Can you walk us through Article 6 of the AI Act in concrete engineering terms?

The answer sorts candidates in under a minute. AI Act Article 6 defines which AI systems are high-risk; Annex III lists eight categories (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice and democracy); Article 6(2) and (3) set rules for biometric and product-safety exceptions.

A serious candidate explains how Article 6 maps to your use case in less than five minutes and tells you whether your system is in scope. They quote subparagraphs by number and name a judgement criterion ("if your CV-screening tool scores ranked candidates, that hits Annex III paragraph 4"). A generalist either cannot answer or paraphrases the executive summary. If they stumble on Article 6, they will not survive a procurement argument with your bank's compliance team.

2. Where does inference actually run for the systems you build?

Inference location is the entire Sovereign AI problem. You will get one of four answers:

• "We integrate with OpenAI / Anthropic / Azure OpenAI." Cloud US, potentially EU region.
• "We build on open-weights models served in EU cloud (OVH, Scaleway, Hetzner, private AWS Frankfurt)." Acceptable with caveats around tenancy and the contractual chain.
• "On premises at the customer, on hardware we specify and they own." Optimal for high-risk systems handling regulated data.
• "It depends." Best answer if followed by "and here is the trade-off framework we use to decide."

An answer that lands on only the first option is disqualifying for a regulated industry. Regulated data plus a third-country inference path plus a Cyberus-style ruling is a contract you cannot sign.

3. What does a typical first six weeks deliver?

A serious answer names three to five deliverables with a fixed shape and a fixed time: an architectural decision record, a data flow map, a build-vs-buy analysis per AI component, a compliance readiness checklist mapped to AI Act and (where relevant) DORA and NIS2, a prototype of the riskiest integration point.

Implementation-only answers ("we'll deliver a working prototype in week six") skip the strategic decision support that an SME needs first. A prototype without an architecture is wasted work. A typical fixed-scope diagnostic runs two to three days. A typical first-month engagement runs four to six weeks. Mismatches against this profile usually mean the candidate is selling a different product or does not know what they are selling.

4. Can we talk to a reference customer with the same regulatory profile?

Not a logo slide. A real reference with the same regulation, the same data type, the same approximate scale.

References that count: a bank that uses the vendor for AI governance under DORA, a medical SaaS under MDR plus GDPR, a public-sector entity under NIS2. Logo slides from any-name Fortune 500 brand with no operational depth are not a reference. If a candidate cannot produce a comparable reference after one follow-up, they have not done the work you are about to pay them to do.

5. What is your position on managed services once the engagement ends?

A serious answer is one of three:

• "We hand off to your team with documentation and a transition period." Best answer for an SME with in-house engineers.
• "We offer an optional retainer for ongoing architectural review, but the architecture is yours." Acceptable.
• "We operate the system under an SLA, with runbooks and a documented exit." Valid for a customer that does not want to operate AI itself.

Disqualifying: "all architecture and IP are exclusive to our platform," "the system depends on our proprietary inference backend that you cannot self-host," or no answer. Switching costs are designed in either way.

6. How do you measure success of the engagement?

Concrete and quantitative: "compliance readiness percentage against Article 12 to 15 artefacts," "decision-to-production cycle time in weeks," "audit finding count in the next conformity assessment," "vendor consolidation ratio on the AI stack." Qualitative answers like "stakeholder satisfaction" or "workshop attendance" do not survive a post-engagement review where the buyer asks whether anything changed. Disqualifying: no answer, or "we'll define KPIs together" - defining success criteria after the engagement has started is the procurement-team tell.

7. What does it cost and is the scope fixed?

A serious candidate publishes fixed prices for diagnostic engagements or names the rate, the day count, and the cap. They tell you the engagement ends at a defined number of artefacts, not "until we are done."

Polish AI consulting is generally priced in one of two shapes: a short fixed-price diagnostic with a written output, or a longer embedded engagement (fractional architect, a few hours a week for a few months) billed monthly. A price clearly below the other candidates usually means a junior or subcontractor model where the senior is on the sales call and the work is done by someone else; a price clearly above is the Big Four premium, the hyperscaler consulting arm, or a brand name that does not yet have the delivery track record to justify it. If the proposal arrives without one of these two shapes on the page, ask why.

How to use the seven questions

In a typical vendor selection this list turns into a 45-minute first call and a two-hour second call with a reference. If the candidate fails questions 1 or 2 on the first call, you do not need a second call.

The seven questions also double as a writing prompt for the candidate's eventual proposal. A strong proposal answers each question implicitly: it cites Article 6 subparagraphs in the scope section, names the inference location, lists deliverables by name and date, includes one comparable reference, names the transition plan and the IP boundary, names two to three measurable outcomes, and states the price and the scope shape up front.

If your shortlist has multiple candidates that pass all seven, the choice between them usually turns on cultural fit (will this person be effective in your CTO's staff meeting) and pricing geometry (which scope shape matches your budget cycle).

What to do after you choose

Once a candidate is selected, three operational practices make the engagement produce the outcomes you paid for. A weekly written status (one page; agreed, delivered, next), which becomes part of your internal record under DORA Article 11 or NIS2 Article 21 documentation requirements. A shared working document where architectural decision records, data flow maps, and risk registers live in a single space both parties can see. A fixed decision gate at the end of each phase where the buyer signs the work as accepted or rejected, so a long engagement cannot drift.

When the answer is "do this in-house"

If the seven questions get answered well only by external candidates and the engagement cost would consume your AI budget for a year, the right next step is to build the capability with a different scope. Hire a Fractional AI Architect for three months at 40% allocation. Use that time to build the diagnostic capability in-house, document the architecture, and decide which parts of the implementation stay external. The retained knowledge stays with you; the fractional person exits when the work is documented.

ArtCode Software operates exactly this model with regulated Polish SMEs: a fixed-scope diagnostic in the first two weeks, an AI architect working with the team for the following twelve weeks, and a clean exit at the end with the documentation handed over.

If you want to discuss what an engagement with ArtCode Software specifically would look like, the “Does AI make sense for your process?” consultation is 60 minutes online (PLN 299 total) with a short written summary. If you need the full diagnostic, that is the AI Readiness Audit, which takes two weeks and costs from PLN 4,900 net.