Artificial intelligence is changing the way we work, communicate and make decisions. The European Union is trying to give these changes a direction — from the AI Act to the development of a European cloud and open-source software. What does this mean for a small company or a social organisation? And how can you prepare for the future without turning your existing work upside down?

In October I had the pleasure of spending a few days in Brussels on a study visit organised by the Regional Representation of the European Commission in Wrocław. The programme included meetings on artificial intelligence, digital technologies and the challenges facing education — at school, university and in non-formal settings.

As co-founder and CTO of Tesserakt, I paid particular attention to this last area. Day to day, we run training for companies and social organisations and help them make use of new technologies. So during the conversations in Brussels one question kept coming back to me: how do you translate European strategies and regulations into decisions that a small team can actually make?

I came back from the visit convinced that although EU legislative processes can be slow, the diagnosis behind them is accurate: AI, dependence on the big platforms and the growing role of data are changing our economies and societies. Policymakers are trying to create frameworks that will allow European organisations to adapt to these changes and develop competitive solutions.

But between a regulation and the everyday reality of a foundation, an association or a small company, there is still a lot of work to do. You need to understand your own needs, assess risk, train people and choose solutions that will serve the organisation several years from now as well.

In this article we look at the most important changes and at what you can do today.

Study visit to Brussels — in the Europa building, seat of the European Council and the Council of the European Union.

Europe wants more control over technology

For years, many European companies and institutions have built their operations on services supplied by global technology giants. That is understandable: popular platforms are convenient, often easy to deploy and offer a wide range of features.

That convenience comes at a price, though. When data, communication, sales and everyday processes all end up in a single ecosystem, the organisation becomes dependent on the decisions of its owner. A change in pricing, terms of service or access rules can suddenly become a business problem. So can an outage, the loss of an administrator account or the inability to export data easily.

This is one of the reasons why digital sovereignty is being discussed more and more often in Europe.

In June 2026 the European Commission presented its technology sovereignty package. It includes a strategy for supporting open-source software and projects concerning, among other things, the cloud, AI and semiconductors. Their common goal is to strengthen European competences and reduce risky dependencies on individual suppliers and non-EU countries. Part of the package consists of legislative proposals — so not all of the announced solutions should be treated as law that is already in force.

In practice, digital sovereignty means the ability to make informed decisions about technology. An organisation should know:

• where its most important data is held and who has access to it;
• which services and suppliers its key processes depend on;
• whether it can export its data and move it to another system;
• what it will do in the event of an outage, loss of access or a change in contract terms;
• what alternatives exist and how much it would cost to implement them.

For a large institution this may mean an extensive technology strategy. For a small association, the first step may be writing down its services, administrator accounts and backup locations.

Sovereignty does not require a revolution

Let us imagine a foundation that has been using Google Workspace for years. Its team knows the tools, the documents are well organised and collaboration runs smoothly. Should it immediately move everything to another provider?

Not necessarily. Such a change could absorb time and money, disrupt work and require training for the whole team. If it does not stem from real needs and a risk analysis, it may bring more problems than benefits.

A more sensible starting point is to check what data is stored in the service, who has access to it, whether it can be recovered and what a migration plan would look like. When choosing the next tool, you can consciously compare European and open alternatives as well.

That is how we understand digital sovereignty at Tesserakt: as gradually expanding the range of choices and reducing unnecessary dependencies.

The European cloud and open source: more freedom, but also more responsibility

An important part of Europe's technology strategy is the development of open-source software. Its code is available under the terms set out in the licence, which can make it easier to analyse how a program works, develop it and adapt it to your own needs.

For an organisation, the value can be very concrete. An open system gives you a chance to find another contractor, maintain the solution yourself or change your infrastructure. This does not mean that every migration will be simple or free of charge, however. You still need competences, documentation and time.

At Tesserakt we mainly use the European cloud Hetzner. We also use, among other things, Coolify, an open tool for deploying and managing applications on infrastructure of your choice. We use solutions such as Proton, Tuta and Mistral, and we support open-source projects.

These are examples of different possibilities, not a universal list of tools for every organisation. When choosing a service, you need to look at its specific terms. Hetzner offers locations in Europe, but also provides infrastructure outside it, for example — so what matters is where we actually run the service. Maintaining Coolify yourself gives you more control, but requires you to take care of updates, security and backups.

Similar caution applies to AI. France's Mistral offers various models, but their licences and availability are not identical. Before choosing a particular model, it is worth checking whether you can run it in your own environment, on what terms you may use it and who will process the data you enter into it.

A European provider and open code can be important advantages. Neither of them replaces an analysis of security, contracts and the organisation's real needs.

The AI Act: Europe's attempt to bring order to artificial intelligence

Artificial intelligence is developing quickly, and its applications increasingly affect people: from recruitment and education to access to services. The EU's answer is the AI Act, a regulation laying down rules on certain artificial intelligence systems.

The foundation of the European approach is risk assessment. Obligations depend on, among other things, what the system is used for, what effects it may have and whether the organisation is its provider or its deployer.

Some practices are prohibited. For certain high-risk uses, more extensive requirements have been laid down. There are also transparency obligations concerning selected systems and content generated by AI.

This is an important distinction. A small company using a ready-made assistant to prepare draft versions of texts does not automatically have the same obligations as an entity designing and placing on the market a system for making significant decisions about people.

At the same time, the question "are we only using AI?" does not always close the matter. What matters is how the tool is actually used, the type of data involved and the decisions the organisation makes with its help.

What is already in force?

The AI Act applies in stages. In 2026 the timetable for some provisions was changed, so it is worth being careful with older articles that quote the original dates. According to the current European Commission timeline:

• from 2 February 2025, provisions including those on prohibited practices and AI literacy apply;
• from 2 August 2025, certain obligations concerning general-purpose AI models apply;
• from 2 August 2026, most provisions apply, including certain transparency obligations;
• from 2 December 2027, provisions concerning the high-risk systems listed in Annex III are due to apply;
• from 2 August 2028, the relevant provisions on high-risk AI systems embedded in products covered by certain regulations are due to apply.

Poland also has its Act on Artificial Intelligence Systems of 3 July 2026, which regulates, among other things, the national supervisory framework. The AI Act itself applies directly as an EU regulation.

AI literacy is a team matter

For many companies and NGOs, Article 4 of the AI Act is particularly important. It concerns providers and deployers of AI systems taking measures to support the development of AI literacy among the people who operate or use those systems on their behalf.

Such measures should take into account, among other things, employees' experience, the context of use and the people the system may affect. Following the changes to the provision, the point is not to guarantee a specific level of competence for every individual.

In practice, it is worth starting with these questions:

• Which AI tools do people in our organisation use?
• What tasks are they used for?
• What data should not be entered into them?
• Who checks the answers before they are used?
• Which decisions always require human assessment?

Training can help a team work out the answers and understand the limitations of the tools. There is, however, no single universal training course whose completion automatically settles every question of AI Act compliance.

Regulation can help, but it has to be translated into practice

The European approach gives companies and organisations a chance to build trust and develop services based on transparent rules. A common framework can also make it easier to operate in a wider market.

This does not mean that implementing the rules is simple. Legal analysis, documentation, changing deadlines and the costs of adaptation can be particularly difficult for small teams. It is also worth distinguishing the purpose of a regulation from its actual effects — those can be assessed as the rules are applied in practice.

The AI Act provides for measures supporting innovation, including priority access for eligible SMEs and start-ups to regulatory sandboxes. How useful they are for a particular project will, however, depend on the conditions of participation and the type of solution.

GDPR and AI: what happens to the data you enter?

A foundation is preparing a summary of conversations with its beneficiaries. A company wants to analyse customer enquiries. A recruitment team asks an AI assistant to organise candidates' documents.

Each of these uses may seem convenient. Each also requires an answer to the question: what information goes into the tool and what happens to it afterwards?

If we are working with personal data, the GDPR applies. Using AI does not suspend the rules on, among other things, the purpose and legal basis of processing, data minimisation and appropriate safeguards. The terms of service and the role of the provider matter as well.

Before entering a document into a tool, it is worth checking:

1. Do we really need personal data to complete this task?
2. Can we remove identifying data or use a test example?
3. What data processing terms does the provider offer?
4. Are we using the service on an account and plan approved by the organisation?
5. Who verifies the result and makes the final decision?

In some NGOs the stakes can be particularly high. Data concerning health, a difficult life situation or beliefs requires great caution. It should not end up in a random tool simply because that tool can quickly produce a summary.

The European Data Protection Board notes that applying data protection principles to AI models requires an analysis of the specific circumstances — including whether a model can be considered anonymous and which legal basis applies.

Is an American tool incompatible with the GDPR?

The provider's origin alone does not determine non-compliance. A transfer of data to the USA may rely on an appropriate mechanism, and what matters includes the recipient and the specific circumstances of processing. At the same time, a server located in Europe does not in itself guarantee GDPR compliance. More on this can be found in the European Data Protection Board's guide to international data transfers.

That is why, instead of asking only "is the data in the EU?", it is worth also asking about contracts, subcontractors, access to data, safeguards and the possibility of ending the relationship.

AI in everyday work: start with the problem, not the tool

According to Eurostat data, in 2025 20% of EU enterprises employing at least 10 people used at least one AI technology. In Poland, the figure in the cited publication was 8.4%. The survey covered a specific group of enterprises, not all companies or social organisations, but it illustrates the scale of change and the room for growth.

AI can support small teams if it is used for a specific task and kept under control.

In a social organisation it can help prepare a first draft of an event plan, organise publicly available information about a grant programme, develop alternative versions of communications or create a working outline of educational material.

In a company it can support the preparation of answers to recurring questions, the analysis of non-confidential materials, the organisation of knowledge, the creation of offer variants or communication planning.

In both cases the same principle applies: AI output is material to be checked, not a ready guarantee of correctness. The system may get facts wrong, misinterpret a document or produce a convincingly worded answer that has no basis in the sources.

OECD research on SMEs shows both the potential and the importance of skills. Among the surveyed firms using generative AI and experiencing skills gaps, some reported that the tools helped them narrow those gaps. At the same time, firms pointed to barriers related to legal issues and employee skills, among others.

That is why, before buying another subscription, it is worth sorting out the process itself. If an organisation does not know who approves content or where the current version of a document is kept, automation can only replicate the existing chaos faster.

Cybersecurity in the age of AI

AI can help with threat analysis and education, but it is also used by people committing fraud. Messages impersonating a colleague, a supplier or an institution can be better tailored linguistically and harder to recognise.

The European Union Agency for Cybersecurity, ENISA, points out that malicious groups increasingly use AI to streamline their operations. At the same time, phishing and other forms of social engineering remain a significant problem.

For a company or an NGO, this does not mean building a large security department straight away. It is worth starting with the basics:

• enable multi-factor authentication wherever possible;
• use unique passwords and a password manager;
• restrict access to data to the people who actually need it;
• make backups and check that they can be restored;
• regularly update devices and software;
• establish how unusual requests for a transfer, a change of account number or the sharing of data are confirmed;
• train the team on examples that reflect its everyday work.

In a small organisation it is particularly important to know who manages the domain, email, website and social media accounts. One person leaving should not mean losing access to the entire digital back office.

Marketing, brand and relationships with audiences

AI affects not only the way content is created. It also changes how audiences find information and make decisions.

In Pew Research Center research, based on the activity of a group of adult Google users in the United States in March 2025, clicks on traditional search results occurred less often on pages containing an AI summary than on pages without one. This is an observation about a specific sample and period, not proof that every Polish website will see the same effect. It does, however, show a direction of change worth following.

For companies and organisations this means reflecting on several questions:

• Are we publishing information that comes from our real experience?
• Does the audience know who stands behind the brand and why they can trust it?
• Is our knowledge also available outside social media?
• Can we reach customers, donors or participants without relying solely on one platform?
• Do we check content prepared with AI before publishing it?

AI can speed up the preparation of materials, but it will not replace knowledge of your own audience or responsibility for what you publish. Your own examples, client experiences and reliable sources help build communication that is backed by a specific organisation.

Transparency matters too. The AI Act provides for certain obligations concerning, among other things, certain deepfake content and systems that interact with people. This does not mean a general requirement to label every text that was created with the help of AI. The scope of obligations depends on the type of content, the use and the role of the entity concerned.

A separate element of the European legal environment is the Digital Services Act, which concerns primarily intermediary services and online platforms. It is worth understanding how it changes the obligations of the platforms we use, but you should not assume that every website owner or social media user has the same obligations as the provider of a large platform.

Why should social organisations talk about AI?

For NGOs, artificial intelligence is more than a set of office tools. Its development may affect the areas organisations work on every day: education, human rights, access to services, citizen participation in public life and efforts to counter exclusion.

AI can make it easier to prepare materials and increase access to knowledge. It can also reinforce existing inequalities if a tool handles a particular language, social group or context less well. An automatically generated summary of residents' statements may, for example, omit important nuances — and incorrect information can spread faster and further.

In the context of citizen participation, the OECD points to the risk of manipulation, disinformation, inequality and excessive reliance on AI outputs, among other things.

Social organisations have an important role to play here. They can not only use technology but also ask whom it serves, whose needs it takes into account and who is responsible for mistakes.

This is particularly important in non-formal education. Technological change does not stop at the walls of a school or a university. It affects volunteers, employees, older people, local leaders, parents and everyone trying to find their way in the digital world.

Where to start? A plan for a company or an NGO

You do not have to do everything at once. What matters is choosing the first step and assigning a person responsible for it.

1. List your most important tools. Include email, documents, your website, payments, messaging apps, AI tools and social media accounts.

2. Establish what data you process. Check where information about customers, donors, beneficiaries, employees and contractors is held.

3. Review access. Make sure administrative accounts are secured and that one person leaving will not deprive the organisation of control over its services.

4. Test a backup. Knowing that a backup exists is not enough. It is worth checking whether you can recover a needed document or service from it.

5. Get to know the alternatives. For your most important services, note whether data can be exported and what solution could replace them.

6. Talk to your team about AI. Ask what people are already using. Agree on rules for data, checking outputs and decisions that require human involvement.

7. Choose one process to improve. Start with a task that recurs regularly and does not require entrusting particularly sensitive information to the tool.

8. Build competences. Tailor training to the team's actual responsibilities. The person responsible for communications, administration and beneficiary support may need different examples.

How we help at Tesserakt

At Tesserakt we combine technology with education and an understanding of organisations' needs. We run training and workshops on modern tools, AI, cybersecurity and conscious digitalisation. We also help companies and NGOs review their current solutions and choose their next steps.

One example is our series of practical training sessions for the Centrum Obywatelskie Centrum C 10 and the Institute of Public Policies. We covered the use of AI, automation, marketing and digital tools in the everyday work of social organisations — with the limited resources of small teams in mind.

We also handle digital implementations and build applications tailored to specific needs. Sometimes, however, the best solution will be sorting out access, training the team or making better use of the tools the organisation already has.

The visit to Brussels was another opportunity for me to broaden my knowledge and look at these activities in a wider European context. At Tesserakt we continually develop our competences so that we can help clients make informed decisions in a world where technology and regulations change quickly.

Do you want to find out where to start in your company or organisation? Book a free 30-minute introductory consultation. We will talk about your situation, your current tools and possible directions for action.

Legal information current as of 10 November 2026. This article is for information purposes only; the application of the regulations depends on the specific situation of the organisation and the way technology is used.