NIS2 Poland: Amendment to the Act on the National Cybersecurity System (KSC)
See how Poland is preparing to transpose the NIS2 Directive through a far-reaching amendment to the Act on the National Cybersecurity System (KSC), why the process is delayed, and what essential and important entities should do now even though the new law is not yet in force.
Introduction: NIS2 Directive & the Polish context
Poland implemented the original NIS Directive through the Act on the National Cybersecurity System (KSC) adopted in July 2018, which created a decentralised national cybersecurity system built around three national CSIRTs (CSIRT NASK, CSIRT MON and CSIRT GOV) and operators of essential services and digital service providers.
NIS2 requires Poland to significantly broaden this regime, move the focus from individual services to entire entities, expand the list of sectors and organisations in scope, and introduce stronger enforcement, including direct liability for management and stricter vendor controls.
NIS2 implementation in Poland
Poland is transposing NIS2 through an amendment to the Act on the National Cybersecurity System (KSC), rather than adopting a new standalone law. Multiple draft versions of the amendment were published between 2023 and 2025, reflecting extensive political and industry debate.
After a prolonged legislative process, the amendment was adopted by the Sejm on 26 January 2026 and subsequently approved by the Senate. Promulgation and publication in the Journal of Laws — and the determination of the final entry-into-force date — are pending.
The adopted amendment keeps the KSC as the backbone of the national regime but introduces NIS2 concepts such as essential and important entities, stricter incident-reporting rules, a central register of regulated entities, vendor-risk provisions (including “high-risk vendor” mechanisms) and a strengthened sanctioning framework.
Status
NIS2 is not yet transposed into Polish law. Work on the amendment to the KSC is at an advanced but still unfinished stage; several successive drafts have been published, but the act has not been promulgated.
Legal structure (planned)
NIS2 will be implemented through a comprehensive amendment to the 2018 Act on the National Cybersecurity System, supported by secondary legislation and sectoral regulations.
Expected impact
The future law is expected to bring over 10,000 entities into scope, covering a wide range of public and private organisations and significantly increasing supervisory reach.
NIS2 Poland: what you need to know about compliance
Even without a final act in force, the Polish drafts closely follow the NIS2 model of essential and important entities and give a clear picture of the obligations organisations will face once the amendment is adopted.
Who is likely in scope?
- Entities operating in NIS2 Annex I sectors (energy, transport, health, drinking water, digital infrastructure, public administration, etc.).
- Entities in NIS2 Annex II sectors (postal and courier services, waste management, food, manufacturing of critical products, research, etc.).
- Medium and large organisations meeting NIS2 size or turnover thresholds.
- Entities covered regardless of size, such as DNS and TLD operators, trust-service providers, major cloud and data-centre operators.
Core obligations (based on draft)
- Implement risk-management measures for networks and information systems aligned with NIS2 Article 21.
- Introduce governance structures and policies, including management-approved cybersecurity strategies.
- Detect, handle and report significant incidents and certain cyber threats within strict deadlines.
- Manage supply-chain and vendor risk, with special rules for “high-risk vendors” in sensitive sectors.
- Ensure that management bodies are directly responsible for overseeing and approving cybersecurity measures.
Register of entities
Drafts foresee a central register of essential and important entities maintained at national level. Entities will either be identified by the authority or required to submit information to be included in the register and keep their data up to date.
NIS2 timeline & key dates (Poland)
Sector-specific notes for Poland
- Energy: electricity, gas and other critical energy operators will fall under strict essential-entity obligations once the amendment is in force.
- Digital infrastructure: data centres, electronic communications networks and cloud providers are a major focus, with specific vendor-risk rules.
- Public administration: ministries, key central authorities and selected local government entities will be included as essential or important entities.
- Industry & manufacturing: manufacturers of critical products and key industrial players will be captured as important entities in line with NIS2.
- Finance & health: banks, financial market infrastructures and healthcare providers will face combined obligations from NIS2 and sector-specific EU rules.
Penalties for non-compliance
The planned Polish NIS2 regime is notable for a particularly strict sanctions model, going beyond the basic NIS2 ceilings and adding specific national mechanisms and direct liability for management.
- For essential entities: fines aligned with NIS2, up to around €10 million or 2% of worldwide annual turnover (whichever is higher).
- For important entities: fines up to around €7 million or 1.4% of worldwide annual turnover.
- Additional national cap: in certain high-risk scenarios, a special fine of up to PLN 100 million (approx. €20–25 million) is foreseen in some drafts.
- Management liability: courts may disqualify board members from holding management functions for several years in cases of repeated or serious negligence.
- Corrective measures: orders to remedy deficiencies, enhanced supervision and follow-up audits for non-compliant entities.
How to prepare for NIS2 in Poland
- Assess whether you are likely in scope: map your organisation against NIS2 Annex I & II sectors and size thresholds; assume that the Polish law will broadly follow them.
- Monitor the legislative process: follow official publications and legal updates on the amendment to the KSC so you know when the law is finally adopted and when it enters into force.
- Run a NIS2 gap assessment now: compare your current cybersecurity posture against NIS2 Article 21 requirements (governance, technical controls, processes, documentation).
- Plan for registration: prepare internal data (services, systems, dependencies, key contacts) that you will need to provide once the register of entities goes live.
- Strengthen incident management: design monitoring, triage and reporting workflows that can support 24-hour early warning and follow-up reports required by NIS2.
- Review supply-chain and vendor risk: identify high-impact suppliers and plan contractual updates, mindful of possible “high-risk vendor” restrictions in Poland.
- Align with recognised frameworks: build or refine an ISMS aligned with ISO/IEC 27001 or similar to make NIS2 implementation structured and auditable.
- Engage the board: brief senior management on upcoming personal liability and ensure cybersecurity is treated as a strategic, not just technical, topic.