NIS2 Poland: KSC Amendment, Deadlines & Registration
Poland transposed NIS2 by amending the Act on the National Cybersecurity System (KSC). The amendment has applied since 3 April 2026 and brings around 38,000 organisations into scope, some 27,000 of them public bodies. Self-registration in the Wykaz KSC closed on 3 October 2026, but the duty to register did not: if you have not applied, apply now.
Introduction: NIS2 Directive & the Polish context
Poland implemented the original NIS Directive through the Act on the National Cybersecurity System (KSC) adopted in July 2018, which created a decentralised national cybersecurity system built around three national CSIRTs (CSIRT NASK, CSIRT MON and CSIRT GOV) and operators of essential services and digital service providers.
The NIS2 amendment broadened that regime substantially. It shifts the focus from individual services to whole entities, widens the list of sectors, and adds stronger enforcement including personal liability for the head of the entity and a high-risk supplier regime. The Ministry of Digital Affairs estimates that around 38,000 organisations are in scope, of which roughly 27,000 are public bodies — a public-sector share unmatched anywhere else in the EU, and the reason Polish implementation is as much an administrative programme as a corporate one.
What you must do in Poland
The Polish law phases obligations in over two years. These are the dates that bind you, in order.
- Self-identify. The Act applies automatically to entities meeting the criteria in Annexes 1 and 2. Nobody designates you, and the duty to assess yourself started on 3 April 2026.
- Apply for entry in the Wykaz KSC now, if you have not. The self-registration window ran from 7 May to 3 October 2026. The duty did not lapse with it, and if you came into scope after 3 April 2026 you have six months from the day you met the criteria. You file at wykaz-ksc.gov.pl. See Registration.
- Implement the security measures by 3 April 2027. An information security management system, security policies and supply-chain risk management.
- If you are a key entity, complete your first security audit by 3 April 2028, then at least once every three years. Important entities have no standing audit duty.
- Report incidents from day one. The reporting duty is already live, and which CSIRT you report to depends on what kind of entity you are. See Incident reporting.
NIS2 implementation in Poland
Poland transposed NIS2 by amending the Act on the National Cybersecurity System (KSC) rather than adopting a standalone law. Multiple drafts were published between 2023 and 2025, reflecting long political and industry debate.
The amendment was adopted by the Sejm in January 2026, approved by the Senate, published in the Journal of Laws on 2 March 2026 as Dz.U. 2026 poz. 252, and entered into force on 3 April 2026.
The amendment keeps the KSC as the backbone of the national regime while introducing NIS2 concepts: key and important entities, stricter incident reporting, a central register of regulated entities, the high-risk supplier procedure, and a much stronger sanctioning framework that reaches the head of the entity personally.
Status
In force since 3 April 2026. The ustawa z dnia 23 stycznia 2026 r. was published in the Journal of Laws on 2 March 2026 as Dz.U. 2026 poz. 252; its Article 49 brings the Act into force one month after publication.
Legal structure
An amendment to the 2018 Act on the National Cybersecurity System, supported by secondary legislation and sectoral regulations. The KSC remains the single national framework.
Scale
Around 38,000 entities are in scope, some 27,000 of them public bodies, phased in through registration by October 2026, the Chapter 3 duties by April 2027 and — for key entities only — a first audit by April 2028.
NIS2 Poland: what you need to know about compliance
The amended KSC is in force. Scope is a self-assessment against Annexes 1 and 2 to the Act and the size thresholds — nobody designates you — and the duties below are already binding, even though most fines cannot be imposed until 3 April 2028.
Who is in scope
- Entities in the sectors listed in Annex 1 to the Act (energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space).
- Entities in Annex 2 (postal and courier services, waste management, chemicals, food, manufacturing, digital providers, scientific research).
- Medium and large organisations meeting the size thresholds in Annex I to Regulation 651/2014.
- A named list of entity types regardless of size: DNS service providers, TLD registries, domain name registration services, qualified trust service providers, nuclear facility operators, critical entities, and the public bodies named in Annex 1.
- Two Polish size rules that catch people out. An electronic communications undertaking is a key entity only once it reaches medium size — but a managed security service provider is a key entity from small size upwards, a lower threshold than any other category in the Act.
What you must actually do
- Run systematic incident risk assessment and manage that risk (art. 8(1)(1)).
- Operate an information security management system for the systems used to deliver the service (art. 8).
- Report major incidents on the 24h / 72h / one-month chain (arts 11 to 12b).
- Manage supply-chain risk, including the consequences of a high-risk supplier designation.
- Use the S46 system for the reporting duties where the Act requires it (art. 73(1)(13) makes not doing so fineable).
- Key entities only: a security audit at your own cost at least once every three years (art. 15(1)).
The register is live
The Wykaz podmiotów kluczowych i podmiotów ważnych — the Wykaz KSC — opened on 13 April 2026 under Article 34(1). Existing operators of essential services, trust service providers, telecoms undertakings and public entities were entered ex officio between 13 April and 6 May. Everyone else files their own application. See Registration.
Registration: who, where, by when
Registration means applying for entry in the Wykaz podmiotów kluczowych i podmiotów ważnych, the national register of key and important entities. It is a self-assessment: you decide whether you qualify, and you carry the consequences of getting it wrong.
Where
The Wykaz KSC application, at wykaz-ksc.gov.pl. It is part of the S46 system. You sign in with login.gov.pl, and the application is signed electronically by the head of the entity or someone they authorise.
When
The window for entities already in scope on 3 April 2026 closed on 3 October 2026. If you missed it, apply now: the duty continues. If you come into scope later, Article 7c(1) gives you six months from the day you meet the criteria. Changes to registered data must be filed within 14 days.
Who
Key entities (podmioty kluczowe) and important entities (podmioty ważne) in the sectors listed in Annexes 1 and 2 to the Act.
| Route | Who | When |
|---|---|---|
| Wpis z urzędu — entered by the Minister | Existing operators of essential services, trust service providers, telecoms undertakings and public entities | Done between 13 April and 6 May 2026. You receive a notice and a request to complete your entry — that request has its own deadline, and ignoring it is fineable in its own right. |
| Samorejestracja — you file yourself | Everyone else who meets the criteria | 7 May to 3 October 2026 |
Incident reporting in Poland
Poland does not have a single national CSIRT. Which team you report to depends on what kind of entity you are, and getting the routing wrong costs time you do not have inside a 24-hour window.
| CSIRT | Run by | Receives reports from |
|---|---|---|
| CSIRT NASK | NASK (Research and Academic Computer Network) | The general case: most private-sector key and important entities, local government, and citizens. |
| CSIRT GOV | Head of the Internal Security Agency (ABW) | Government administration and critical infrastructure operators. |
| CSIRT MON | Minister of National Defence | Defence entities and organisations subordinate to or supervised by the MoD. |
| Sectoral CSIRTs (CSIRT sektorowy) | Appointed by the competent authority for each sector | Sectors where a dedicated team has been established. A sectoral CSIRT sits alongside the three national teams rather than replacing them: it handles first-line reports for its sector and coordinates upward. |
NIS2 timeline & key dates (Poland)
12 Jun 2026 — S46 access opens for newly registered entities.
3 Oct 2026 — Deadline to apply for entry in the Wykaz KSC. Former operators of essential services also move onto the new incident-reporting rules on this date (Article 33(4)), and the Council of Ministers must adopt the national incident response plan and the Cybersecurity Strategy of the Republic of Poland (Article 47).
3 Oct 2027 — Deadline for each competent authority to establish its sectoral CSIRT (Article 42(1)).
Sector-specific notes for Poland
- Energy: electricity, gas and other critical energy operators are key entities. Nuclear energy investments were given their own limb in 2026, supervised by the Minister for Energy.
- Digital infrastructure and electronic communications: split between two regulators. Digital infrastructure generally sits with the Minister for Digital Affairs; the electronic communications subsector and postal services sit with the President of UKE. Telecoms undertakings were entered in the register ex officio.
- TLD registries and domain name registration services: a duty no other sector carries. Article 37 gives them 12 months from 3 April 2026 to align their domain registration databases with Article 16b and to write and implement the matching policies.
- Public administration: the largest single group, at roughly 27,000 of the 38,000 entities. Supervision runs to the Minister for Digital Affairs, except for bodies under the Minister of National Defence and units under the Minister for Public Finance.
- Industry & manufacturing: supervised by the Minister for Economy, except medical devices and in-vitro diagnostics, which go to the Minister for Health.
- Finance & health: banks and financial market infrastructure are in Annex 1 but are also subject to DORA, which displaces the ICT risk-management and reporting rules for entities it covers.
How Polish law differs from the NIS2 Directive
Poland did not simply copy the Directive. Four choices go beyond it, and two have no equivalent anywhere else in the EU.
| Area | What Poland does |
|---|---|
| Three national CSIRTs | Most member states run one. Poland splits reporting between CSIRT NASK, CSIRT GOV and CSIRT MON, plus sectoral teams. Your reporting path depends on what you are. |
| High-Risk Supplier procedure | The Dostawca Wysokiego Ryzyka mechanism lets a supplier be formally designated high risk. Two consequences follow: key entities may not introduce any new products from that supplier, and existing equipment must be withdrawn. The withdrawal window is 4 years for equipment performing critical network functions (5G/3GPP core elements such as AMF, AUSF and UPF) and 7 years for all other ICT hardware and software, counted from publication of the decision in Monitor Polski. Neither the Directive nor ISO 27001 has an equivalent. |
| Extraordinary penalty | A fine of up to PLN 100 million where a breach creates a direct and serious threat to national defence or security, public order, human life and health, or the continuity of essential services. This sits above the NIS2 ceilings. |
| Personal fines for the head of the entity | Poland fines the individual, not only the organisation, and does it by reference to their own pay. Under Art. 73a(4) the head of a private entity faces up to 300% of their remuneration, calculated using the holiday-pay equivalent rules. For a public entity the ceiling is 100%, unless that body is also in scope through another Annex sector, in which case 300% applies again. A municipal water utility is the standard example. The fine is separate from any penalty on the entity itself. |
Operating in more than one EU country?
Registering in Poland does not necessarily cover you elsewhere, and registering elsewhere does not necessarily cover Poland.
Register once
DNS providers, TLD registries, cloud computing providers, data centre providers, CDNs, managed service providers and managed security service providers register only in the member state of their main establishment, and are supervised there.
Register in each country
Every other entity type registers separately in each member state where it provides in-scope services. A Polish manufacturer with operations in three countries may face three registrations.
Rules that are identical everywhere
Implementing Regulation (EU) 2024/2690 sets the technical requirements for the digital and ICT entity types above. It is not transposed, so Polish and German obligations read the same.
Penalties for non-compliance
Poland runs one of the strictest sanctions models in the EU. It goes beyond the NIS2 ceilings and adds national mechanisms, including a fine levied on the head of the entity personally.
- Key entities: up to €10 million or 2% of revenue, whichever is higher — and never less than PLN 20,000 (Article 73(3)).
- Important entities: up to €7 million or 1.4% of revenue, whichever is higher — and never less than PLN 15,000 (Article 73(4)).
- Extraordinary penalty: up to PLN 100 million where the breach creates a direct and serious threat to national defence or security, public order, human life and health, or the continuity of essential services.
- The head of the entity, personally: up to 300% of their remuneration in the private sector (Article 73a(4)) and 100% in the public sector (Article 73a(5)). Separate from, and additional to, any fine on the entity itself.
- A daily fine to force compliance: PLN 500 to PLN 100,000 for every day of delay in carrying out certain supervisory decisions (Article 76b). It runs alongside the ordinary fine, not instead of it.
- Corrective measures: orders to remedy deficiencies, enhanced supervision, follow-up audits, and in the most serious cases suspension of a key entity's activity.
- Timing, and the one exception: Article 35 defers the fines in Articles 73(1) to (4), 73a to 73c and 76b until 3 April 2028. It does not mention Article 73(5) — so the PLN 100 million extraordinary penalty has been available since the day the amendment took effect. The same is true of the penalty under Article 67g(10) for ignoring a ministerial securing order.
How to prepare for NIS2 in Poland
- Settle whether you are in scope: map your organisation against Annexes 1 and 2 to the Act and the size thresholds. This is a self-assessment and it is already overdue — the duty started on 3 April 2026.
- Check whether you are already on the register: if you were an operator of essential services, a trust service provider, a telecoms undertaking or a public entity, the Minister entered you ex officio in April or May and sent you a request to complete your entry. Answering that request is a separate obligation from registering.
- Run a NIS2 gap assessment now: compare your current cybersecurity posture against NIS2 Article 21 requirements (governance, technical controls, processes, documentation).
- File in the Wykaz KSC: gather the data the application asks for (services, systems, dependencies, key contacts), make sure someone can sign in through login.gov.pl and is authorised to bind the organisation, and file at wykaz-ksc.gov.pl. The self-registration window closed on 3 October 2026; if you have not filed, do it now.
- Strengthen incident management: design monitoring, triage and reporting workflows that can support 24-hour early warning and follow-up reports required by NIS2.
- Review supply-chain and vendor risk: identify high-impact suppliers and plan contractual updates. The Dostawca Wysokiego Ryzyka procedure is live, and a designation forces withdrawal of existing equipment on a 4- or 7-year clock — so the question is contractual, not theoretical.
- Align with recognised frameworks: build or refine an ISMS aligned with ISO/IEC 27001 or similar to make NIS2 implementation structured and auditable.
- Engage the board: brief senior management on the personal fine under Article 73a — up to 300% of their own pay — and on the fact that whoever signs the registration application does so under criminal liability for a false statement.
Official links & resources
FAQ: NIS2 in Poland
Has Poland fully transposed NIS2?
Which law implements NIS2 in Poland?
We have not heard from any authority. Do we still have to act?
Who are the main NIS2 players in Poland?
Is ISO 27001 mandatory?
When exactly must we register, and where?
Which CSIRT do we report incidents to?
Sources & verification
Every date, figure and article reference on this page was read from the Polish original on 20 September 2026, not from secondary summaries. Where the market and the statute disagree, the statute is what is printed here.
- The Act. Ustawa z dnia 23 stycznia 2026 r. o zmianie ustawy o krajowym systemie cyberbezpieczeństwa oraz niektórych innych ustaw, Dz.U. 2026 poz. 252. Full text read in the Journal of Laws. Article 49 brings it into force one month after publication; published 2 March 2026, so in force 3 April 2026. Checked 20 September 2026.
- Entry into force, independently. The Sejm's legislative database returns 3 April 2026 for this Act. Checked 20 September 2026.
- Deadlines. Articles 33 to 37, 42 and 47 of the amending Act, and the Minister's schedule published under Article 34(3)(1). Checked 20 September 2026.
- Registration mechanics. The Ministry of Digital Affairs' own announcements on the register and its schedule, and the Wykaz KSC application itself. Checked 20 September 2026.
- Scale. The Ministry of Digital Affairs states the amendment may cover about 38,000 entities, of which about 27,000 are public bodies. Checked 20 September 2026.
- Penalties. Articles 73, 73a, 76b and 67g of the KSC as amended, and Article 35 of the amending Act for the deferral. Checked 20 September 2026.
- A count of entities actually on the register. The Ministry's 38,000 is an estimate of who is in scope, not a count of who has filed. No figure for entries made has been published, so none is given here.
- That the 3 October deadline is statutory. It is set by a ministerial communication issued under Article 34(3)(1), and Article 34(5) permitted that communication to be changed. It was not changed.
- That missing the deadline brings an immediate fine. Article 73(1a) is discretionary and Article 35 defers it to 3 April 2028. Several English-language summaries state the opposite.
- A single national cybersecurity regulator. There is not one. Article 41 names an authority per sector, and this page reproduces only the sectors the 2026 amendment added or reassigned.