{"id":4145,"date":"2026-07-13T13:46:14","date_gmt":"2026-07-13T11:46:14","guid":{"rendered":"https:\/\/lome.legal\/nis2-self-identification-requirement-new-cybersecurity-rules\/"},"modified":"2026-08-08T14:07:08","modified_gmt":"2026-08-08T12:07:08","slug":"nis2-self-identification-requirement-new-cybersecurity-rules","status":"publish","type":"post","link":"https:\/\/lome.legal\/en\/nis2-self-identification-requirement-new-cybersecurity-rules\/","title":{"rendered":"NIS2 Self-Identification Requirement \u2014 New Cybersecurity Rules"},"content":{"rendered":"\n

Cybercrime is becoming increasingly professional at a pace that is hard for us to imagine today. Hacking groups operate like well-organized, global corporations. They attack hospitals, paralyze supply chains, and shut down the systems of transportation and manufacturing companies. Disruptions to business operations result in enormous financial and reputational losses. History has seen cases where companies have gone bankrupt as a result of such actions. This, in turn, affects security not only in individual countries but throughout the European Union. The EU recognizes the growing scale of these threats and is therefore constantly working on solutions to ensure our cybersecurity. These include, among others, the recent amendments to the NIS2 Directive, which were transposed into national law in 2026. <\/strong><\/p>\n\n

One of these is the requirement for companies to self-identify\u2014they must determine on their own whether they belong to a group of important or critical entities as defined in the NIS2 Directive. Now, companies must verify, assess, and decide for themselves whether the new regulations apply to their operations. A mistake could cost them dearly. That is why our law firm, LO:ME<\/a><\/strong>, assists with this process and helps mitigate the risk. <\/p>\n\n

What exactly is the NIS2 Directive, and why did the EU decide to make these changes?<\/h2>\n\n

The NIS2 Directive replaced its predecessor, the NIS Directive. The purpose of both directives is to establish basic cybersecurity standards for a specific group of operators of essential services. Initially, this applied to a narrow group of entities, including financial institutions, the energy sector, and major digital service providers. It quickly became apparent that, with the ongoing digitization of the economy and the growing network of business connections, the scope of the NIS Directive had become too narrow. <\/p>\n\n

Criminal groups have grown in size and changed their modus operandi. They began targeting smaller businesses, which were easier targets and more vulnerable to attacks. Based on these experiences, the EU decided to implement the NIS2 Directive, which expands the list of entities required to improve their cybersecurity standards. <\/p>\n\n

\"the<\/figure>\n\n

Thus, NIS2 expands the scope of protection. Instead of targeting specific institutions, the EU legislature has decided to protect the entire economic sector and supply chains<\/strong>. One of the biggest changes brought about by the NIS Directive is the introduction of new, uniform criteria and obligations that require companies to independently determine whether they meet the criteria to be classified as a critical or important entity,<\/strong> as defined by the directive. <\/p>\n\n

The essence of these changes is to require obligated entities to implement a comprehensive risk management system. These entities are also required to proactively monitor incidents and immediately report breaches to government authorities. The system introduced by the NIS2 Directive is intended not only to standardize security levels across the European Union but also to hold company management fully accountable for their IT infrastructure. <\/p>\n\n

The main objectives of the NiS2 Directive\u2014harmonization and the creation of a digital shield<\/h2>\n\n

Recognizing the existence of cyber threats, the European Union aims to establish a common, high level of resilience to these threats across all member states. The directive is intended to serve as a tool to harmonize these European cybersecurity standards. To ensure these objectives are met, the directive introduces strict rules for incident reporting. Among other things, it requires affected companies to notify authorities of significant attacks within just 24 hours of their detection. <\/p>\n\n

The NIS2 Directive has also significantly expanded the list of sectors subject to state protection. The requirements cover, among other things, waste management, food production and distribution, postal and courier services, chemical production, and digital infrastructure in the broad sense. However, the EU\u2019s goal is not to penalize businesses, but to implement effective safeguards. According to the EU legislature\u2019s vision, the economy must continue to function smoothly even in the face of massive cyberattacks. <\/p>\n\n

Amendment to the Act on the National Cybersecurity System\u2014Implementation of NIS2 in Poland<\/h2>\n\n

Poland, like other countries, had to transpose European guidelines into its legal system. This is because a directive does not take effect directly in member states but requires its provisions to be implemented through appropriate laws. In Poland, this law is Act of January 23, 2026, amending the Act on the National Cybersecurity System and certain other acts. <\/strong> The new regulations have been in effect in our country since April 3, 2026<\/strong>. The law marks a true revolution in the approach to information security, and the changes it introduces affect hundreds of Polish companies. Many of them have not given cybersecurity the attention it deserves. This is set to change, as the government gains new tools for controlling and supervising businesses under the Act. <\/p>\n\n

Model Change and the Self-Identification Requirement<\/h2>\n\n

The biggest change concerns the very mechanism for determining who is subject to the provisions of the law. Previously, the competent authority decided whether a company fell into the category of important or critical entities. This model has now been completely overhauled. Now, the company itself must assess whether it meets the relevant conditions\u2014it must therefore self-identify<\/strong>. Under this model, the law assumes that business owners operate their businesses responsibly, are familiar with the regulations, and are capable of assessing the scale and nature of their operations. Consequently, it is now the responsibility of company boards of directors to verify and determine whether the company meets the conditions imposed by the law and whether a new set of obligations applies to it. <\/p>\n\n

\n

Only through a thorough self-assessment can we determine whether an organization qualifies as a significant or key entity.<\/p>\n<\/blockquote>\n\n

Management Responsibility\u2014Why Shifting the Blame to the IT Team Isn’t the Best Strategy<\/h2>\n\n

The law clearly states that shifting responsibility for the consequences of self-identification and compliance with obligations solely onto the IT department is not the best strategy. Responsibility ultimately rests with the head of the entity\u2014which, in the case of corporations, is the board of directors. While IT specialists install software, configure firewalls, and implement other cybersecurity solutions, it is the board that sets the budget, approves security policies, and ensures that all solutions comply with the law. The board of directors may appoint one of its members to be responsible for this area. It is very important that board members personally understand the threats and the policies being implemented, as financial penalties for failing to meet statutory obligations can be very severe. <\/p>\n\n