{"id":4532,"date":"2026-10-31T14:44:10","date_gmt":"2026-10-31T13:44:10","guid":{"rendered":"https:\/\/lome.legal\/nis2-in-poland-amendment-to-the-act-on-the-national-cybersecurity-system-ksc-deadlines-and-company-obligations\/"},"modified":"2026-10-31T16:40:19","modified_gmt":"2026-10-31T15:40:19","slug":"nis2-in-poland-amendment-to-the-act-on-the-national-cybersecurity-system-ksc-deadlines-and-company-obligations","status":"publish","type":"post","link":"https:\/\/lome.legal\/en\/nis2-in-poland-amendment-to-the-act-on-the-national-cybersecurity-system-ksc-deadlines-and-company-obligations\/","title":{"rendered":"NIS2 in Poland \u2013 amendment to the Act on the National Cybersecurity System (KSC), deadlines, and company obligations"},"content":{"rendered":"\n

NIS2 is the EU Cybersecurity Directive (EU) 2022\/2555, which Poland implemented through an amendment to the Act on the National Cybersecurity System (NCS) of January 23, 2026. The regulations have been in force since April 3, 2026, and cover key and important entities (as defined in the Act) from 18 economic sectors. The deadline for applying for inclusion on the list of key and important entities expired on October 3, 2026. Companies must implement an Information Security Management System (ISMS) and begin using the S46 system by April 3, 2027. In this article, we discuss deadlines, obligations, penalties, and incident reporting rules based on the text of the Act (Journal of Laws of 2026, item 252).<\/strong><\/p>\n\n

What is the NIS2 Directive and the National Cybersecurity System Act?<\/h2>\n\n

The NIS2 Directive defines cybersecurity objectives for the entire European Union. Unlike EU regulations, for the objectives and principles of the EU Directive to be binding on Member States, it must be implemented into law. In Poland, cybersecurity is regulated by the National Cybersecurity System Act (NCS)<\/a>. This legal act, the NIS2 Act, implements the NIS2 Directive. It ensures that the objectives and obligations of the NIS2 Directive also directly apply to your company.<\/p>\n\n

The NIS2 Directive to the Polish Cybersecurity Act was implemented by an amendment, specifically the Act of January 23, 2026, amending the Act on the National Cybersecurity System and certain other acts<\/a>. The Sejm adopted it on January 23, 2026, and the President signed it on February 19, 2026. On March 2, 2026, the amendment was published in the Journal of Laws of 2026, item 252 (Journal of Laws of 2026, item 252). It entered into force on April 3, 2026.<\/p>\n\n

NIS2 Directive (EU) 2022\/2555 \u2013 what has it changed compared to NIS1?<\/h3>\n\n

The NIS 2 Directive, or Directive (EU) 2022\/2555 of December 14, 2022, completely overhauled the approach to digital security in Europe. It replaced the previous NIS Directive from 2016, expanding the list of entities covered. The deadline for its implementation in all EU Member States was October 17, 2024. The new regulations introduce stricter penalties for non-compliance with the security rules set out in the regulations, direct liability of management boards, and the need to secure the entire supply chain when providing services and goods.<\/p>\n\n

The Act on the National Cybersecurity System \u2013 what is the National Cybersecurity System?<\/h3>\n\n

The KSC is the national cybersecurity system, the legal framework of which is established by the Act of 5 July 2018. This legal act defines incidents, the competencies of CSIRTs, and the obligations imposed on economic entities. The KSC creates the national security architecture, linking the public sector with private business.<\/p>\n\n

Why do you apply the KSC Act in Poland and not the directive itself?<\/h3>\n\n

As a business operating in Poland, you are subject to Polish regulations. The directive requires EU member states to achieve a specific result, but the amended KSC Act specifies the exact procedure, where to submit the application, and within what deadlines. Therefore, you must verify the compliance of your operations with Polish law. If you need assistance, check out the legal advice on NIS2 and KSC<\/a> from our law firm LO:ME in Gdynia.<\/p>\n\n

What does the amendment to the Act on the National Cybersecurity System change?<\/h2>\n\n

The amendment to the National Cybersecurity System Act primarily changes the methodology for determining whether your company is subject to the new regulations. This has significant legal and potentially financial implications.<\/p>\n\n

Amendment to the KSC of January 23, 2026 \u2013 Journal of Laws 2026, item 252<\/h3>\n\n

The amendment to the Code of Criminal Procedure (KSC) moved away from the model in which the state administration was tasked with identifying and qualifying essential service operators. The model changed completely with the introduction of mandatory self-identification.<\/p>\n\n

Self-identification instead of a decision of the authority<\/h3>\n\n

Currently, the Cybersecurity Act relies on a self-identification mechanism. This means that you are responsible for verifying whether your company meets the criteria for a key or important entity. If the audit confirms that your company meets the criteria, you must register your company with the appropriate register without waiting for a request from the relevant authority.<\/p>\n\n

Responsibility of the entity’s manager<\/h3>\n\n

One of the most significant changes is the introduction of personal liability for management boards. Under the act, the entity’s manager is financially responsible for failing to meet cybersecurity obligations. This includes not only penalties imposed on the company, but also sanctions directly affecting the assets of management board members.<\/p>\n\n

High Risk Vendor \u2013 Polish Add-on to NIS2<\/h3>\n\n

The Polish law goes a step further than the NIS 2 Directive (NIS2). It introduces a procedure for recognizing a hardware or software supplier as a high-risk supplier.<\/strong><\/p>\n\n

How does this mechanism work? The Minister of Digital Affairs issues a decision designating a given hardware, software, or cloud service provider as a high-risk supplier. This act has immediate and difficult consequences for important and key entities covered by the KSC Act. From the moment the decision is issued, the company cannot purchase, install, or implement any new products or services from the manufacturer covered by the decision. The Act imposes the obligation to completely remove and replace previously used hardware or software within a specified period. The process of withdrawing and replacing the technology with alternative infrastructure is carried out at the company’s expense. The regulations do not provide for automatic compensation from the State Treasury for the need to prematurely replace functional equipment.<\/p>\n\n

Since this mechanism raises doubts, especially in terms of protecting the interests of companies that legally acquired software, the President of the Republic of Poland signed the act on February 19, 2026, at the same time referring the provisions regarding high-risk suppliers to the Constitutional Tribunal for ex-post review.<\/p>\n\n

Element<\/strong><\/td>Until April 2, 2026<\/td>From April 3, 2026<\/td><\/tr>
Who is subject to<\/td>Essential service operators designated by a decision of the authority<\/td>Essential and important entities \u2013 the company itself verifies whether it meets the requirements<\/td><\/tr>
Registration<\/td>List of essential service operators<\/td>List of essential and important entities, application submitted via http:\/\/wykaz-ksc.gov.pl<\/td><\/tr>
Incident Reporting<\/strong><\/td>Previous Rules<\/td>24 hours \/ 72 hours \/ month (Article 11, Section 1 of the Code of Commercial Companies)<\/td><\/tr>
Liability<\/td>Entity<\/td>Entity + manager personally (Articles 8d, 73a, Section 1 of the Code of Commercial Companies)<\/td><\/tr>
Manager Training<\/td>No obligation<\/td>Once per calendar year (Article 8e)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Who is covered by NIS2 in Poland \u2013 key and important entities?<\/h2>\n\n

The act expands the national cybersecurity system to thousands of new companies, dividing them into two main categories: key entities and important entities. Membership depends primarily on the industry and size of the company.<\/p>\n\n

Sectors from Annexes 1 and 2 to the Act<\/h3>\n\n

The new regulations implementing NIS2 Poland identify 18 economic sectors subject to regulation. Annex 1 to the act lists key sectors (e.g., energy, banking, transport, health). Annex 2, in turn, lists important sectors (e.g., food production, waste management, postal services).<\/p>\n\n

\n

Key sectors:<\/strong> energy, transport (air, rail, water, road), banking and financial market infrastructure, healthcare, drinking water supply, collective sewage disposal, digital infrastructure, ICT service management, space, public entities.<\/p>\n<\/blockquote>\n\n

\n

Important sectors:<\/strong> postal services, nuclear energy investments, waste management, chemicals, selected production sectors<\/p>\n<\/blockquote>\n\n

Size thresholds: medium and large enterprises<\/h3>\n\n

If you operate in one of the sectors listed, you must verify your company’s size. The law covers medium-sized and large enterprises. A medium-sized enterprise is one with 50 or more employees or an annual turnover and balance sheet total exceeding \u20ac10 million. A large enterprise employs 250 or more employees or exceeds \u20ac50 million in turnover and \u20ac43 million in balance sheet total.<\/p>\n\n

Who is subject to the Act regardless of size?<\/h3>\n\n

The size threshold rule has its exceptions. Some institutions are subject to KSC requirements regardless of their employee size. This includes trust service providers, top-level domain name (TLD) registries, and DNS service providers.<\/p>\n\n

Criterion<\/strong><\/td>Key entity<\/strong><\/td>Important entity<\/strong><\/td><\/tr>
Sectors<\/strong><\/td>Annex 1 (e.g., energy, transport, banking, healthcare, digital infrastructure)<\/td>Annex 1 (medium-sized enterprises) and Annex 2 (e.g., postal services, waste, food, manufacturing, research)<\/td><\/tr>
Typical Size<\/td>Large Enterprise<\/td>Medium Enterprise<\/td><\/tr>
Supervision<\/strong><\/td>Ex-ante \u2013 planned inspections<\/td>Ex-post \u2013 after a violation report<\/td><\/tr>
Audit<\/strong><\/td>Mandatory, at least every 3 years<\/td>At the request of the authority<\/td><\/tr>
Maximum fine<\/strong><\/td>\u20ac10 million or 2% of annual revenue<\/td>\u20ac7 million or 1.4% of annual revenue<\/td><\/tr><\/tbody><\/table><\/figure>\n\n