Poland transposed NIS2 by amending its Act on the National Cybersecurity System (the KSC Act), in force since 3 April 2026, and the six-month registration window has already closed while the deadline to have the full security regime running is 3 April 2027. The amending act of 23 January 2026 was published in Dziennik Ustaw on 2 March 2026 as item 252 (Dz.U. 2026 poz. 252). It replaces the old operator of essential services model with key and important entities, adds a register run in the S46 system, sets 24 hour, 72 hour and one month incident reporting to sectoral CSIRTs, requires an information security management system (SZBI), and adds fines for entities and their heads. This guide is for security, compliance and IT leaders at organisations in Poland or with Polish subsidiaries who already know the Directive. For the EU layer, see the NIS2 Directive Guide.
Source note: this page summarises the official text and the sources listed at the end. Confirm against the official text before relying on it.
Sources and status, checked 11 November 2026: article numbers, fines, reporting times, training and the high-risk supplier procedure come from the official text of Dz.U. 2026 poz. 252 on the Sejm's ELI service. Registration dates, S46 and the 2027 and 2028 milestones come from the Ministry of Digital Affairs (Ministerstwo Cyfryzacji). Article references are to the KSC Act as amended unless marked as a transitional provision of the amending act. Sectoral regulations and the minister's guidance are still being issued, so confirm details against the current consolidated text.
Key takeaways
- Registration was due by 3 October 2026. Private entities that meet the criteria had to apply for entry in the register of key and important entities (Wykaz KSC) through the S46 system; late filers should apply at once, because missing the date is a breach of the Act.
- 3 April 2027 is the main compliance date. By then entities must run an SZBI, report incidents, name contact persons, verify relevant staff and connect to S46. Key entities need their first audit by 3 April 2028.
- Reporting goes to the sectoral CSIRT. Early warning within 24 hours, notification within 72 hours and a final report within one month. Until a sector CSIRT is operational, reports go to CSIRT GOV, CSIRT MON or CSIRT NASK.
- Heads of entities are personally liable. The head of the entity answers for the cybersecurity duties, must train once per calendar year, and can be fined up to 300% of remuneration (100% in public entities).
- Fines start in April 2028 but supervision starts now. Most fines can first be imposed two years after entry into force; inspections, orders and warnings apply already.
Scope: who and what is covered
The Act follows the Directive's two annexes, renumbered as Polish Annexes 1 and 2, with size rules that count linked and partner enterprises. Entities assess themselves against the sector annexes, the size criteria and Article 5, using their PKD activity codes, licences and financial statements.
| Annex | Sectors | Typical status |
|---|---|---|
| Annex 1 (high criticality) | Energy, transport, banking and financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, space, public entities | Key entity if large; important if medium |
| Annex 2 (other critical sectors) | Postal services, nuclear investment, waste management, chemicals, food production, manufacturing (medical devices, electronics, electrical equipment, machinery, vehicles, other transport equipment), online marketplaces, search engines and social networks, research | Important entity |
| Annex 3 | Ten categories of critical functions in telecommunications networks, mapped to 3GPP functions | Used in the high-risk supplier procedure |
| Annex 4 | Information security management requirements for public bodies that are important entities, with 18 mandatory measures | Public sector SZBI baseline |
Who registers: private entities apply themselves. Public entities, telecommunications providers, trust service providers and former operators of essential services are entered by the Minister of Digital Affairs ex officio, and are then summoned to complete their data within six months. The Minister of National Defence can designate defence-related units as key or important.
Competent authorities: Article 41 assigns a sector authority for each area. Examples from the text: the minister for informatisation for digital infrastructure, ICT service management, digital providers and most public entities; the President of UKE for electronic communications and postal services; the minister for the economy for space, chemicals and most manufacturing; the minister for health for medical devices; the minister for agriculture for food; the minister for climate for waste; and the minister for water management for wastewater. Financial entities interact with the Polish Financial Supervision Authority (KNF) under the DORA provisions. See the DORA and NIS2 Overlap Mapping Guide.
Key obligations
| Obligation | KSC Act reference | What it requires |
|---|---|---|
| Register entry | Art. 7c | Apply within six months of meeting the criteria; keep data current |
| Information security management system (SZBI) | Art. 8 | Systematic risk assessment, proportionate technical and organisational measures, incident management, supply chain security, and account of coordinated EU risk assessments and high-risk supplier decisions |
| Detailed requirements | Art. 8a | Council of Ministers may set detailed requirements by regulation; public bodies follow Annex 4 |
| Management duties | Art. 8c, 8d | Head of entity responsible for the duties; decides on the SZBI, plans budget, assigns tasks, ensures awareness and legal compliance |
| Training | Art. 8e | Head of entity and the person responsible for cybersecurity trained once per calendar year, with documented attendance |
| Incident reporting | Art. 11, 12, 12b | 24 hour early warning, 72 hour notification, progress reports, final report within one month, to the sectoral CSIRT |
| Audit | Art. 15 | Key entities: first audit within 24 months of entry into force, then at least every three years; authorities can also order an audit |
| Contact persons and staff checks | Ministry summary | Name persons for contact with the national system; verify criminal records of relevant staff |
Incident reporting stages
- Early warning: within 24 hours of detecting a serious incident (Art. 11(1)(4)).
- Incident notification: within 72 hours of detection (Art. 11(1)(4a)).
- Progress reports: as requested (Art. 12b).
- Final report: within one month of the 72 hour notification (Art. 11(1)(4c)).
Transitional Article 44 of the amending act routes reports to CSIRT MON, CSIRT NASK or CSIRT GOV until the relevant sector CSIRT announces operational capability; Article 42 gives sector CSIRTs 18 months to get there. Trust service providers must send early warnings within 24 hours under Art. 11(1a). For the EU reporting thresholds, see the NIS2 Implementing Regulation 2024/2690 Guide.
High-risk suppliers
Articles 67b to 67j let the minister for informatisation designate a supplier as high risk by decision, after an opinion of the Cybersecurity Board (Kolegium) within three months. The decision is immediately enforceable and reviewable by an administrative court. Covered entities may not bring the designated products, services or processes into use and must withdraw existing ones within seven years of publication in Monitor Polski; telecommunications providers must withdraw items in Annex 3 critical functions within four years. Entities may not procure the designated items. Article 67a separately allows non-binding recommendations. See the NIS2 Supply Chain Security Guide.
Timeline and current status
| Date | Milestone | Source |
|---|---|---|
| 23 January 2026 | Amending act adopted | Dz.U. 2026 poz. 252 |
| 2 March 2026 | Published in Dziennik Ustaw | Dz.U. 2026 poz. 252 |
| 3 April 2026 | Entry into force (one month after publication, Art. 49) | Act; Ministry |
| 7 May 2026 | Self-registration opens at wykaz-ksc.gov.pl | Ministry |
| 12 June 2026 | New entities can start using S46 | Ministry |
| 3 October 2026 | Registration applications due | Ministry |
| 3 April 2027 | Obligations implemented, S46 connection completed | Act transitional provisions (12 months); Ministry |
| 3 April 2028 | First audit for key entities not previously operators of essential services; most fines become available | Act transitional provisions (24 months), Art. 35; Ministry |
Registration happens in the Wykaz KSC application of the S46 system, signed in through the National Node (Węzeł Krajowy) with Profil Zaufany, mObywatel, e-ID, online banking or a qualified certificate. The head of the entity or an authorised person files, attaching a power of attorney where needed. After entry the entity gets access to the S46 Cyber Hub. In June 2026 the Ministry added 86 questions to its Q&A and consulted on requirements for standardisation documents. Late registrants should file as soon as possible: the authority can also enter an entity ex officio and require its data within six months.
Enforcement and penalties
| Penalty | Reference | Amount |
|---|---|---|
| Key entity | Art. 73(3) | Up to EUR 10,000,000 or 2% of prior-year revenue, whichever is higher; minimum PLN 20,000 |
| Important entity | Art. 73(4) | Up to EUR 7,000,000 or 1.4% of prior-year revenue, whichever is higher; minimum PLN 15,000 |
| Serious threat or disruption | Art. 73(5) | Up to PLN 100,000,000 |
| Head of entity | Art. 73a | Up to 300% of remuneration; up to 100% in public entities |
| Obstructing inspection | Art. 73(1)(14) | Within the entity fine ranges |
Euro amounts convert at the National Bank of Poland average rate on 31 December of the year before the decision. Transitional Article 35 of the amending act lets fines under Art. 73(1) to (4), 73a to 73c and 76b be imposed only two years after entry into force, that is from 3 April 2028. Article 76a(9) allows a fine to be waived for negligible breaches where the entity stops the violation or repairs the harm. Supervision applies already: under Article 53 authorities can inspect, including remotely, order an audit, commission a CSIRT security assessment, request evidence and issue binding orders. Supervision of key entities is preventive and ex post; for important entities it is ex post. For key entities, authorities can temporarily suspend activities or bar a manager from management functions. See the NIS2 Management Liability Executive Briefing.
What it means for AI agents and non-human identities
The KSC Act says nothing specific about AI agents, but Article 8's risk assessment, measures and supply chain duties reach every service account, API key and automated integration in scope systems, and Annex 4 lists access control among the mandatory measures for public bodies.
- Inventory machine identities in the SZBI: service accounts, certificates, CI/CD tokens and agent credentials belong in the asset and access control records an auditor will sample in 2028.
- Treat leaked credentials as reportable risk: a leaked key used to reach a regulated service can be a serious incident on the 24 hour clock. Poland has seen this pattern: in the Poland ArcGIS Password Leak 2023 an old emailed login exposed military maps.
- Supply chain covers agents: AI agents and SaaS integrations from third parties are ICT supply chain under Article 8; record their permissions and include them in supplier assessments, and track any high-risk supplier decisions that touch them.
- Logs for the final report: the one month report needs root cause; agent actions without per-identity logs make that impossible.
See the AI Agent Credential Lifecycle and Rotation Guide and the How to Run an Access Review for Service Accounts guide.
Compliance steps
- Confirm status and register. Check Annexes 1 and 2, Article 5, PKD codes and group size; if in scope and not yet listed, file in Wykaz KSC now and keep evidence of the date.
- Name accountable people. Confirm the head of entity, the person responsible for cybersecurity and contact persons; schedule their annual training under Art. 8e and keep attendance records.
- Gap-assess against Article 8. Map existing ISO/IEC 27001 or former operator of essential services controls to the Article 8 SZBI elements; public bodies use Annex 4. See the ISO 27001 to NIS2 and DORA Mapping Guide.
- Build the reporting path. Identify your sector CSIRT, or the interim CSIRT, connect to S46, and rehearse the 24 hour, 72 hour and one month stages with a tabletop exercise.
- Review suppliers. Flag suppliers that could be subject to an Article 67b decision and plan replacement within the seven or four year windows.
- Pilot, then extend. Run the SZBI first on the most critical service, test with an internal audit, then roll out to the rest of the scope before 3 April 2027.
- Prepare for audit. Key entities book their first audit to finish before 3 April 2028.
Common failure patterns
- Assuming ex officio entry: private companies wait for the ministry to list them, but only specific groups are entered ex officio.
- Group-level assumptions: one Polish subsidiary registers and others with different PKD codes do not.
- Reading 2028 as the start date: fines wait, but obligations, supervision and orders do not.
- Untrained management: the head of entity never completes the annual training, which is easy for an inspector to check.
- Reporting to the wrong team: sending reports to an interim CSIRT after the sector CSIRT has become operational.
Useful measures: date of register entry, share of in-scope systems covered by the SZBI risk assessment, time from detection to early warning in exercises, training completion for named managers, and open audit findings. Framework anchors: NIST CSF 2.0 GV.RR-01 for leadership accountability and RS.CO-02 for reporting to authorities. For other Member States, see the NIS2 Transposition Tracker.
Practitioner checklist
- Confirm in-scope entities by Annex, Article 5, PKD code and group size, and file any missing Wykaz KSC entries.
- Record the head of entity, the cybersecurity lead and contact persons, with annual training evidence.
- Implement the Article 8 SZBI by 3 April 2027, including supply chain and machine identity controls.
- Connect to S46 and document the sector or interim CSIRT reporting route.
- Exercise the 24 hour, 72 hour and one month reporting stages at least once a year.
- Track high-risk supplier decisions in Monitor Polski and plan replacements.
- Book the first audit for key entities before 3 April 2028.
- Monitor the Ministry Q&A and new regulations under Article 8a.
Standards and references
- Dziennik Ustaw: Act of 23 January 2026 amending the National Cybersecurity System Act (Dz.U. 2026 poz. 252)
- Sejm ELI: Text of Dz.U. 2026 poz. 252
- Ministry of Digital Affairs: Obligations of key and important entities
- Ministry of Digital Affairs: Self-registration in the list of key and important entities
- KPMG Poland: NIS2 implemented in Poland, legal alert
- Grant Thornton Poland: After the KSC register deadline
Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Transposition Tracker · NIS2 Readiness Checklist · Germany NIS2 Implementation Guide. This guide summarises Poland's amended National Cybersecurity System Act and is not legal advice.