The amended KSC Act and NIS2 in Poland: what a small or medium-sized business has to do
The amended National Cybersecurity System Act has been in force since 3 April 2026. The deadline for applying for entry in the register of essential and important entities is 3 October 2026, and the obligations must be implemented by 3 April 2027. We explain who the rules cover, what the penalties are for ignoring them, what your customers covered by the Act may expect from you and what to do in the coming weeks.
3 October 2026 is the deadline for applying for entry in the register of essential entities and important entities. It applies to companies that met the criteria for one of these categories on the day the amendment to the KSC Act (National Cybersecurity System Act) entered into force. For most businesses, entry does not happen automatically: each company has to assess for itself whether the rules apply to it.
Below we collect the facts confirmed in the text of the act and in announcements from the Ministry of Digital Affairs, describe what companies outside the scope of the act can expect, and suggest an order of actions for the coming weeks.
The 2026 National Cybersecurity System Act in dates
The amendment is the Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts, published in the Journal of Laws (Dz.U.) on 2 March 2026 as item 252. It transposes the EU NIS 2 Directive (2022/2555) into Polish law. It entered into force one month after publication, i.e. on 3 April 2026.
In its announcement of 2 April 2026, the Ministry of Digital Affairs indicated four dates on which the work plan depends:
| Date | What happens |
|---|---|
| 3 April 2026 | The amendment enters into force and the deadlines start to run |
| 3 October 2026 | Deadline for applying for entry in the register for entities meeting the criteria on the day the act entered into force |
| 3 April 2027 | Deadline for essential and important entities to implement their obligations |
| 3 April 2028 | Deadline for the first audit of essential entities; from this date administrative fines may be imposed |
Self-registration in the Wykaz KSC (KSC register) application opened on 7 May 2026. Some entities, including public entities, telecommunications businesses, trust service providers and existing operators of essential services, are entered by the ministry ex officio and asked to complete their data.
Who the KSC amendment covers
The amendment replaces the former division into operators of essential services and digital service providers with two categories: essential entities i important entities. Membership depends on two conditions at once: the type of activity and the size of the company.
Sectors listed in the annexes to the act
Annex 1 lists the key sectors: energy, transport, banking and financial market infrastructure, health, drinking water supply, wastewater collection, digital infrastructure, ICT service management, space and public entities.
Annex 2 lists the important sectors: postal services, investment in nuclear power facilities, waste management, manufacture and distribution of chemicals, production, processing and distribution of food, selected areas of manufacturing (medical devices, computers and electronics, electrical equipment, machinery, vehicles and other transport equipment), digital service providers, scientific research and some public entities.
In its self-identification guide, the ministry stresses that the PKD code (Polish classification of business activities) helps, but what decides is the actual scope of services provided. A manufacturing company with a trade PKD code may therefore be covered by the act, while a company with a “manufacturing” PKD code that in fact only trades may not be.
Medium-sized enterprise thresholds
The act refers to the EU definition of SMEs in Commission Regulation 651/2014. According to the Ministry of Digital Affairs' summary:
| Category | Headcount | Annual turnover or balance sheet total |
|---|---|---|
| Micro | fewer than 10 people | up to EUR 2 million |
| Small | fewer than 50 people | up to EUR 10 million |
| Medium | fewer than 250 people | turnover up to EUR 50 million or balance sheet total up to EUR 43 million |
| Large | above the medium-sized thresholds |
The general rule is this: a company in a sector from Annex 1 that exceeds the medium-sized enterprise thresholds is an essential entity. A company from Annex 1 that meets the criteria for a medium-sized enterprise is an important entity. A company from Annex 2 is an important entity if it is a medium-sized enterprise or larger.
When calculating size, linked and partner enterprises are taken into account, so a small company in a larger group may fall within the scope of the act. The act provides an exception here: if the status results only from these links, and the company's information system is independent of the systems of the linked companies or the company does not provide services jointly with them, it is neither an essential nor an important entity. Size is assessed as at the date the financial statements are drawn up.
Who is covered regardless of size
Some entities are covered by the act regardless of headcount and turnover. These include, among others, DNS service providers, top-level domain name registries and entities providing domain name registration services, qualified trust service providers and public entities specified in the act. Micro and small electronic communications businesses are important entities. Managed security service providers are essential entities from the small enterprise threshold upwards.
Entry in the register of essential and important entities in the S46 system
The application is submitted electronically in the Wykaz KSC application at wykaz-ksc.gov.pl, which runs within the S46 system. You sign in through the National Node (Węzeł Krajowy): Trusted Profile (profil zaufany), mObywatel, e-ID card, online banking or a qualified certificate.
The application is signed by the head of the entity or a person authorised by them, with a qualified signature, trusted signature, personal signature or qualified electronic seal. It contains a statement by the head, made under penalty of criminal liability, that the data is true. Entry takes effect when a correct application is submitted.
The act lists the data that must be provided. Before signing in, it is worth having to hand:
- name, registered office address and correspondence address, address for electronic delivery, NIP (tax ID) and REGON (business statistical number);
- sector, subsector and type of entity according to Annex 1 or 2;
- public IP address ranges and internet domains in continuous use;
- details of contact persons for the entities of the national cybersecurity system;
- size declaration: micro, small, medium or larger enterprise;
- information about the contract with a managed security service provider, if you have entrusted it with tasks under the act.
Changes to this data are reported within 14 days. A company that meets the criteria later, for example after exceeding the medium-sized enterprise threshold, has 6 months to apply from the date it meets the conditions.
If the 3 October deadline passes and your company meets the criteria, submit the application as soon as possible. The act allows the authority to impose a fine for failing to submit the application on time if the gravity of the infringement warrants it, and the transitional provisions state that fines may first be imposed 2 years after the act enters into force.
Obligations by 3 April 2027
Entities that met the criteria on the day the act entered into force have 12 months to implement the obligations in Chapter 3 of the act. The most important of these is an information security management system (ISMS) covering the information system used to provide the service. Among other things, the act requires:
- systematic incident risk assessment and management of that risk;
- technical and organisational measures proportionate to the risk, including security policies, access control, asset management, cryptography and multi-factor authentication where appropriate;
- security of the supply chain for ICT products and services;
- business continuity and disaster recovery plans that are maintained and tested;
- continuous system monitoring;
- regular software updates;
- staff training and basic cyber hygiene rules;
- incident management.
On top of that comes security documentation (normative and operational) and the appointment of at least two contact persons for the entities of the national cybersecurity system. Micro and small businesses covered by the act appoint at least one person.
Significant incidents are reported to the competent sector CSIRT in two stages: an early warning without undue delay, no later than 24 hours after detection, and an incident notification no later than 72 hours after detection. A final report is submitted within one month of the notification.
Essential entities carry out a security audit at their own expense at least once every 3 years. Entities that met the criteria on the day the act entered into force must carry out the first audit within 24 months, i.e. by 3 April 2028.
Management liability and fines
The amendment moves responsibility for cybersecurity to board level. The head of an essential or important entity is responsible for fulfilling the obligations even if they have entrusted them to another person. If the head is a collective body and no responsible person has been designated, all of its members are responsible.
The head makes decisions about the ISMS, plans funding for cybersecurity, assigns tasks and supervises their execution. Once every calendar year, they complete documented training. People entrusted with ISMS and incident handling tasks must, before starting work, present a certificate from the National Criminal Register (Krajowy Rejestr Karny) confirming that they have no convictions for offences against the protection of information.
The act sets the following upper limits for fines:
| Who | Upper limit of the fine |
|---|---|
| Essential entity | EUR 10 million or 2% of revenue from the previous financial year, whichever is higher; no less than PLN 20,000 |
| Important entity | EUR 7 million or 1.4% of revenue from the previous financial year; no less than PLN 15,000 |
| An infringement causing a serious threat, for example to human life and health | up to PLN 100 million |
| Head of the entity | up to 300% of their remuneration |
According to the Ministry of Digital Affairs' announcement, fines may be imposed from 3 April 2028. This period is for implementation, and the deadlines for the obligations are already running.
NIS2 in Poland and companies outside the scope of the act
Most small businesses will be neither essential nor important entities. Many of them will, however, feel the amendment indirectly, through their customers. The act requires essential and important entities to take ICT supply chain security into account in their ISMS, including vulnerabilities related to the hardware or software supplier and the overall quality of its products and services.
In practice, expect security questionnaires, new contract clauses and questions about how the supplier protects access to the customer's systems. This applies especially to companies that service a customer's systems, have remote access to them, supply software or process the customer's data. Prepare answers to the questions asked most often:
- whether accounts with access to the customer's systems use two-factor authentication;
- how quickly you will inform the customer about an incident that may affect them, and who the contact person is;
- how you manage updates and vulnerabilities in your products and on your computers;
- where and how backups are made of the data you process for the customer;
- who on your side has access to the customer's systems and how that access is revoked.
Getting admin accounts and the second sign-in factor in order is usually the first item in such questionnaires. We describe a practical standard in our post on 2FA and administrator accounts in a company.
What to do in the coming weeks
First, self-identification. Check whether your actual business activity falls within Annex 1 or 2, and calculate the size of the company together with linked and partner enterprises. If the answer is yes, submit the application at wykaz-ksc.gov.pl. The deadline is 3 October 2026; if you are reading this later, submit the application without delay and discuss the delay with a lawyer. If the answer is no, write a short note of the analysis: the date, who carried out the assessment, which sectors and thresholds were checked. It will come in handy when customers ask questions and the next time the size of the company changes.
In October. Companies covered by the act appoint contact persons, plan a budget and designate a person on the management side responsible for implementation. The head plans their annual training.
By the end of the year. An inventory of systems and services, risk assessment and a comparison of the current state with the ISMS requirements. The result of such a comparison is a prioritised list of gaps with costs, on the basis of which the work up to 3 April 2027 can be planned. On the technical side, this is supported by an IT audit or our small business cybersecurity checklist.
In parallel. An incident handling procedure with the 24 and 72 hour deadlines, a list of ICT suppliers with a risk assessment and a review of contracts with IT service providers. Meanwhile, companies outside the scope of the act prepare answers for their customers and tidy up their own access to the customers' systems.
If you want to start with a one-hour conversation about the state of your IT, book free IT review. The result is a list of the most urgent technical risks, which can then be turned into an implementation plan.
When you need a lawyer
This material sets out the regulations from an IT perspective and is not legal advice. It is worth going to a legal adviser or attorney when the sector classification is unclear, when the company belongs to a group and calculates its size together with linked entities, when it carries out regulated activity or several types of activity from different annexes, when the registration deadline has passed, and when a customer sends a contract with new cybersecurity obligations. Assessing whether a particular company is an essential or important entity is always the responsibility of the company itself and its advisers.
We describe implementing the technical part of the requirements, from accounts and backups to monitoring and the incident procedure, on the page cybersecurity.
Sources
- Journal of Laws (Dz.U.), Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts, Dz.U. 2026 item 252, https://api.sejm.gov.pl/eli/acts/DU/2026/252/text.pdf (accessed 02/10/2026)
- Ministry of Digital Affairs, The amendment to the National Cybersecurity System Act comes into force, 2.04.2026, https://www.gov.pl/web/cyfryzacja/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa-zaczyna-obowiazywac (accessed 02/10/2026)
- Ministry of Digital Affairs, Amendment to the KSC Act: we are launching self-registration in the Register of essential entities and important entities, 7.05.2026, https://www.gov.pl/web/cyfryzacja/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa-ksc--uruchamiamy-samorejestracje-w-wykazie-podmiotow-kluczowych-i-podmiotow-waznych-sprawdz-jak-dokonac-wpisu (accessed 02/10/2026)
- gov.pl knowledge base, Amendment to the KSC Act: how to carry out self-identification, 27.04.2026, https://www.gov.pl/web/baza-wiedzy/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa-ksc---jak-dokonac-samoidentyfikacji (accessed 02/10/2026)
- gov.pl knowledge base, Miesiąc na samorejestrację w Wykazie KSC. Termin mija 3 października (One month to self-register in the KSC register. The deadline is 3 October), 3.09.2026, https://www.gov.pl/web/baza-wiedzy/miesiac-na-samorejestracje-w-wykazie-ksc-termin-mija-3-pazdziernika (accessed 02/10/2026)
- NASK Cyberpolicy, Nowelizacja ustawy o krajowym systemie cyberbezpieczeństwa (Amendment to the National Cybersecurity System Act), 6.03.2026, https://cyberpolicy.nask.pl/aktualnosci/nowelizacja-ustawy-o-krajowym-systemie-cyberbezpieczenstwa/ (accessed 02/10/2026)
As of 2 October 2026.