NIS2 in Poland – what exactly does it mean for companies

The implementation of the NIS2 Directive into Polish law through an amendment to the Act on the National Cybersecurity System (KSC Act) is one of the most significant regulatory changes in the IT sector in recent years.

However, this is not just another “compliance formality.” It is a change that has a real impact on how companies manage IT, security, and business continuity – and the responsibility for it rests with the management board.

In this article, we explain not only what the law says, but above all, what it means in practice for organizations.

Legal basis for the information in this article: Act of 5 July 2018 on the national cybersecurity system (Journal of Laws 2026, item 20 – consolidated text), as amended by the Act of 23 January 2026 (Journal of Laws 2026, item 252, in force since 3 April 2026) and by the amendments in Journal of Laws 2026, items 815 and 1003, implementing Directive (EU) 2022/2555. Registration deadlines: Announcement of the Minister of Digital Affairs of 8 April 2026 (Official Journal of the MC 2026, item 7).

NIS2 - What Is It Really All About?

The NIS2 Directive has one main objective: to strengthen the resilience of organizations and the state against cyber threats and to ensure the continuity of services critical to the economy and society.

In practice, this means three things:

• Cybersecurity is no longer the exclusive domain of the IT department,
• Responsibility is shifted to the executive level (board of directors),
• Security must be managed systematically, rather than on a “project-by-project” basis.

Poland’s implementation is based on the National Cybersecurity System Act, which defines specific obligations, deadlines, and sanctions. The National Cybersecurity System includes, among others, essential and important entities, incident response teams (CSIRT NASK, CSIRT GOV, CSIRT MON, and sector-specific CSIRTs), and the authorities responsible for cybersecurity in individual sectors.

Who Is Affected by NIS2? More Companies Than You Might Think

The scope of the regulations is very broad, and a complete list of industries is provided in Appendices 1 and 2 to the KSC Act.

Essential Entities (High-Criticality Sectors)

• Energy (electricity, gas, fuels and oil, heat),
• Transportation (air, rail, water, road),
• Banking and financial market infrastructure (for financial entities the DORA Regulation applies as the more specific regime – the exact scope of the carve-out is set out below),
• Healthcare (including manufacturers of essential medicines and medical devices, EU reference laboratories),
• Drinking water and wastewater,
• Digital infrastructure (data centers, cloud, electronic communications networks and services),
• ICT service management,
• Space,
• Selected public entities.

Banking and financial markets – what remains from the KSC Act. For entities in banking and financial market infrastructure the primary regime is DORA. The KSC Act does not apply to them its provisions on the information security management system or on reporting serious incidents, but Art. 8i(1) lists the exceptions explicitly. Two items remain from the catalogue of measures: systematic risk assessment (Art. 8(1)(1)) and basic cyber hygiene practices (Art. 8(1)(2)(j)). The provisions on the manager's accountability, their duties, annual training and criminal-record verification (Art. 8c–8f) also apply accordingly.

Important Entities

This is where the largest group of companies that do not expect to be subject to regulation is found:

• Postal and courier services,
• Waste management,
• Production, processing, and distribution of chemicals and food,
• Manufacturing (including medical devices, electronics, machinery, vehicles, and transportation equipment),
• Digital service providers (e-commerce platforms, search engines, social networks),
• Scientific research,
• Investments in nuclear energy,
• Selected regional public entities.
  NIS2 therefore covers a significant portion of the SME sector – particularly companies that are part of larger supply chains.

Essential Entity vs. Important Entity - The Key Difference

Whether a company is subject to the regulation depends not only on the industry but also on the company’s size (thresholds set out in EU Regulation 651/2014):

• Essential entities – primarily large companies in high-criticality sectors and selected entities regardless of size (including DNS providers, TLD registries, domain name registration service providers, qualified trust service providers, critical entities, nuclear facility operators, and public entities listed in Appendix 1),
• Important entities – most often medium-sized businesses in high-criticality sectors, as well as medium- and large-sized businesses in important sectors.

Two categories are classified by type of activity rather than sector, and they are easy to overlook:

• Electronic communications undertakings – an essential entity from the size of a medium-sized enterprise upwards; a micro or small undertaking is an important entity,
• Managed security service providers (MSSP) – an essential entity already from the small or medium enterprise threshold (Art. 5(1)(3) of the Act); only an MSSP qualifying as a micro-enterprise remains outside the scope,
• Non-qualified trust service providers – an important entity as a micro, small or medium-sized enterprise.

When the size threshold is assessed, the company is not looked at in isolation. Under Regulation 651/2014/EU the headcount and financial figures of linked and partner enterprises are aggregated (ownership above 25%). A company with 80 employees may therefore qualify as a large enterprise because it belongs to a larger group – and, conversely, an information system that is genuinely independent and not used to provide the regulated service may fall outside the scope. Verifying the ownership structure is a mandatory step before classification, not an afterthought.

Most importantly: the company itself must classify itself and report accordingly. No one will send a notification – incorrect classification or failure to classify poses a real risk of sanctions.

When the Act Applies (Territorial Scope)

The regulations apply, among others, to entities operating in Poland (headquarters, branch, or cross-border operations) and to companies from outside the EU offering services in Poland – the latter must appoint a representative with an organizational unit in Poland, unless they have already appointed one in another EU Member State. Digital service providers are subject to the regulations based on their principal place of business in Poland.

Deadlines – When You Need to Take Action

The KSC Act has been in effect since April 3, 2026, and the implementation of the requirements is phased in over time. What matters is when the company met the criteria for being designated as an essential or important entity.

In practice: Most companies should already be in the process of implementation, not just in the analysis phase.

Registration in the list of essential and important entities

The list is maintained by the competent authorities in the S46 information and communication technology system. Some entities – former operators of essential services, trust service providers, electronic communications undertakings, critical entities and public entities – are entered ex officio: they receive a notice of the entry together with a request to complete their data, and have 6 months from the date that request is served. All other entities that met the criteria on 3 April 2026 file the application themselves between 7 May and 3 October 2026, in line with the schedule published by the Minister of Digital Affairs (announcement of 8 April 2026); entities meeting the criteria later have 6 months from the day they do so. Changes to the data must be reported within 14 days. Data from the list is not public information; only aggregate statistics are publicly available.

Key Responsibilities

1. Risk Management and Safety Measures

The law does not impose a single set of tools – the measures are to be proportionate to the risk and tailored to the size of the company. However, the minimum scope includes, among other things:

• Risk analysis and information systems security policies
• Incident response,
• Business continuity and backups (backup, disaster recovery plans, crisis management),
• Supply chain security,
• Security in the procurement, development, and maintenance of systems, including vulnerability management,
• Assessment of the effectiveness of implemented measures,
• Cybersecurity awareness and staff training,
• Cryptography and encryption,
• Human resources security, access control, and asset management,
• Multi-factor authentication (MFA) and secure communication.

For some entities the catalogue is more detailed. DNS service providers, TLD registries, cloud computing providers, data centre and CDN providers, managed service providers (MSP) and managed security service providers (MSSP), as well as providers of online marketplaces, search engines and social networking platforms apply, within their information security management system, the measures set out directly in Commission Implementing Regulation (EU) 2024/2690 (Art. 8b(1) of the Act). For them the list above is a minimum, not the full set of requirements. Other essential and important entities apply the implementing acts issued for their type of entity, where such acts are adopted.

Public entities – a different catalogue. An important entity that is a public entity does not apply Art. 8(1) of the Act. Its information security management system is based on Annex 4 to the Act: 18 mandatory requirements (including an inventory of ICT products and services, least privilege, backups separated both logically and physically, restore testing, email controls, use of stable versions free of known critical vulnerabilities, and cyber hygiene training), 9 optional requirements, and a review of the ISMS at least once a year or without delay following a recommendation of the Government Plenipotentiary. The same applies to entities under Art. 7(1)(1–4) and (6–7) of the Law on Higher Education and Science that are not research organisations, in respect of their public tasks. Failure to meet the obligation under Art. 8(3) is a separate ground for a penalty (Art. 73(1c)).

Data in SaaS applications

The requirement to manage backups also covers data held in cloud services, and this is where we most often find a gap. It follows from the shared responsibility model: the SaaS provider is responsible for the availability of the platform and its infrastructure, while the customer is responsible for the data and configuration inside it. A recycle bin, retention policies and archiving limit the damage from a single deletion, but they do not restore the state from a chosen point in time, they do not cover identity configuration – conditional access policies or app registrations, for instance – and they are not independent of the production vendor.

What counts in an audit is demonstrating recoverability rather than assuming it: defined RTO and RPO, immutable copies, storage independent of the production environment, and cyclical, documented restore tests. This requirement closes back onto supply chain security, because the backup provider itself becomes an ICT supplier to be assessed – at which point its certifications and independent audit reports are part of the documentation, not a marketing extra.

We cover this topic in a dedicated webinar (in Polish) and on our SaaS data backup page.

2. Information Security Management System (SZBI)

Essential and important entities must implement an information security management system (SZBI) covering the entire lifecycle of the IT systems used to provide services – including policies, roles and responsibilities, operational procedures, security monitoring and testing, and systematic risk analysis. In our experience an existing ISO/IEC 27001 system shortens the work considerably, because the risk process, the policies and much of the documentation are already in place. It is worth being clear about the limit, though: the KSC Act does not treat certification as evidence of compliance – the authority assesses the measures themselves, not the certificate.

3. Incident Management – with Specific Deadlines

This is one of the most practical aspects of NIS2.

Classifying an incident as serious is the entity's own obligation, not the CSIRT's. The thresholds are set by a regulation of the Council of Ministers – until the new act enters into force, the regulation of 31 October 2018 (Journal of Laws 2018, item 2180) remains in effect, but for no longer than 12 months from 3 April 2026. The new regulation, covering all the sectors added by the amendment, is in preparation. For some entities the thresholds were set directly by the European Commission in an implementing act.

A serious incident is reported to the relevant CSIRT in stages:

• 24 hours – early warning (whether the incident was intentional or has a cross-border dimension),
• 72 hours – a formal report assessing the impact, causes, and actions taken,
• Upon request – an interim report,
• 1 month from the 72-hour report – a final report. If the handling of the incident is still ongoing, a progress report is submitted within that deadline, and the final report within one month of the handling being completed.

The report goes to the relevant sector-specific CSIRT, but only from the day after the announcement that it has reached operational capability is published. The competent authorities have 18 months from 3 April 2026 to set up the sector-specific teams, so today most entities report serious incidents to the relevant CSIRT MON, CSIRT NASK or CSIRT GOV. The exception covers sectors where a sector team was established before 2025. Before you write the recipient into your incident procedure, check the announcements of your competent authority.

Reporting to the CSIRT is not the whole obligation. The entity must also inform the recipients of its services where an incident may affect the services they use, and – where a serious cyber threat arises – tell them what protective measures they can apply, and in appropriate cases about the threat itself. In practice this means a prepared communication path to customers, not only to the authority.

In practice, this means that a company must have a process in place and personnel capable of responding within 24 hours – this cannot be “put together” in the middle of an attack. Note: for trust service providers the 24-hour deadline applies to the full incident notification, not only to the early warning.

4. Supply Chain

The company is also responsible for the security of its suppliers and ICT partners – it must assess their risks and incorporate security requirements into its business relationships. In practice, even SMEs that fall outside the scope of the law are sometimes required to implement appropriate measures because their larger customers demand it.

The Act goes further than the Directive here and states explicitly what must be taken into account when selecting supply chain measures (Art. 8(2)):

1. vulnerabilities associated with the hardware or software supplier,
2. the overall quality of that supplier's ICT products, services and processes,
3. the results of the coordinated security risk assessment carried out by the Cooperation Group (Art. 22(1) of Directive 2022/2555),
4. the outcome of proceedings to designate the supplier as a high-risk supplier (Art. 67b – covered below).

A supplier assessment that does not address these four points does not meet the statutory requirement. It is also worth reviewing existing contracts: clauses that prevent a CSIRT from testing an ICT product or service are void by operation of law (Art. 40(1) of the amending act).

5. Documentation and Audits

A complete audit trail is required: normative documentation (policies, procedures, plans) and operational documentation (implementation records, system logs), which must be protected and version-controlled. Documentation is retained for at least 2 years from the date it is withdrawn from use or the service ceases to be provided, with the period counted from 1 January of the year following the year in which the retention term expires. Destruction is confirmed by a disposal report kept on a permanent basis. This provision does not apply to entities covered by the Act on the national archival resource and archives. Essential entities must conduct an audit of the security of their information system at least once every 3 years, counted from the signing of the previous audit report and at their own cost, and must send the report to the competent cybersecurity authority in electronic form within 3 working days of receiving it. Essential entities carry out their first audit by 3 April 2028. The exception is former operators of essential services that have already carried out an audit – the first-audit deadline does not apply to them and they continue the three-year cycle counted from the date on which the report from the last audit was drawn up and signed (Art. 25 of the amending act). A former operator that has not carried out an audit is subject to the general deadline. The authority may also order an external audit – at any time for an essential entity, and after a serious incident or another breach for an important entity. Such an order is immediately enforceable.

There is one constraint companies often run into when planning an audit: it cannot be carried out by a person who performs tasks under Art. 8 and Art. 9–13 in the audited entity, nor by a person who performed them within the year preceding the start of the audit. In practice this rules out your own security team and the consultant who implemented the ISMS – the audit has to be planned with a different provider.

Management's Responsibility

The entity’s management (e.g., a company’s board of directors) is responsible for fulfilling these obligations – even when the tasks have been delegated to someone else. In particular, management:

• Approves security measures and oversees their implementation,
• Provides organizational and financial resources,
• Designates at least 2 contact persons for the national cybersecurity system (at least 1 in the case of a micro or small enterprise and of a public entity classified as an important entity),
• Gives users of the service access to knowledge about cyber threats, in particular on the company website – a hyperlink to the pages of the competent authority or a CSIRT is sufficient,
• Gives users a way to report a cyber threat, incident or vulnerability related to the service provided.

The entity's manager, and any person entrusted with their cybersecurity duties, also complete training once per calendar year. The Act defines its scope – it covers the performance of obligations under, among others, Art. 8, 8d, 8f, 9–12b, 14 and 15 – and attendance must be documented. The absence of such training is a standalone ground for a penalty imposed on the manager, as is failing to provide users with a reporting channel.

The Act provides for monetary penalties imposed directly on managers and requires that individuals performing cybersecurity tasks have no criminal record.

Penalties

Before imposing a penalty, the authority typically employs “soft” measures – such as recommendations, orders to implement specific measures, inspections or audits, and deadlines for rectifying violations. Failure to respond, however, results in financial sanctions.

If the period of business activity is shorter than 12 months, or the entity has not generated any revenue, the penalty is calculated on a base of EUR 500,000 for an essential entity and EUR 250,000 for an important entity; the penalty may not be lower than PLN 20,000 and PLN 15,000 respectively. When setting the amount, the authority takes into account, among other things, the revenue for the financial year preceding the decision and – in the case of a public entity and of the entity's management – their financial capacity.

Independently of the penalty for the breach itself, the authority may impose a periodic penalty payment to compel compliance with a supervisory decision – from PLN 500 to PLN 100,000 for each day of delay (Art. 76b(1) of the KSC Act). That penalty is, however, covered by the same two-year grace period as the other financial penalties: Art. 35 of the amending act lists Art. 76b explicitly, so it can first be imposed from 3 April 2028.

The Act also provides for an extraordinary penalty of up to PLN 100,000,000 (Art. 73(5) of the Act). There are two alternative grounds: a direct and serious cyber threat to national defence, state security, public security and order, or human life and health; or a risk of serious financial loss or serious disruption to the provision of services. The second ground does not require any national-security dimension, so the provision is not limited to critical infrastructure. Importantly, the penalty is mandatory – the Act states that the authority "shall impose" it rather than "may impose" it; the discretion concerns the amount, not the decision itself.

Penalties are imposed on the manager personally as well, independently of the penalty imposed on the entity: up to 300% of remuneration in a private entity and up to 100% in a public one, unless that public entity is also subject to the Act by virtue of a sector listed in Annex 1 or 2, in which case the 300% cap applies; calculated on the same basis as holiday pay equivalent. The authority may also order the implementation of specific measures, conduct an audit, temporarily prohibit a person from performing management functions, or – in the case of an essential entity – suspend the provision of the service.

A note on timing: for entities that met the criteria on 3 April 2026, the supervisory authorities may impose financial penalties from 3 April 2028 (Art. 35 of the amending act). The two-year grace period does not, however, cover the extraordinary penalty of up to PLN 100,000,000 under Art. 73(5) of the Act – Art. 35 of the amending act lists Art. 73(1)–(4), Art. 73a–73c and Art. 76b, but not paragraph 5. That penalty is therefore imposed from the day the Act enters into force. The grace period does not move the implementation deadlines. Entities perform the obligations under Chapter 3 of the Act – including incident reporting and management-body duties – within 12 months of the Act's entry into force, i.e. by 3 April 2027 (Art. 33(1) of the amending act). The exception is former operators of essential services, who report incidents under the new rules after just 6 months (Art. 33(4)).

High-Risk Supplier - A New Risk in the Supply Chain

The minister responsible for digitization may designate a hardware or software supplier as a high-risk supplier if it poses a threat to national security. The decision (published in Monitor Polski) means, among other things, that companies using such products:

• A ban on putting into service the ICT products, services, or processes covered by the decision,
• An obligation to phase out solutions already in use – generally within 7 years (4 years for critical telecommunications functions).

This is a practical aspect of procurement planning and IT architecture – it’s worth mapping your dependence on key suppliers today.

Security Measures for Critical Incidents

In the event of a critical incident, the minister responsible for digital transformation may issue an immediately enforceable security directive (e.g., an order to install a patch, implement a specific configuration, suspend software distribution, or restrict network traffic), which may remain in effect for up to 2 years. Companies must be able to implement such a directive quickly.

What NIS2 Really Changes for Companies

1. Senior management is personally accountable for cybersecurity

Cybersecurity is no longer solely the domain of IT – decisions on risk tolerance, the security budget, and investment priorities move to the board level, along with accountability for them.

2. Compliance without implementation doesn’t work

Documents without actual processes will not pass an audit, will not mitigate risk, and will not protect against penalties. The authority does not assess declarations. In relation to essential entities, the Act expressly empowers it to request evidence that the requirements of Art. 8(1) have been met and information needed to assess the measures implemented (Art. 53(2)(4) and (6)). Supervision of important entities is ex post, but the same documents are examined during an inspection. In practice this means that for every area you have to know which document or record substantiates it – and where that record sits.

The most common mistakes we see

• “We still have time” – implementation usually takes 6 – 12 months.
• “We’ll prepare the documentation” – NIS2 requires action, not paperwork.
• “We’re not a critical sector” – most companies fall into the “important” category, and some are included through the supply chain.

How to Approach NIS2

• Quick assessment (2 – 4 weeks): Does the company fall under NIS2? What is its classification? What gaps exist relative to the requirements?
• Implementation plan: priorities, roadmap, budget.
• System implementation: information security management system (ISMS), processes, tools, integration with S46.
• Audit preparation and ongoing incident reporting.

Summary

NIS2 is not an IT project or a one-time implementation – it is a change in the way an organization operates in the area of security. Companies that approach this strategically will increase their operational resilience, streamline their IT processes, and gain a competitive advantage. The rest will implement the same requirements later, usually under greater time pressure.

Not sure whether the Act applies to your organization? Start with the self-assessment questionnaire on biznes.gov.pl (in Polish). If you would rather work through classification and a gap analysis with someone who has done it before, get in touch.

Legal position as at 15 September 2026. This article is a general overview and not legal advice; the classification of a specific company requires an individual analysis of its activity, size and ownership structure.

Sources:

• The NIS2 Directive (EU) 2022/2555 and the Act on the National Cybersecurity System (Annexes 1 and 2).
• biznes.gov.pl
• cyber.gov.pl
• ISAP – Act of 23 January 2026 (Journal of Laws 2026, item 252): isap.sejm.gov.pl
• List of essential and important entities: wykaz-ksc.gov.pl
• S46 system: gov.pl/web/system-s46
• NIS2 self-assessment questionnaire (biznes.gov.pl): biznes.gov.pl