NIS2 obligations in Poland (KSC amendment (UKSC))

Competent authority & CSIRT Legal ref: Art. 5

• Minister of Digital Affairs maintains the list of key and important entities (Wykaz KSC, run in System S46); incident reporting and communication with authorities use System S46. gov.pl · 28 Oct 2026 · source-checked
• Minister of Digital Affairs. ecs-org.eu · 28 Oct 2026 · secondary source
• Four types of CSIRTs: ecs-org.eu · 28 Oct 2026 · secondary source
• CSIRT MON. ecs-org.eu · 28 Oct 2026 · secondary source
• CSIRT NASK. ecs-org.eu · 28 Oct 2026 · secondary source
• CSIRT GOV and sector CSIRTs. ecs-org.eu · 28 Oct 2026 · secondary source
• Minister of Digital Affairs will maintain a list of essential and important entities. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Annex 1,2

• In addition to NIS2, the following subsectors are covered under ‘sectors of high criticality’ (essential entities): ecs-org.eu · 28 Oct 2026 · secondary source
• Mining and nuclear energy (subsectors part of the energy sector). ecs-org.eu · 28 Oct 2026 · secondary source
• Provision of health services and public health; production and distribution of medicinal products and medical devices (subsectors part of the healthcare sector). ecs-org.eu · 28 Oct 2026 · secondary source
• Electronic communication (subsector part of the digital infrastructure sector). ecs-org.eu · 28 Oct 2026 · secondary source
• The following sectors are covered under ‘other critical sectors’ (important entities): ecs-org.eu · 28 Oct 2026 · secondary source
• Nuclear energy investments. ecs-org.eu · 28 Oct 2026 · secondary source
• Certain public entities. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 7

• Self-registration in the Wykaz KSC (wykaz-ksc.gov.pl, electronic signature) ran 7 May – 3 Oct 2026 for entities meeting the criteria on 3 Apr 2026. Public entities, telecoms, trust service providers and former operators of essential services are entered ex officio and must complete their data within 6 months of the request. gov.pl · 28 Oct 2026 · source-checked
• The government registered existing essential providers first. The registration of other entities opened on 7 May 2026. The deadline for registration is 2 April 2027. Entities will apply for registration in the Register of Essential and Important Entities ecs-org.eu · 28 Oct 2026 · secondary source
• The following information is collected: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector, subsector, and type of entity. ecs-org.eu · 28 Oct 2026 · secondary source
• Registered office address and correspondence address. ecs-org.eu · 28 Oct 2026 · secondary source
• Address for electronic service, if it has been entered in the database of electronic addresses. ecs-org.eu · 28 Oct 2026 · secondary source
• Email address. ecs-org.eu · 28 Oct 2026 · secondary source
• Tax identification number (NIP). ecs-org.eu · 28 Oct 2026 · secondary source
• The identification number of the public entity in the National Official Register of National Economy Entities (REGON). ecs-org.eu · 28 Oct 2026 · secondary source
• The number in the relevant register of regulated activities. ecs-org.eu · 28 Oct 2026 · secondary source
• The range of public IP addresses and internet domains used by the entity. ecs-org.eu · 28 Oct 2026 · secondary source
• Up-to-date contact details of the entity and its legal representative. ecs-org.eu · 28 Oct 2026 · secondary source
• The telephone number assigned to the activity performed. ecs-org.eu · 28 Oct 2026 · secondary source
• Information specifying in which Member States of the European Union the key entity or important entity performs its activity, together with the type of activity performed. ecs-org.eu · 28 Oct 2026 · secondary source
• The cybersecurity authority determines whether entities can be classified as important or essential based on the requirements set out in the law. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 11

• Key and important entities must use System S46 (available to new entities from 12 Jun 2026), including for incident reporting; adoption deadline 3 Apr 2027. gov.pl · 28 Oct 2026 · source-checked
• Entities must inform the relevant sectoral CSIRT of significant incidents. ecs-org.eu · 28 Oct 2026 · secondary source
• Reporting requirements: ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours plus an initial assessment of the impact, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report at the request of the national CSIRT (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source
• 3 types of incidents: ecs-org.eu · 28 Oct 2026 · secondary source
• Incident: has or may have an adverse effect on the security of information systems. ecs-org.eu · 28 Oct 2026 · secondary source
• Critical incident: resulting in significant damage to public security or order, international interests, economic interests, the operation of public institutions, civil rights and freedoms or human life and health, classified by the appropriate CSIRT. ecs-org.eu · 28 Oct 2026 · secondary source
• Serious incident: causes or may cause a serious reduction in quality or interruption of the continuity of service provision by a key entity or an important entity, financial losses for this entity or affects other natural persons, legal persons, organisational units without legal personality by causing material or non-material damage. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

• The head of the entity (e.g. management board) is responsible for KSC obligations even when delegated; approves security measures, oversees implementation, ensures resources, appoints at least 2 contact persons (1 for micro/small); training duty for heads of entity; fines for heads of entity are possible. biznes.gov.pl · 28 Oct 2026 · source-checked

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 73

• The amount of the monetary penalty may not exceed 10,000,000 euros, expressed in złoty, or 2% of the revenue earned by the key entity from business activity in the financial year preceding the imposition of the penalty, whichever amount is higher. However, this penalty may not be less than 20,000 złoty. In the case where the period of conducting business activity is shorter than 12 months, or the entity has not achieved revenue, the basis for calculating the monetary penalty shall be the equivalent of 500,000 euros, expressed in złoty. ecs-org.eu · 28 Oct 2026 · secondary source
• The amount of the monetary penalty may not exceed 7,000,000 euros, expressed in złoty and determined using the average exchange rate announced by the National Bank of Poland applicable on December 31 of the year preceding the year of issuing the decision to impose the penalty, or 1.4% of the revenue earned by the important entity from business activity in the financial year preceding the imposition of the penalty. However, this penalty may not be lower than 15,000 złoty. ecs-org.eu · 28 Oct 2026 · secondary source
• Administrative fines can only be imposed from 3 Apr 2028 (two years after entry into force) and are preceded by a warning. gov.pl · 28 Oct 2026 · source-checked

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Chapter 3b

• Reference to European and International standards ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

• Ministry of Digital Affairs – key dates gov.pl
• gov.pl – self-identification guide gov.pl
• biznes.gov.pl – NIS2 obligations for businesses biznes.gov.pl

Key dates

• 3 Apr 2027 Poland: end of adjustment period – implement KSC obligations and start using System S46
  gov.pl source-checked
• 3 Apr 2028 Poland: first ISMS audit for key entities that were not operators of essential services; fines provisions start
  gov.pl source-checked

What changed recently

1. 3 Oct 2026
   Self-registration window in Wykaz KSC closed gov.pl source-checked
2. 3 Apr 2026
   Amended KSC Act in force (ECSO lists 2 Apr 2026 — gov.pl date used) gov.pl source-checked