NIS2by country

NIS2 in Poland

Ustawa o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 252)

Law in force since

Law
KSC Act
Authority
Minister of Digital Affairs
Classes
podmiot kluczowy (essential), podmiot ważny (important)
Register
Wykaz KSC (System S46)
ISO 27001
Not named in the law

Check your company for Poland

Get the NIS2 dates for Poland

  • 2 dates as a calendar file.
  • An alert when the rules change.

This site stores your email and emails you when the NIS2 rules in Poland change. Unsubscribe at any time.

The law

The amendment took effect on 2026-04-03, 1 month after publication.

Name
Ustawa o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 252)National Cybersecurity System Act, as amended on 23 January 2026
Published
2026-03-02
In force
2026-04-03
Text
Read the KSC Act

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Poland differs

  • Art. 5(1) KSC Act Managed security service providers are key entities from the small size class up. The Directive starts at medium size.
  • Art. 5(6)-(7) KSC Act Partner and linked company figures do not count when your information system is independent of the group's systems, or when you do not provide services jointly with the group.

Also note

  • Each sector has its own competent authority. The Minister of Digital Affairs covers ICT service management. The President of the Office of Electronic Communications covers postal services.

Registration

Companies in scope at the start had a window from 2026-05-07 to 2026-10-03. Companies that come into scope later have 6 months from that point.

Portal
Wykaz KSC (System S46)
Rule
Deadline counts from the day you come into scope
Deadline
2026-10-03
Later entrants
6 months after you come into scope
You need
An account in the S46 system for the person who files for the company.
Changes
Report changes to your data within 14 days

Incident reporting

  1. 24 hEarly warning
  2. 72 hIncident notification
  3. 1 monthFinal reportafter the notification

Send the reports to the competent CSIRT.

The 24 and 72 hours run from detection of the incident.

Measures and proof

Essential
A security audit at least every 3 years. Key entities in scope at the start must finish the first audit by 2028-04-03.
Important
No mandatory audit cycle. The authority can order an inspection.

The dates, in order

  1. End of the first registration window
  2. Measures and procedures in place (12 months after entry into force) Next
  3. Key entities: first audit doneEssential entities only

Fines

The ceiling is the higher of a fixed amount and a share of the annual turnover of the entity itself.

Fine ceilings, Art. 73 KSC Act. The higher amount applies. Each "At EUR" figure is the ceiling at that entity turnover.
Class Ceiling At EUR 20mAt EUR 500mAt EUR 2bn
Essential EUR 10m or 2% EUR 10mEUR 10mEUR 40m
Important EUR 7m or 1.4% EUR 7mEUR 7mEUR 28m

The % applies to the revenue of the entity itself, not to the group. Minimum fines are PLN 20,000 (key) and PLN 15,000 (important). A breach that causes a serious threat can cost up to PLN 100 million. The head of the entity can be fined up to 300% of their salary.