NIS2/KSC · Energy

NIS2 and the KSC Act in the energy sector

NIS2 in the energy sector covers companies licensed to generate, transmit, distribute or trade electricity, heat, fuels and gas, as well as charging point operators and businesses in energy storage and hydrogen. In Poland, NIS2 is implemented by the National Cybersecurity System Act (KSC Act), and energy is one of its sectors of high criticality: a large enterprise is an essential entity, a medium-sized one an important entity, and the operator of a nuclear facility is an essential entity regardless of size.

Request a gap analysis Check your company's status

01Status

Which energy companies are subject to NIS2 and the KSC Act

The energy sector has seven subsectors: mineral extraction, electricity, heat, oil and fuels, gas, nuclear energy and hydrogen.

Type of activity

Annex 1 defines the types of entity by reference to licences and authorisations under the Energy Law and the Geological and Mining Law: generation, transmission, distribution and trading of electricity, heat, liquid fuels and gaseous fuels, storage and transhipment of fuels, operation of gas systems and mineral extraction. It also covers newer areas: electric vehicle charging points, aggregation, demand response, energy storage, hydrogen and synthetic fuels.

According to the Ministry of Digital Affairs (Q&A of 1 October 2026, question 1.1), self-assessment starts with your licences, permits and PKD codes (the Polish Classification of Activities). Trading in liquid fuels that does not require a licence is not subject to the Act (Annex 1, Oil and fuels subsector; Ministry of Digital Affairs, Q&A of 1 October 2026, question 1.49).

Size and exceptions

A large energy company is an essential entity and a medium-sized one an important entity (Art. 5(1)(1) and Art. 5(2)(1)); micro and small enterprises generally remain outside the Act. For renewable energy special purpose vehicles and subsidiaries of large energy groups, the group structure matters: size is calculated together with linked and partner enterprises; an entity that exceeds a threshold only because of them is not, on that basis, an essential or important entity if its information system is independent of theirs or it does not provide services jointly with them (Art. 5(6)-(7)).

Regardless of size, the operator of a nuclear facility is an essential entity, and an investor holding a decision in principle for a nuclear energy investment is an important entity (Art. 5(1)(4)(h) and Art. 5(2)(5)).

Check your company's status in our NIS2 scope checker.

Types of entity in the energy sector (Annex 1) and nuclear energy investments (Annex 2)
Type of entity	When it is subject to the Act	Legal basis
Extraction of minerals under a licence - natural gas, crude oil, lignite and hard coal, other minerals (Geological and Mining Law).	Large enterprise - essential, medium-sized - important	Annex 1, Energy sector, Mineral extraction subsector
Electricity generation (licensed)	Large enterprise - essential, medium-sized - important	Annex 1, Energy sector, Electricity subsector
Electricity transmission or distribution (licensed) - transmission and distribution system operators.	Large enterprise - essential, medium-sized - important	Annex 1, Energy sector, Electricity subsector
Electricity trading (licensed)	Large enterprise - essential, medium-sized - important	Annex 1, Energy sector, Electricity subsector
Aggregation, demand response, energy storage, nominated electricity market operator	Large enterprise - essential, medium-sized - important	Annex 1, Energy sector, Electricity subsector (Art. 3(6e), (11j), (28b), (59) and (59a) of the Energy Law)
Operator of electric vehicle charging points - managing a charging point and providing a charging service to end users.	Large enterprise - essential, medium-sized - important	Annex 1, Energy sector, Electricity subsector
Heat generation, transmission, distribution or trading (licensed)	Large enterprise - essential, medium-sized - important	Annex 1, Energy sector, Heat subsector
Crude oil and liquid fuels - production, transmission (including by pipeline), storage, transhipment and trading of liquid fuels (including foreign trade), synthetic fuels.	Large enterprise - essential, medium-sized - important	Annex 1, Energy sector, Oil and fuels subsector
Executive agency established under the Strategic Reserves Act	Essential regardless of size	Annex 1, Energy sector, Oil and fuels subsector
Natural gas and gaseous fuels - production, transmission and trading of gaseous fuels (including foreign trade); transmission, distribution, storage and liquefaction system operators; natural gas refining and processing.	Large enterprise - essential, medium-sized - important	Annex 1, Energy sector, Gas subsector
Operator of a nuclear power facility	Essential regardless of size	Annex 1, Energy sector, Nuclear energy subsector; Art. 5(1)(4)(h)
Hydrogen: production, transmission, storage or distribution	Large enterprise - essential, medium-sized - important	Annex 1, Energy sector, Hydrogen subsector
Investor in a nuclear power facility	Important once a decision in principle has been obtained, regardless of size	Annex 2, Nuclear energy investments sector; Art. 5(2)(5)

02Authority and critical entities

Competent authority, critical entities and incident reporting

Authority and the register

The competent authority for the energy sector and for nuclear energy investments is the minister responsible for energy (Art. 41(1) and (1a)). Energy companies apply for registration themselves, in the S46 system. The original deadline has passed, but according to the Ministry of Digital Affairs, self-registration in the register is available at all times; 3 October 2026 was the last day for entities that met the criteria on the date the amendment entered into force (Ministry of Digital Affairs, Q&A of 1 October 2026, question 2.32).

Incidents

A significant incident is reported through S46: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Until a sectoral CSIRT (computer security incident response team) for energy announces its operational capability, notifications go to the competent national-level CSIRT - CSIRT GOV, CSIRT NASK or CSIRT MON (Art. 44 of the amending act).

Critical entities

Energy is one of the sectors in which critical entities are identified under the CER Directive (Directive (EU) 2022/2557 on the resilience of critical entities). A critical entity is a critical infrastructure operator entered in the register of critical entities kept by the Director of the Government Centre for Security; the authority informs the operator of the entry within 30 days (Art. 2(11c) of the KSC Act; Art. 3(1a), Art. 6zo(1) and Art. 6zr(3) of the Crisis Management Act). The authorities carry out the first identification of critical entities and their entry in the register within 9 months of the entry into force of the Act of 29 May 2026 (4 July 2026), i.e. by 4 April 2027 (Art. 34 of the Act of 29 May 2026 (Dz.U. 2026 item 815)).

A critical entity is an essential entity regardless of size (Art. 5(1)(4)(c)), so an entry in the register of critical entities can change the status of a smaller company too. Until critical entities are identified under the Crisis Management Act, no entity is entered in the register as a critical entity; the Government Centre for Security will provide the Minister of Digital Affairs with the list of identified entities (Ministry of Digital Affairs, Q&A of 1 October 2026, questions 2.37-2.38).

03Risks

Systems and risks in the energy sector

Systems to include in the risk assessment

Control and monitoring - SCADA, grid management and dispatch systems, controllers in power plants and substations.
Metering and billing - remotely read meters, billing and customer service systems.
Market and trading - energy trading, forecasting and scheduling systems.
Distributed generation - remotely managed wind and solar farms, energy storage, charging points with driver apps.

What to look out for

the boundary between the operational technology (OT) network and the office network, and remote access for vendor maintenance,
equipment and software from suppliers - assessing their vulnerabilities and quality is part of supply chain security (Art. 8(2)),
business continuity - contingency and recovery plans tested against realistic scenarios,
continuous monitoring and reporting incidents within the statutory deadlines,
for essential entities in the electricity subsector - the measures in Delegated Regulation (EU) 2024/1366 (according to the Ministry of Digital Affairs, Q&A question 14.1).

04Obligations

Obligations and deadlines in the energy sector

Essential and important entities

an information security management system under Art. 8 - by 3 April 2027,
incident reporting, documentation, contact persons and annual training for the head of the entity (Art. 8e),
essential entities: a security audit at least once every 3 years, the first by 3 April 2028; important entities: only when ordered by the authority.

Fines

essential entities: up to EUR 10 million or 2% of revenue from business activity in the previous financial year, whichever is higher; not less than PLN 20,000 (Art. 73(3)),
important entities: up to EUR 7 million or 1.4% of revenue from business activity in the previous financial year; not less than PLN 15,000 (Art. 73(4)),
fines under Art. 73(1)-(4), Arts. 73a-73c and Art. 76b may be imposed for the first time 2 years after the amendment entered into force (according to the Ministry of Digital Affairs - after 3 April 2028). The moratorium does not cover the fine of up to PLN 100 million (Art. 35 of the amending act).

05How we help

Gap analysis, implementation and testing in the energy sector

NIS2 gap analysis - scope assessment of the companies in your group, a review of gaps against Art. 8 and an implementation plan.
NIS2 implementation - policies, incident and business continuity procedures, requirements for suppliers.
Infrastructure and network penetration testing - including segmentation of the OT network, remote access and customer-facing systems, under rules of engagement agreed in advance to keep testing safe.
Web application penetration testing - customer portals and charging apps.

We carry out the Art. 15 security audit in cooperation with a partner whose auditors meet the statutory requirements - and we do not audit a company that we helped to implement its security management system in the year before the audit. We prepare the board for the duties of the head of the entity in our board training.

Our NIS2/KSC checklist lists the questions to check before an audit.

Frequently asked questions

Is a solar or wind farm subject to NIS2?

Annex 1 covers energy companies holding a licence to generate electricity and, among others, entities providing aggregation, demand response and energy storage services. If a project company holds a licence, its size decides - calculated together with linked and partner enterprises - and a special purpose vehicle owned by a large energy group often exceeds the thresholds. A domestic prosumer installation without a licence is not listed in the annex.

Is an EV charging point operator subject to the KSC Act?

Yes, if it meets the size threshold. The electricity subsector includes businesses responsible for the management and operation of a charging point that provide a charging service to end users. A medium-sized operator is an important entity, a large one an essential entity.

Is a municipal district heating company subject to NIS2?

A company licensed to generate, transmit, distribute or trade heat belongs to the energy sector: a medium-sized one is an important entity, a large one an essential entity. If it is a municipal company performing public utility tasks using information systems, it is also an important entity as a public entity (Art. 5(2)(8)); the higher of the two statuses applies.

Is fuel trading that does not require a licence subject to the Act?

According to the Ministry of Digital Affairs, no - trading in liquid fuels that does not require a licence is not subject to the KSC Act (Q&A of 1 October 2026, question 1.49). The annex defines the types of entity in the energy sector by reference to licences and other authorisations under the Energy Law and the Geological and Mining Law.

Do additional EU rules apply to the energy sector?

Yes. According to the Ministry of Digital Affairs, essential entities in the electricity subsector also apply, within their security and business continuity management system, the measures set out in Commission Delegated Regulation (EU) 2024/1366 - the network code on sector-specific rules for cybersecurity aspects of cross-border electricity flows (Q&A, question 14.1). Many energy companies may also be identified as critical entities.

Sources

Legal status as of 8 October 2026 Updated 8 October 2026

Related services

NIS2/KSC · Gap analysis