NIS2/KSC · Transport and logistics

NIS2 and the KSC Act in transport and logistics

NIS2 in the transport sector covers air carriers, railway undertakings, airport and port managing bodies, shipowners, railway infrastructure managers, the national road authority and providers of intelligent transport systems (ITS). Road hauliers, freight forwarders and warehouses are not listed in the annexes to the Polish National Cybersecurity System Act (KSC Act), which implements NIS2 - but postal operators, including courier companies, are. We explain who is in scope, what the obligations are and what this means for logistics.

Request a gap analysis Check your company's status

01Status

Who in transport and logistics is subject to NIS2 and the KSC Act

Transport is a sector of high criticality (Annex 1) with four subsectors: air, rail, water and road. Postal services belong to the other critical sectors (Annex 2).

Transport in Annex 1

air - air carriers, airport managing bodies, ground handling and security screening providers, and the air navigation service provider,
rail - railway infrastructure managers, licensed railway undertakings and operators of service facilities,
water - shipowners, managing bodies of ports and port facilities, entities carrying out activities ancillary to maritime transport within ports, and the Vessel Traffic Service (VTS),
road - the national road authority and ITS service providers.

A large enterprise is an essential entity and a medium-sized one an important entity; size is calculated at group level, together with linked and partner enterprises.

Logistics - what is in scope and what is not

Road hauliers, freight forwarders and warehouses are not listed in the annexes. The Act does, however, cover:

postal operators (Annex 2) - including courier companies entered in the register of postal operators: medium-sized and large ones are important entities,
activities in other sectors, e.g. wholesale food distribution or pharmaceutical wholesalers,
ITS service providers - according to the Ministry of Digital Affairs, an ITS service provider may be a public or private entity, e.g. providing navigation and traffic information, route planning, dispatch and fleet management or shipment tracking services; a carrier using an external fleet platform is an ITS user, not an ITS provider (Annex 1, Road transport subsector; Ministry of Digital Affairs, Q&A of 1 October 2026, question 1.36).

Check your company's status in our NIS2 scope checker.

Types of entity in the transport sector (Annex 1) and postal services (Annex 2)
Type of entity	When it is subject to the Act	Legal basis
Air carrier	Large enterprise - essential, medium-sized - important	Annex 1, Transport sector, Air transport subsector
Airport managing body	Large enterprise - essential, medium-sized - important	Annex 1, Transport sector, Air transport subsector
Ground handling and security screening at airports - businesses that provide ground handling services to air carriers or perform aviation security screening tasks.	Large enterprise - essential, medium-sized - important	Annex 1, Transport sector, Air transport subsector (Art. 177(2) and Art. 186b(1)(2) of the Aviation Law)
Air navigation service provider	Essential regardless of size	Annex 1, Transport sector, Air transport subsector
Railway infrastructure manager - excludes managers solely of disused or private infrastructure and of narrow-gauge railways.	Large enterprise - essential, medium-sized - important	Annex 1, Transport sector, Rail transport subsector
Licensed railway undertaking or operator of a service facility	Large enterprise - essential, medium-sized - important	Annex 1, Transport sector, Rail transport subsector
Shipowner in maritime transport or inland navigation	Large enterprise - essential, medium-sized - important	Annex 1, Transport sector, Water transport subsector
Managing body of a seaport or port facility	Large enterprise - essential, medium-sized - important	Annex 1, Transport sector, Water transport subsector
Activities supporting maritime transport within a port	Large enterprise - essential, medium-sized - important	Annex 1, Transport sector, Water transport subsector (NACE 52.22)
Vessel traffic service (VTS)	Essential regardless of size	Annex 1, Transport sector, Water transport subsector
Road authority for national roads - the annex lists only this road authority; road carriers (e.g. road haulage) are not included.	Essential regardless of size	Annex 1, Transport sector, Road transport subsector (Art. 19(2)(1) of the Public Roads Act)
Intelligent transport systems (ITS) service provider - e.g. navigation and traffic information, route planning, dispatch and fleet management, shipment tracking. A carrier that only uses such a platform is its user.	Large enterprise - essential, medium-sized - important	Annex 1, Transport sector, Road transport subsector (Art. 4(36) of the Public Roads Act)
Postal operator - entered in the register of postal operators (including courier companies).	Medium-sized and large enterprise - important	Annex 2, Postal services sector

02Authority and incidents

Competent authorities, CSIRT and registration

Competent authorities

air, rail and road transport - the minister responsible for transport,
water transport - the minister responsible for maritime affairs and the minister responsible for inland navigation,
postal services - the President of the Office of Electronic Communications (UKE) (Arts. 41 and 41a).

Transport entities apply for registration themselves, in the S46 system. The deadline for entities that met the criteria on 3 April 2026 passed on 3 October 2026; registration is declaratory, and if you have not yet applied, you should do so without delay.

Incident reporting

A significant incident is reported through S46: an early warning within 24 hours, a notification within 72 hours and a final report within one month (Art. 11(1)(4)-(4c)). Notifications are received by CSIRTs (computer security incident response teams). For transport, water and waste water, the Minister of Infrastructure established CSIRT INFRASTRUKTURA in June 2026; until an announcement of its operational capability is published, significant incidents are reported via S46 to CSIRT NASK, GOV or MON. The Minister has indicated that this announcement will be published by 31 December 2026 (Art. 42(2) and Art. 44(1)-(2) of the amending act; Dz.Urz. MI 2026 items 13 and 27).

Many transport entities will also be identified as critical entities: a critical entity is a critical infrastructure operator entered in the register of critical entities kept by the Director of the Government Centre for Security; the authority informs the operator of the entry within 30 days (Art. 2(11c) of the KSC Act; Art. 3(1a), Art. 6zo(1) and Art. 6zr(3) of the Crisis Management Act).

03Risks

Systems and risks in transport and logistics

Systems

traffic control and dispatch, booking and ticketing systems,
port and airport systems, baggage and cargo handling,
fleet management, telematics, shipment tracking and warehouse management systems,
integrations with customers and public authorities, including the exchange of electronic documents.

Electronic freight transport documents are becoming more important: the eFTI Regulation (Regulation (EU) 2020/1056 on electronic freight transport information) applies from 21 August 2024 (Art. 18(2) of Regulation (EU) 2020/1056). From 9 July 2027, Member State authorities are required to accept information made available electronically by certified eFTI platforms (Art. 5(1) of Regulation (EU) 2020/1056; European Commission).

What to look out for

business continuity - how to keep carrying passengers and goods and handling cargo when systems fail,
suppliers' remote access, and devices in the field (vehicles, terminals, sensors),
the supply chain - a carrier with no statutory obligations of its own is often a critical supplier to an essential entity and receives contractual requirements from it (Art. 8(2)),
passenger apps - websites, apps, e-tickets and travel information in bus, rail, air and waterborne transport are subject to accessibility requirements from 28 June 2025; for bus transport, supervision is carried out by the provincial road transport inspectors (WITD) (Art. 3(2)(3) and Art. 38(3)(4) of the Act of 26 April 2024; Art. 54g of the Road Transport Act).

04Obligations

Obligations and deadlines in transport

An information security management system under Art. 8 - by 3 April 2027.
Incident reporting, documentation, contact persons and annual training for the head of the entity (Art. 8e).
Essential entities: a security audit at least once every 3 years, the first by 3 April 2028. Important entities: an audit only when ordered by the authority.

Fines for essential entities: up to EUR 10 million or 2% of revenue from business activity in the previous financial year, whichever is higher; not less than PLN 20,000 (Art. 73(3)).
Fines for important entities: up to EUR 7 million or 1.4% of revenue from business activity in the previous financial year; not less than PLN 15,000 (Art. 73(4)).
Fines under Art. 73(1)-(4), Arts. 73a-73c and Art. 76b may be imposed for the first time 2 years after the amendment entered into force (according to the Ministry of Digital Affairs - after 3 April 2028). The moratorium does not cover the fine of up to PLN 100 million (Art. 35 of the amending act).

05How we help

Gap analysis, implementation and testing in transport

NIS2 gap analysis - scope assessment (including logistics companies in your group), a review of gaps against Art. 8 and an implementation plan.
NIS2 implementation - policies, incident and business continuity procedures, requirements for suppliers.
Penetration testing - booking systems, customer portals, integration APIs and networks.
Board training - the duties of the head of the entity under Arts. 8c-8e.

We carry out the Art. 15 security audit in cooperation with a partner whose auditors meet the statutory requirements - and we do not audit a company that we helped to implement its security management system in the year before the audit.

We also build software for logistics - integrations of warehouse and transport management systems and mobile apps for drivers: see software for manufacturing and logistics. Our NIS2/KSC checklist lists the questions to check before an audit.

Frequently asked questions

Is a road haulage company subject to NIS2?

As a rule, no. In the road transport subsector, Annex 1 lists only the national road authority and ITS service providers - road hauliers are not included. A haulier may, however, be subject to the Act in another sector (e.g. as a postal operator), and it will in any case feel the effects of the Act through the supply chain: customers that are essential or important entities assess the security of their suppliers (Art. 8(2)).

Is a freight forwarder or a logistics warehouse subject to the KSC Act?

Freight forwarding and warehousing services are not listed in the annexes to the Act. The exceptions are activities that fall within another sector - e.g. wholesale food distribution (food sector), a pharmaceutical wholesaler (health) or making a fleet management and shipment tracking platform available to other companies, which according to the Ministry of Digital Affairs may be an ITS service. Check your status in our NIS2 scope checker.

Is a courier company subject to NIS2?

Postal services are listed in Annex 2. A postal operator - a business entered in the register of postal operators kept by the President of the Office of Electronic Communications (UKE) - is an important entity if it is at least a medium-sized enterprise (Art. 5(2)(2)). Courier companies operating as postal operators are subject to the same rule, and their competent authority is the President of UKE.

Is a fleet management system provider an ITS service provider?

It can be. According to the Ministry of Digital Affairs, typical ITS services include navigation and traffic information, route planning, dispatch and fleet management, and tracking the carriage of passengers or goods using location data; a carrier that only uses such a platform is a user, not a provider (Q&A of 1 October 2026, question 1.36). ITS service providers are listed in Annex 1 - a medium-sized provider is an important entity, a large one an essential entity.

Where do transport entities report incidents?

Through the S46 system - an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. For transport, the Minister of Infrastructure established a sectoral computer security incident response team, CSIRT INFRASTRUKTURA, in June 2026; until an announcement of its operational capability is published, notifications go to a national-level CSIRT (Art. 44 of the amending act).

Sources

Legal status as of 9 October 2026 Updated 9 October 2026

Related services

NIS2/KSC · Gap analysis