Does NIS2 apply to your company in Poland?

Obligations of essential and important entities

• Application for entry in the register of essential and important entities in the S46 system (the Wykaz KSC application) and notification of changes to the data within 14 days (Art. 7c(1), (3) and (6)).
• The Minister of Digital Affairs makes the entry in the register ex officio (including public entities, electronic communications undertakings, trust service providers and critical entities) - the entity completes any missing data when requested (Art. 7a(2), Art. 7b(2)).
• Information security management system: risk assessment, policies, technical and organisational measures (including business continuity, supply chain, monitoring, cryptography, access control and staff training) and incident management (Art. 8(1)).
• Important entities that are public entities apply the requirements of Annex 4 to the Act instead of Art. 8(1) (Art. 8(3)).
• Reporting significant incidents through the S46 system: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month (Art. 11(1)(4)-(4c)).
• Reporting significant incidents through the S46 system - without an early warning and without intermediate, progress or final reports (Art. 12c).
• Security documentation - normative (management system, business continuity, technical documentation) and operational (records, logs) - retained for at least 2 years after it is withdrawn from use (Art. 10).
• The entity designates at least two persons to liaise with the entities of the national cybersecurity system; micro and small enterprises designate at least one (Art. 9(1)-(3)).
• The head of the entity is responsible for performing the obligations, including those entrusted to others, and undergoes documented training once every calendar year (Art. 8c, Art. 8e).
• An essential entity carries out, at its own expense, a security audit of the information system at least once every 3 years, counting from the signing of the report on the last audit (Art. 15(1); copy of the report to the authority within 3 working days - Art. 15(1a)).
• A security audit only when ordered by the authority - after a significant incident or another infringement of the law (Art. 15(1b)).
• The provisions on the information security management system and incident reporting do not apply to essential and important entities in the banking and financial market infrastructure sector (DORA replaces them), but obligations such as registration, contact persons and training for the head of the entity still apply (Art. 8i).
• Ex ante and ex post supervision by the competent authority (Art. 53(3)(1)).
• Ex post supervision by the competent authority, particularly where there are reasonable grounds to suspect an infringement of the law (Art. 53(3)(2)).
• A fine of up to EUR 10 million or 2% of revenue from business activity in the previous financial year, whichever is higher; not less than PLN 20,000 (Art. 73(3)).
• A fine of up to EUR 7 million or 1.4% of revenue from business activity in the previous financial year; not less than PLN 15,000 (Art. 73(4)).

Deadlines

• Entities that met the criteria on 3 April 2026 applied for registration from 7 May to 3 October 2026 - that deadline has passed. Registration is declaratory and the obligations arise from the Act, so you should apply without delay - self-registration is available at all times, and the authority may also enter an entity ex officio. Entities that come within scope later must apply within 6 months from meeting the criteria (Art. 33(3) of the amending act, announcement of the Minister of Digital Affairs (Dz.Urz. MC 2026 item 7); Art. 7c(1), Art. 7d(5), Art. 7j of the KSC Act; Ministry of Digital Affairs, Q&A of 1 October 2026, question 2.32).
• The Minister of Digital Affairs enters these entities in the register ex officio; after being requested to do so, an entity has 6 months to complete any missing data (Art. 7a(2), Art. 7b(2)).
• Obligations under Chapter 3 of the Act (management system, incidents, documentation, contact persons): by 3 April 2027 for entities that met the criteria on 3 April 2026; for others - within 12 months from meeting the criteria (Art. 33(1) of the amending act, Art. 16(1) of the KSC Act).
• First security audit: by 3 April 2028 (entities that were essential on 3 April 2026) or within 24 months from meeting the criteria; then at least once every 3 years (Art. 33(2) of the amending act, Art. 16(2) and Art. 15(1) of the KSC Act).
• After a decision of the authority: 12 months for the obligations under Chapter 3 and 24 months for the first audit of an essential entity - counted from delivery of the decision (Art. 7l(7), Art. 7m(6)).
• Fines under Art. 73(1)-(4), Arts. 73a-73c and Art. 76b may be imposed for the first time 2 years after the amendment entered into force (according to the Ministry of Digital Affairs - after 3 April 2028). The moratorium does not cover the fine of up to PLN 100 million (Art. 35 of the amending act).

Special situations

• Digital providers (including cloud computing, data centre and DNS service providers, managed service providers and managed security service providers) apply the measures set out in Commission Implementing Regulation (EU) 2024/2690 (Art. 8b(1)).
• An important entity that is a public entity designates at least one contact person, and the fine for the head of a public entity is up to 100% of their remuneration (Art. 9(3), Art. 73a(5)).
• If the organisation is a municipal company or a local government budgetary unit or establishment, also check the “Local government budgetary units, cultural institutions and municipal companies” option - performing public tasks using information systems gives it the status of an important entity (Art. 5(2)(8)).
• Essential and important entities assess the security of their suppliers of ICT products and services - so customers covered by the Act may impose security requirements on you in their contracts (Art. 8(1)(2)(e) and Art. 8(2)).
• The authority may also, by decision, recognise as essential or important an entity listed in an annex that does not meet the thresholds - e.g. where it is the sole provider of an essential service or its service is of significant regional (voivodeship) or national importance (Art. 7l(1)).
• A critical entity is an essential entity regardless of size. A critical entity is a critical infrastructure operator entered in the register of critical entities kept by the Director of the Government Centre for Security; the authority informs the operator of the entry within 30 days. The authorities carry out the first identification of critical entities and their entry in the register within 9 months of the entry into force of the Act of 29 May 2026 (4 July 2026), i.e. by 4 April 2027 (Art. 5(1)(4)(c); Art. 2(11c) of the KSC Act; Art. 3(1a), Art. 6zo(1) and Art. 6zr(3) of the Crisis Management Act; Art. 34 of the Act of 29 May 2026 (Dz.U. 2026 item 815)).