NIS2 and Poland's new KSC Act in a mid-sized company: are you covered and what to do first

The amendment to the Polish Act on the National Cybersecurity System (ustawa o krajowym systemie cyberbezpieczeństwa, KSC), which transposes the EU NIS2 Directive into Polish law, was published in the Journal of Laws on 2 March 2026 (Dz.U. 2026 item 252) and has applied since 3 April 2026. The most important change for mid-sized companies operating in Poland: it is no longer a public authority that decides whether the rules cover you. The company assesses its own status and registers itself on the list.

The first deadline has already passed. Companies that met the conditions on the day the Act entered into force had until 3 October 2026 to apply for registration. If your company is covered by the Act and has not submitted an application, it is worth doing so as soon as possible.

Key dates

Is your company covered by the Act: three questions

1. Do you operate in one of the sectors listed in the annexes to the Act? Annex 1 (essential sectors) covers, among others, energy, transport, banking, healthcare, including the manufacture of medicines and medical devices, drinking water, waste water, digital infrastructure and ICT service management. Annex 2 (important sectors) covers, among others, postal services, waste management, chemicals, food, the manufacture of medical devices, electronics, electrical equipment, machinery and vehicles, digital service providers and scientific research.

This matters for manufacturing companies: a plant that makes machinery, electrical equipment or food may be covered by the Act, even though it is not associated with cybersecurity.

2. Are you at least a medium-sized enterprise? The Act refers to the EU definition of SMEs. Put simply, a medium-sized enterprise starts at 50 employees or at over EUR 10 million in turnover and balance sheet total, and a large one at 250 employees or at over EUR 50 million in turnover and EUR 43 million in balance sheet total. The precise counting rules, including those for links with other companies, are worth checking with your accountants.

3. Do you belong to the exceptions that are covered regardless of size? These include, among others, DNS service providers, domain name registries, trust service providers, critical entities and certain public entities. Managed cybersecurity service providers are essential entities from the small enterprise threshold upwards.

The result: essential or important entity

The difference matters in practice. An essential entity must undergo an audit at least once every three years. An important entity is audited only when the authority orders it, for example after a serious incident.

What to do first

Below is the order I follow when putting the organisational side of information security in order. It concerns processes, roles and documents, not technical safeguards, which should be assessed by an IT specialist.

• Establish your status and apply for registration. Answer the three questions above and write down your reasoning. If the company is covered by the Act, submit the application via the S46 system. The application is signed by the head of the entity, and failure to apply is subject to a penalty.
• Assign responsibility within management. The head of the entity is responsible for fulfilling the obligations, even when the tasks are delegated to someone else. The head and that person must undergo training at least once per calendar year.
• Make a list of the processes and systems the company depends on. Without it, risk cannot be assessed reliably. A process map showing which systems and data are used at each step works well here.
• Assess risk and plan measures. The Act requires systematic risk assessment and risk management, including business continuity plans, asset management and employee training.
• Prepare incident handling. A serious incident must be reported to the competent CSIRT team: an early warning within 24 hours, a notification within 72 hours and a final report within a month. This requires defined roles and a decision path before an incident happens.
• Review your suppliers. Supply chain security is part of the obligations, so it is worth knowing which suppliers have access to your systems and data.

There is time until 3 April 2027 to implement the obligations. A year seems long, but risk assessment, procedures and training in a mid-sized company usually take several months.

Penalties and the liability of the head of the entity

An essential entity faces a fine of up to EUR 10 million or 2% of annual revenue, whichever is higher. An important entity faces a fine of up to EUR 7 million or 1.4% of revenue. The head of the entity can be fined separately, up to 300% of their remuneration. Most penalties can be imposed from 3 April 2028. The exception is a fine of up to PLN 100 million for breaches that create a serious threat, for example to national security or to life and health.

What about ISO/IEC 27001?

An ISO/IEC 27001 certificate does not exempt you from the statutory obligations or from the audit. An information security management system built to this standard does, however, make meeting the requirements of the Act much easier, because it rests on the same logic: risk, roles, safeguards and improvement. If the company is considering certification anyway, it is worth combining the two projects.

Myths worth setting aside

• The Act has applied since January 2026. 23 January is the date it was passed by the Sejm. The Act has applied since 3 April 2026.
• Every important entity has a regular audit. The audit every three years applies to essential entities. An important entity is audited when the authority requires it.
• Penalties apply from day one. Most penalties can be imposed from 3 April 2028, although this time is better spent on implementation than on waiting.
• An ISO/IEC 27001 certificate means compliance with the Act. The Act makes no such provision. The standard helps, but it does not replace the obligations.

How we can help

We prepare the organisational side of readiness: defining the scope, a map of processes and systems, roles and management responsibility, risk assessment, an incident handling procedure and business continuity. We do not replace legal advice or technical testing, and for those elements we work with specialists. More on the ISO Systems page.

Frequently asked questions

Who does NIS2 apply to in Poland?

The amended KSC Act covers at least medium-sized enterprises, that is from 50 employees or above EUR 10 million in turnover and balance sheet total, operating in the sectors listed in the annexes to the Act, including energy, transport, healthcare, and the manufacture of machinery, electrical equipment, food and chemicals. Some entities are covered regardless of size.

Since when does the new KSC Act apply?

Since 3 April 2026. Information security management obligations must be implemented by 3 April 2027, and the first audit of an essential entity carried out by 3 April 2028.

What are the penalties under the KSC Act?

An essential entity faces a fine of up to EUR 10 million or 2% of annual revenue, an important entity up to EUR 7 million or 1.4% of revenue, and the head of the entity a personal fine of up to 300% of their salary. Most fines can be imposed from 3 April 2028.

Sources: the Act of 23 January 2026 amending the Act on the National Cybersecurity System and certain other acts (Dz.U. 2026 item 252), announcements by the Polish Ministry of Digital Affairs. Status as at October 2026. This article is for information only and does not constitute legal advice. The status of a specific company should be confirmed with a lawyer.