Hinweis zum Datum: 6 months from the amended KSC's entry into force on 2026-04-03; this deadline was extended from an originally proposed 3 months during the Sejm's second reading. Entities that qualify later must still register within 6 months of first meeting the criteria - an ongoing rule, not only a one-off deadline for this initial batch.
Entities newly brought into scope as 'key' or 'important' by Poland's amended Cybersecurity Act (KSC), implementing NIS2, must submit a registration application to the competent authority within 6 months of the Act's entry into force.
Medium and large companies in NIS2 sectors that are or become in scope of the amended KSC, plus smaller entities designated as critical or sole providers of a service.
Größen: mittel, groß · Branchen: Energie, Transport / Logistik, Finanzen / Versicherungen, Gesundheit, Software / SaaS, Produzierendes Gewerbe, Landwirtschaft / Lebensmittel, Freiberufliche Dienstleistungen · Gilt, wenn: Wir sind in einem kritischen Sektor tätig (NIS2); Wir nutzen Cloud-Dienste
Determine whether your organisation meets the key/important entity criteria under the amended KSC. If you qualify from the Act's entry into force, submit your registration application by 3 October 2026; if you qualify later, register within 6 months of first meeting the criteria. Begin preparing risk-management measures and incident-reporting workflows in parallel, ahead of the 3 April 2027 implementation deadline.
Administrative fines apply under the Act, first enforceable from 3 April 2028 (2 years after entry into force).
Zuletzt geprüft am 8. September 2026. Nur zur Information, keine Rechtsberatung.
Medium and large entities in NIS2 sectors (energy, transport, finance, health, digital infrastructure/software, manufacturing, food/agri, and others designated by the Act), plus smaller entities the authorities designate as critical or sole providers of a service.