Date note: 6 months from the amended KSC's entry into force on 2026-04-03; this deadline was extended from an originally proposed 3 months during the Sejm's second reading. Entities that qualify later must still register within 6 months of first meeting the criteria - an ongoing rule, not only a one-off deadline for this initial batch.
Entities newly brought into scope as 'key' or 'important' by Poland's amended Cybersecurity Act (KSC), implementing NIS2, must submit a registration application to the competent authority within 6 months of the Act's entry into force.
Medium and large companies in NIS2 sectors that are or become in scope of the amended KSC, plus smaller entities designated as critical or sole providers of a service.
Sizes: medium, large · Sectors: Energy, Transport / logistics, Finance / insurance, Health, Software / SaaS, Manufacturing, Agriculture / food, Professional services · Applies if: We operate in a critical sector (NIS2); We rely on cloud services
Determine whether your organisation meets the key/important entity criteria under the amended KSC. If you qualify from the Act's entry into force, submit your registration application by 3 October 2026; if you qualify later, register within 6 months of first meeting the criteria. Begin preparing risk-management measures and incident-reporting workflows in parallel, ahead of the 3 April 2027 implementation deadline.
Administrative fines apply under the Act, first enforceable from 3 April 2028 (2 years after entry into force).
Last verified 8 September 2026. Informational only, not legal advice.
Medium and large entities in NIS2 sectors (energy, transport, finance, health, digital infrastructure/software, manufacturing, food/agri, and others designated by the Act), plus smaller entities the authorities designate as critical or sole providers of a service.