Note sur la date : 6 months from the amended KSC's entry into force on 2026-04-03; this deadline was extended from an originally proposed 3 months during the Sejm's second reading. Entities that qualify later must still register within 6 months of first meeting the criteria - an ongoing rule, not only a one-off deadline for this initial batch.
Entities newly brought into scope as 'key' or 'important' by Poland's amended Cybersecurity Act (KSC), implementing NIS2, must submit a registration application to the competent authority within 6 months of the Act's entry into force.
Medium and large companies in NIS2 sectors that are or become in scope of the amended KSC, plus smaller entities designated as critical or sole providers of a service.
Tailles : moyenne, grande · Secteurs : Énergie, Transport / logistique, Finance / assurance, Santé, Logiciels / SaaS, Industrie manufacturière, Agriculture / agroalimentaire, Services professionnels · S'applique si : Nous opérons dans un secteur critique (NIS2); Nous dépendons de services cloud
Determine whether your organisation meets the key/important entity criteria under the amended KSC. If you qualify from the Act's entry into force, submit your registration application by 3 October 2026; if you qualify later, register within 6 months of first meeting the criteria. Begin preparing risk-management measures and incident-reporting workflows in parallel, ahead of the 3 April 2027 implementation deadline.
Administrative fines apply under the Act, first enforceable from 3 April 2028 (2 years after entry into force).
Dernière vérification le 8 septembre 2026. À titre informatif uniquement, ne constitue pas un conseil juridique.
Medium and large entities in NIS2 sectors (energy, transport, finance, health, digital infrastructure/software, manufacturing, food/agri, and others designated by the Act), plus smaller entities the authorities designate as critical or sole providers of a service.