Anmärkning om datumet: 6 months from the amended KSC's entry into force on 2026-04-03; this deadline was extended from an originally proposed 3 months during the Sejm's second reading. Entities that qualify later must still register within 6 months of first meeting the criteria - an ongoing rule, not only a one-off deadline for this initial batch.
Entities newly brought into scope as 'key' or 'important' by Poland's amended Cybersecurity Act (KSC), implementing NIS2, must submit a registration application to the competent authority within 6 months of the Act's entry into force.
Medium and large companies in NIS2 sectors that are or become in scope of the amended KSC, plus smaller entities designated as critical or sole providers of a service.
Storlekar: medelstort företag, stort företag · Branscher: Energi, Transport / logistik, Finans / försäkring, Hälso- och sjukvård, Programvara / SaaS, Tillverkning, Jordbruk / livsmedel, Konsult- och tjänsteföretag · Gäller om: Vi är verksamma i en kritisk sektor (NIS2); Vi är beroende av molntjänster
Determine whether your organisation meets the key/important entity criteria under the amended KSC. If you qualify from the Act's entry into force, submit your registration application by 3 October 2026; if you qualify later, register within 6 months of first meeting the criteria. Begin preparing risk-management measures and incident-reporting workflows in parallel, ahead of the 3 April 2027 implementation deadline.
Administrative fines apply under the Act, first enforceable from 3 April 2028 (2 years after entry into force).
Senast verifierad 8 september 2026. Endast information, inte juridisk rådgivning.
Medium and large entities in NIS2 sectors (energy, transport, finance, health, digital infrastructure/software, manufacturing, food/agri, and others designated by the Act), plus smaller entities the authorities designate as critical or sole providers of a service.