NIS2 in Poland: KSC registration and what to do next

Does NIS2 apply to every medium-sized or large business in Poland?

No. Size is only one part of the test. The business must also match a type of entity listed in Annex 1 or Annex 2 to the KSC Act, or fall within a special category identified directly in Article 5.

Essential sectors include energy, transport, banking and financial-market infrastructure, healthcare, drinking water, wastewater, digital infrastructure, electronic communications and ICT service management. Important sectors include postal services, waste management, the manufacture or distribution of chemicals and food, selected manufacturing activities, digital providers and research organisations.

In a typical case, the business must reach at least the relevant medium-enterprise threshold. The assessment should not, however, stop at the headcount of one Polish company. EU rules on partner and linked enterprises may require group data to be taken into account. The KSC Act also contains specific rules relating to independent information systems and services jointly supplied within a group.

Some entities are covered regardless of size or under different thresholds. Examples include DNS providers, qualified trust-service providers, top-level domain registries, domain-name registration service providers and certain electronic-communications or managed cybersecurity service providers. “We have fewer than 250 employees” is therefore not a complete analysis.

How should a business perform its scope assessment?

The first step is to map the services the entity actually provides, rather than relying only on Polish business-activity codes or a product’s marketing description. Those services should then be matched against the entity types in the KSC annexes and any sector-specific conditions.

The second step is the size analysis under the relevant EU rules, including ownership and control relationships. Only after combining the sector and size tests can the business determine whether it is an essential entity, an important entity or outside the statutory scope.

Who must enter the KSC Register and by when?

The minister responsible for digital affairs enters certain entities automatically, including specified public bodies, telecommunications undertakings, trust-service providers and critical entities. Other essential and important entities must apply themselves.

In its announcement of 28 September 2026, Poland’s Ministry of Digital Affairs identified 3 October 2026 as the self-registration deadline for entities that met the statutory criteria on 3 April 2026 and are not entered automatically. Applications are submitted electronically through the KSC Register. Each case requires confirmation of the applicable deadline and whether the application was properly signed and successfully submitted.

If the company first met the criteria later, its deadline must be determined separately; the general period is six months from that date. Changes to registered information also require updates. Do not assume that all companies share the same deadline or that the absence of correspondence from an authority removes the need to act.

What if the company’s status or filing is still unclear?

First establish whether the company is covered by the KSC Act and whether registration is automatic or requires an application. If an application has been sent, check its status and keep the confirmation. Preparing a form or passing information to an employee does not establish that a filing was made.

If compliance is uncertain, address it promptly. Check the company’s classification, when the duty arose and the filing records, then determine the necessary action. Whether a deadline was met depends on the particular case; this article does not conclude that every company without an entry is already late.

At the same time, agree the remaining implementation work with the people responsible for IT, security and management. Registration does not replace the procedures, documentation and agreements required for the other duties.

What information is needed for registration?

The filing goes beyond ordinary corporate particulars. It includes the sector and entity type, addresses, Polish tax and statistical numbers, continuously used public IP ranges and domains, contact persons, a size declaration, other EU Member States in which the entity operates and information about any managed cybersecurity service provider engaged for statutory tasks.

Legal, IT, security and finance teams should reconcile the information before filing. A mistaken sector classification, incomplete domain list or unsuitable contact person may make subsequent communication and S46 onboarding more difficult.

What must the business implement after registration?

Entities that met the criteria when the amendment entered into force have a separate transitional period for implementing the duties in Chapter 3 of the KSC Act. The Ministry identifies 3 April 2027 for this group. This is a separate stage from registration. Implementation work should not be left until the end of that period.

An essential or important entity must implement an information security management system for the information systems used in processes affecting the covered service. The system must address risk assessment, supplier security, business continuity, monitoring, incident management, cyber hygiene, access control, cryptography, updates and staff awareness.

The business also needs normative and operational documentation, designated contact persons, an incident handling and reporting process, S46 access and either an internal cybersecurity structure or an agreement with a managed cybersecurity service provider. Outsourcing may support delivery but does not replace the entity’s oversight of scope, reporting or access to information.

Supplier contracts should deal with reaction times, incident and vulnerability information, audit rights, subcontracting, continuity and support with regulatory reporting. A general statement that a supplier is “NIS2 compliant” does not establish those mechanisms. The supplier-review logic is comparable to the approach described in the article on data processing agreements, although the KSC Act and GDPR impose separate duties.

What is management responsible for?

The head of the entity is responsible for compliance with the cybersecurity duties. If the management function is performed by a collective body and no responsible person has been identified, all members are accountable. The Act expressly provides that delegating tasks to another person does not remove that responsibility.

Management must make decisions on the information security system, allocate sufficient funding, assign and supervise tasks and ensure staff awareness. The head of the entity and any person entrusted with the head’s cybersecurity duties must complete documented training every calendar year.

This makes implementation a governance project, not merely the purchase of an IT tool. Management should receive regular reporting on risk, implementation progress, incidents, supplier dependencies and budget gaps.