Poland NIS2: after the KSC register deadline, obligations apply from 3 April 2027
Poland's amended KSC Act has applied since 3 April 2026. The register deadline passed on 3 October 2026; the obligations apply from 3 April 2027.
Poland transposed NIS2 by amending its Act on the national cybersecurity system (KSC). The amending Act of 23 January 2026 was published in the Journal of Laws on 2 March 2026 (Dz.U. 2026 poz. 252) and, according to the Ministry of Digital Affairs, has applied since 3 April 2026. The first deadline, registration, passed on 3 October 2026. The next one is 3 April 2027.
Who is covered
The Act applies to key and important entities in the sectors listed in its annexes. Each organisation has to check for itself whether it meets the criteria, in particular Article 5 and Annexes 1 and 2. Public entities, telecoms operators, trust service providers and former operators of essential services are entered in the register (Wykaz KSC) ex officio. All others had to apply for entry through the Wykaz KSC application by 3 October 2026.
Key dates
- 3 October 2026: application for entry in the KSC register (passed).
- 3 April 2027: connection to the S46 system, and the obligations of chapter 3 of the Act apply, including incident handling and reporting to the CSIRTs, an information security management system (SZBI) and contact persons.
- 3 April 2028: first mandatory cybersecurity audit for key entities that were not operators of essential services, then at least every three years.
These dates apply to entities that met the criteria on 3 April 2026.
Reporting and fines
A serious incident needs an early warning within 24 hours of detection, a notification within 72 hours and a final report within one month of the notification. Fines reach EUR 10 million or 2% of revenue, whichever is higher, for key entities, and EUR 7 million or 1.4% of revenue for important entities. For most obligations, the Ministry notes that fines can only be imposed after 3 April 2028.
What to do now
If you are covered and have not applied for entry, do it now. Then use the five months to 3 April 2027 to set up the information security management system, the measures and the incident procedure.
Dazr Compliance turns the NIS2 measures of Article 21 into recurring tasks with owners and evidence, includes ISO 27001 for the management system, and its incident register counts down the 24-hour, 72-hour and one-month milestones. The interface is available in Polish.
Sources
- Dziennik Ustaw 2026 poz. 252: Act of 23 January 2026 amending the Act on the national cybersecurity system
- Ministry of Digital Affairs: the amended KSC Act starts to apply (3 April 2026)
- Ministry of Digital Affairs: obligations of key and important entities
- Samorzad.gov.pl: one month left for self-registration in the KSC register (3 September 2026)
For information only, not legal advice. Last updated 7 November 2026.
Also available in: Polski