Poland's registration window for its NIS2 regime closed on 3 October. Companies that assumed someone would write to them have had the duty backwards all year.
The amending act, ustawa z dnia 23 stycznia 2026 r. amending the Act on the National Cybersecurity System, was published as Dz.U. 2026 poz. 252 and entered into force on 3 April 2026. The Polish regime applies automatically to any entity meeting the criteria in Annexes 1 and 2. No authority designates you. The duty to assess your own position started on 3 April 2026, and the self-registration window ran from 7 May to 3 October 2026 through wykaz-ksc.gov.pl, with sign-in via login.gov.pl.
If you met the criteria and did not register, the answer is to register now rather than wait to be told. An entity that came into scope after 3 April 2026 has six months from the day it met the criteria, which gives a rolling deadline rather than a fixed one.
Who counts as an important entity. Annex 2 sectors at the size thresholds taken from Regulation (EU) 651/2014, which is the standard EU SME definition. Key entities are a different and partly lower bar: Annex 1 sectors at medium or large size, plus named providers regardless of size, including DNS service providers, top-level domain registries, qualified trust service providers and nuclear operators. Managed security service providers are key entities from small size upwards, a materially lower threshold than anything else in the act. Electronic communications undertakings come in from medium size. A Kraków managed service provider of thirty people may sit in a heavier category than a food manufacturer of two hundred.
The next date is 3 April 2027, and it is the substantive one. By then essential and important entities must have an information security management system in place, security policies, supply-chain risk management, incident reporting arrangements, named responsible persons, and a connection to the national S46 system. Key entities face a first security audit by 3 April 2028, then at least once every three years.
Incident reporting runs on the NIS2 clock: early warning within 24 hours, initial assessment within 72 hours, final report with root cause analysis within one month. Reports route through CSIRT NASK in the general case, with CSIRT GOV for government and CSIRT MON for defence. Sectoral CSIRTs are to be established by 3 October 2027.
There is no single regulator, which is the detail that most often sends companies to the wrong office. Supervision is sector-specific: the Minister for Digital Affairs for digital infrastructure, digital providers, ICT services and public administration; the President of UKE for electronic communications and postal services; the Minister for Economy for chemicals, manufacturing and space.
Penalties reach EUR 10 million or 2 per cent of revenue for key entities, with a floor of PLN 20,000, and EUR 7 million or 1.4 per cent for important entities, with a floor of PLN 15,000. An extraordinary penalty of up to PLN 100 million is available where national security is threatened. The head of the entity can be fined personally, up to 300 per cent of remuneration in the private sector. Most fines are deferred until 3 April 2028. The extraordinary penalty is available immediately.
A Polish exporter selling into Germany and Ireland now has three jurisdictions reading the same directive differently, and only one of them has already closed a register.
Questions on the Polish cybersecurity register
The register closed on 3 October 2026. What do we do if we missed it?
If you met the criteria and did not register, the answer is to register now rather than wait to be told.
Does an authority tell us we are in scope?
No. The Polish regime applies automatically to any entity meeting the criteria in Annexes 1 and 2. No authority designates you.
Which law is this and when did it enter into force?
The amending act, ustawa z dnia 23 stycznia 2026 r. amending the Act on the National Cybersecurity System, was published as Dz.U. 2026 poz. 252 and entered into force on 3 April 2026.
When did the duty to assess our own position start?
On 3 April 2026.
Where does registration happen?
The self-registration window ran from 7 May to 3 October 2026 through wykaz-ksc.gov.pl, with sign-in via login.gov.pl.
We came into scope after 3 April 2026. What is our deadline?
An entity that came into scope after 3 April 2026 has six months from the day it met the criteria, which gives a rolling deadline rather than a fixed one.
Who counts as an important entity?
Annex 2 sectors at the size thresholds taken from Regulation (EU) 651/2014, which is the standard EU SME definition.
Who counts as a key entity?
Annex 1 sectors at medium or large size, plus named providers regardless of size, including DNS service providers, top-level domain registries, qualified trust service providers and nuclear operators.
Are managed security service providers caught at small size?
Yes. Managed security service providers are key entities from small size upwards, a materially lower threshold than anything else in the act. Electronic communications undertakings come in from medium size.
We are a thirty-person managed service provider. Are we in a heavier category than a larger manufacturer?
A Kraków managed service provider of thirty people may sit in a heavier category than a food manufacturer of two hundred.
What has to be in place by 3 April 2027?
Essential and important entities must have an information security management system in place, security policies, supply-chain risk management, incident reporting arrangements, named responsible persons, and a connection to the national S46 system.
When is the first security audit?
Key entities face a first security audit by 3 April 2028, then at least once every three years.
What are the incident reporting deadlines?
Early warning within 24 hours, initial assessment within 72 hours, final report with root cause analysis within one month.
Who do we report an incident to?
Reports route through CSIRT NASK in the general case, with CSIRT GOV for government and CSIRT MON for defence.
When are sectoral CSIRTs due?
Sectoral CSIRTs are to be established by 3 October 2027.
Which regulator supervises us?
There is no single regulator. Supervision is sector-specific: the Minister for Digital Affairs for digital infrastructure, digital providers, ICT services and public administration; the President of UKE for electronic communications and postal services; the Minister for Economy for chemicals, manufacturing and space.
What are the penalties?
Penalties reach EUR 10 million or 2 per cent of revenue for key entities, with a floor of PLN 20,000, and EUR 7 million or 1.4 per cent for important entities, with a floor of PLN 15,000. An extraordinary penalty of up to PLN 100 million is available where national security is threatened.
Can the head of the company be fined personally?
Yes. The head of the entity can be fined personally, up to 300 per cent of remuneration in the private sector.
When do the fines start?
Most fines are deferred until 3 April 2028. The extraordinary penalty is available immediately.
More from ComplianceSME
- A machine fired the drivers. The bill is 824,990,000 euro.
- Europe Blamed the AI Act. The Delays Were Data Protection Law.
- The Two Rulebooks, the One Person, and the Answer That Is Already Out of Date
- The 24 hour clock that starts on 11 September
- The leaders who called compliance too complicated, and what the work costs
- ComplianceSME Completes the Free Business Compliance Libraries of All Twenty-Eight Nations
- The Digital Omnibus deferral: what moved, what did not, and what applies now
- Italy's NIS2 basic measures, and what has to be working by 31 October
- Platform work's deadline is 2 December, and the rules reach past the couriers
- Software becomes a product on 9 December, and the liability follows it
- The AI Act did not pause, and two prohibitions start on 2 December
- Every verified deadline between now and the end of December
- Pay gap reporting arrives before the software does
- Six questions Irish companies keep asking, answered with the section that settles each