NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. Poland implements it through the National Cybersecurity System Act (KSC), as amended on 23 January 2026 (Journal of Laws of 2026, item 252). The new rules apply from 3 April 2026, and most organizations in scope must meet the full obligations by 3 April 2027. Legal status as of 30 September 2026.
TL;DR - Key takeaways
- Who Does NIS2 Apply To?
- What a Company in Scope Must Do
- Incident Reporting
- Penalties and Management Accountability
1. Who Does NIS2 Apply To?
NIS2 significantly broadens the range of entities compared to the first NIS directive. The new categories include, among others, food producers, courier companies, the space sector, public administration, and ICT service providers.
Entities fall into two categories: "essential entities" and "important entities." Their obligations are largely the same. The two categories differ in supervision, audits and the level of fines.
An essential entity is subject to preventive supervision, so the authority can inspect it without any sign of an infringement. Supervision of an important entity is ex post: it is triggered only by a significant incident or a sign of an infringement.
An essential entity carries out a security audit at least once every 3 years, the first by 3 April 2028. An important entity carries one out only on the basis of a decision by the authority (Art. 15 of the KSC Act).
Heads-Up
If your company employs at least 50 people, or has both an annual turnover and a balance sheet total above EUR 10 million (counting linked enterprises), and operates in one of the sectors listed in the annexes to the KSC Act, it is probably in scope. Some entities are covered regardless of size. Check this as soon as possible.
2. What a Company in Scope Must Do
The KSC Act lists the measures but does not prescribe ready-made configurations. How strong the safeguards must be is decided by the risk assessment. The main obligations:
- An application for entry in the register of essential and important entities. For companies in scope since 3 April 2026, the deadline passed on 3 October 2026.
- Risk analysis and an information-systems security policy.
- Incident management — detection, response, reporting.
- Business continuity — backups, disaster recovery, crisis management.
- Supply-chain security — assessment of suppliers and partners.
- Assessment of how effective the safeguards are, and a security audit (at least once every 3 years for an essential entity).
- Cybersecurity training for management and staff.
3. Incident Reporting
For a significant incident, you send the competent CSIRT an early warning within 24 hours of detection and an incident notification within 72 hours of detection. You submit the final report within one month of the notification (Art. 11(1)(4), (4a) and (4c) of the KSC Act).
This means an organization must have an incident-response process in place with clearly defined roles, escalation procedures, and communication channels with the relevant CSIRT.
You submit reports through the S46 system. Until sectoral CSIRTs are set up, they go to CSIRT MON, CSIRT NASK or CSIRT GOV.
4. Penalties and Management Accountability
NIS2 introduces personal accountability for management in implementing cybersecurity measures. This is a landmark change — leadership can no longer delegate responsibility "down" the organization.
An essential entity faces a fine from PLN 20,000 up to EUR 10 million or 2% of revenue, and an important entity from PLN 15,000 up to EUR 7 million or 1.4% of revenue. Whichever amount is higher applies (Art. 73 of the KSC Act).
The authority can impose fines from 3 April 2028. The postponement applies only to fines: supervision, inspections and orders already apply today.
PWNONE Recommendation
Start with a gap analysis — compare your current security posture against the NIS2 requirements. This lets you estimate the budget and time needed to comply. Our team can run such an analysis in 2–3 weeks.
Summary
From 3 April 2027, most companies covered by the KSC Act must have a working information security management system (ISMS), an incident-handling procedure and an S46 account. From 3 April 2028, the authority can impose fines. If you have not yet applied for entry in the register, do it now and plan the rest of the work around the deadlines in the Act.