NIS2 in Poland: Who Is Covered by the New KSC Act

NIS2 is the EU cybersecurity framework established by Directive (EU) 2022/2555, requiring Member States to impose risk-management, incident-reporting and governance obligations on entities operating in critical and digitally important sectors.[1] In Poland, these requirements are to be implemented primarily through an amendment to the Act of 5 July 2018 on the National Cybersecurity System, commonly referred to as the KSC Act.[2]

For businesses, the key issue is not whether they are technology companies. NIS2 may apply to entities in energy, manufacturing, transport, healthcare, digital services, public administration, waste management, food production and other sectors identified in the Directive. The Polish implementing rules determine the final national classification, registration process and enforcement mechanisms.

KSC Act amendment: what is the legal position?

The NIS2 Directive was required to be transposed by 17 October 2024. Poland did not complete implementation by that deadline. The current legal position must therefore be assessed against the wording of the legislation in force, including any transitional provisions and implementing regulations.

Nevertheless, the Directive already provides a reliable framework for identifying businesses likely to fall within scope. Companies should not wait for the final Polish registration process before reviewing their cybersecurity governance, contracts with IT providers, incident-response procedures and management oversight.

The Polish rules may contain national choices regarding sector definitions, supervisory authorities, registration deadlines and penalties. A business operating in Poland should therefore verify its anticipated scope under the Directive and its status under the KSC Act as amended.

Essential and important entities in Poland: the main scope test

NIS2 generally covers public and private entities operating in sectors listed in Annex I and Annex II to the Directive, provided that they qualify as medium-sized enterprises or exceed that threshold. In practice, this usually means an entity that employs at least 50 persons or has an annual turnover or annual balance-sheet total exceeding EUR 10 million.[1]

However, certain entities fall within NIS2 regardless of size. These include providers of public electronic communications networks or publicly available electronic communications services, DNS service providers, top-level domain name registries and qualified trust service providers. Member States may also identify certain additional entities as essential entities regardless of size in the circumstances set out in the Directive.[1]

The Directive distinguishes between essential entities and important entities. This distinction matters because essential entities may be subject to proactive supervision, while important entities are generally supervised after evidence of non-compliance or an incident.

Entities likely to be classified as essential

Essential entities include medium-sized and large organisations operating in highly critical sectors listed in Annex I, including:

• energy, transport, banking and financial market infrastructure;
• healthcare, drinking water and wastewater;
• digital infrastructure, including cloud-computing, data-centre, managed service and managed security service providers;
• ICT service management for business-to-business providers;
• public administration at central-government level; and
• space-sector entities.

Providers of public electronic communications networks or publicly available electronic communications services, DNS service providers, top-level domain name registries and qualified trust service providers may fall within the essential category regardless of size. The final classification in Poland may depend on the entity’s activities, group structure, licences and the detailed provisions of the amended KSC Act.

Entities likely to be classified as important

Important entities generally include medium-sized and large businesses from Annex II sectors. These include postal and courier services, waste management, manufacturing of specified critical products, chemicals, food production, specified digital providers, research organisations and certain manufacturers of healthcare-related products.

Manufacturing is particularly relevant for international investors. NIS2 may cover manufacturers of medical devices, computer and electronic products, electrical equipment, machinery, motor vehicles and other transport equipment. A company may be covered even where cybersecurity is not its core commercial activity.

Institutional and activity-based exclusions from NIS2 scope

The Directive does not apply to Member States’ parliaments or central banks.[1] These institutional exclusions should not be interpreted broadly to exempt commercial entities working with such institutions.

In addition, NIS2 does not apply to public-administration entities carrying out activities in the areas of national security, public security, defence or law enforcement, including the prevention, investigation, detection and prosecution of criminal offences. Whether an activity falls within those exclusions depends on its actual function, not merely on the identity of a shareholder, customer or contracting authority. A private supplier to the public sector is not automatically excluded.

NIS2 registration deadline and incident reporting to CSIRTs in Poland

The Directive required Member States to establish a list of essential and important entities by 17 April 2025.[1] It does not, however, set one universal deadline by which all businesses must submit registration information. The relevant deadline and procedure result from the Polish implementing legislation and may differ depending on the entity category. Businesses that may be covered should prepare data required for registration, including corporate details, sector information, key services, contact persons and relevant digital infrastructure.

For significant incidents, NIS2 establishes a strict reporting model. An entity must submit an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report no later than one month after submitting the incident notification.[1] Where incident handling is ongoing, the entity must instead provide a progress report and submit the final report within one month after the handling of the incident. The Polish regime determines the precise reporting channel and competent authority.

Under the existing KSC framework, Poland’s national CSIRT system includes CSIRT NASK, CSIRT GOV and CSIRT MON.[2] The correct incident-reporting route depends on the entity type, the incident and the final statutory allocation of supervisory responsibilities.

Cybersecurity obligations and management board liability

Article 21 of NIS2 requires covered entities to implement proportionate technical, operational and organisational cybersecurity measures. These measures include risk analysis, incident handling, business continuity, supply-chain security, vulnerability management, access control, encryption where appropriate, staff training and assessment of cybersecurity effectiveness.[1]

Article 20 requires management bodies to approve and oversee cybersecurity risk-management measures and to follow training that enables them to identify cybersecurity risks.[1] This is a governance obligation, not merely an IT department task.

Cybersecurity obligations and management board liability must be assessed carefully under Polish corporate and civil law. NIS2 requires Member States to ensure that management bodies can be held liable for infringements by the entities they manage, in accordance with national law. It does not automatically create personal criminal liability for every board member after an incident. Exposure may arise where management failures breach statutory duties, cause damage, obstruct regulatory action or overlap with offences defined in Polish criminal law. The assessment is always fact-dependent.

NIS2 fines in Poland and business consequences

Under Article 34 of NIS2, Member States must provide for administrative fines of up to at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and up to at least EUR 7 million or 1.4% of worldwide annual turnover for important entities, whichever amount is higher.[1] The final NIS2 fines in Poland depend on the enacted KSC amendment.

Financial penalties are only one risk. A cybersecurity failure may disrupt operations, trigger contractual claims, expose confidential data, delay transactions and damage a company’s reputation. Early scope analysis is therefore a practical compliance and continuity measure.

This is informational material, not legal advice. For a tailored assessment of NIS2 exposure, corporate governance and KSC Act obligations, contact Lawyersinpoland.com by Kopeć & Zaborowski.

FAQ – NIS2 in Poland

Does NIS2 apply only to IT companies in Poland?

No. NIS2 covers a broad range of critical and important sectors, including energy, healthcare, transport, manufacturing, food, waste management and specified digital services.

When will the KSC Act amendment enter into force?

The effective date depends on the enacted Polish legislation and its transitional provisions. Businesses should monitor the text published in the Journal of Laws rather than rely solely on draft timelines.

What is the NIS2 registration deadline in Poland?

The Directive required Member States to establish lists of essential and important entities by 17 April 2025, but it does not set one universal deadline for all businesses to submit registration information. The deadline and registration procedure must be confirmed under the amended KSC Act and implementing rules.

What incidents must be reported under NIS2?

Significant incidents must be reported. These are incidents that have caused, or are capable of causing, severe operational disruption or financial losses for the entity concerned, or that have affected or may affect other natural or legal persons by causing considerable material or non-material damage.

Can a management board be liable for cybersecurity failures?

Management bodies must approve and oversee cybersecurity measures. Personal liability under Polish law depends on the facts, applicable corporate duties, damage, regulatory findings and any potential criminal-law elements.

What are the maximum NIS2 fines in Poland?

NIS2 requires Member States to provide for fines of up to at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and EUR 7 million or 1.4% of worldwide annual turnover for important entities, whichever amount is higher. The final Polish penalty regime is set by national legislation.

Bibliography

[1] Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148, Official Journal of the European Union L 333, 27 December 2022, pp. 80-152.

[2] Act of 5 July 2018 on the National Cybersecurity System, consolidated text: Journal of Laws of 2024, item 1077, as amended.

[3] EUR-Lex, Directive (EU) 2022/2555, including the consolidated and official-language versions of the act.