NIS2 in Poland: who it applies to and what to do by April 2027
NIS2 applies to companies that operate in one of the sectors listed in the annexes to the Polish National Cybersecurity System Act (KSC) and are at least medium-sized: 50 or more staff, or turnover and balance sheet total both above EUR 10 million. Some entities, such as DNS service providers or critical entities, are covered regardless of size. Poland implemented the directive through the amendment to the KSC Act (Journal of Laws 2026 item 252), in force since 3 April 2026, and most companies have until April 2027 to put the obligations in place.
In short
- NIS2 is implemented in Poland by the amendment to the National Cybersecurity System Act (Journal of Laws 2026 item 252), in force since 3 April 2026.
- The act covers companies in the sectors listed in its Annexes 1 and 2, usually from medium size up: 50 or more staff, or turnover and balance sheet both above EUR 10 million.
- Companies that met the criteria when the act came into force have 12 months to implement the obligations, which means until early April 2027.
- A significant incident is reported to the competent sector CSIRT twice: an early warning within 24 hours and a full notification within 72 hours of detection.
- The head of the company is personally responsible for cybersecurity and takes training once a year, while most fines under the act can only be imposed 2 years after it came into force.
Contents
- What NIS2 is and how it works in Poland
- Who NIS2 applies to: a three-question test
- Essential vs important entity: the differences
- NIS2 deadlines in Poland
- What a company covered by NIS2 has to do
- Your client is covered and you are not: the supply chain
- A plan for a company covered by NIS2: five steps to April 2027
- Limits: when NIS2 is not your problem
- Frequently asked questions
Legal position as of 3 November 2026. This is not legal advice: confirm your company’s status with a lawyer, especially if it belongs to a group.
What NIS2 is and how it works in Poland
NIS2 is EU Directive 2022/2555 on cybersecurity. The directive does not bind companies directly; national law does. In Poland that law is the National Cybersecurity System Act as amended on 23 January 2026, published on 2 March and in force since 3 April 2026.
The act splits companies into two groups: essential entities (podmioty kluczowe) and important entities (podmioty ważne). Both have the same core duties (an information security management system, incident reporting, entry in the register); they differ in supervision, fine levels and a mandatory audit.
Who NIS2 applies to: a three-question test
Answer three questions in order. If the answer to the first is “no”, the act usually does not cover you, but read the section on the supply chain.
1. Do you operate in a sector from Annex 1 or Annex 2 of the act?
- Annex 1 (essential sectors) includes energy (with mining), transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, B2B ICT service management, public bodies and space.
- Annex 2 (important sectors) includes postal services, waste management, chemicals, food, manufacturing of medical devices, computers and electronics, electrical equipment, machinery, motor vehicles and other transport equipment, digital providers (online marketplaces, search engines, social networks) and research.
What counts is the type of activity described in the annex, not the business classification code alone. A furniture maker and a machinery maker may run similar factories, yet only the second is in Annex 2.
2. How big is the company?
The act uses the SME definition in Annex I to Commission Regulation 651/2014. According to the European Commission’s user guide to the SME definition, the headcount ceiling must always be met, while one of the two financial ceilings is enough.
| Size | Status | Ceilings |
|---|---|---|
| Micro and small | usually out of scope | under 50 staff and turnover or balance sheet up to EUR 10m |
| Medium | important entity (Annexes 1 and 2) | 50–249 staff, or turnover and balance sheet both above EUR 10m; turnover up to EUR 50m or balance sheet up to EUR 43m |
| Large | essential in Annex 1, important in Annex 2 | 250 staff or more, or turnover above EUR 50m and balance sheet above EUR 43m |
The table does not cover the exceptions in question 3.
Size is assessed as at the date of the financial statements (Article 5(5)). Watch out for groups: linked and partner enterprises are added when assessing size. The act makes an exception where your information system is independent of the group companies’ systems or you do not provide services jointly with them (Article 5(6)–(7)).
3. Are you in the “regardless of size” group?
Whatever their headcount, essential entities include DNS service providers, qualified trust service providers, critical entities, TLD registries and domain registration services. Managed security service providers are essential from small-enterprise size (Article 5(1)(3)). Electronic communications providers, such as local internet providers, are covered at any size: micro and small ones as important entities, medium and larger ones as essential (Article 5(1)(2) and 5(2)(4)). Likewise, non-qualified trust service providers that are micro, small or medium enterprises are important entities (Article 5(2)(3)). The authority can also designate a company as essential or important by decision.
Example (a made-up company): a packaging printer serving the food industry, 120 staff. Printing packaging is not “food” under Annex 2, so the printer is usually out of scope. Its client, a large food manufacturer, is an important entity and will ask the printer about its security.
Essential vs important entity: the differences
The difference is about supervision, fines and audit, not the list of day-to-day duties.
- Essential entity: a fine of up to EUR 10m or 2% of revenue (whichever is higher), at least PLN 20,000; a first security audit within 24 months of the act coming into force (Article 33(2)).
- Important entity: a fine of up to EUR 7m or 1.4% of revenue, at least PLN 15,000; the transitional rules do not require a first audit.
- The head of the company in both groups: a fine of up to 300% of pay (Article 73a(4)).
Most fines (Article 73(1)–(4) and the fines on the head of the company in Article 73a) can only be imposed for the first time once 2 years have passed since the act came into force (Article 35 of the amending act). The exception: for a breach that causes a direct and serious cyber threat, or a threat of serious property damage or serious disruption to services, the authority can impose a fine of up to PLN 100 million (Article 73(5)), and Article 35 does not list it. So the duties are not optional until then: supervision and inspections have applied since April 2026.
NIS2 deadlines in Poland
The key dates for a company that already met the criteria on 3 April 2026:
| Date | What happens |
|---|---|
| 3 April 2026 | the act is in force (Article 49) |
| 7 May – 3 October 2026 | self-registration in the register of essential and important entities (Ministry of Digital Affairs announcement) |
| by April 2027 | chapter 3 duties in place: security system, incidents, contacts (12 months, Article 33(1)) |
| by April 2028 | first audit of essential entities (24 months, Article 33(2)) |
| 2 years after entry into force | fines under Article 73(1)–(4) and 73a possible (Article 35) |
Missed self-registration by 3 October? File the application as soon as possible at wykaz-ksc.gov.pl. You log in through the national login node (trusted profile, mObywatel, e-ID, online banking). The minister registered some entities ex officio; for them the application ends in an error and they only need to complete their data. A company that starts meeting the criteria later, for example by passing 50 staff, has 6 months from that day to apply (Article 7c(1)).
What a company covered by NIS2 has to do
The duties are in chapter 3 of the act. I split them into five parts.
Information security management system (Article 8)
Regular risk assessment and measures proportionate to that risk, including security policies, supply chain security, business continuity and disaster recovery plans, system monitoring, access control, asset management, encryption where appropriate, multi-factor authentication where appropriate, software updates and cyber hygiene training for staff. The act does not require ISO 27001 certification or any specific product.
Incidents (Article 11)
An early warning of a significant incident to the competent sector CSIRT within 24 hours of detection, a full notification within 72 hours and a final report within a month of the notification. Without a path agreed in advance, “who decides it is significant and who reports it”, 24 hours go quickly.
Contact people (Article 9)
At least two people responsible for contact with the national cybersecurity system, and a channel through which customers can report a threat or vulnerability linked to your service.
Management responsibility (Articles 8c–8e)
The head of the company is responsible for the duties being carried out, even when they are delegated. They plan the budget, assign tasks and supervise them, and take documented training once every calendar year. On a multi-member board with no designated person, all members are responsible.
Register entry and data
The entry, updates when data changes, and use of the ministry’s IT system (S46) after registration.
Your client is covered and you are not: the supply chain
The act requires essential and important entities to secure their ICT supply chain (Article 8(1)(2)(e)) and assess hardware and software suppliers (Article 8(2)). In practice a supplier with access to a client’s systems or data receives a questionnaire or a contract addendum. That is how I read this duty and how I would prepare for that conversation.
Questions I expect in such a questionnaire, and what to have ready:
- Do accounts with access to the client’s data use two-factor authentication?
- Who on your side can access the client’s systems, and how do you remove access when someone leaves?
- How do you back up, and when did you last test a restore?
- How quickly will you tell the client about an incident on your side? The client has 24 hours for its early warning, so it will ask in hours, not days.
- Do you update systems and computers, and who keeps an eye on it?
- Do you have written security rules, even short ones?
You can check most of these in one day with the list in IT audit for a small business. If you use SaaS tools, also see what to ask a software vendor in custom system or off-the-shelf tool.
A plan for a company covered by NIS2: five steps to April 2027
If the test shows the act covers you and you have nothing in place yet, this order gives the most in the shortest time:
- Status and registration. Confirm sector and size with a lawyer, check the register and apply if you are not in it.
- Responsibility. The head of the company appoints a cybersecurity lead and two contact people, plans the budget and the first training date.
- Inventory and risk. A list of systems, accounts, suppliers and data, then a risk assessment: what would stop the company for a day, and what for a week.
- Quick measures. Two-factor authentication on admin accounts and email, removing access when people leave, backups with a restore test, updates.
- Procedures on paper and in practice. An incident procedure with the 24- and 72-hour clock, a business continuity plan, access policies, a questionnaire for key suppliers, short staff training. Finish with a drill: a mock incident to check you make the deadline.
Steps 1–2 take weeks, 3–4 usually one to two months, step 5 the rest of the time. Order matters: documents written before the inventory describe a company that does not exist.
How I handle this myself
In the system I built for Reefa, the security minimum is enforced by the technology and the database, not good intentions. Super admins sign in with a mandatory second factor (TOTP). Client files sit in private storage, and the client portal only gets them through a server-side function that checks whose file it is. Permissions are enforced in the database, and I test changes to them by role simulation. I describe more in the case study an operating system for a service company.
I apply the same rule to AI: a new tool gets only the access it needs. I cover it in AI in small and medium businesses.
Limits: when NIS2 is not your problem
- A small company outside the groups covered regardless of size (including telecoms). The act does not cover you. A minimum is still worth having, because clients covered by the act will ask.
- A sector outside the annexes. If your activity is in neither Annex 1 nor Annex 2, headcount does not matter.
- “NIS2 certificate” offers. The KSC Act does not require any such document from a company. Pay for specific work: inventory, procedures, controls actually in place.
- A corporate group. Size is counted differently here, and the exception in Article 5(6)–(7) needs an assessment of your systems. Without a lawyer it is easy to get it wrong either way.
If you want to run the test and the plan on your own case, that is typical work under IT rollouts and fractional CTO (from PLN 12,000/month excl. VAT). Book a 30-minute call: I will tell you straight what on this list you already have and what is missing. And if you also want to see which processes in your company are ready for AI, take the AI readiness assessment.