The amendment to the Polish National Cybersecurity System Act (the “KSC Act”), effective from 3 April 2026, introduces new cybersecurity obligations for essential and important entities, including registration in the Register of Essential and Important Entities as a part of Poland’s implementation of the NIS2 Directive.
For entities that already met the statutory criteria on that date, the registration deadline is 3 October 2026. Businesses should therefore assess whether the KSC Act applies to them and whether they need to submit to registration application.
What should be known before submitting an application? Below are the six key points.
1. When is the deadline for registration in the KSC Register?
The deadline for submitting an application for entry in the Register of Essential and Important Entities under the NIS2 Directive is 3 October 2026 for entities that already met the statutory criteria for classification as an essential or important on the date the amended KSC Act entered into force.
This deadline applies to those required to self-register. Entities entered ex officio by the Minister of Digital Affairs do not need to submit a separate registration form.
2. Who is required to register in the KSC Register?
The amended KSC Act, implementing the EU NIS2 Directive, divides entities covered by the legislation into either essential or important.
Whether a particular business falls within its scope depends primarily on the type of activity it carries out and the sector in which operates. Its size and the nature of the services provided may also be relevant.
Annex 1 to the KSC Act identifies the sectors and types of entities classified as essential. These include areas that are fundamental to the functioning of the state and the economy, such as energy, transport, banking and financial market infrastructure, healthcare, the production and distribution of medicinal products and medical devices, drinking water supply, digital infrastructure, electronic communications, ICT services, the space sector and certain public entities.
Annex 2 to the KSC Act, in turn, lists the sectors in which important entities operate. It covers, among others, postal and courier services, nuclear energy-related activities, waste management, the production and distribution of chemicalsas well as food, certain products and services, digital services, research organisations and public bodies, including local authorities.
However, operating in a regulated sector does not, by itself, mean that a business is required to register. Its size and other statutory criteria must also be taken into account.
As a general rule, micro and small enterprises are excluded from the scope of the KSC Act, subject to the exceptions set out in Article 5(1)(4) of the KSC Act. Medium-sized and large businesses operating in the sectors listed in Annex 1 or Annex 2 should assess whether they qualify as essential or important entities.
3. Does the KSC Act apply to foreign companies?
The fact that an entity is a foreign company does not, in itself, exclude the application of the scope of KSC Act. Foreign businesses carrying out activities covered by legislation in Poland should therefore assess whether they meet the relevant statutory criteria and are subject to the resulting obligations.
4. Registration ex officio or self-registration?
Not all entities covered by the KSC Act are required to submit an application themselves. Some of them entered in the Register ex officio by the Minister of Digital Affairs, without the need for aseparate submission.
This applies in particular to certain public entities, telecom operators, trust service providers and those that held the status of an operator of an essential service before the amendment came into force.
Other organizations that meet the statutory criteria but are not covered by this procedure are required to self-register through the relevant electronic system S46. In practice, this obligation applies primarily to private sector.
5. How can a business register in the KSC Register?
Registration is carried out electronically through the KSC Register system S46. An entity required to self-register must log in, complete the form and provide the required information.
The application must be submitted and signed by a person authorised to represent the entity. Where joint representation applies, all persons whose participation is required under the applicable rules must sign.
If a representative acts under a power of attorney or other form of statutory authority, its scope and legal basis should be verified before submission.
Once the process has been properly completed, the entity is entered in the Register as essential or important, depending on the statutory criteria it meets.
6. What does registration in the KSC Register mean for businesses?
Registration in the KSC Register is declaratory in nature and confirms an entity’s status asessential or important. The underlying cybersecurity obligations arise from meeting the criteria set out in the KSC Act, rather than solely from the registration itself.
Essential and important entities are required, among other things, to implement appropriate cybersecurity risk-management measures, establish and maintain an Information Security Management System (ISMS), monitor threats, keep the required documentation and handle and report cybersecurity incidents to the competent CSIRT (Computer Security Incident Response Team).
Registration also provides access to the S46 Cyber Hub, which supports these tasks, particularly the submission of reports and the exchange of information on cyber threats.
Businesses should also carefully verify the details provided in the application, as submitting false information may result in criminal liability.
Key takeaway
Businesses operating in Poland should not assume that the KSC Act does not apply to them simply because they are foreign-owned or incorporated abroad. The first step is to assess whether their activities fall within a regulated sector and whether they meet the statutory criteria for classification as essential or important entity.
Where self-registration is required, those that met these relevant conditions on 3 April 2026 must submit their application by 3 October 2026. Businesses should also bear in mind that completing the registration formalities do not, in itself, ensure compliance with the broader of cybersecurity obligations imposed on essential and important entities under the KSC Act.
