KSC registration by 3 October 2026 - who is affected?

Amendment to the KSC Act - what does the NIS2 Directive change for Polish companies?

The latest amendment to the 2018 Act on the National Cybersecurity System is a turning point for thousands of Polish businesses. The change, which entered into force on 3 April 2026, implements into Polish law the provisions of the European NIS2 Directive - a comprehensive act regulating cybersecurity across the European Union.

From 7 May 2026, businesses can submit registration applications to the National Cybersecurity System (KSC), maintained by the Minister of Digital Affairs. The deadline for meeting this obligation expires on 3 October 2026 - and the consequences of missing it can be extremely severe. The Act provides for financial penalties of up to PLN 100 million.

According to the Ministry of Digital Affairs, the new rules may cover around 38,000 entities, including about 11,000 private-sector ones. The scale of the change is therefore enormous, and many business owners are still unaware that the rules apply to their organisation.

One important principle should be stressed: any company that starts to meet the conditions for being classed as a key or important entity after the Act has entered into force will have six months from that moment to apply for entry in the register. The registration obligation is therefore not a one-off - it is continuing.

Who exactly is required to register in the KSC?

The NIS2 Directive creates a common cybersecurity framework for 18 sectors that are essential to the functioning of the state and the economy. The Polish Act precisely defines the sectors, sub-sectors and types of entities covered. The key sectors include:

• Energy - including nuclear energy investments
• Transport - air, rail, water and road
• Banking and financial market infrastructure
• Healthcare
• Drinking water supply and distribution
• Collective wastewater disposal
• Digital infrastructure and ICT service management
• Space
• Public entities

As a rule, the regulations apply to medium-sized and large entities. In some cases, however, the Act covers organisations regardless of their size, because of the particular importance of the service they provide. Operating in a listed sector does not in itself determine whether you must register, but it should be a clear signal to verify your company's status immediately.

Importantly, the new obligations may also apply to some trading companies - in particular businesses engaged in wholesale food distribution, the production or distribution of chemicals, and operators of online marketplaces. The obligation to register depends on the type of activity carried out, the size of the business, capital links and the exceptions provided for in the Act.

Registration is only the beginning - what obligations follow?

Registration in the KSC opens the way to a range of further obligations. After being entered in the register, entities will have to start using the S46 system, which is used, among other things, to report cybersecurity incidents and for communication within the National Cybersecurity System.

Key and important entities that met the statutory criteria on 3 April 2026 must start using the system and implement the other obligations arising from the new rules by 3 April 2027. The NIS2 Directive requires appropriate and proportionate technical, operational and organisational measures, covering in particular:

• Risk analysis and incident response policies
• Ensuring business continuity and regular backups
• Verifying supplier security and the supply chain
• Secure acquisition and maintenance of IT systems
• Use of cryptography, encryption and multi-factor authentication
• Staff training in cyber hygiene

Implementing these requirements involves significant costs - both financial and organisational. A company must analyse the regulations, define responsibilities, train staff, verify suppliers and fund the necessary technology changes. The later preparations start, the greater the risk of expenditure piling up over a short period.

Penalties for failing to register and breaching the rules - up to PLN 100 million

The legislator has provided for a strict system of sanctions for breaches of cybersecurity obligations. For failing to submit an application for entry in the register of key and important entities within the statutory deadline, the competent authority may impose a financial penalty. Sanctions also apply to failing to implement risk management rules, failing to report an incident, failing to carry out a mandatory audit and failing to comply with the authority's recommendations.

As standard, penalties range from PLN 15,000 to €10 million. For key entities, the minimum penalty is PLN 20,000 and the maximum is the equivalent of €10 million or 2% of revenue from business activity - whichever is higher. For important entities, the minimum penalty is PLN 15,000 and the maximum is €7 million or 1.4% of revenue.

A particularly severe penalty - up to PLN 100 million - may be imposed where a breach creates a direct and serious cyber threat and risks serious property damage or serious disruption to the provision of services. Importantly, the Act also provides for the personal liability of managers of key and important entities - the penalty for the person in charge may be up to 300% of their remuneration.

The transitional provisions state that most penalties may be imposed for the first time two years after the amendment enters into force. However, this limitation does not cover the special penalty of up to PLN 100 million - it may be imposed earlier.

What should your company do now? Four key steps

Time to act is limited. A business should immediately take the following steps:

1. Verify the company's status - check the business profile, PKD code, company size and the data of partner and linked entities to determine whether the organisation qualifies as a key or important entity.
2. Determine the method of entry - check whether the organisation has been entered in the register automatically (this applies, among others, to public entities, telecoms operators and trust service providers) or must submit an application itself.
3. Complete the registration formalities - if the company met the criteria on 3 April 2026 and was not entered automatically, submit an application by 3 October 2026 at the latest.
4. Prepare an implementation plan - appoint responsible persons, carry out a risk analysis, plan technical and organisational measures and include their costs in the budget and cash flow plan.

Submitting the application alone does not mean that all obligations have been met. KSC registration is only the first item on a long list of requirements imposed by the amended Act. Organisational, technical and financial preparations should therefore not wait until October.

Need legal support? Contact our firm

The new cybersecurity rules are complex, and the consequences of non-compliance may threaten the financial stability of the entire business. Correctly classifying the company's status, preparing the documentation and implementing the required procedures call for specialist legal knowledge.

Our firm offers comprehensive support at every stage - from verifying whether your company is subject to the KSC registration obligation, through preparing the application, to advice on implementing the requirements of the NIS2 Directive. Do not wait until the last day - contact us today and protect your company from the risk of heavy financial penalties.