Poland's KSC amendment (NIS2) – what companies must do by 3 April 2027

Who is covered

Instead of operators of essential services the Act introduces essential and important entities – including medium-sized and large enterprises in energy, transport, banking, health, digital infrastructure, ICT service management and manufacturing, as well as public administration. A company that meets the criteria and was not entered in the register ex officio must apply itself.

Key obligations

• Entry in the register of essential and important entities.
• Security management system and risk assessment.
• Procedures for handling and reporting significant incidents.
• ICT supply chain security management.
• Management oversight and training.

Deadlines

• 3 April 2026 – amendment enters into force.
• 3 April 2027 – end of the adaptation period.
• 3 April 2028 – fines apply to most obligations; first audit deadline for some essential entities.

Where to start

First, determine whether the organisation is an essential or important entity and whether the registration application has been filed. Then carry out a gap analysis and plan the documentation and procedures before April 2027.

Other services

• Cybersecurity documentation
• Security management system
• Incident reporting