Companies falling within Poland’s expanded cybersecurity regime must apply for registration by 3 October 2026. The requirement follows an amendment to the Act on the National Cybersecurity System, commonly abbreviated as UKSC, which entered into force on 3 April 2026 and implements the European Union’s NIS2 Directive.
The amendment was adopted on 23 January 2026 and published in the Journal of Laws on 2 March as Dz.U. 2026 poz. 252. It substantially broadens the range of private and public organisations covered by national cybersecurity requirements.
Why it matters
The law replaces the previous focus on operators of essential services with two regulated categories: key entities and important entities. Companies in digital infrastructure, information and communications technology service management, cloud services, transport and manufacturing are among those potentially covered.
This has direct implications for shared-service centres, IT outsourcing businesses and digital-service providers operating in Warsaw, Kraków, Wrocław, Tricity and Poznań. The legislation applies nationally, however, and a company’s location in a major technology or business-services centre does not itself determine its status.
Around 42,000 entities are expected to come within the expanded regime. This estimate includes private companies and public bodies meeting specified sector and size conditions, including thresholds of at least 50 employees or EUR 10 million in turnover.
Whether an individual organisation qualifies as key or important depends on the statutory criteria. The supplied sources do not support a definitive assessment for any particular company, and the threshold figures should not be read separately from the sector requirements.
The Ministry of Digital Affairs launched the KSC Register on 13 April 2026. For entities that are not entered by the authorities on their own initiative, the self-registration period runs from 7 May until 3 October.
A covered organisation must identify its category and apply for entry through the S46 system. The system is used both for registration and for communicating specified cybersecurity incidents to the relevant Computer Security Incident Response Team, or CSIRT.
Missing the registration requirement can result in administrative penalties. For key entities, the maximum fine cited in the supplied material is EUR 10 million or 2 per cent of worldwide turnover. Important entities face lower ceilings, but the precise amounts are not included in the brief.
Registration is not the only immediate obligation. Significant incidents must already be reported in three stages: an early warning within 24 hours, a fuller notification within 72 hours and a final report within one month.
The reporting timetable means that affected organisations cannot treat 3 October as the starting date for all compliance duties. Incident assessment and escalation may be required before an entity completes its registration application, depending on when it became subject to the amended law.
The implementation timetable differs between organisations already regulated under the 2018 system and those newly brought within scope. Existing operators have no grace period for most duties, according to HLB Poland.
Newly covered entities generally have 12 months from the amendment’s entry into force to implement the security measures contained in Chapter 3 of the legislation. That transition period runs until 3 April 2027.
The distinction between registration, incident reporting and the implementation of security measures is therefore significant. The 3 October 2026 registration deadline does not replace the 24-hour incident-warning requirement, while the April 2027 adjustment period does not postpone every obligation under the amended act.
For management boards, the immediate issue is governance rather than technical deployment alone. The organisation must determine whether it falls within a listed sector, whether it meets the relevant size conditions and which regulatory category applies. The brief does not provide a detailed compliance checklist or establish the personal liability consequences for individual directors.
