Under Poland’s 2026 amendment to the Act on the National Cybersecurity System, known as UKSC, newly covered organisations must implement required cybersecurity measures by 3 April 2027. For shared-service centres and IT hubs, the legislation makes compliance a governance responsibility rather than a project confined to technical teams.
The expanded framework may cover centres providing digital infrastructure, cloud services or information and communications technology service management. An SSC or IT operation can enter the regime when it meets the applicable sector and size criteria, without first receiving an individual designation from the regulator.
That distinction is important for multinational operations in Warsaw, Kraków, Wrocław, Tricity and Poznań. A company cannot assume that it falls outside the law simply because it has not been contacted by an authority.
The responsibility for assessing whether an organisation qualifies as a key or important entity rests with the company. Auditors and legal advisers may use the annexes to UKSC when examining the organisation’s activities, but the initial classification obligation remains with the entity itself.
Once covered, an organisation must implement a catalogue of organisational and technical measures. These include cybersecurity risk analysis, incident handling, business continuity, supply-chain security and policies covering human resources and access control.
For an international service centre, this means that compliance extends beyond the security of its own systems. The supply-chain requirement also places vendor relationships within the risk-management framework, although the brief does not specify particular contractual clauses or technical standards.
Management bodies carry explicit responsibility for meeting the obligations. The amendment introduces possible personal consequences for members of those bodies, including financial penalties and management bans, alongside fines imposed on the organisation.
Cybersecurity awareness is also a statutory management issue. Regular staff education is mandatory, while the head of the entity must complete documented training annually. Failure to meet this obligation may result in a fine of up to 300 per cent of the manager’s remuneration.
The training requirement indicates that management cannot transfer the whole compliance burden to a security team, external consultant or group-level function. Senior decision-makers must be able to oversee the organisation’s approach and demonstrate that the required education has taken place.
Incident management is another immediate operational responsibility. Significant incidents must be reported through the S46 platform to the relevant Computer Security Incident Response Team, or CSIRT.
The process has three stages. An early warning is required within 24 hours, followed by a notification within 72 hours and a final report within one month. Meeting those deadlines requires internal procedures capable of identifying an incident, escalating it and assigning responsibility for regulatory communication.
For SSCs serving foreign clients, the reporting process may also need to operate alongside internal group procedures. The supplied material does not specify how the Polish reporting timetable interacts with contractual notices to clients or reporting obligations in other jurisdictions.
The compliance timetable has several separate stages. Registration is required by 3 October 2026, but that date is not the endpoint of implementation. Newly covered entities have until 3 April 2027 to introduce the required measures.
The first mandatory audits for key entities are due by 3 April 2028. Important entities are also subject to the wider compliance framework, but the brief does not state that the same first-audit date applies to them.
The resulting sequence gives boards a medium-term programme to oversee: classification and registration in 2026, implementation of organisational and technical measures by April 2027, and the first mandatory audits for key entities by April 2028.
These stages do not suspend incident-reporting duties in the meantime. Organisations must distinguish between the deadline for completing their broader control framework and obligations that already apply when a significant incident occurs.
