NIS2 cybersecurity regulations impose heavy fines on Polish firms

New cybersecurity regulations under the NIS2 Directive and the amendment to the National Cybersecurity System Act (UKSC) are introducing significant compliance requirements for businesses in Poland. The Ministry of Digital Affairs estimates that approximately 38,000 entities, including 27,000 public institutions, may be affected. These sectors include energy, transport, banking, healthcare, digital infrastructure, manufacturing, chemicals, food, waste management, and ICT.

A critical deadline for self-registration of entities that met the criteria for key or important entities on the day the regulations entered into force is October 3, 2026. Non-compliance can result in severe penalties, reaching up to €10 million or 2% of total annual turnover for key entities.

Beyond registration, companies face ongoing obligations such as conducting security audits, providing employee training in AI and cybersecurity, and maintaining continuous reporting of incidents and cyber events. Notably, organizations cannot transfer their responsibility for risk management to third-party providers; even if a service provider causes a data breach, the primary organization remains accountable for how it managed the risks associated with that partnership.