Poland implements NIS2 cybersecurity regulations for critical sectors

Poland is implementing the NIS2 directive through an amendment to the National Cybersecurity System (KSC) act, which establishes security frameworks for 18 essential sectors, including energy, transport, banking, and healthcare. The regulations primarily target medium and large entities, though some organizations may be included regardless of size due to their strategic importance.

Approximately 38,000 entities may be affected, including roughly 11,000 non-public organizations. While some entities, such as public bodies and telecommunications providers, are entered into the registry automatically by the state, others must submit applications for entry into the list of key or important entities.

Entities that met the statutory criteria upon the law's entry into force have until October 3, 2026, to submit their applications. For those newly meeting the criteria after the law took effect, a six-month window is provided to apply. Many organizations are currently discovering their status through official notifications from the Ministry of Digital Affairs, which require them to supplement missing data in the central registry.