Poland Sets October 2026 Deadline for Companies to Register under New NIS2 Cybersecurity Rules

Poland will amend its National Cybersecurity System (KSC) law to implement the EU NIS2 directive, extending cybersecurity obligations to a broader range of enterprises. The amendment, expected in the first quarter of 2025, requires medium‑ and large‑sized firms in key and important sectors – such as energy, transport, finance, health, ICT, manufacturing and logistics – to assess whether they qualify as a "key" or "important" entity and, if so, submit an application to be listed in the KSC register by 3 October 2026.

The new rules introduce stricter risk‑management standards, mandatory incident‑reporting deadlines and a pre‑verification service available on the Biznes.gov.pl portal to help companies determine their status. Maria Magdoń, Deputy Director of the Digital Economy Department at the Ministry of Development and Technology, emphasized that early verification can give firms more time to prepare the required documentation and avoid penalties.

NIS2 replaces the 2016 NIS directive and aims to harmonise cybersecurity requirements across the EU, expanding the scope of covered sectors and tightening reporting obligations for both "key" and "important" entities.