Poland tightens cybersecurity rules for digital payments and key firms

Poland’s cybersecurity framework is reinforced by strong EU regulations that have been incorporated into national law, including the recently adopted National Cybersecurity System (UKSC/KSC). Mastercard’s director for Poland, Czechia and Slovakia highlighted that about 69% of retail transactions are now cashless and that the EU‑aligned rules give authorities tools to combat fraud and cybercrime, while emphasizing the need for continued education of consumers.

A forthcoming amendment to the KSC law, implementing the EU NIS2 directive, will require enterprises classified as "key" or "important" to carry out self‑identification and register in the KSC Register. The self‑registration opens on 7 May 2026 and applies to sectors listed in the law’s annexes, with all telecom operators included regardless of size. Companies must assess their activity, PKD codes and size to determine their status and complete the registration by 3 October 2026.