Poland's National Cybersecurity System mandates new obligations for key entities

Under Poland’s National Cybersecurity System Act, key and important entities are required to implement an Information Security Management System (ISMS). This system focuses on organizational processes, including risk assessment, incident management, and regular security effectiveness checks, rather than just purchasing technical tools like SIEM or 2FA.

Medical facilities, including hospitals and private clinics, must determine if they meet the criteria for key or important entities. While the deadline for registration for those meeting criteria upon the law's amendment is October 3, 2026, the status of these entities is established by law as soon as they meet the necessary prerequisites. Failure to register does not exempt an organization from its legal obligations and can result in significant financial penalties for the facility and its management.