- FortCyber
- NIS2
NIS2 and the KSC Act. What they mean for your organisation NIS2 is an EU directive implemented in Poland by the amendment to the National Cybersecurity System Act. It has applied since 3 April 2026 and covers far more companies and public bodies than the previous rules.
Law as of 20 October 2026. Sources: the Act (Journal of Laws 2026, item 252) and the KSC FAQ on cyber.gov.pl.
- The Act comes into force
The amendment to the KSC Act came into force.
- End of self-registration in the register
The deadline has passed, but you can still apply. What to do after the deadline
- Obligations and the S46 system
ISMS, incident reporting, contact persons, training for the head of the entity.
- First audit and penalties
Audit of essential entities. From this date the authority can impose penalties.
If you’re in scope and haven’t applied for registration, apply now. Registration takes effect on submission, and penalties can only be imposed from 3 April 2028.
NIS2, KSC and ISO 27001. Three things people confuse
The directive, the Act and the standard all deal with the same thing: information security management. But obligations arise only from the Act.
NIS2
The EU minimum for member states. It doesn’t apply directly: each state transposes it into its own law. The deadline passed on 17 October 2024.
Reference point
The KSC Act
The Polish amendment that implements NIS2. It sets out who is in scope, what their obligations are, the deadlines and the penalties.
This is what you apply
ISO 27001
A voluntary standard for an information security management system. A good basis for the ISMS the Act requires, but certification doesn’t exempt you from registration, incident reporting or the audit.
A way to organise it properly
Who the Act applies to
The authority doesn’t issue a decision that you’re in scope. You determine it yourself, based on the activity you actually carry out and the size of your organisation (FAQ 1.1, 1.12, 2.7).
SectorsAnnex 1 and Annex 2
Annex 1 (key sectors):
- energy
- transport
- banking and financial markets
- health
- drinking water
- waste water
- digital infrastructure
- ICT services for businesses
- space
- public entities
Annex 2 (other critical sectors):
- postal and courier services
- waste
- chemicals
- food
- manufacturing: medical devices, electronics, machinery, vehicles
- digital services
- research
In the water, waste water and waste sectors, only the main activity counts (FAQ 1.4, 2.8).
SizeSector and size determine your status
- Large enterprise in an Annex 1 sectoressential
- Medium-sized enterprise in an Annex 1 sectorimportant
- Medium-sized and large in an Annex 2 sectorimportant
- Small and micro enterprisesgenerally not
Medium-sized: 50 or more people, or turnover and balance sheet total above EUR 10 million. Large: 250 or more people, or turnover above EUR 50 million and balance sheet total above EUR 43 million. Count together with linked and partner enterprises (Art. 5, FAQ 1.5).
Regardless of sizeServices that are always in scope
- DNS, TLD registries, domain registrars, qualified trust services, critical entitiesessential
- Managed security services (MSSP), from small enterprises upwardsessential
- Telecoms: medium-sized and largeessential
- Telecoms: micro and small, non-qualified trust servicesimportant
The authority may also bring an entity below the thresholds into scope by decision, e.g. the sole provider of an essential service (Art. 7l, FAQ 1.2, 1.3).
Local governmentAll municipal offices are in scope
- Municipal office employing at least 50 full-time equivalent staff on 1 Januaryessential
- Other municipal officesimportant
- District offices, voivodeship units and budgetary establishments (with exceptions)essential
- Schools, social welfare centres (GOPS), budgetary establishments, cultural institutions, municipal companiesimportant
Public entities are entered in the register by the minister. Important public entities have a simplified ISMS under Annex 4 (FAQ 1.8, 1.29, 2.3, 3.14).
Guide for local governmentAre you a supplier to a company or public office covered by the Act? That alone doesn’t put you in scope. Your client will, however, write security requirements into the contract (FAQ 3.3, 3.9).
Essential or important: what difference it makes
The obligations are the same. Supervision, audits and penalty levels differ. If an organisation meets both sets of criteria, it is an essential entity (Art. 5(4)).
| Comparison | Essential entity | Important entity |
|---|---|---|
| Obligations | ISMS, incidents, contact persons, training for the head of the entity, suppliers | the same |
| Supervision | ex ante: the authority can inspect at any time | ex post: when information about an infringement emerges |
| Audit | at least once every 3 years, at your own cost; the first by 3.04.2028 | only at the authority’s request |
| Maximum penalty | EUR 10 million or 2% of revenue, whichever is higher | EUR 7 million or 1.4% of revenue |
| Minimum penalty | PLN 20,000 | PLN 15,000 |
| Public entities | full obligations | simplified ISMS (Annex 4), reporting of major incidents only, one contact person |
Based on KSC FAQ 1.11, 3.14, 6.12, 9.1, 12.3 and 12.4.NIS2 Audit
What the Act requires you to do
Six areas, by 3 April 2027. The detailed list with owners and evidence is in the guide.
- Information security management system
Risk assessment, technical and organisational measures, policies, business continuity, backups and updates, multi-factor authentication where justified.
Art. 8 · FAQ 3.3 - Documentation
Normative (policies and procedures) and operational: registers, reviews and reports. Versioned and protected.
Art. 10 · FAQ 3.5 - Incidents
You handle every incident and report major ones: early warning within 24 h, notification within 72 h, final report within a month. Via the S46 system.
Art. 11 · FAQ 6.3, 6.4 - Contact persons
At least two. One in micro and small enterprises and in important public entities.
Art. 9 · FAQ 3.17, 3.18 - Head of the entity
Responsible for fulfilling the obligations, including those delegated to others. Training once every calendar year, the first no later than 2027.
Art. 8c–8e · FAQ 3.46, 4.3, 4.4 - Suppliers
Supply chain policy, selection criteria, security requirements in contracts and a list of direct suppliers.
Art. 8 · FAQ 3.3, 3.9
Steps, deadlines and evidence for the auditor in one place.Guide: what I need to do
Penalties and the liability of the head of the entity
Penalties are high, but the Act gives you time: they can be imposed from 3 April 2028. By that date you must already be meeting the obligations.
Whichever is higher, and no less than PLN 20,000 (Art. 73(3)).
No less than PLN 15,000 (Art. 73(4)).
Up to 100% in a public entity. The head is also liable for obligations delegated to others (Art. 73a, Art. 8c).
- From 3 April 2028. Before then the authority won’t impose penalties, except a penalty of up to PLN 100 million in the event of a direct and serious threat (Art. 35, FAQ 12.1).
- A warning first. Before imposing a penalty the authority issues a warning, and for a minor infringement that has ended it may waive the penalty (FAQ 12.7, 12.12).
- A penalty for every day. For failing to comply with the authority’s decision: from PLN 500 to PLN 100,000 a day (Art. 76b).
Obligation by obligation: how we handle it
FortCyber experts do the work and the platform keeps the evidence. Responsibility stays with the head of the entity, who sees every step.
- ISMS and riskFortCyber teamThe ISMS officer runs the risk assessment, the treatment plan and reviews.On the platformRisk register, plan and tasks with deadlines.
- IncidentsFortCyber teamWe help you assess whether an incident is major and prepare the report for S46.On the platformIncident register, 24 h and 72 h deadlines, action history.
- Training for the head of the entity and staffFortCyber teamAnnual management training, phishing campaigns and tests.On the platformTraining paths and completion confirmations.
- Oversight by the head of the entityFortCyber teamReport and decisions for approval, with a recommendation.On the platformManagement dashboard: status, tasks, decisions.
- Evidence for the auditorFortCyber teamAudit preparation and participation.On the platformAction history and versioned documentation.
Agents, automations and the experts’ role.How the platform works
Frequently asked questions
Answers based on the Act and the KSC FAQ. This is not legal advice.
Can’t see your question?Call +48 699 587 011 or book a meeting.
Is our municipality in scope?
Yes, all municipal offices are covered. An office that on 1 January employs at least 50 full-time equivalent staff under employment contracts is an essential entity; the others are important entities. Schools, social welfare centres (GOPS) and cultural institutions are important entities (FAQ 1.8, 1.29, 1.31, 3.36).
We’re an IT supplier to a hospital. Are we in scope?
Not for that reason alone. You’re in scope if you meet the criteria yourselves, e.g. as a managed security service provider or a medium-sized or large ICT company. The hospital will, however, write security requirements into the contract (FAQ 3.3, 3.9).
We have ISO 27001 certification. Is that enough?
It’s a good basis for the ISMS required by Art. 8. But the certificate doesn’t replace registration, incident reporting via S46, contact persons, training for the head of the entity or the statutory audit.
Do we need a SOC?
The Act doesn’t explicitly require a SOC. It requires continuous monitoring and incident handling, and how you do it depends on your organisation’s risk (FAQ 3.16).
We bought “NIS2-compliant” documentation. Are we compliant?
No. The documentation must describe your organisation and be applied in practice (FAQ 3.7).
Does outsourcing transfer responsibility to the provider?
No. Tasks can be entrusted to a managed security service provider, but the head of the entity remains responsible for carrying them out (Art. 8c, FAQ 3.19, 4.4).
The registration deadline has passed. What now?
Apply. Self-registration is open all the time, and registration takes effect on submission (FAQ 2.32, 2.48). Details in our guide to late registration.
Sources: Act of 23 January 2026 amending the KSC Act, Journal of Laws 2026, item 252 · KSC FAQ, cyber.gov.pl · Ministry of Digital Affairs: key deadlines. Law as of 20 October 2026.
Read more
Guides and articles from our knowledge base.
All articles on regulations.NIS2 and compliance
Let’s talk about your organisation
Tell us what you want to sort out. We'll show you the platform and suggest a package that fits your situation.