The Polish Act on the National Cybersecurity System (KSC), implementing the EU NIS2 Directive, entered into force on April 3, 2026. Its adoption marked a fundamental change in the cybersecurity oversight model. The previous mechanism, in which key entity status was granted by individual administrative decision, was abolished. Currently, businesses themselves are responsible for self-identification – verifying whether they qualify as a key or important entity under the new regulations and, if they meet the criteria, submitting an application to the register by October 3, 2026.
Who is covered by the regulations? Employment and turnover thresholds
In principle, the new KSC Act covers medium-sized and large enterprises operating in specific economic sectors. Referring to EU SME qualification standards, a company is considered to be covered by the regime if it meets at least the following criteria:
- employs at least 50 employees or
- has an annual turnover of at least EUR 10 million or an annual balance sheet total of at least EUR 10 million.
Micro and small enterprises (employing fewer than 50 people and with a turnover or balance sheet total of less than €10 million) are generally outside the scope of the act. However, the regulations provide for important exceptions. Smaller companies will also be subject to the requirements if they serve as the sole provider of an essential service in a given area, provide certain digital services (e.g., trust service providers, domain name registries, electronic communications network providers), or if their disruption could pose a significant systemic risk.
Key and important sectors: is your industry on the list?
The amendment significantly expands the list of industries covered by cybersecurity regulations, dividing them into two levels of the regulatory regime:
- Critical Entities: Includes traditional critical infrastructure sectors such as energy, transport, banking, financial market infrastructure, health, drinking water supply and distribution, wastewater, digital infrastructure, ICT service management (including B2B managed service providers), and public administration.
- Important entities: cover sectors of high economic and social importance, including postal and courier services, waste management, chemical production and distribution, food production and processing, selected manufacturing industries (e.g., production of medical devices, computers, electrical appliances, or vehicles), as well as digital service providers (online trading platforms, search engines, social networks).
Self-identification without waiting for the authority's decision
The most important practical change is the departure from the previous lack of obligation for entrepreneurs to take action. The amendment to the Commercial Companies Code introduces responsibility for their own verification. Failure to deliver any administrative decision from the supervisory authority does not release the company from its obligations.
The entrepreneur must independently analyze the type of business conducted, classify the services provided according to the annexes to the Act, and then compare this data with their employment structure and finances. It is worth remembering that when assessing the enterprise size threshold, capital and personal ties with other entities in the group should be taken into account (in accordance with Annex I to EC Regulation No. 651/2014), which may result in a formally small subsidiary being considered part of a larger entity.
How to prepare for change
Organizations should begin the formal self-identification process immediately to meet the upcoming October 3, 2026 deadline:
- Analyse the group structure and financial indicators: verify employment status, annual turnover and balance sheet total for the last approved reporting periods, taking into account related and partner entities.
- Map your business: carefully compare the PKD codes and the services actually provided with the list of sectors and subsectors specified in the new KSC Act.
- Check for exceptions: verify whether, despite not exceeding the size thresholds, the company does not provide services that constitute a bottleneck for the functioning of the market or state security.
- Document the verification process: prepare an internal self-identification protocol – both in the event of determining that the company is subject to the Act (which constitutes the basis for registration in the register) and in the event of determining that the KSC regime does not apply to it (in the event of a possible inspection).
To sum up
From April 3, 2026, the clock is ticking in favor of those entrepreneurs who efficiently conduct a legal and organizational audit of their business. The October 3, 2026, deadline for registration on the list of key and important entities is a strict deadline, and failure to do so may result in legal sanctions. Due to the complexity of calculating thresholds within capital groups and assessing the material scope of services provided, it is advisable to consult the results of the self-identification with a cybersecurity law specialist.
This article is for informational purposes only and does not constitute legal advice.
The law is current as of August 5, 2026.
