Properly conducting a self-assessment under the new Act on the National Cybersecurity System (KSC) requires not only determining whether a company is subject to the regulations but also clarifying its status. The Act divides the recipients of obligations into two main categories: key entities and important entities. Although both groups are required to implement cybersecurity risk management measures and submit a registration by October 3, 2026, the scope of oversight and potential financial sanctions differ significantly.
How to distinguish a key entity from an important one?
Belonging to a specific category is determined by two main factors: the economic sector in which the company operates and its size (measured by employment and financial indicators).
| Criterion | Key entity | Important entity |
| Economic sectors | Key sectors (including energy, transport, banking, health, water, digital infrastructure, ICT). | Important sectors (including post/couriers, waste, chemicals, food, industrial production, digital services). |
| Company size | Large enterprises in key sectors (≥250 employees or turnover >€50 million / balance sheet >€43 million). | Medium-sized enterprises in key sectors and medium-sized and large enterprises in important sectors. |
| Qualification regardless of size | Trust service providers, domain name registries, public administration entities or those individually designated due to systemic risk. | Entities indicated in the Act as important regardless of the scale of their activity. |
Ex-ante versus ex-post supervision: a key systemic difference
The most significant practical difference between the two categories concerns the way in which regulators exercise control over compliance:
- supervision ex-ante): Regulators have the authority to conduct preventive and regular inspections. They can request documentation at any time—without prior incident—order independent security audits at the company's expense, or verify procedures.
- supervision ex-post): The supervisory regime is post-competitive. Authorities take control and enforcement actions only after obtaining evidence, a report, or a reasonable suspicion that a breach of regulations has occurred (e.g., following a serious incident or complaint).
Organizational responsibilities
Both categories of entities must implement a similar set of technical and organizational measures, including:
- regular risk analysis and security policy of ICT systems,
- incident handling procedures and business continuity planning (BCP) and crisis management,
- verification of supply chain security (auditing of software and IT service providers),
- mandatory use of cryptography and encryption where justified.
For both groups, the deadline for full implementation of the Information Security Management System (ISMS) remains April 3, 2027.
Financial sanctions and managerial liability
Differences in the criticality of the sector are also reflected in the tariff of fines for failure to fulfil obligations:
- For key entities: Fines may amount to up to EUR 10,000,000 or up to 2% of the total worldwide annual turnover of the company in the previous financial year (whichever is higher).
- For important entities: Maximum sanctions up to EUR 7,000,000 or up to 1.4% of the total global annual turnover (whichever is higher).
It is worth emphasizing that the amendment to the KSC also provides for the personal liability of unit managers (management board members). In the case of key entities, supervisory authorities, in extreme cases of persistent failure to comply with post-audit recommendations, will be authorized to request the temporary suspension of an individual from performing management functions.
To sum up
Although important entities are subject to a more lenient, ex-post, the scope of necessary security procedures is almost identical to that for key entities. A cursory interpretation of regulations and delaying implementation due to a lack of preventive controls poses a high business risk – the first serious incident at a significant entity will trigger an audit procedure. To protect the organization from severe penalties, it is advisable to begin the process of technological and legal gap analysis simultaneously with preparing the application for registration.
This article is for informational purposes only and does not constitute legal advice.
The law is current as of August 13, 2026.
