Entities deemed essential or important by the Act must submit an application for entry by October 3, 2026, provided they met the criteria on April 3, 2026, and were not officially added to the National Cybersecurity System register. The deadline, which expires next month, is a consequence of the entry into force of the amendment to the National Cybersecurity System Act, which is based on a self-qualification model. The regulator is not required to send individual notices. The burden of verification and timely submission rests entirely with businesses.
Entities subject to registration obligation
The obligation to submit an application applies to organizations that, as of April 3, 2026, met the criteria for recognition as a key or important entity and have not yet been included in the register based on an individual decision by the supervisory authority. The regulations generally cover medium-sized and large enterprises from designated sectors, but the assessment of status also requires consideration of capital and personal ties within groups of companies.
Failure to deliver official letters or reminders from the relevant ministries does not release the organization from liability, and inaction may expose the company to severe consequences.
Procedure and formal requirements for filing a report
Registration is conducted exclusively electronically via a dedicated IT portal. For the application to be processed without requests for additional documentation, the organization must provide:
- Proper representation: The application must be signed with a qualified electronic signature or a trusted signature in accordance with the representation rules disclosed in the National Court Register (KRS) or the Central Registration and Information on Business (CEIDG). If using a proxy, it is necessary to attach an electronic power of attorney along with proof of payment of the stamp duty.
- Contact points: The form requires the provision of dedicated contact details (phone, email) for the units responsible for communication with the appropriate CSIRT team.
- Precise qualification of services: Indication of the relevant sector, subsector and type of services provided, along with basic data on the digital infrastructure used.
Sanctions for failure to meet the deadline
Failure to submit the application by October 3, 2026, creates the risk of initiating proceedings to impose an administrative fine for failure to comply with the statutory obligation. Regardless of the financial sanctions, the supervisory authority will automatically enter the organization into the register after identifying it. Failure to complete the formalities by the deadline may also be considered a violation of the due diligence requirement in managing the company's affairs by management board members.
How to prepare for your upcoming appointment
Companies that have not yet completed the registration procedure should immediately verify their status and submit their application:
- Document the self-assessment: Prepare an internal protocol confirming employment and turnover figures as of April 3, 2026, along with an analysis of the connections within the group.
- Verify the public register: Ensure that the company has not already been listed in the register as part of an official entry.
- Prepare the electronic form: Complete the technical data, verify the validity of the electronic signatures of the representatives and submit the application well in advance to avoid any possible overload of the IT systems.
In summary, the upcoming deadline of October 3, 2026, concludes a key stage in the implementation of the KSC reform. Given the formal requirements for representation and the need to precisely map the services provided, it is worthwhile to immediately analyze the organization's situation and submit a report before the statutory deadline expires. It is also important to designate responsible contact points.
This article is for informational purposes only and does not constitute legal advice.
The law is current as of September 3, 2026.
