On 12 February 2025, the fifth draft amendment to the National Cybersecurity System Act (UKSC) was published. The draft, dated 7 February 2025, is the next step in the implementation of the NIS 2 Directive, a key cybersecurity regulation at European Union level.

It is worth recalling that the NIS 2 Directive implies a significant expansion of the scope of entities covered by its provisions, i.e. essential entities and important entities, as well as a tightening of the requirements for these entities.

The new draft amendment to the UKSC differs from the previous one in the following areas:

  • public entities and
  • rules for the application of supervisory measures.

The draft divides public entities into essential and important ones. The latter category will include, among others, the following entities that are not classified as essential entities: local government budget units and budgetary establishments, cultural institutions and commercial law companies carrying out public utility tasks using information systems.

For public-important entities, a simplified information security management system, outlined in the new Annex 4, will replace the current, more extensive risk management measures. Incident reporting obligations have also been reduced.

Significant changes also concern supervisory measures. The amendment grants the authority competent for cybersecurity the power to independently issue decisions to suspend granted licences or operating permits. The new rules specify that the application of supervisory measures may not exceed 14 days. However, this period may be extended by further 14-day periods until the deficiencies are remedied.

The submission of the draft to the Standing Committee of the Council of Ministers indicates that the government’s work is at an advanced stage. Further intensive work can be expected, given that the deadline for the implementation of the NIS 2 Directive passed on 17 October 2024 and security issues are one of the priorities of the Polish Presidency of the EU Council.

It can be expected that the draft will be sent to parliament in the near future. Therefore, companies that will be subject to this regulation should already start preparing to meet the new requirements.