The deadline for implementing the first obligations under the National Cybersecurity System Act, the Polish legislation implementing the NIS 2 Directive, is fast approaching. Entities which qualified, as of 3 April 2026, as an essential or important entity have only until 3 October 2026 to submit an application for entry in the register of essential and important entities. 

Who is required to register?

As a general rule, the entities subject to the National Cybersecurity System Act (and therefore required to register), are those which meet all of the following criteria: 

  1. they operate in essential or important sectors (i.e. they operate in any of the 18 sectors which broadly correspond to those covered by the NIS 2 Directive); 
  1. they meet the size threshold (i.e. they qualify as at least a medium-sized enterprise, however the act introduces a number of exceptions in this respect, including for micro- and small enterprises); and 
  1. they fall within the scope of Polish law (i.e. they are domiciled or operate in Poland through a registered office or branch, or on a cross-border basis, however the act provides for a number of exceptions in this respect, primarily for entities operating in ‘digital’ sectors). 

How to apply to be registered?

An application for entry in the register must be submitted electronically via the S46 system. The module for submitting applications is now available at: wykaz-ksc.gov.pl. 

The application must contain almost 20 different types of information, including the number in the relevant regulated activity register, if assigned, the range of public IP addresses used on a continuous basis, and information on whether an agreement has been concluded with a managed security service provider. 

The application must also be accompanied by a statement in which the entity’s management confirms that the information provided is true and accurate. The statement is submitted under penalty of criminal liability. 

Other important issues 

  1. The National Cybersecurity System Act does not introduce standalone rules for corporate groups, and thus all entities meeting the relevant criteria must be entered in the register separately (including entities that provide services exclusively to members of their own corporate group). 
  1. Failure to apply does not mean that an entity falls outside the scope of the act. Registration has declaratory effect only, and failure to apply is subject to substantial administrative fines of up to EUR 10 million. 
  1. One month before the registration deadline, more than 80,000 entities had already been entered in the register – several times more than estimated by the Ministry of Digital Affairs.