Does my company fall under the KSC/NIS2 Act? Qualification test and what to do after the registration deadline

The amended Act on the National Cybersecurity System (ustawa o krajowym systemie cyberbezpieczeństwa, KSC), which implements the NIS2 directive, has been in force since 3 April 2026. The first hard deadline has already passed: companies that have qualified as an essential or important entity since that day had to file their application for registration in the register by 3 October 2026. If your company did not, registration is still mandatory, and the next deadline, 3 April 2027 for implementing an information security management system, runs whether or not the company is in the register. But first you need to establish whether the Act covers you at all. Here is how to check.

What is the difference between the KSC Act and the NIS2 directive, and why does the Act matter?

The NIS2 directive (2022/2555) is an EU act addressed to Member States, not directly to companies. A Polish company's obligations stem from the national act that implements the directive. In Poland this is the Act of 5 July 2018 on the National Cybersecurity System, as amended by the Act of 23 January 2026 (Journal of Laws (Dz.U.) 2026, item 252), which entered into force on 3 April 2026.

In practice this means you check the catalogue of sectors, thresholds, deadlines and penalties in the Act and its annexes, not in the directive. The directive is useful for interpretation, but it does not replace the Act.

What two conditions must you meet together to fall under KSC?

As a rule, the Act covers a company that meets both of the conditions below:

1. Sector. The company carries out an activity listed in Annex 1 (essential sectors) or Annex 2 (other critical sectors) to the Act.
2. Size. The company is at least a medium-sized enterprise under the EU thresholds: a medium-sized enterprise has fewer than 250 employees and an annual turnover of up to EUR 50 million, or a balance sheet total of up to EUR 43 million. Micro and small enterprises (fewer than 50 employees and turnover or a balance sheet total of up to EUR 10 million) generally fall outside the Act.

Annex 1 covers: energy (including electricity, gas, hydrogen and nuclear energy), transport (air, rail, water, road), banking and financial market infrastructure, healthcare, drinking water and wastewater, digital infrastructure (including electronic communications), ICT service management, space, and public entities.

Annex 2 covers: postal services, waste management, chemicals, food, selected branches of manufacturing (medical devices, electronics and optics, electrical equipment, machinery, vehicles and other transport equipment), digital service providers, research, and some public entities.

For technology companies, two items in Annex 1 matter most:

• “Digital infrastructure” covers, among others, cloud computing service providers, data centre service providers and content delivery networks. The Act defines a cloud computing service provider broadly: an entity providing a service that gives access to a scalable and elastic pool of computing resources shared among multiple users (Art. 2(4e)). A SaaS provider should therefore check whether its service fits this definition, rather than assuming that “cloud” means only hosting.
• “ICT service management” covers managed service providers and managed cybersecurity service providers. A software house that maintains and operates its clients' systems can fall into this category. Custom software development on its own is not a separate type of entity in the annexes.

Can a company with fewer than 50 employees still fall under KSC?

Yes. This is the most common trap in self-assessment, and it arises in two situations.

• Corporate group. The EU size thresholds are counted together with affiliated and partner enterprises. A 45-person company that belongs to a group employing 400 people is usually not a small enterprise. Counting only the company on its own is a quick route to the wrong conclusion that “this doesn't apply to us”.
• Entities covered regardless of size. The Act covers certain entities regardless of headcount and turnover. These include DNS service providers, top-level domain name registries and domain registration services, qualified trust service providers, critical entities within the meaning of the CER directive, designated public entities, and entities recognised as essential or important by an administrative decision. In electronic communications, obligations also apply to micro and small enterprises (as important entities).

Essential or important entity - does it change your obligations?

In simplified terms: an essential entity is above all a large enterprise from a sector in Annex 1, plus the entities in the “regardless of size” catalogue. An important entity is a medium-sized enterprise from Annex 1, and a medium-sized or large enterprise from Annex 2.

The catalogue of obligations is similar for both categories: registration, an information security management system (ISMS), incident reporting, management training. The differences mainly concern:

• penalties: up to EUR 10 million or 2% of revenue for an essential entity, up to EUR 7 million or 1.4% of revenue for an important entity (in both cases the higher amount applies),
• audit: an essential entity undergoes a mandatory audit, the first one within 24 months of meeting the criteria,
• supervision: it is more intensive for essential entities.

How does registration in the S46 system work?

1. Self-assessment. Start with the government questionnaire “Check whether your company is subject to NIS2/KSC” on biznes.gov.pl. The questionnaire does not replace a proper analysis, but it quickly shows whether the topic applies to you at all.
2. Data for the application. Prepare: the company's basic details, contact persons, the person who will administer the company's account in the S46 system, and the ranges of IP addresses and domains the company uses. Gathering that last list takes the most time.
3. Filing the application. The application is filed electronically in the S46 system run by the minister for digital affairs. It is signed by the head of the entity or an authorised person: with a qualified electronic signature, a trusted signature (profil zaufany), or a personal signature. A qualified electronic seal can also be used.

Some entities - including telecommunications undertakings, trust service providers, public entities and former essential service operators - are registered ex officio. They receive a request to complete their data and have 6 months from its delivery to do so.

What happens to a company that did not apply for registration by 3 October 2026?

Failing to register is a breach of the Act. The authority can register the company ex officio and place it under supervision. The Ministry of Digital Affairs has announced that financial penalties for most breaches will only be imposed after 3 April 2028. The exception is an extraordinary penalty of up to PLN 100 million, provided for the most serious breaches - for example, those endangering state security or life and health.

This is not, however, a period of impunity. The deadlines for implementing an ISMS run from the date the criteria are met, not from the date of registration. A company that registers late therefore has less time for its remaining obligations. The Act also provides for the personal liability of the head of the entity: a penalty of up to 300% of their remuneration in a private entity (up to 100% in a public one), among other things for failures concerning registration, the ISMS, annual training and incident handling.

What obligations and deadlines does a company face after registration?

Deadlines are counted from the date the criteria are met. For companies covered since the Act's entry into force, they look like this:

• 3 October 2026: application for registration (6 months) - deadline passed, registration still mandatory,
• 3 April 2027: implementation of an information security management system and connection to the S46 system (12 months),
• 3 April 2028: first audit of an essential entity (24 months); from this date financial penalties can generally also be imposed.

From registration, the procedure for reporting serious incidents to the competent CSIRT via the S46 system also applies:

• an early warning within 24 hours of detecting the incident,
• a full report within 72 hours,
• a final report within a month of the report.

The head of the company must undergo cybersecurity training every year and is responsible for overseeing the ISMS. The ISMS also covers the supply chain, meaning a review of hardware and software suppliers and the agreements with them. If the same company is also a controller of personal data, a serious incident may at the same time be a personal data breach under Art. 33 GDPR, to be reported to the President of UODO (the Polish data protection authority) within 72 hours. It is worth designing a single incident-handling procedure from the outset that covers both notifications.

Checklist: 10 questions that settle the qualification

1. Does any of your activities (per PKD codes and the services you actually provide) fall within Annex 1 or 2?
2. How many people does the company employ, together with affiliated and partner entities?
3. What is the combined annual turnover and balance sheet total, counted the same way?
4. Do you provide DNS services, domain registration, or trust services?
5. Is the company an electronic communications undertaking?
6. Has the company been designated a critical entity, or received a decision recognising it as an essential or important entity?
7. Do you provide clients with cloud services, data centre services, or managed IT or security services?
8. Since when have you met the criteria: since 3 April 2026, or later? Your deadlines run from that date.
9. Who in the company will administer the S46 account, and who is authorised to sign the application?
10. Do you have an up-to-date list of IP addresses and domains, as required by the application?

If the answer to question 1 is “no”, and the answer to questions 4-7 is also “no”, the Act most likely does not cover you. Record that conclusion with a date and a rationale, though - it will come in handy if the scale of your business changes, or in a conversation with a client asking about NIS2 in the supply chain.

This article is for information purposes only and does not constitute legal advice.