NIS2 registration deadline in Poland – what companies should do

Stay up to date Add us as a preferred source on Google

Add

The NIS2 registration deadline in Poland expired on 3 October 2026 for essential and important entities that met the statutory criteria on 3 April 2026 and were required to register. Missing the deadline does not automatically result in a financial penalty, but it does not exempt companies from their other obligations under Poland’s National Cybersecurity System Act (KSC). Most financial penalties cannot be imposed until 3 April 2028, while the deadline for implementing the relevant cybersecurity requirements is 3 April 2027. Businesses should therefore verify both their registration status and their actual readiness to comply.

The NIS2 Directive (EU Directive 2022/2555), implemented in Poland through amendments to the National Cybersecurity System Act (KSC), introduces new requirements for information systems security and cybersecurity risk management. The legislation applies to certain businesses operating in sectors critical to the economy, including energy, transport, healthcare, digital infrastructure and selected manufacturing industries.

For companies within the scope of the legislation, the end of the initial registration period marks the next stage of compliance preparations. The priority is now to determine whether existing security measures, procedures and governance arrangements meet statutory requirements. A NIS2 compliance audit in Poland can support this assessment by identifying areas requiring improvement.

For further information on the scope of the legislation and business obligations, read our article: NIS2 in Poland: who it applies to, what obligations it creates and how to prepare your company.

In this article:

The KSC registration deadline has passed. What does this mean for businesses?

The initial self-registration period for Poland’s Register of Essential and Important Entities (KSC Register) ended on 3 October 2026. The deadline applied to organisations that already met the statutory criteria on 3 April 2026 and continued to meet them before the registration deadline.

However, not every company operating in a sector covered by NIS2 is required to register independently. Factors such as the type of services provided, company size and specific statutory criteria determine whether the obligation applies.

Certain organisations, including telecommunications operators and other specified categories of entities, are entered into the register by the competent authorities. Businesses that began meeting the criteria only after the amendments entered into force generally have six months from the date they first meet those criteria to register.

The first step for a company that has not registered should therefore be to establish whether registration was mandatory and when that obligation arose. If the business was required to register independently, it should complete the outstanding registration through the KSC Register without delay.

NIS2 registration is only the beginning of compliance obligations

Registration in the KSC Register is a formal step towards meeting statutory requirements. However, it does not automatically mean that a company complies with all applicable cybersecurity obligations.

An organisation may have completed its registration correctly but still lack appropriate risk management procedures, security documentation or effective incident response arrangements. The reverse is also possible: a business may have extensive technical safeguards in place while failing to meet certain organisational and formal requirements.

NIS2 compliance therefore requires an assessment of the entire cybersecurity management framework, rather than simply checking registration status.

Which areas should companies review?

Businesses subject to the legislation should examine the following areas in particular:

Risk management – how threats are identified, their potential business impact assessed and appropriate security measures selected.
Incident management – procedures for detecting, responding to and reporting cybersecurity incidents.
Business continuity – the organisation’s ability to maintain or restore critical operations following a disruption.
Supplier security – assessment of risks associated with external providers and IT services.
Documentation and management accountability – arrangements for cybersecurity oversight, approval of required measures and monitoring their effectiveness.

Having security controls in place is not sufficient in itself to demonstrate regulatory compliance. These measures must also be documented, applied in practice and periodically assessed for effectiveness.

NIS2 from a board-level perspective – cybersecurity as part of risk management

Implementing NIS2 should not be treated solely as an IT department responsibility. The new regulations also require appropriate management oversight and closer integration of information systems security with business continuity.

For example, a manufacturing company may have network security controls, backup systems and access management procedures but lack a formally defined response to a cybersecurity incident affecting a critical technology supplier. In such circumstances, the problem may not be the absence of a particular IT solution, but rather insufficient integration of existing safeguards into the company’s risk management processes.

This hypothetical example illustrates why technical security and regulatory compliance should be assessed together, without treating them as interchangeable concepts.

For company boards, three priorities are particularly important: determining the scope of applicable obligations, identifying compliance gaps and assigning responsibility and deadlines for addressing them.

Can failure to register with the KSC lead to penalties or inspections?

Failure to meet a mandatory registration deadline constitutes a breach of the legislation, but it does not automatically trigger a financial penalty.

Most financial penalties introduced by the amended KSC Act cannot be imposed until 3 April 2028. The competent authority determines whether a penalty is appropriate, taking into account the circumstances of the particular infringement. However, this does not mean that businesses are exempt from regulatory oversight until that date.

The competent cybersecurity authorities may already verify compliance, conduct inspections, request documentation and apply supervisory measures provided for under the legislation.

Where a company meets the criteria for classification as an essential or important entity but has not submitted the required application, the competent authority may also enter it into the KSC Register on its own initiative.

The legislation also provides for an extraordinary financial penalty of up to PLN 100 million, which is not subject to the general postponement of penalties until 2028. This penalty may be imposed on an essential or important entity where a breach creates a direct and serious cyber threat to national defence, state security, public safety and order, or human life and health, or threatens serious financial damage or significant disruption to service provision.

Simply missing the registration deadline does not automatically satisfy the conditions for imposing such a penalty.

For businesses, the central point is that postponing most financial penalties does not postpone all obligations arising from NIS2.

NIS2 compliance audit – how can companies assess their readiness?

Following the registration deadline, businesses should focus not only on completing any outstanding formalities but also on their actual readiness to meet statutory requirements.

A NIS2 compliance audit in Poland enables companies to compare their existing organisational and technical measures against the requirements of the NIS2 Directive and Poland’s KSC Act.

The assessment may cover documentation, security procedures, incident management, information systems protection and governance mechanisms. Audit findings help identify gaps in existing arrangements, assess their significance and develop a structured remediation plan.

When should a company conduct a NIS2 compliance audit?

An assessment is particularly relevant when a business:

is uncertain whether its existing measures meet statutory requirements;
has security procedures in place but has not conducted a comprehensive review;
is preparing for upcoming deadlines under the KSC Act;
needs a structured action plan with clearly defined priorities and responsibilities.

It is important to distinguish between a voluntary readiness assessment and the mandatory cybersecurity audit required by the legislation for certain essential entities.

HLB Poland provides NIS2 compliance audit services in Poland, including an assessment of existing measures, identification of non-compliance and recommendations for corrective action.

This approach allows businesses to plan regulatory adjustments based on identified needs, rather than implementing changes without first assessing whether they are necessary.

Key NIS2 deadlines in Poland after 3 October 2026

The end of the initial registration period does not mark the completion of the regulatory implementation process. For businesses that met the statutory criteria from 3 April 2026, several important dates remain.

3 April 2027 – implementation of KSC obligations and commencement of S46 use

By this date, the relevant essential and important entities should have implemented requirements covering areas such as information security management and incident handling, and should begin using the S46 system.

3 April 2028 – first mandatory audit for certain essential entities

This deadline applies to essential entities that were not previously operators of essential services and that met the relevant criteria from 3 April 2026.

Existing operators of essential services remain subject to the requirement to conduct an audit at least once every three years, calculated from the date on which the previous audit report was prepared and signed. They are not covered by the extension of the first-audit deadline provided for newly classified essential entities.

3 April 2028 – most financial penalties become applicable

From this date, competent authorities will be able to impose most financial penalties introduced by the new legislation, subject to the applicable statutory conditions. The deadlines applicable to individual organisations may vary depending on their classification and when they first met the statutory criteria.

Preparing for NIS2 requires more than registration

The expiry of the KSC registration deadline should prompt businesses to assess their progress towards meeting the remaining statutory obligations. Formal registration does not, in itself, establish compliance with requirements concerning risk management and information systems security.

For company boards, the priority is to establish the organisation’s actual level of readiness, identify areas requiring improvement and plan corrective measures before the next deadlines. A NIS2 compliance audit can provide the basis for this assessment, helping businesses organise their obligations and develop a structured compliance roadmap.

Companies seeking to verify their compliance with KSC requirements can contact HLB Poland’s experts to discuss the scope of an audit and potential preparatory measures.

Sources:

If you have any further questions or require additional information, please contact your business relationship person or use the enquiry form on the HLB Poland website.

***

This publication is non-binding information and serves for general information purposes. The information provided does not constitute legal, tax or management advice and does not replace individual advice. Despite careful processing, all information in this publication is provided without any guarantee for the accuracy, up-to-date nature or completeness of the information. The information in this publication is not suitable as the sole basis for action and cannot replace actual advice in individual cases. The liability of the authors or getsix® are excluded. We kindly ask you to contact us directly for a binding consultation if required. The content of this publication iis the intellectual property of getsix® or its partner companies and is protected by copyright. Users of this information may download, print and copy the contents of the publication exclusively for their own purposes.

Missed the NIS2 registration deadline in Poland? What companies should do next