Article partially generated by artificial intelligence.
TL;DR: KSC NIS2 Poland compliance runs through one law: the amended Act on the National Cybersecurity System (KSC), which implements the NIS2 directive and covers around 38,000 Polish companies and institutions. Registration in the KSC register closed on 3 October 2026. The deadline that matters most is still ahead: by 3 April 2027, essential and important entities must have their risk-management measures in place, including an information security management system. Those duties reach the applications a company runs every day: the customer portal, the ordering system, the ERP integration and the tools staff built themselves. This article explains what to do with that software and in what order.
The KSC Act is one piece of a bigger picture. For what NIS2 and the EU Cyber Resilience Act require from any company that owns software, see our guide to NIS2 and the Cyber Resilience Act for companies that own software. Here we focus on the Polish law and what it means for applications.
Key facts:
The amended KSC Act splits companies in scope into essential and important entities. Sector and size decide which group a company belongs to. The Act covers medium and large enterprises, meaning at least 50 employees or more than €10 million in annual turnover, in the sectors listed in its annexes. They include energy, transport, banking, health, drinking water and wastewater, digital infrastructure, ICT service management, waste management, food and chemicals production, and the manufacture of electrical equipment, electronics, machinery and vehicles. Some entities, such as DNS service providers, are covered regardless of size.
An essential entity is usually a large company in a highly critical sector. An important entity is a company in scope that does not meet the essential criteria. Both groups share the same risk-management duties, but supervision differs: essential entities face mandatory audits and higher fines.
No authority hands out a decision. Each company assesses for itself whether it is essential or important and applies to be entered in the KSC register kept by the Minister of Digital Affairs. A company that should have registered by 3 October 2026 and did not should speak to its legal adviser as soon as possible, because failing to register carries penalties.
By the end of 2026, a company in scope should have two formal steps behind it. The first is the entry in the KSC register, which records the entity’s details, sector, contacts and services. The second is a connection to S46, the national system used to report incidents and communicate with CSIRT teams.
Both steps are easy compared with what comes next. Reporting an incident requires noticing it first. If an application keeps no event logs, nobody watches sign-ins and every former contractor still knows the admin password, a company may learn about a breach from the press. That is why the technical side of KSC NIS2 Poland compliance starts with applications, not forms.
The KSC Act brings the risk-management measures from Article 21 of NIS2 into Polish law. The central one is the information security management system (Article 8 of the Act). An ISMS sounds like paperwork, but much of its substance is about software. For a company’s applications, it means seven areas:
Each area can be described in a policy in an evening. Under KSC NIS2 Poland rules, checking whether the application actually behaves the way the policy says is harder, and that is exactly what an auditor, or a regulator after an incident, will ask about.
About five months remain until the main KSC NIS2 Poland deadline. That is enough if the work starts now and runs in the right order.
| Period | What to do | Outcome |
| November–December 2026 | Inventory applications, assign owners, confirm who holds the source code and server access | Application list ranked by criticality |
| January 2027 | Technical review of the most important applications: access, secrets, dependencies, cloud and database configuration, logging | Prioritised list of vulnerabilities |
| February 2027 | Fix critical issues, roll out multi-factor authentication, rotate keys | No open high-risk flaws |
| March 2027 | Vulnerability handling process, updated supplier contracts, a tested backup restore, ISMS documentation | Evidence of implementation for the auditor |
| By 3 April 2027 | Management review and sign-off | Ready for supervision |
The most common mistake is the reverse order: documents first, application review later. Policies then describe a state that does not exist, and code fixes force a rewrite of the documents. It is better to start with what is there and document what has been fixed.
The amendment moves responsibility for cybersecurity to the top of the company. The head of the entity is accountable for meeting the duties, must complete risk-management training (Article 8e) and can be fined personally. The company itself faces high penalties too: NIS2 sets maximum fines of €10 million or 2% of worldwide turnover for essential entities and €7 million or 1.4% for important entities.
In most cases, administrative fines can only be imposed from April 2028. That does not make the risk zero in the meantime. An incident in 2027 still has to be reported, and the regulator will check whether the company implemented the required measures on time. For a board member, the simplest protection is evidence that the applications were reviewed and the issues found were fixed.
Essential entities must commission, at their own cost, a security audit of their information system at least every three years, with the first one due by 3 April 2028. An independent auditor with the required qualifications carries it out. Important entities have no cyclical audit duty, but the regulator can inspect them, especially after an incident.
A statutory audit and a technical review of applications are different things. The auditor assesses the management system and may ask for evidence such as security test results or a code review report. A company that arrives with that report and a list of fixed vulnerabilities is in a much stronger position than one that brings only a policy.
Application reviews at companies preparing for KSC NIS2 Poland compliance keep turning up the same problems. The first is shared accounts: one admin login for a whole department and its former contractors. The second is secrets in code, meaning database passwords and API keys stored in the repository, often for years. The third is outdated libraries with known vulnerabilities that nobody updates because the application “works”. The fourth is missing logs: the application does not record who signed in or what they changed, so an incident can neither be detected nor investigated.
The fifth is backups that nobody has ever restored. The sixth is missing source code, when the application was built by a contractor the company can no longer reach.
Each of these problems can be fixed in days or weeks, but only once someone has found it. That is why a technical application review belongs at the start of KSC NIS2 Poland preparation, not just before the audit or after the first incident.
Sanddev reviews the code, configuration and infrastructure of your applications, writes a board-level report mapped to the KSC Act’s requirements, and then fixes what it finds or takes over maintenance from the previous vendor. See how a technical application review ahead of a KSC audit works. We do not give legal advice: whether you are an essential or important entity is for your lawyers to assess, and we are happy to work alongside them.
It is shorthand for Poland’s implementation of the NIS2 directive through the amended Act on the National Cybersecurity System (KSC). The amendment (Journal of Laws 2026, item 252) applies from 3 April 2026 and covers around 38,000 entities.
Essential and important entities must implement risk-management measures, including an information security management system, by 3 April 2027. Essential entities must complete their first audit by 3 April 2028.
An essential entity is usually a large company in a highly critical sector; it faces mandatory audits and higher fines. An important entity has the same risk-management duties but lighter supervision.
S46 is Poland’s national system for reporting incidents and exchanging information with CSIRT teams. Entities covered by the KSC Act report incidents through it.
Yes. A company is responsible for the security of the systems it uses, including those bought from or built by an outside supplier. That is why the Act requires supplier assessments and security terms in contracts.
It applies to entities established or providing services in Poland in the covered sectors, including Polish subsidiaries of foreign groups. A group with operations in several EU countries should also check each country’s own NIS2 law.
OWASP Top 10 is the list of the most serious risk categories in web applications. AI-built apps, for example in Lovable on a Supabase database, usually fail exactly where it says – above all in access control. Here is a 12-point checklist to run before an auditor asks.
Third-party risk management is now a legal duty for companies covered by NIS2. Supply chain security is one of the minimum risk-management measures in the directive, and it reaches the companies that write, maintain and host your software.
An SBOM (software bill of materials) is a list of the libraries, modules and versions a product is built from. From 11 December 2027, the Cyber Resilience Act requires manufacturers of products with digital elements to draw up an SBOM in a commonly used, machine-readable format covering at least top-level dependencies.
