Poland transposed NIS2 through amendments to the Act on the National Cybersecurity System (Krajowy System Cyberbezpieczeństwa, UKSC). The Sejm passed the amendment on 23 January 2026; it has been in force since 3 April 2026. Key and important entities self-register on the list the Minister of Digital Affairs keeps in the S46 system, within six months of meeting the criteria. Supervision sits with sector competent authorities — the financial supervisor (KNF) for banking, the energy minister for energy — while the three national CSIRTs (CSIRT NASK, CSIRT GOV and CSIRT MON) handle incident reports, allocated by type of entity, NASK taking most companies. Serious incidents are reported electronically through S46, which routes them to the competent CSIRT on the directive’s 24-hour / 72-hour / one-month ladder. The amendment also lets the Minister of Digital Affairs designate a hardware or software supplier as high-risk, after which covered entities may not deploy its products or services — a power not yet used as of August 2026.
- 3 Apr 2026Amended Act on the National Cybersecurity System in force (signed 19 February, published 2 March 2026).
- 3 Oct 2026Registration window closed for entities in scope on day one (six months from entry into force); later entrants have six months from meeting the criteria.
- 3 Apr 2027Information-security management system in place and the entity connected to the S46 system (twelve months from entry into force).
- 3 Apr 2028First audit due for key entities (24 months from entry into force) — also the earliest date for fines, an extraordinary penalty aside.
The ministry’s own FAQ on the national cybersecurity system (KSC), in Polish — who supervises whom, registration on the S46 list, and the deadlines that follow. Registration and incident reports themselves go through the S46 system.