A five-person IT company configures a firewall and provides remote support to a single client. It sounds like a typical maintenance contract. Yet under the NIS2 regime, that company may be an essential entity — subject to the strictest supervision and required to report incidents within 24 hours. Size thresholds do not apply in this category.
And no one will notify it. Because under NIS2, there are no invitations — only questions from the competent authority, usually after the deadline has already passed.
Poland’s implementation of NIS2 entered into force on 3 April 2026 under the Act of 23 January 2026 (Journal of Laws 2026, item 252). The deadline for companies meeting the criteria on the date the amendment entered into force to apply for entry in the register of entities expired on 3 October 2026. If you have not yet checked whether your company is subject to the rules, this article will take you through the NIS2 qualification test step by step. I will show you why PKD codes can be misleading, where the grey areas lie, and how to document the outcome of your analysis — whether positive or negative.
Key concepts before you begin the test
Before you move on to the qualification test, establish the meaning of several concepts. Without doing so, they can easily be misinterpreted.
| Concept | What it means | Why it matters |
|---|---|---|
| Self-identification | The company determines for itself whether it meets the statutory criteria — the competent authority does not issue notices | The obligation arises by operation of law, not through a decision by the competent authority |
| Essential entity | A company in a sector listed in Annex I (e.g. energy or digital infrastructure) that meets the size thresholds or falls within a category with no threshold | Proactive supervision — the competent authority may inspect without waiting for an incident; the highest penalties apply |
| Important entity | A company in a sector listed in Annex I or II that meets the thresholds but does not meet the criteria for an essential entity | Reactive supervision — the competent authority responds after an incident; lower maximum penalties apply |
| KSC register | The statutory name of the electronic register of essential and important entities | Registration is declaratory — it confirms the entity’s status but does not create it |
| SME thresholds (Recommendation 2003/361/EC) | Micro/small: <50 employees and ≤EUR 10 million in turnover; medium-sized: 50–249 employees or turnover of EUR 10–50 million; large: ≥250 employees or turnover >EUR 50 million | Linked and subsidiary enterprises must be counted together |
| Managed service provider | A company that remains involved in the client’s environment after implementation: administering, monitoring and updating it | The dividing line: a one-off implementation does not qualify; ongoing administration does |
| Managed security service provider | SOC, SIEM, IAM, backup and DR, testing, audits and incident response for a client | Qualification regardless of size and immediate classification as an essential entity |
How NIS2 works — the mechanism that catches companies off guard
The NIS2 regime does not operate like a register that companies voluntarily sign up for. It works like a tax: the obligation arises by operation of law as soon as the relevant criteria are met. A company must identify itself and apply for entry in the KSC register on its own initiative.
This creates an asymmetry in the cost of getting it wrong:
| Scenario | Consequence |
|---|---|
| You decide that the rules do not apply when they do | You are retrospectively liable for the entire period: failure to register, failure to report incidents and failure to implement risk-management measures |
| You decide that the rules apply when they do not | You voluntarily pay for a regime that does not apply to you — incurring organisational and financial costs as well as ongoing supervision |
The deadline for applying for registration is 6 months from the date on which the criteria are met (Article 7c(1) of the KSC Act). The deadline runs from the moment the criteria are actually met — not from the day you become aware of it.
Liability is personal. Article 8c(1) of the KSC Act states explicitly: the head of the entity is responsible for fulfilling cybersecurity obligations. Where the management board has multiple members and no specific person has been designated as responsible, all members are liable (Article 8c(2)). Entrusting the duties to another person does not release the head of the entity from liability (Article 8c(3)).
This is not the IT department’s responsibility. It is the management board’s responsibility.
The PKD code trap — two myths that need to be debunked
Before moving on to the test, let us clear up the most common misconception. PKD codes are not a statutory criterion for NIS2 qualification.
Myth 1: “Our articles of association include a code from the list — so the rules apply to us.”
Not necessarily. A PKD code does not create an obligation. What matters is the business activity actually conducted.
Myth 2: “We do not have any codes from the list — so the rules do not apply to us.”
That is also incorrect. The absence of a code does not exempt you if you actually conduct an activity covered by the annexes.
As confirmed by the Ministry of Digital Affairs, self-identification requires an analysis of your activities under Article 5 of the KSC Act and Annexes 1 and 2. PKD codes are merely indicative.
What PKD codes actually do
PKD codes are a screening tool used by the competent authority. They do not determine the outcome, but they do determine whom the competent authority will approach. If your articles of association include code 62.20.A (cybersecurity activities), you will be among the first to attract attention, even if you do not actually conduct that activity.
The problem with the National Court Register: you see 10 codes, but you have 25
The National Court Register discloses a maximum of 10 PKD codes. In one case we analysed, the company’s articles of association contained 25 entries — and among the 15 not visible in the register were precisely those that raised questions about NIS2.
That is why the first step in the test is to obtain the complete list of codes from the articles of association or statute, not from an extract from the National Court Register.
There is an additional risk: many companies now have a list of codes in their articles of association that was recently copied across when transitioning to PKD 2025 (Journal of Laws 2024, item 1936) — without considering what those codes imply under the NIS2 regime. From 1 January 2027, entities that have not updated their codes will be reclassified automatically according to the Statistics Poland correspondence table — and that table includes one-to-many relationships, which may expose discrepancies.
Contact us — we will help you complete the NIS2 qualification test and document the outcome.
The NIS2 qualification test in 8 steps
You can apply the following test to your own company. After each step, you will know whether to continue or whether you already have your answer.
Step 1: obtain the complete list of PKD codes from the articles of association
Do not use an extract from the National Court Register. Mark each entry as: conducted / not conducted. If you have codes for activities that you do not actually conduct, make a note of this. Consider adopting a resolution to remove unnecessary codes (procedure: shareholders’ resolution, notarial deed, filing with the National Court Register — Article 255 § 3 of the Commercial Companies Code).
Step 2: check whether your activity falls within Annex I or II
Annex I covers sectors of high criticality:
| No. | Sector |
|---|---|
| 1 | Energy |
| 2 | Transport |
| 3 | Banking |
| 4 | Financial market infrastructures |
| 5 | Health |
| 6 | Drinking water |
| 7 | Wastewater |
| 8 | Digital infrastructure |
| 9 | ICT service management (B2B) |
| 10 | Public administration |
| 11 | Space |
Annex II covers, among other things: postal and courier services, waste, chemicals, food, manufacturing, digital providers and research organisations.
Note for IT companies: “digital infrastructure” may sound as though it covers every IT company, but it applies to specific roles: IXPs, DNS service providers, TLD name registries, cloud computing services, data centres, CDNs, trust services, and public electronic communications networks and services. A software development company is none of these — until it starts doing something in addition to developing software.
Step 3: check your regulatory status within your sector
In some sectors, qualification is determined by regulatory status (a licence, permit or entry in a register of regulated activities), rather than by the industry itself. Look for the answer in the relevant sector-specific legislation, not in the KSC Act.
Example: electricity generation is covered by the regime only where it is carried out by a licensed energy undertaking. Article 32(1)(1)(c) of the Energy Law exempts micro-installations and small installations from the licensing requirement. Without a licence, there is no qualification under the “electricity” category, regardless of code 35.11.Z.
However, expanding an installation to a size that requires a licence changes its status. And no one will remind you of this.
Step 4: take stock of your maintenance contracts
Ask one question about each contract: do you remain involved in the client’s environment after implementation? Accounts, configuration, updates, monitoring, backup, remote administrative access — every “yes” makes you a potential managed service provider.
The dividing line is clear: implementation alone does not qualify. Subsequent ongoing administration of the client’s environment does.
Step 5: check the categories with no size threshold
This is the point most commonly overlooked. The following categories qualify regardless of the size of the company:
| No. | Category | Status |
|---|---|---|
| 1 | Managed security service providers | Essential entity |
| 2 | Trust service providers | Essential entity |
| 3 | TLD name registries | Essential entity |
| 4 | DNS service providers | Essential entity |
| 5 | Providers of public electronic communications networks and services | Essential entity |
| 6 | Public administration entities | Essential entity |
Check whether anywhere in your business — even in a single isolated case and outside your core business — you provide or support cybersecurity risk management for a client: incidents, testing, audits, consulting, SOC, SIEM, IAM, backup and DR, or threat monitoring.
Passive firewall monitoring alone is not enough. What matters is whether you actually intervene in the client’s system security management process.
But “we act as the IT department for one client” — configuring servers, a UTM appliance and a firewall, plus providing remote support — is, on a prudent assessment, more likely to constitute a managed security service. And that means essential-entity status regardless of the company’s size.
Step 6: calculate the size thresholds, taking the group into account
The thresholds must be calculated in accordance with Commission Recommendation 2003/361/EC:
| Category | Employees | Annual turnover | Balance sheet total |
|---|---|---|---|
| Micro/small | <50 | ≤EUR 10 million | ≤EUR 10 million |
| Medium-sized | 50–249 | EUR 10–50 million | EUR 10–43 million |
| Large | ≥250 | >EUR 50 million | >EUR 43 million |
Employee headcount is a standalone criterion. Turnover and balance sheet total are alternative criteria.
The most common mistake: failing to include linked and subsidiary enterprises. A company with 20 employees in a corporate group may exceed the thresholds when counted together with the group. The Recommendation distinguishes between autonomous, partner and linked enterprises — links through natural persons result in data aggregation where the market criterion (the same or an adjacent market) and a relationship of control are both present.
A change in status occurs after the thresholds have been exceeded or no longer exceeded for two consecutive accounting periods — exceeding a threshold once during the year does not automatically result in immediate qualification.
Step 7: establish who provides the service to the end user
For each product, answer the following question: who determines and accepts the terms of service in relation to the end user — you or your client?
Example: a developer of software for local authorities supplies a local government unit with a portal through which residents can view amounts due and make payments. The terms of service are prepared and accepted by the local government unit. The supplier provides and operates the tool — the local government unit provides the service. The supplier is not a “provider of a social networking services platform” because the platform enables communication with the authority, not between citizens.
This is an evidentiary criterion — document it.
Step 8: document the outcome — including a negative one
A conclusion that “the rules do not apply to us” has a date. If you do not record what that conclusion depends on, two years later no one in the company will know that a new maintenance contract brings the company within the regime.
Document the outcome in the form of a legal opinion setting out the assumptions on which it is based. This serves simultaneously as:
- A defensive document in case the competent authority raises questions
- A list of conditions requiring reassessment
- A basis for identifying events that trigger a repeat of the test
Grey areas — where the answer is not clear-cut
With newly enacted legislation and no case law or established practice from the competent authorities, some qualifications remain open to interpretation. There are no confirmed Polish decisions by competent authorities or court judgments resolving the boundaries described below — each qualification requires an analysis of the actual scope and continuity of the services and the service provider’s responsibilities.
Incidental colocation and hosting
A company keeps physical servers at its own premises and hosts several clients’ environments on them. It also rents racks to third parties as a secondary activity. The incidental nature of that activity does not prevent qualification — this constitutes a data centre service provider (making server infrastructure available to third parties together with its operation: power supply, cooling and maintenance).
A powered-shell model (where the client manages everything independently and the company provides only power and cooling) and resources used exclusively by the company itself do not qualify.
Implementation vs. managed service
Implementing a system for a client does not by itself make the company a managed service provider. But if the company remains involved after implementation — configuring, updating and monitoring the system and retaining remote administrative access — the line has been crossed. An editorial change to the contract without any change to what you actually do in the client’s environment does not change the qualification.
In-product chat and telecommunications
Four telecommunications codes (61.10.A, 61.10.B, 61.90.A, 61.90.B) included “just in case” raise questions about the provision of networks and interpersonal communications services. If your product includes a user-to-user communication feature, check whether you fall within the definition of an electronic communications service.
Research codes and R&D tax relief
Codes 71.20.C and 72.10.Z in the articles of association, combined with the use of R&D tax relief where research is conducted exclusively for the company’s own purposes, do not make it a research organisation under Annex II. But that is how it looks on paper. Prepare a description of whose needs your R&D work serves — this will be the competent authority’s first question.
Electronic signatures within a system
Internal acceptance of a “system signature” is not a trust service. A qualified signature on decisions issued externally is — but the trust service provider is the external qualified provider whose libraries are used by the system (e.g. within the meaning of the eIDAS Regulation), not the system’s developer.
What you must implement after registration
If the qualification test produced a positive result, the following obligations arise under the KSC Act:
| No. | Obligation | Deadline / frequency |
|---|---|---|
| 1 | Entry in the KSC register | 6 months after the criteria are met |
| 2 | Implementation of an information security management system (ISMS) | By 3 April 2027 (for entities meeting the criteria on the date the amendment entered into force) |
| 3 | Risk analysis and security policies | Ongoing, with updates |
| 4 | Incident response: early warning | Within 24 hours of detection |
| 5 | Significant incident notification | Within 72 hours of detection |
| 6 | Final incident report | 1 month |
| 7 | Business continuity, backup and recovery | Ongoing |
| 8 | Supply chain security | Ongoing, in contracts with suppliers |
| 9 | Vulnerability management | Ongoing |
| 10 | Cryptography, access control and MFA | Ongoing |
| 11 | Cybersecurity training for the head of the entity (Article 8e) | Once per calendar year, documented |
| 12 | Certificate of no criminal record from the National Criminal Register for persons performing cybersecurity tasks (Article 8f) | Before being authorised to perform tasks; also applies to subcontractors |
| 13 | Connection to the S46 system | By 3 April 2027 |
| 14 | First audit (essential entities not previously designated as operators of essential services) | By 3 April 2028 |
Supply chain security obligations are passed on contractually to ICT suppliers. Article 21(2)(d)–(e) of the NIS2 Directive covers relationships with direct suppliers. A contracting entity subject to NIS2 must obtain appropriate assurances from the supplier regarding data location, encryption, vulnerability management and arrangements for returning data after the relationship ends.
You may not be directly subject to the Act but still be subject to its requirements — through a contract rather than through the register.
Events that invalidate your assessment
The outcome of the qualification test has a shelf life. Draw up a closed list of events that trigger a repeat of the test, assign responsibility for it to a specific person and set a review schedule:
| No. | Triggering event | What to reassess |
|---|---|---|
| 1 | A new client under a maintenance contract (ongoing administration) | Step 4 — managed service provider |
| 2 | A new security service (even if provided only once) | Step 5 — category with no size threshold |
| 3 | Exceeding an employee threshold (50 or 250 people) | Step 6 — SME thresholds |
| 4 | Joining a corporate group or a change in ownership structure | Step 6 — linked enterprises |
| 5 | Expansion of an installation (e.g. a photovoltaic installation) resulting in a licensing requirement | Step 3 — regulatory status |
| 6 | Launch of hosting or colocation services for third parties | Step 4 — data centre |
| 7 | Addition of an in-product user-to-user communication feature | Step 7 — electronic communications service |
How we can help
The NIS2 qualification test requires three layers to be compared: the contents of the articles of association, the actual scope of the company’s activities and the statutory requirements. In grey areas — and there are many under newly enacted legislation — a prudent assessment requires a technical analysis of the actual scope of the services, not merely a reading of the contract.
We conduct the NIS2 qualification test using a questionnaire and interview. We document the outcome in a legal opinion setting out the underlying assumptions — serving both as a defensive document in dealings with the competent authority (including where the outcome is negative) and as a list of conditions requiring reassessment.
Three levels of engagement:
| Level | Scope | Who it is for |
|---|---|---|
| Operational minimum | Review of the PKD codes listed in the articles of association against the activities actually conducted, plus a preliminary qualification assessment | Companies that want to determine quickly whether the issue affects them |
| Solid foundation | Full qualification test, including an analysis of disputed concepts, calculation of group-level thresholds, a legal opinion setting out the assumptions and a register of triggering events | Companies operating in grey areas or with an extensive list of PKD codes |
| Comprehensive protection | As above + restructuring of maintenance contracts and supply chain clauses, a resolution streamlining the company’s objects, implementation of obligations under Articles 20, 21 and 23 of NIS2, and management board training | Companies that are subject to the rules and need end-to-end implementation |
NIS2 self-identification is a management board decision, not an IT decision
NIS2 does not ask whether you want to be subject to it. It asks whether you meet the criteria. The obligation arises by operation of law, and responsibility for identifying it rests personally with the management board — delegation offers no protection (Article 8c(3) of the KSC Act).
Three things to do now:
- Obtain the complete list of PKD codes from the articles of association and compare it with the activities actually conducted
- Take stock of your maintenance contracts — any ongoing administration of a client’s environment is a potential qualifying activity
- Document the outcome of the analysis — including a negative one — together with the assumptions and a list of triggering events
If you need support with the qualification analysis, restructuring contracts or implementing NIS2 obligations — contact us.
Frequently asked questions
We are a 40-person software house — does NIS2 apply to us at all?
Software development alone does not qualify. But check three things: whether you remain involved in the client’s environment after implementation (managed service), whether you support the client’s security management in any way (a category with no size threshold), and whether you host client environments on your own infrastructure (data centre). Every “yes” triggers further analysis.
Our articles of association include a cybersecurity code, even though we do not conduct that activity. Should we remove it?
The code itself does not create an obligation, but it attracts the competent authority’s attention during a review. Consider adopting a resolution to remove the code — this requires a notarial deed and registration with the National Court Register. Bear in mind two side effects: returning to that activity would require another amendment to the articles of association, while an extensive list of codes for activities not actually conducted undermines the credibility of the entire self-identification process.
We act as the “IT department” for one client for a few thousand per month. Could that make us an essential entity?
Yes — if the scope includes configuring a firewall and UTM appliance, remote administration and monitoring. On a prudent assessment, this is more likely to constitute a managed security service, and that category qualifies regardless of size and results in immediate essential-entity status. The determining factor is a technical analysis of the actual scope, not a reading of the contract.
We are part of a corporate group — do we count our 20 employees or the entire group?
The entire group. Recommendation 2003/361/EC requires the aggregation of data from linked and subsidiary enterprises. A company with 20 employees in a group may exceed the thresholds when counted together with the group. This is the most common self-identification error. Links through natural persons result in data aggregation where the market criterion (the same or an adjacent market) and a relationship of control are both present.
Our largest client is subject to NIS2 and has sent us an addendum containing security requirements. Do we have to sign it if we are not subject to NIS2 ourselves?
The statutory obligation does not apply to you, but the contractual obligation does. Article 21(2)(d)–(e) of the NIS2 Directive covers supply chain security. An entity subject to NIS2 remains responsible for risk management even after outsourcing ICT services — which is why it will require assurances from you. Review the addendum with regard to the scope of liability, data location, vulnerability management rules and the conditions for returning data.
What document protects the management board if the analysis produces a negative outcome?
A legal opinion setting out the assumptions on which the outcome is based. It should state what activities you actually conduct, why you do not meet the criteria and which events would invalidate the conclusion. It serves as a defensive document in case the competent authority raises questions and as a list of conditions requiring reassessment. An internal memo without legal analysis offers no protection — omitting facts from the qualification questionnaire shifts all responsibility onto the management board.
