{"id":5196,"date":"2026-11-09T13:51:25","date_gmt":"2026-11-09T13:51:25","guid":{"rendered":"https:\/\/sawaryn.com\/?p=5196"},"modified":"2026-11-09T13:52:37","modified_gmt":"2026-11-09T13:52:37","slug":"nis2-qualification-test-pkd-codes","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/nis2-qualification-test-pkd-codes\/","title":{"rendered":"Does Your Company Fall Under NIS2? An Eight-Step Qualification Test and the PKD Code Trap"},"content":{"rendered":"

A five-person IT company configures a firewall and provides remote support to a single client. It sounds like a typical maintenance contract. Yet under the NIS2 regime, that company may be an essential entity<\/strong> \u2014 subject to the strictest supervision and required to report incidents within 24 hours. Size thresholds do not apply in this category.<\/p>\n

And no one will notify it. Because under NIS2, there are no invitations \u2014 only questions from the competent authority, usually after the deadline has already passed.<\/p>\n

Poland\u2019s implementation of NIS2 entered into force on 3 April 2026<\/strong> under the Act of 23 January 2026 (Journal of Laws 2026, item 252)<\/a>. The deadline for companies meeting the criteria on the date the amendment entered into force to apply for entry in the register of entities expired on 3 October 2026<\/strong>. If you have not yet checked whether your company is subject to the rules, this article will take you through the NIS2 qualification test step by step. I will show you why PKD codes can be misleading, where the grey areas lie, and how to document the outcome of your analysis \u2014 whether positive or negative.<\/p>\n

Key concepts before you begin the test<\/h2>\n

Before you move on to the qualification test, establish the meaning of several concepts. Without doing so, they can easily be misinterpreted.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Concept<\/th>\nWhat it means<\/th>\nWhy it matters<\/th>\n<\/tr>\n<\/thead>\n
Self-identification<\/strong><\/td>\nThe company determines for itself whether it meets the statutory criteria \u2014 the competent authority does not issue notices<\/td>\nThe obligation arises by operation of law, not through a decision by the competent authority<\/td>\n<\/tr>\n
Essential entity<\/strong><\/td>\nA company in a sector listed in Annex I (e.g. energy or digital infrastructure) that meets the size thresholds or falls within a category with no threshold<\/td>\nProactive supervision \u2014 the competent authority may inspect without waiting for an incident; the highest penalties apply<\/td>\n<\/tr>\n
Important entity<\/strong><\/td>\nA company in a sector listed in Annex I or II that meets the thresholds but does not meet the criteria for an essential entity<\/td>\nReactive supervision \u2014 the competent authority responds after an incident; lower maximum penalties apply<\/td>\n<\/tr>\n
KSC register<\/strong><\/td>\nThe statutory name of the electronic register of essential and important entities<\/td>\nRegistration is declaratory \u2014 it confirms the entity\u2019s status but does not create it<\/td>\n<\/tr>\n
SME thresholds (Recommendation 2003\/361\/EC)<\/strong><\/td>\nMicro\/small: <50 employees and \u2264EUR 10 million in turnover; medium-sized: 50\u2013249 employees or turnover of EUR 10\u201350 million; large: \u2265250 employees or turnover >EUR 50 million<\/td>\nLinked and subsidiary enterprises must be counted together<\/td>\n<\/tr>\n
Managed service provider<\/strong><\/td>\nA company that remains involved in the client\u2019s environment after implementation: administering, monitoring and updating it<\/td>\nThe dividing line: a one-off implementation does not qualify; ongoing administration does<\/td>\n<\/tr>\n
Managed security service provider<\/strong><\/td>\nSOC, SIEM, IAM, backup and DR, testing, audits and incident response for a client<\/td>\nQualification regardless of size and immediate classification as an essential entity<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

How NIS2 works \u2014 the mechanism that catches companies off guard<\/h2>\n

The NIS2 regime does not operate like a register that companies voluntarily sign up for. It works like a tax: the obligation arises by operation of law<\/strong> as soon as the relevant criteria are met. A company must identify itself and apply for entry in the KSC register<\/a> on its own initiative.<\/p>\n

This creates an asymmetry in the cost of getting it wrong:<\/p>\n\n\n\n\n\n\n
Scenario<\/th>\nConsequence<\/th>\n<\/tr>\n<\/thead>\n
You decide that the rules do not apply when they do<\/td>\nYou are retrospectively liable for the entire period: failure to register, failure to report incidents and failure to implement risk-management measures<\/td>\n<\/tr>\n
You decide that the rules apply when they do not<\/td>\nYou voluntarily pay for a regime that does not apply to you \u2014 incurring organisational and financial costs as well as ongoing supervision<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The deadline for applying for registration is 6 months from the date on which the criteria are met<\/strong> (Article 7c(1) of the KSC Act). The deadline runs from the moment the criteria are actually met \u2014 not from the day you become aware of it.<\/p>\n

Liability is personal. Article 8c(1) of the KSC Act states explicitly: the head of the entity is responsible for fulfilling cybersecurity obligations<\/strong>. Where the management board has multiple members and no specific person has been designated as responsible, all members are liable (Article 8c(2)). Entrusting the duties to another person does not release the head of the entity from liability (Article 8c(3)).<\/p>\n

This is not the IT department\u2019s responsibility. It is the management board\u2019s responsibility.<\/p>\n

The PKD code trap \u2014 two myths that need to be debunked<\/h2>\n

Before moving on to the test, let us clear up the most common misconception. PKD codes<\/a> are not a statutory criterion for NIS2 qualification.<\/p>\n

Myth 1: \u201cOur articles of association include a code from the list \u2014 so the rules apply to us.”<\/strong>
\nNot necessarily. A PKD code does not create an obligation. What matters is the business activity actually conducted.<\/p>\n

Myth 2: \u201cWe do not have any codes from the list \u2014 so the rules do not apply to us.”<\/strong>
\nThat is also incorrect. The absence of a code does not exempt you if you actually conduct an activity covered by the annexes.<\/p>\n

As confirmed by the Ministry of Digital Affairs<\/a>, self-identification requires an analysis of your activities under Article 5 of the KSC Act and Annexes 1 and 2. PKD codes are merely indicative<\/strong>.<\/p>\n

What PKD codes actually do<\/h3>\n

PKD codes are a screening tool used by the competent authority. They do not determine the outcome, but they do determine whom the competent authority will approach<\/strong>. If your articles of association include code 62.20.A (cybersecurity activities), you will be among the first to attract attention, even if you do not actually conduct that activity.<\/p>\n

The problem with the National Court Register: you see 10 codes, but you have 25<\/h3>\n

The National Court Register discloses a maximum of 10 PKD codes. In one case we analysed, the company\u2019s articles of association contained 25 entries \u2014 and among the 15 not visible in the register were precisely those that raised questions about NIS2.<\/p>\n

That is why the first step in the test is to obtain the complete list of codes from the articles of association or statute<\/strong>, not from an extract from the National Court Register.<\/p>\n

There is an additional risk: many companies now have a list of codes in their articles of association that was recently copied across when transitioning to PKD 2025 (Journal of Laws 2024, item 1936)<\/a> \u2014 without considering what those codes imply under the NIS2 regime. From 1 January 2027<\/strong>, entities that have not updated their codes will be reclassified automatically according to the Statistics Poland correspondence table<\/a> \u2014 and that table includes one-to-many relationships, which may expose discrepancies.<\/p>\n

Contact us<\/a> \u2014 we will help you complete the NIS2 qualification test and document the outcome.<\/p>\n

The NIS2 qualification test in 8 steps<\/h2>\n

You can apply the following test to your own company. After each step, you will know whether to continue or whether you already have your answer.<\/p>\n

Step 1: obtain the complete list of PKD codes from the articles of association<\/h3>\n

Do not use an extract from the National Court Register. Mark each entry as: conducted \/ not conducted<\/strong>. If you have codes for activities that you do not actually conduct, make a note of this. Consider adopting a resolution to remove unnecessary codes (procedure: shareholders\u2019 resolution, notarial deed, filing with the National Court Register \u2014 Article 255 \u00a7 3 of the Commercial Companies Code).<\/p>\n

Step 2: check whether your activity falls within Annex I or II<\/h3>\n

Annex I covers sectors of high criticality:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
No.<\/th>\nSector<\/th>\n<\/tr>\n<\/thead>\n
1<\/td>\nEnergy<\/td>\n<\/tr>\n
2<\/td>\nTransport<\/td>\n<\/tr>\n
3<\/td>\nBanking<\/td>\n<\/tr>\n
4<\/td>\nFinancial market infrastructures<\/td>\n<\/tr>\n
5<\/td>\nHealth<\/td>\n<\/tr>\n
6<\/td>\nDrinking water<\/td>\n<\/tr>\n
7<\/td>\nWastewater<\/td>\n<\/tr>\n
8<\/td>\nDigital infrastructure<\/td>\n<\/tr>\n
9<\/td>\nICT service management (B2B)<\/td>\n<\/tr>\n
10<\/td>\nPublic administration<\/td>\n<\/tr>\n
11<\/td>\nSpace<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Annex II covers, among other things: postal and courier services, waste, chemicals, food, manufacturing, digital providers and research organisations.<\/p>\n

Note for IT companies:<\/strong> \u201cdigital infrastructure” may sound as though it covers every IT company, but it applies to specific roles: IXPs, DNS service providers, TLD name registries, cloud computing services, data centres, CDNs, trust services, and public electronic communications networks and services. A software development company is none of these \u2014 until it starts doing something in addition to developing software.<\/p>\n

Step 3: check your regulatory status within your sector<\/h3>\n

In some sectors, qualification is determined by regulatory status<\/strong> (a licence, permit or entry in a register of regulated activities), rather than by the industry itself. Look for the answer in the relevant sector-specific legislation, not in the KSC Act.<\/p>\n

Example: electricity generation is covered by the regime only where it is carried out by a licensed energy undertaking. Article 32(1)(1)(c) of the Energy Law exempts micro-installations and small installations from the licensing requirement. Without a licence, there is no qualification under the \u201celectricity” category, regardless of code 35.11.Z.<\/p>\n

However, expanding an installation to a size that requires a licence changes its status. And no one will remind you of this.<\/p>\n

Step 4: take stock of your maintenance contracts<\/h3>\n

Ask one question about each contract: do you remain involved in the client\u2019s environment after implementation?<\/strong> Accounts, configuration, updates, monitoring, backup, remote administrative access \u2014 every \u201cyes” makes you a potential managed service provider.<\/p>\n

The dividing line is clear: implementation alone does not qualify. Subsequent ongoing administration of the client\u2019s environment does.<\/p>\n

Step 5: check the categories with no size threshold<\/h3>\n

This is the point most commonly overlooked. The following categories qualify regardless of the size of the company<\/strong>:<\/p>\n\n\n\n\n\n\n\n\n\n\n
No.<\/th>\nCategory<\/th>\nStatus<\/th>\n<\/tr>\n<\/thead>\n
1<\/td>\nManaged security service providers<\/td>\nEssential entity<\/td>\n<\/tr>\n
2<\/td>\nTrust service providers<\/td>\nEssential entity<\/td>\n<\/tr>\n
3<\/td>\nTLD name registries<\/td>\nEssential entity<\/td>\n<\/tr>\n
4<\/td>\nDNS service providers<\/td>\nEssential entity<\/td>\n<\/tr>\n
5<\/td>\nProviders of public electronic communications networks and services<\/td>\nEssential entity<\/td>\n<\/tr>\n
6<\/td>\nPublic administration entities<\/td>\nEssential entity<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Check whether anywhere in your business \u2014 even in a single isolated case and outside your core business \u2014 you provide or support cybersecurity risk management for a client<\/strong>: incidents, testing, audits, consulting, SOC, SIEM, IAM, backup and DR, or threat monitoring.<\/p>\n

Passive firewall monitoring alone is not enough. What matters is whether you actually intervene in the client\u2019s system security management process.<\/p>\n

But \u201cwe act as the IT department for one client” \u2014 configuring servers, a UTM appliance and a firewall, plus providing remote support \u2014 is, on a prudent assessment, more likely to constitute a managed security service. And that means essential-entity status regardless of the company\u2019s size.<\/p>\n

Step 6: calculate the size thresholds, taking the group into account<\/h3>\n

The thresholds must be calculated in accordance with Commission Recommendation 2003\/361\/EC<\/a>:<\/p>\n\n\n\n\n\n\n\n
Category<\/th>\nEmployees<\/th>\nAnnual turnover<\/th>\nBalance sheet total<\/th>\n<\/tr>\n<\/thead>\n
Micro\/small<\/td>\n<50<\/td>\n\u2264EUR 10 million<\/td>\n\u2264EUR 10 million<\/td>\n<\/tr>\n
Medium-sized<\/td>\n50\u2013249<\/td>\nEUR 10\u201350 million<\/td>\nEUR 10\u201343 million<\/td>\n<\/tr>\n
Large<\/td>\n\u2265250<\/td>\n>EUR 50 million<\/td>\n>EUR 43 million<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Employee headcount is a standalone criterion. Turnover and balance sheet total are alternative criteria.<\/p>\n

The most common mistake:<\/strong> failing to include linked and subsidiary enterprises. A company with 20 employees in a corporate group may exceed the thresholds when counted together with the group. The Recommendation distinguishes between autonomous, partner and linked enterprises \u2014 links through natural persons result in data aggregation where the market criterion (the same or an adjacent market) and a relationship of control are both present.<\/p>\n

A change in status occurs after the thresholds have been exceeded or no longer exceeded for two consecutive accounting periods<\/strong> \u2014 exceeding a threshold once during the year does not automatically result in immediate qualification.<\/p>\n

Step 7: establish who provides the service to the end user<\/h3>\n

For each product, answer the following question: who determines and accepts the terms of service in relation to the end user \u2014 you or your client?<\/strong><\/p>\n

Example: a developer of software for local authorities supplies a local government unit with a portal through which residents can view amounts due and make payments. The terms of service are prepared and accepted by the local government unit. The supplier provides and operates the tool \u2014 the local government unit provides the service. The supplier is not a \u201cprovider of a social networking services platform” because the platform enables communication with the authority, not between citizens.<\/p>\n

This is an evidentiary criterion \u2014 document it.<\/p>\n

Step 8: document the outcome \u2014 including a negative one<\/h3>\n

A conclusion that \u201cthe rules do not apply to us” has a date. If you do not record what that conclusion depends on, two years later no one in the company will know that a new maintenance contract brings the company within the regime.<\/p>\n

Document the outcome in the form of a legal opinion setting out the assumptions<\/strong> on which it is based. This serves simultaneously as:<\/p>\n

    \n
  1. A defensive document in case the competent authority raises questions<\/li>\n
  2. A list of conditions requiring reassessment<\/li>\n
  3. A basis for identifying events that trigger a repeat of the test<\/li>\n<\/ol>\n

    Grey areas \u2014 where the answer is not clear-cut<\/h2>\n

    With newly enacted legislation and no case law or established practice from the competent authorities, some qualifications remain open to interpretation. There are no confirmed Polish decisions by competent authorities or court judgments resolving the boundaries described below \u2014 each qualification requires an analysis of the actual scope and continuity of the services and the service provider\u2019s responsibilities<\/a>.<\/p>\n

    Incidental colocation and hosting<\/h3>\n

    A company keeps physical servers at its own premises and hosts several clients\u2019 environments on them. It also rents racks to third parties as a secondary activity. The incidental nature of that activity does not prevent qualification \u2014 this constitutes a data centre service provider (making server infrastructure available to third parties together with its operation: power supply, cooling and maintenance).<\/p>\n

    A powered-shell model (where the client manages everything independently and the company provides only power and cooling) and resources used exclusively by the company itself do not qualify.<\/p>\n

    Implementation vs. managed service<\/h3>\n

    Implementing a system for a client does not by itself make the company a managed service provider. But if the company remains involved after implementation \u2014 configuring, updating and monitoring the system and retaining remote administrative access \u2014 the line has been crossed. An editorial change to the contract without any change to what you actually do in the client\u2019s environment does not change the qualification.<\/p>\n

    In-product chat and telecommunications<\/h3>\n

    Four telecommunications codes (61.10.A, 61.10.B, 61.90.A, 61.90.B) included \u201cjust in case” raise questions about the provision of networks and interpersonal communications services. If your product includes a user-to-user communication feature, check whether you fall within the definition of an electronic communications service.<\/p>\n

    Research codes and R&D tax relief<\/h3>\n

    Codes 71.20.C and 72.10.Z in the articles of association, combined with the use of R&D tax relief where research is conducted exclusively for the company\u2019s own purposes, do not make it a research organisation under Annex II. But that is how it looks on paper. Prepare a description of whose needs your R&D work serves \u2014 this will be the competent authority\u2019s first question.<\/p>\n

    Electronic signatures within a system<\/h3>\n

    Internal acceptance of a \u201csystem signature” is not a trust service. A qualified signature on decisions issued externally is \u2014 but the trust service provider is the external qualified provider whose libraries are used by the system (e.g. within the meaning of the eIDAS Regulation<\/a>), not the system\u2019s developer.<\/p>\n

    What you must implement after registration<\/h2>\n

    If the qualification test produced a positive result, the following obligations arise under the KSC Act:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    No.<\/th>\nObligation<\/th>\nDeadline \/ frequency<\/th>\n<\/tr>\n<\/thead>\n
    1<\/td>\nEntry in the KSC register<\/td>\n6 months after the criteria are met<\/td>\n<\/tr>\n
    2<\/td>\nImplementation of an information security management system (ISMS)<\/td>\nBy 3 April 2027 (for entities meeting the criteria on the date the amendment entered into force)<\/td>\n<\/tr>\n
    3<\/td>\nRisk analysis and security policies<\/td>\nOngoing, with updates<\/td>\n<\/tr>\n
    4<\/td>\nIncident response: early warning<\/td>\nWithin 24 hours of detection<\/td>\n<\/tr>\n
    5<\/td>\nSignificant incident notification<\/td>\nWithin 72 hours of detection<\/td>\n<\/tr>\n
    6<\/td>\nFinal incident report<\/td>\n1 month<\/td>\n<\/tr>\n
    7<\/td>\nBusiness continuity, backup and recovery<\/td>\nOngoing<\/td>\n<\/tr>\n
    8<\/td>\nSupply chain security<\/td>\nOngoing, in contracts with suppliers<\/td>\n<\/tr>\n
    9<\/td>\nVulnerability management<\/td>\nOngoing<\/td>\n<\/tr>\n
    10<\/td>\nCryptography, access control and MFA<\/td>\nOngoing<\/td>\n<\/tr>\n
    11<\/td>\nCybersecurity training for the head of the entity (Article 8e)<\/td>\nOnce per calendar year, documented<\/td>\n<\/tr>\n
    12<\/td>\nCertificate of no criminal record from the National Criminal Register for persons performing cybersecurity tasks (Article 8f)<\/td>\nBefore being authorised to perform tasks; also applies to subcontractors<\/td>\n<\/tr>\n
    13<\/td>\nConnection to the S46 system<\/td>\nBy 3 April 2027<\/td>\n<\/tr>\n
    14<\/td>\nFirst audit (essential entities not previously designated as operators of essential services)<\/td>\nBy 3 April 2028<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Supply chain security obligations are passed on contractually to ICT suppliers. Article 21(2)(d)\u2013(e) of the NIS2 Directive<\/a> covers relationships with direct suppliers. A contracting entity subject to NIS2 must obtain appropriate assurances from the supplier regarding data location, encryption, vulnerability management and arrangements for returning data after the relationship ends.<\/p>\n

    You may not be directly subject to the Act but still be subject to its requirements \u2014 through a contract rather than through the register.<\/p>\n

    Events that invalidate your assessment<\/h2>\n

    The outcome of the qualification test has a shelf life. Draw up a closed list of events that trigger a repeat of the test, assign responsibility for it to a specific person and set a review schedule:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
    No.<\/th>\nTriggering event<\/th>\nWhat to reassess<\/th>\n<\/tr>\n<\/thead>\n
    1<\/td>\nA new client under a maintenance contract (ongoing administration)<\/td>\nStep 4 \u2014 managed service provider<\/td>\n<\/tr>\n
    2<\/td>\nA new security service (even if provided only once)<\/td>\nStep 5 \u2014 category with no size threshold<\/td>\n<\/tr>\n
    3<\/td>\nExceeding an employee threshold (50 or 250 people)<\/td>\nStep 6 \u2014 SME thresholds<\/td>\n<\/tr>\n
    4<\/td>\nJoining a corporate group or a change in ownership structure<\/td>\nStep 6 \u2014 linked enterprises<\/td>\n<\/tr>\n
    5<\/td>\nExpansion of an installation (e.g. a photovoltaic installation) resulting in a licensing requirement<\/td>\nStep 3 \u2014 regulatory status<\/td>\n<\/tr>\n
    6<\/td>\nLaunch of hosting or colocation services for third parties<\/td>\nStep 4 \u2014 data centre<\/td>\n<\/tr>\n
    7<\/td>\nAddition of an in-product user-to-user communication feature<\/td>\nStep 7 \u2014 electronic communications service<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    How we can help<\/h2>\n

    The NIS2 qualification test requires three layers to be compared: the contents of the articles of association, the actual scope of the company\u2019s activities and the statutory requirements. In grey areas \u2014 and there are many under newly enacted legislation \u2014 a prudent assessment requires a technical analysis of the actual scope of the services, not merely a reading of the contract.<\/p>\n

    We conduct the NIS2 qualification test using a questionnaire and interview. We document the outcome in a legal opinion setting out the underlying assumptions \u2014 serving both as a defensive document in dealings with the competent authority (including where the outcome is negative) and as a list of conditions requiring reassessment.<\/p>\n

    Three levels of engagement:<\/p>\n\n\n\n\n\n\n\n
    Level<\/th>\nScope<\/th>\nWho it is for<\/th>\n<\/tr>\n<\/thead>\n
    Operational minimum<\/strong><\/td>\nReview of the PKD codes listed in the articles of association against the activities actually conducted, plus a preliminary qualification assessment<\/td>\nCompanies that want to determine quickly whether the issue affects them<\/td>\n<\/tr>\n
    Solid foundation<\/strong><\/td>\nFull qualification test, including an analysis of disputed concepts, calculation of group-level thresholds, a legal opinion setting out the assumptions and a register of triggering events<\/td>\nCompanies operating in grey areas or with an extensive list of PKD codes<\/td>\n<\/tr>\n
    Comprehensive protection<\/strong><\/td>\nAs above + restructuring of maintenance contracts and supply chain clauses, a resolution streamlining the company\u2019s objects, implementation of obligations under Articles 20, 21 and 23 of NIS2, and management board training<\/td>\nCompanies that are subject to the rules and need end-to-end implementation<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    NIS2 self-identification is a management board decision, not an IT decision<\/h2>\n

    NIS2 does not ask whether you want to be subject to it. It asks whether you meet the criteria. The obligation arises by operation of law, and responsibility for identifying it rests personally with the management board \u2014 delegation offers no protection (Article 8c(3) of the KSC Act).<\/p>\n

    Three things to do now:<\/p>\n

      \n
    1. Obtain the complete list of PKD codes from the articles of association and compare it with the activities actually conducted<\/li>\n
    2. Take stock of your maintenance contracts \u2014 any ongoing administration of a client\u2019s environment is a potential qualifying activity<\/li>\n
    3. Document the outcome of the analysis \u2014 including a negative one \u2014 together with the assumptions and a list of triggering events<\/li>\n<\/ol>\n

      If you need support with the qualification analysis, restructuring contracts or implementing NIS2 obligations \u2014 contact us<\/a>.<\/p>\n

      Frequently asked questions<\/h2>\n

      We are a 40-person software house \u2014 does NIS2 apply to us at all?<\/strong>
      \nSoftware development alone does not qualify. But check three things: whether you remain involved in the client\u2019s environment after implementation (managed service), whether you support the client\u2019s security management in any way (a category with no size threshold), and whether you host client environments on your own infrastructure (data centre). Every \u201cyes” triggers further analysis.<\/p>\n

      Our articles of association include a cybersecurity code, even though we do not conduct that activity. Should we remove it?<\/strong>
      \nThe code itself does not create an obligation, but it attracts the competent authority\u2019s attention during a review. Consider adopting a resolution to remove the code \u2014 this requires a notarial deed and registration with the National Court Register. Bear in mind two side effects: returning to that activity would require another amendment to the articles of association, while an extensive list of codes for activities not actually conducted undermines the credibility of the entire self-identification process.<\/p>\n

      We act as the \u201cIT department” for one client for a few thousand per month. Could that make us an essential entity?<\/strong>
      \nYes \u2014 if the scope includes configuring a firewall and UTM appliance, remote administration and monitoring. On a prudent assessment, this is more likely to constitute a managed security service, and that category qualifies regardless of size and results in immediate essential-entity status. The determining factor is a technical analysis of the actual scope, not a reading of the contract.<\/p>\n

      We are part of a corporate group \u2014 do we count our 20 employees or the entire group?<\/strong>
      \nThe entire group. Recommendation 2003\/361\/EC requires the aggregation of data from linked and subsidiary enterprises. A company with 20 employees in a group may exceed the thresholds when counted together with the group. This is the most common self-identification error. Links through natural persons result in data aggregation where the market criterion (the same or an adjacent market) and a relationship of control are both present.<\/p>\n

      Our largest client is subject to NIS2 and has sent us an addendum containing security requirements. Do we have to sign it if we are not subject to NIS2 ourselves?<\/strong>
      \nThe statutory obligation does not apply to you, but the contractual obligation does. Article 21(2)(d)\u2013(e) of the       NIS2 Directive<\/a> covers supply chain security. An entity subject to NIS2 remains responsible for risk management even after outsourcing ICT services \u2014 which is why it will require assurances from you. Review the addendum with regard to the scope of liability, data location, vulnerability management rules and the conditions for returning data.<\/p>\n

      What document protects the management board if the analysis produces a negative outcome?<\/strong>
      \nA legal opinion setting out the assumptions on which the outcome is based. It should state what activities you actually conduct, why you do not meet the criteria and which events would invalidate the conclusion. It serves as a defensive document in case the competent authority raises questions and as a list of conditions requiring reassessment. An internal memo without legal analysis offers no protection \u2014 omitting facts from the qualification questionnaire shifts all responsibility onto the management board.<\/p>\n","protected":false},"excerpt":{"rendered":"

      Use an eight-step test to assess whether your company falls under Poland’s NIS2 rules, why PKD codes can mislead, and how to document the result.<\/p>\n","protected":false},"author":13,"featured_media":3597,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"f93f8a3a-a357-4562-ab3d-cb8c8adf6aaa","sip_pair_state":"draft_ready"},"categories":[1580],"tags":[1562,1448,1555,1548,1540,1543,1546],"specialization":[1207],"practice_area":[],"class_list":["post-5196","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance","tag-articles-of-association-and-partnership-agreements","tag-compliance","tag-corporate-governance-en","tag-due-diligence-en","tag-internal-procedure","tag-it-ai-and-ip-law","tag-risk-assessment","specialization-compliance"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/5196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=5196"}],"version-history":[{"count":6,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/5196\/revisions"}],"predecessor-version":[{"id":5212,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/5196\/revisions\/5212"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/3597"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=5196"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=5196"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=5196"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=5196"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=5196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}