Does Poland’s NIS2 Regime Apply to Your Company? An Eight-Step Qualification Test
A five-person IT company configures a firewall and provides remote support for one client. That sounds like a routine maintenance contract. Under Poland’s NIS2 regime, however, the company may be an essential entity—subject to the strictest supervision and an incident early-warning deadline of 24 hours. In this category, size thresholds do not apply.
The competent authority will not necessarily tell the company that it qualifies. The company must assess its own position, and a question from the authority may arrive only after a deadline has passed.
Poland’s NIS2 implementing amendment entered into force on April 3, 2026, under the Act of January 23, 2026 (Journal of Laws 2026, item 252). For companies that met the criteria when the amendment entered into force, the deadline to apply for entry in the register of entities expired on October 3, 2026.
If you have not assessed your company’s position, the test below will help you identify the relevant activities, size thresholds and difficult boundaries—and document your conclusion, whether the rules apply or not.
Key Polish concepts
The Polish KSC Act is the Act on the National Cybersecurity System. Its electronic register of essential and important entities is referred to here as the KSC register. A Polish PKD code is a business-activity classification code; it is useful evidence to review, but it does not determine NIS2 status.
| Concept | What it means | Why it matters |
|---|---|---|
| Self-identification | A company assesses for itself whether it meets the statutory criteria; the authority does not send an invitation to register. | Obligations arise by operation of law, not through an authority’s decision. |
| Essential entity | An entity in a sector listed in Annex I that meets the applicable size criteria, or an entity in a category for which no size threshold applies. | Proactive supervision, including inspections without waiting for an incident, and the highest penalties. |
| Important entity | An entity in a sector listed in Annex I or II that meets the applicable thresholds but not the criteria for an essential entity. | Reactive supervision and lower maximum penalties. |
| KSC register | The statutory electronic register of essential and important entities. | Entry is declaratory: it confirms status rather than creating it. |
| SME thresholds | Size criteria assessed under Commission Recommendation 2003/361/EC. | Data from linked and subsidiary enterprises must be taken into account. |
| Managed service provider | A provider that remains involved in a client’s IT environment after implementation—for example, administering, monitoring or updating it. | A one-off implementation does not qualify; ongoing administration does. |
| Managed security service provider | A provider involved in a client’s cybersecurity management, potentially through SOC, SIEM, IAM, backup and disaster recovery, testing, audits or incident response. | The source’s qualification approach treats this as an essential-entity category with no size threshold. |
Why self-identification matters
The NIS2 regime is not a voluntary sign-up system. The obligation arises when the statutory criteria are met. A company must identify its status and apply for entry in the KSC register on its own initiative.
Getting the assessment wrong has different costs:
| If you conclude… | Potential consequence |
|---|---|
| “We are outside the regime,” when you are not | Exposure for the period in which you failed to register, report incidents or implement required risk-management measures. |
| “We are within the regime,” when you are not | Organizational and financial costs of following a regime that does not apply, together with ongoing supervision. |
Under Article 7c(1) of the KSC Act, an application for registration is due within six months of meeting the criteria. The period runs from when the criteria are actually met—not when management discovers that they have been met.
Responsibility sits with the entity’s leadership. Article 8c(1) of the KSC Act makes the head of the entity responsible for fulfilling cybersecurity obligations. If a multi-member management board has not designated a responsible person, all its members are responsible under Article 8c(2). Assigning tasks to someone else does not release the head of the entity from responsibility under Article 8c(3).
This is therefore a management-board issue, not merely an IT-department issue.
The PKD code trap
PKD codes classify business activities in Poland. They are not a statutory criterion for NIS2 qualification.
- “Our company documents list a relevant PKD code, so NIS2 applies.” Not necessarily. What matters is the activity the company actually conducts.
- “We have no relevant PKD code, so NIS2 cannot apply.” Also incorrect. An activity covered by the statutory annexes may qualify even without a matching code.
The Polish Ministry of Digital Affairs directs companies to assess their activities under Article 5 of the KSC Act and Annexes 1 and 2. PKD codes are an aid to that analysis.
They may nevertheless affect who receives questions from an authority. For example, code 62.20.A, covering cybersecurity activities, may draw attention even if the company does not conduct that activity.
Check the company documents, not just the public extract
Poland’s National Court Register (KRS) displays a maximum of 10 PKD codes. A company’s articles of association or other constitutive document may contain more. In one matter analyzed by the firm, the company document listed 25 codes; the 15 not visible in the register included those that raised NIS2 questions.
Obtain the complete list from the articles of association or statute, rather than relying on a KRS extract.
There is also a transition issue. Some companies copied codes into their documents when moving to PKD 2025 (Journal of Laws 2024, item 1936) without considering their NIS2 implications. From January 1, 2027, entities that have not updated their codes will be reclassified automatically using the Statistics Poland correspondence table. Its one-to-many mappings may reveal discrepancies.
The NIS2 qualification test in eight steps
Step 1: Match every PKD code to actual activity
Take the full code list from the company’s articles of association or statute. Mark each activity conducted or not conducted. Record why a listed activity is not carried out.
If unnecessary codes remain, consider removing them. For a Polish limited liability company, the procedure described in the source involves a shareholders’ resolution, a notarial record and a KRS filing under Article 255 § 3 of the Commercial Companies Code. Removal is not an NIS2 exemption: the factual activity remains decisive.
Step 2: Check Annex I and Annex II activities
Annex I covers sectors of high criticality:
| No. | Sector |
|---|---|
| 1 | Energy |
| 2 | Transport |
| 3 | Banking |
| 4 | Financial market infrastructures |
| 5 | Health |
| 6 | Drinking water |
| 7 | Wastewater |
| 8 | Digital infrastructure |
| 9 | ICT service management (business-to-business) |
| 10 | Public administration |
| 11 | Space |
Annex II includes, among others, postal and courier services, waste, chemicals, food, manufacturing, digital providers and research organizations.
For IT companies, “digital infrastructure” does not mean all IT activity. It concerns specific roles, including internet exchange points (IXPs), DNS service providers, top-level domain (TLD) name registries, cloud services, data centers, content delivery networks (CDNs), trust services, and public electronic communications networks and services. Developing software alone does not place a company in one of those roles. An additional activity may change the answer.
Step 3: Check whether sector-specific regulatory status is required
In some sectors, a license, permit or entry in a regulated-activity register determines qualification—not the general description of the industry. Check the relevant sector-specific law as well as the KSC Act.
For example, the source’s assessment is that electricity generation falls within the relevant category where it is carried out by an energy undertaking holding a license. Article 32(1)(1)(c) of the Polish Energy Law exempts micro-installations and small installations from the licensing requirement. On that assessment, without a license there is no qualification in the “electricity” category, regardless of PKD code 35.11.Z.
Expanding an installation until it requires a license changes the position. Build that possibility into your review process.
Step 4: Inventory maintenance contracts
For each contract, ask: Do we remain involved in the client’s environment after implementation?
Look beyond the contract title. Consider accounts, configuration, updates, monitoring, backup and remote administrative access. Each continuing responsibility calls for analysis as a possible managed service.
The distinction drawn in the source is between one-off implementation, which does not qualify on its own, and ongoing administration of the client’s environment, which does.
Step 5: Check categories with no size threshold
The following categories are treated in the source as essential entities regardless of size:
| Category | Status |
|---|---|
| Managed security service providers | Essential entity |
| Trust service providers | Essential entity |
| TLD name registries | Essential entity |
| DNS service providers | Essential entity |
| Providers of public electronic communications networks and services | Essential entity |
| Public administration entities | Essential entity |
Review even work performed for one client or outside your principal business. Do you perform or support the client’s cybersecurity risk management through incident response, testing, audits, advice, a security operations center (SOC), security information and event management (SIEM), identity and access management (IAM), backup and disaster recovery, or threat monitoring?
The source draws a distinction here: passively monitoring a firewall alone is insufficient. The question is whether the provider actually intervenes in the client’s system-security management process.
By contrast, acting as an IT function for one client—configuring servers, a unified threat management (UTM) appliance and a firewall, while providing remote help—is, on a prudent assessment, more likely to be a managed security service. That would mean essential-entity status without a size threshold. The actual technical work, not the contract label, must be analyzed.
Step 6: Calculate size, including relevant group companies
Apply Commission Recommendation 2003/361/EC when assessing the thresholds:
| Category | Employees | Annual turnover | Balance sheet total |
|---|---|---|---|
| Micro/small | Fewer than 50 | Up to EUR 10 million | Up to EUR 10 million |
| Medium-sized | 50–249 | EUR 10–50 million | EUR 10–43 million |
| Large | 250 or more | Over EUR 50 million | Over EUR 43 million |
Employee headcount is a standalone criterion. Turnover and balance sheet total operate as alternatives.
Do not assess a group company in isolation. A business with 20 employees may cross a threshold when relevant group data is included. The Recommendation distinguishes autonomous, partner and linked enterprises. Links through individuals can also lead to aggregation where both the required control relationship and market condition—the same or an adjacent market—are met.
Under the source’s stated approach, a change of size status follows thresholds being exceeded, or no longer exceeded, for two consecutive accounting periods. Crossing a threshold once during a year does not automatically cause immediate reclassification.
Step 7: Identify who provides the end-user service
For each product, establish who sets and accepts the terms governing the service to its end users: your company or your client?
Consider a software provider that supplies a Polish local-government unit with a portal through which residents view amounts due and make payments. The local-government unit prepares and accepts the user terms. On the source’s analysis, the supplier provides and operates the tool, while the local-government unit provides the service. The supplier is not a provider of a social networking services platform: the portal enables residents to communicate with the authority, not with one another.
Record the contractual and operational evidence supporting the answer.
Step 8: Document the conclusion—even if it is negative
A conclusion that NIS2 does not apply depends on facts at a particular time. A later maintenance contract may change it.
Document the outcome in a legal opinion that states its factual assumptions. It should serve as:
- A record to present if the competent authority asks questions.
- A list of conditions on which the conclusion depends.
- A basis for events that trigger a fresh assessment.
Areas where qualification is disputed
These boundaries are not all settled. The source identifies no confirmed Polish authority decisions or court judgments resolving the examples below. With new provisions and no established practice, qualification requires examination of the service’s actual scope, continuity and the provider’s responsibilities.
Incidental colocation and hosting
Suppose a company hosts several clients’ environments on physical servers at its premises and, as a secondary activity, rents racks to third parties. On the source’s assessment, the secondary nature of that activity does not prevent qualification as a data center service provider: server infrastructure is made available to third parties together with its operation, including power, cooling and maintenance.
The source distinguishes a powered-shell model, in which the client manages everything and the company supplies only power and cooling, and infrastructure used solely for the company’s own purposes; it treats those as not qualifying.
Implementation versus a managed service
Installing a system for a client does not, by itself, make the installer a managed service provider. Continuing to configure, update and monitor it while retaining remote administrative access crosses the line on the source’s analysis. Editing the wording of a contract without changing the work actually performed does not change the qualification.
In-product chat and electronic communications
Telecommunications PKD codes 61.10.A, 61.10.B, 61.90.A and 61.90.B listed “just in case” may prompt questions about networks and interpersonal communications services. If a product lets users communicate with one another, assess whether the feature falls within the definition of an electronic communications service.
Research codes and R&D tax relief
A company may list codes 71.20.C and 72.10.Z and claim R&D tax relief while conducting research exclusively for its own needs. The source does not treat that combination alone as making it a research organization under Annex II. It can, however, look that way in the records. Prepare an explanation of whose needs the R&D work serves.
Electronic signatures within a system
Internal acceptance using a “system signature” is not, on the source’s analysis, a trust service. A qualified signature on decisions issued externally is different—but where the system uses the libraries of an external qualified provider, that external provider is the trust service provider, not the software developer. See the eIDAS Regulation.
Obligations if the company qualifies
A positive qualification calls for planning beyond registration. The source identifies the following KSC Act requirements and deadlines:
| Obligation | Deadline or frequency |
|---|---|
| Apply for entry in the KSC register | Within six months of meeting the criteria |
| Implement an information security management system (ISMS) | By April 3, 2027, for entities that met the criteria when the amendment entered into force |
| Conduct risk analysis and maintain security policies | Ongoing, with updates |
| Send an incident early warning | Within 24 hours of detection |
| Notify a significant incident | Within 72 hours of detection |
| Submit a final incident report | Within one month |
| Maintain business continuity, backup and recovery arrangements | Ongoing |
| Address supply chain security | Ongoing, including in supplier contracts |
| Manage vulnerabilities | Ongoing |
| Address cryptography, access control and multifactor authentication (MFA) | Ongoing |
| Document cybersecurity training for the head of the entity under Article 8e | Once each calendar year |
| Obtain a certificate of no criminal record from Poland’s National Criminal Register (KRK) for people performing cybersecurity tasks under Article 8f | Before allowing them to perform those tasks; also applies to subcontractors |
| Connect to the S46 system | By April 3, 2027 |
| Complete the first audit, if an essential entity was not previously designated an operator of essential services | By April 3, 2028 |
Registration confirms a status that already exists; it is not what first creates the underlying obligation.
If your customer is subject to NIS2 but you are not
NIS2 requirements can reach ICT suppliers through contracts, even when those suppliers are not themselves directly subject to the KSC Act. Article 21(2)(d)–(e) of the NIS2 Directive addresses relationships with direct suppliers. An in-scope customer may seek assurances about data location, encryption, vulnerability management and return of data when the relationship ends.
Direct statutory status and contractual commitments are different questions. Review any proposed addendum for the obligations and liability it would actually place on your company.
Changes that should trigger a fresh assessment
Assign someone responsibility for monitoring changes and set a review calendar. The source recommends a defined list of triggers:
| Change | Reassess |
|---|---|
| A new maintenance client involving ongoing administration | Managed-service activity under Step 4 |
| A new security service, even if provided once | The no-size-threshold category under Step 5 |
| Reaching an employee threshold of 50 or 250 | Size and group calculations under Step 6 |
| Joining a corporate group or changing ownership structure | Linked-enterprise calculations under Step 6 |
| Expanding an installation, such as a photovoltaic installation, so that a license is required | Sector-specific status under Step 3 |
| Starting hosting or colocation for third parties | Data center activity considered with Step 4 |
| Adding user-to-user communications to a product | Electronic communications questions under Step 7 |
A negative assessment is not permanent. Preserve the assumptions behind it so the person reviewing a new contract or product feature knows when to reopen the analysis.
How we can help
A defensible NIS2 qualification assessment compares three things: the company’s constitutive documents, what the business actually does and the statutory criteria. In disputed areas, a prudent assessment also requires a technical account of the services—not just a reading of their descriptions in contracts.
We conduct the assessment through a questionnaire and interview, then document the conclusion and its assumptions in a legal opinion. This gives management a record for possible authority questions and a list of facts that require reassessment.
| Level | Scope | Suitable for |
|---|---|---|
| Operational minimum | Review the complete PKD list against actual activities and make a preliminary qualification assessment. | Companies seeking an initial answer. |
| Solid foundation | Complete the test, analyze disputed definitions, calculate group-level thresholds, and prepare an assumptions-based legal opinion and trigger list. | Companies in grey areas or with extensive PKD lists. |
| Comprehensive support | Add review of maintenance contracts and supply chain clauses, a resolution to streamline stated business activities, implementation of obligations under Articles 20, 21 and 23 of NIS2, and management-board training. | Companies that qualify and need implementation support. |
Contact us if you need help assessing qualification, reviewing contracts or implementing the resulting obligations.
Three actions for management now
- Obtain the complete PKD list from the company’s articles of association or statute and compare it with actual activity.
- Review maintenance and security work client by client, especially continuing access to or administration of client environments.
- Document the result, including a negative result, its factual assumptions and the events that will require a new assessment.
Under Article 8c(3) of the KSC Act, delegating cybersecurity tasks does not remove the head of the entity’s responsibility. Self-identification needs management ownership.
Frequently asked questions
We are a 40-person software developer. Could NIS2 apply to us?
Software development alone does not qualify on the source’s analysis. Check whether you administer a client’s environment after implementation, support a client’s cybersecurity management or host client environments on your own infrastructure. A “yes” to any of these calls for further analysis; it is not a substitute for assessing the actual service.
Our company documents list a cybersecurity PKD code, but we do not conduct that activity. Should we remove it?
The code does not itself create an obligation, but it may attract attention in a review. Consider removing it through the applicable company procedure, which for the company form discussed above involves a resolution, notarial record and KRS filing. Removing it has consequences: returning to that activity would require another amendment, while retaining a long list of unused activities can weaken the credibility of your self-identification record.
We provide IT support to just one client for a modest monthly fee. Could we be an essential entity?
Yes, potentially. If the work includes firewall and UTM configuration, remote administration and monitoring, the source considers it more likely, on a prudent assessment, to be a managed security service. That category is treated as essential without a size threshold. The technical scope of the actual work determines the assessment, not the fee or the name of the contract.
Our Polish company has 20 employees but belongs to a larger group. Whose figures count?
Assess the relevant group relationships under Recommendation 2003/361/EC; do not rely only on the Polish company’s 20 employees. Linked and subsidiary-enterprise data must be included as applicable. Links through individuals also require attention where the control and same-or-adjacent-market conditions are met.
A client subject to NIS2 has sent us a security addendum. Must we accept it if we are not directly in scope?
Being outside the statute does not, by itself, make a proposed contractual commitment binding; review what you are being asked to agree to. The client remains responsible for its risk management when it outsources ICT services and may therefore require supplier assurances under its supply chain arrangements. Check the addendum’s liability provisions, data location, vulnerability-management requirements and data-return terms. For more background, see our NIS2 article.
What should management keep if the conclusion is that NIS2 does not apply?
Keep a legal opinion explaining the activities actually conducted, why the criteria are not met, the facts assumed and the changes that would require reassessment. It provides a reasoned record if an authority asks questions; it does not replace an accurate factual review. An internal note without legal analysis is weaker, and omitting material facts from a qualification questionnaire leaves management exposed.
