{"id":3292,"date":"2026-11-09T13:54:07","date_gmt":"2026-11-09T13:54:07","guid":{"rendered":"https:\/\/sawaryn.com\/us\/?p=3292"},"modified":"2026-11-09T13:55:32","modified_gmt":"2026-11-09T13:55:32","slug":"poland-nis2-qualification-test","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/us\/poland-nis2-qualification-test\/","title":{"rendered":"Does Poland\u2019s NIS2 Regime Apply to Your Company? An Eight-Step Qualification Test"},"content":{"rendered":"

Does Poland\u2019s NIS2 Regime Apply to Your Company? An Eight-Step Qualification Test<\/h1>\n

A five-person IT company configures a firewall and provides remote support for one client. That sounds like a routine maintenance contract. Under Poland\u2019s NIS2 regime, however, the company may be an essential entity<\/strong>\u2014subject to the strictest supervision and an incident early-warning deadline of 24 hours. In this category, size thresholds do not apply.<\/p>\n

The competent authority will not necessarily tell the company that it qualifies. The company must assess its own position, and a question from the authority may arrive only after a deadline has passed.<\/p>\n

Poland\u2019s NIS2 implementing amendment entered into force on April 3, 2026<\/strong>, under the Act of January 23, 2026 (Journal of Laws 2026, item 252)<\/a>. For companies that met the criteria when the amendment entered into force, the deadline to apply for entry in the register of entities expired on October 3, 2026<\/strong>.<\/p>\n

If you have not assessed your company\u2019s position, the test below will help you identify the relevant activities, size thresholds and difficult boundaries\u2014and document your conclusion, whether the rules apply or not.<\/p>\n

Key Polish concepts<\/h2>\n

The Polish KSC Act<\/em> is the Act on the National Cybersecurity System. Its electronic register of essential and important entities is referred to here as the KSC register<\/strong>. A Polish PKD code<\/strong> is a business-activity classification code; it is useful evidence to review, but it does not determine NIS2 status.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Concept<\/th>\nWhat it means<\/th>\nWhy it matters<\/th>\n<\/tr>\n<\/thead>\n
Self-identification<\/strong><\/td>\nA company assesses for itself whether it meets the statutory criteria; the authority does not send an invitation to register.<\/td>\nObligations arise by operation of law, not through an authority\u2019s decision.<\/td>\n<\/tr>\n
Essential entity<\/strong><\/td>\nAn entity in a sector listed in Annex I that meets the applicable size criteria, or an entity in a category for which no size threshold applies.<\/td>\nProactive supervision, including inspections without waiting for an incident, and the highest penalties.<\/td>\n<\/tr>\n
Important entity<\/strong><\/td>\nAn entity in a sector listed in Annex I or II that meets the applicable thresholds but not the criteria for an essential entity.<\/td>\nReactive supervision and lower maximum penalties.<\/td>\n<\/tr>\n
KSC register<\/strong><\/td>\nThe statutory electronic register of essential and important entities.<\/td>\nEntry is declaratory: it confirms status rather than creating it.<\/td>\n<\/tr>\n
SME thresholds<\/strong><\/td>\nSize criteria assessed under Commission Recommendation 2003\/361\/EC.<\/td>\nData from linked and subsidiary enterprises must be taken into account.<\/td>\n<\/tr>\n
Managed service provider<\/strong><\/td>\nA provider that remains involved in a client\u2019s IT environment after implementation\u2014for example, administering, monitoring or updating it.<\/td>\nA one-off implementation does not qualify; ongoing administration does.<\/td>\n<\/tr>\n
Managed security service provider<\/strong><\/td>\nA provider involved in a client\u2019s cybersecurity management, potentially through SOC, SIEM, IAM, backup and disaster recovery, testing, audits or incident response.<\/td>\nThe source\u2019s qualification approach treats this as an essential-entity category with no size threshold.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Why self-identification matters<\/h2>\n

The NIS2 regime is not a voluntary sign-up system. The obligation arises when the statutory criteria are met.<\/strong> A company must identify its status and apply for entry in the KSC register<\/a> on its own initiative.<\/p>\n

Getting the assessment wrong has different costs:<\/p>\n\n\n\n\n\n\n
If you conclude\u2026<\/th>\nPotential consequence<\/th>\n<\/tr>\n<\/thead>\n
\u201cWe are outside the regime,\u201d when you are not<\/strong><\/td>\nExposure for the period in which you failed to register, report incidents or implement required risk-management measures.<\/td>\n<\/tr>\n
\u201cWe are within the regime,\u201d when you are not<\/strong><\/td>\nOrganizational and financial costs of following a regime that does not apply, together with ongoing supervision.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Under Article 7c(1) of the KSC Act, an application for registration is due within six months of meeting the criteria<\/strong>. The period runs from when the criteria are actually met\u2014not when management discovers that they have been met.<\/p>\n

Responsibility sits with the entity\u2019s leadership. Article 8c(1) of the KSC Act makes the head of the entity responsible for fulfilling cybersecurity obligations<\/strong>. If a multi-member management board has not designated a responsible person, all its members are responsible under Article 8c(2). Assigning tasks to someone else does not release the head of the entity from responsibility under Article 8c(3).<\/p>\n

This is therefore a management-board issue, not merely an IT-department issue.<\/p>\n

The PKD code trap<\/h2>\n

PKD codes<\/a> classify business activities in Poland. They are not a statutory criterion<\/strong> for NIS2 qualification.<\/p>\n