Cybersecurity law & regulation in Poland (2026)
Cybersecurity in Poland: comprehensive law.
Poland has a comprehensive horizontal cybersecurity law, the Act on the National Cybersecurity System (KSC), in force since 2018 to implement the original NIS Directive. A major amendment transposing the EU NIS2 Directive was signed by the President on 19 February 2026, published in the Journal of Laws in March 2026, and entered into force in early April 2026, expanding the regime to thousands of 'essential' and 'important' entities and adding management accountability, high-risk-vendor designation powers, and tiered breach-notification duties. EU baselines (NIS2, GDPR, DORA for finance) apply alongside the national framework.
Legal framework
Act on the National Cybersecurity System (Ustawa o krajowym systemie cyberbezpieczeństwa, KSC), originally of 5 July 2018 implementing NIS1, as amended in 2026 to transpose the EU NIS2 Directive (2022/2555). Supervision led by the Minister of Digital Affairs, with national CSIRTs (CSIRT NASK, CSIRT GOV, CSIRT MON).
NIS2 & cybersecurity law in Poland
In Poland, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.
- Framework
- the NIS2 Directive (EU) 2022/2555, transposed into national law
- Approach
- cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities
- Applies to
- medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration
- Incident reporting
- an early warning within 24 hours and a full notification within 72 hours to the national CSIRT
- Maximum fine
- up to €10 million or 2% of global annual turnover for essential entities
- Oversight
- the national competent authority and CSIRT designated under NIS2
NIS2 is a directive, so Poland implements it through national law; exact scope and deadlines can vary slightly by transposition.
Key points: cybersecurity in Poland
Comprehensive national law (KSC)
The Act on the National Cybersecurity System of 5 July 2018 established Poland's horizontal cyber framework (operators of essential services, digital service providers, public bodies) implementing NIS1; it remains the backbone, now upgraded for NIS2. The Ministry of Digital Affairs is the lead authority.
NIS2 transposition now in force
The amendment transposing NIS2 was signed by President Nawrocki on 19 February 2026, published in the Dziennik Ustaw (Journal of Laws) in March 2026, and entered into force in early April 2026, after Poland missed the EU's 17 October 2024 deadline and faced Commission infringement action.
Essential and important entities
The NIS2 amendment replaces the old 'operators of essential services' model with the NIS2 categories of essential and important entities, expanding coverage to tens of thousands of organisations across sectors such as energy, transport, banking, health, digital infrastructure, public administration, and (in some drafts) food and chemicals.
Incident reporting / breach notification
Entities must report significant incidents to the competent national CSIRT (CSIRT NASK, CSIRT GOV, or CSIRT MON) following the NIS2 staged model: an early warning within 24 hours of becoming aware, a fuller notification within 72 hours, and a final report within one month. The original KSC Act already imposed a 24-hour incident-reporting limit on operators of essential services.
sip.lex.pl nis-2-directive.com digital-strategy.ec.europa.eu
High-risk vendor (HRV) mechanism
A distinctive Polish feature: the minister responsible for IT/digital affairs may designate suppliers of ICT products, services, or processes (and their corporate-group members) as 'high-risk vendors' where they pose a threat to state security, triggering restrictions on their use by regulated entities.
Management accountability and penalties
The law imposes ISMS obligations (referencing PN-EN ISO/IEC 27001 and ISO 22301) and direct top-management responsibility for cyber risk management. Fines reach up to EUR 10 million or 2% of global annual turnover for essential entities, and up to EUR 7 million or 1.4% for important entities, with transitional periods before the highest fines apply.
NIS2 in Poland: FAQ
Does NIS2 apply in Poland?
Yes. As an EU member, Poland has transposed the NIS2 Directive (EU) 2022/2555 into national law, covering essential and important entities in critical sectors.
Who must comply with NIS2 in Poland?
Medium and large organisations in sectors such as energy, transport, banking, health, water, digital infrastructure and public administration.
What are the NIS2 incident-reporting deadlines in Poland?
An early warning within 24 hours of becoming aware and a fuller incident notification within 72 hours to the national CSIRT.
What are the penalties under NIS2 in Poland?
Up to €10 million or 2% of global annual turnover for essential entities, with lower ceilings for important entities.
Timeline of decisions
- Law · officialAmended KSC Act (NIS2 + High-Risk Vendor mechanism) enters into force
Poland's amended Act on the National Cybersecurity System became fully operative, expanding mandatory cybersecurity obligations to an estimated 42,000 entities across 18 sectors and introducing a High-Risk Vendor (HRV) mechanism allowing the Minister of Digital Affairs to ban ICT suppliers deemed threats to national security, extended beyond telecoms to all NIS2-covered sectors.
European Commission – Digital Strategy (NIS2 Poland transposition tracker)
- LawPresident Signs NIS2 Transposition, Amendment to National Cybersecurity System Act
The President of Poland signed into law the amendment to the National Cybersecurity System Act implementing the EU NIS2 Directive, expanding the regulated population from a few hundred to potentially tens of thousands of entities across energy, health, transport, digital infrastructure, and other critical sectors. Poland had missed the EU's October 2024 deadline and received a European Commission reasoned opinion in May 2025 for failure to notify transposition.
KWKR Law
- Guidance · officialCERT Polska and CSIRT MON publish joint APT28 malware-campaign alert
Poland's two national incident-response teams issued a joint technical advisory documenting a large-scale phishing campaign attributed to Russia's APT28 (GRU) that targeted Polish government institutions, deploying a multi-stage redirect chain to download a disguised executable that harvested credentials from Microsoft Exchange mailboxes.
CERT Polska (CSIRT NASK)
- IncidentPro-Russian Killnet launches DDoS campaign against Polish government infrastructure
The Killnet hacktivist collective targeted Poland's Ministry of Foreign Affairs, Senate, Border Control, and Police websites with sustained DDoS attacks in retaliation for Poland's support of Ukraine, marking the onset of an enduring pattern of Russian-aligned hybrid cyber operations against Polish state institutions that CSIRT GOV has had to counter continuously since.
Security Affairs
- Guidance · officialCybersecurity Strategy of the Republic of Poland 2019-2024 adopted
The Council of Ministers approved Poland's second national cybersecurity strategy, establishing five objectives: maturing the KSC system, hardening public-administration and private-sector resilience, building national R&D capacity in cybersecurity, raising public awareness, and strengthening Poland's international cyber standing, with the Ministry of Digital Affairs as coordinator.
Ministerstwo Cyfryzacji (Ministry of Digital Affairs) – Gov.pl
- Law · officialAct on the National Cybersecurity System (KSC) enters into force, NIS1 transposition
Poland's first comprehensive cybersecurity statute entered into force, establishing three national CSIRTs (CSIRT GOV at the Internal Security Agency ABW, CSIRT MON at the Ministry of Defence, and CSIRT NASK/CERT Polska), mandatory incident-reporting obligations for operators of essential services and digital service providers, and a supervisory regime, fully transposing EU NIS Directive 2016/1148.
ISAP – Sejm of the Republic of Poland (Official Legislative Database)
- Decision · officialCERT Polska established within NASK, Poland's first national CSIRT
Poland's first computer emergency response team was created within the state-owned NASK (Research and Academic Computer Network), laying the institutional foundation for national-level cyber-incident handling; CERT Polska joined FIRST in 1998 and TF-CSIRT in 2000, and was formally designated CSIRT NASK under the 2018 KSC Act.
CERT Polska – About Us
Sources
- gov.pl/web/cyfryzacja/krajowy-system-cyberbezpieczenstwa-
- digital-strategy.ec.europa.eu/en/policies/nis2-directive-poland
- prawo.pl/akty/dz-u-2026-20-t-j,18746756.html
- cyberpolicy.nask.pl/ustawa-o-krajowym-systemie-cyberbezpieczenstwa/
- osborneclarke.com/insights/polands-amendment-national-cybersecurity-system-act-has-been
- twobirds.com/en/insights/2025/poland/how-poland-is-shaping-its-nis2-implementation
- sip.lex.pl/akty-prawne/dzu-dziennik-ustaw/krajowy-system-cyberbezpieczenstwa-187
- dentons.com/en/insights/newsletters/2025/august/8/powered-by-dentons/powered-by-d
- nis-2-directive.com/NIS_2_Directive_Article_23.html
- grantthornton.pl/publikacja/nis2-i-uksc-jest-podpis-prezydenta-terminy-obowiazki-i-kog
Next for Poland: Starting a BusinessEasy
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 23 May 2026. Methodology & how to cite · State of Technology Regulation 2026