The amendment to the National Cybersecurity System Act (KSC) is Poland’s implementation of the NIS2 Directive. Since 3 April 2026, essential and important entities must manage risk, report incidents and answer for this at management level. The AI tools employees use are ICT services under this system, so they too must be covered in risk assessment and in the supply chain assessment
The Act of 23 January 2026 (Journal of Laws 2026, item 252) amends the National Cybersecurity System Act and implements the NIS2 Directive. In short:
Essential and important entities have the same obligations. What differs is supervision: essential entities are supervised in advance and audited at least every 3 years, while important entities are supervised after an event and audited only at the authority’s request
As a rule, no one issues a decision that an entity is covered. Each entity checks its own sector and size on the basis of its financial statements, then applies for entry in the register through the S46 system. Public entities, telecommunications operators, trust service providers and critical entities are entered ex officio by the Minister of Digital Affairs, and the authority may designate an entity as essential or important by decision
Each entity implements an ISMS: risk assessment, supply chain security, business continuity, monitoring and incident handling. Local-government important entities apply the simplified ISMS set out in Annex 4, while banks and financial market infrastructure apply DORA in this area (Art. 8i)
The head of the entity is responsible for the obligations, even after delegating them to another person. Once a year they complete documented training, and for negligence they face a fine of up to 300% of their monthly remuneration, or up to 100% in a public entity
The deadline has passed for applying for entry in the register for entities that met the criteria on 3 April 2026. Any entity that has not applied should do so without delay
Art. 7c(1); Art. 33(3) of the amending ActThat is the time limit for an early warning of a significant incident; the notification is due within 72 hours and the final report within a month. A data leak through an AI tool can also be such an incident
Art. 11(1)Or 2% of revenue, whichever is higher: this is the maximum fine for an essential entity (the minimum is PLN 20,000). For an important entity, €7 m or 1.4% (minimum PLN 15,000)
Art. 73(3)-(4)The Act published in the Journal of Laws (2026, item 252)
From this day, 6 months run for the registration application and 12 months for the ISMS
Application in the S46 system with a statement by the head of the entity. Entities entered ex officio complete their data within 6 months of being requested to do so
Information security management system in place and connection to the S46 system
Deadline for the first audit of an essential entity (former operators of essential services follow a separate schedule). After this day, authorities can impose most fines under the Act
These deadlines apply to entities that met the criteria on 3 April 2026. An entity that meets them later has 6 months for the application and 12 months for the ISMS, counted from the day it meets the criteria
• Large enterprises in the sectors: energy, transport, banking and financial market infrastructure, health, drinking water and waste water, digital infrastructure, ICT service management, space
• Medium-sized and large telecommunications operators, and managed security service providers from small enterprise size upwards
• Regardless of size: public entities listed in Annex 1, DNS service providers, top-level domain name registries, domain name registration service providers, qualified trust service providers, critical entities, entities that are not entrepreneurs listed in Annex 1
• Healthcare providers that are not entrepreneurs, with 250 or more staff
Energy · Water utilities · Healthcare · Transport · Finance · Data centres and telecommunications · Public administration
• Medium-sized enterprises in the Annex 1 sectors
• Medium-sized and large enterprises in Annex 2: postal services, waste management, chemicals, food, manufacturing (medical devices, electronics, electrical equipment, machinery, vehicles), digital providers, research
• Micro and small telecommunications operators, and non-qualified trust service providers up to medium size
• Local-government budgetary units and establishments, local-government cultural institutions and companies performing public utility tasks, unless they are essential entities
• Entities that are not entrepreneurs listed in Annex 2, regardless of size
• Healthcare providers that are not entrepreneurs, with 50 to 249 staff
A municipal office that on 1 January employs at least 50 people under employment contracts, counted in full-time equivalents, is an essential entity; a smaller office is an important entity. The Minister of Digital Affairs enters all municipal offices in the register ex officio
Up to three questions, and the result shows your status, the deadlines and what to do now. The tool runs in the browser and sends nothing
Answer the questions and we will show your organisation’s status, the deadlines and the first step
The Act mentions artificial intelligence only once, in Annex 4. AI tools are nonetheless ICT services, so the obligations in Art. 8 cover them just as they cover e-mail or the cloud. Seven points to check:
Which models and chats are used, by whom and with what data (asset management)
Data leaks, wrong answers, provider unavailability
Security requirements in the contract, certificates, where data is processed, decisions on high-risk suppliers
Who uses which model, multi-factor authentication
A record that cannot be changed lets you reconstruct an incident and meet the 24 and 72-hour reporting deadlines
A plan for when a cloud model is unavailable, e.g. a local model
Rules for using AI for employees, and annual documented training for the head of the entity
WORM register, personal data masking, model access policies
On-premise or air-gap, ISO/IEC 27001 and ISO 22301 certificates
Rules for using AI for the team and management
We will show you what an AI query log looks like in an organisation covered by the KSC
This page discusses what the Act means for the use of AI and is not legal advice
Essential and important entities. These are companies and institutions in the sectors listed in Annexes 1 and 2 to the Act, if they are at least medium-sized. Regardless of size, the Act covers, among others, public entities, DNS service providers, top-level domain name registries, domain name registration service providers and qualified trust service providers
Apply without delay through the S46 system, with a statement by the head of the entity. The entry is made when the application is submitted. The authority may also enter the entity ex officio. The Act provides for a fine for failing to apply on time, which can be imposed only after 3.04.2028
The head of the entity is responsible. Where the head is a collective body and no responsible person has been named, all its members are responsible. The head faces a fine of up to 300% of their monthly remuneration, or up to 100% in a public entity. An essential entity faces a fine of up to €10 m or 2% of revenue, and no less than PLN 20,000; an important entity up to €7 m or 1.4%, and no less than PLN 15,000. If an infringement causes a serious cyber threat, the fine is up to PLN 100 m
The Act does not ban the use of AI chats. It requires every tool, including an AI chat, to be covered in risk assessment, in the access control policy and in the supply chain assessment. In practice, the ISMS must therefore set out who may use which models and with what data
The location of processing is not banned in itself. The supply chain assessment must, however, take into account the supplier’s vulnerabilities, the quality of its services, assessments by the NIS Cooperation Group and decisions designating high-risk suppliers. After such a decision, no new products from that supplier are introduced, and existing ones are, as a rule, phased out within 7 years (within 4 years for critical functions in telecommunications)
Yes, if it meets the criteria for a significant incident. The early warning must be sent within 24 hours, the notification within 72 hours and the final report within a month, to the competent CSIRT. To meet these deadlines, you need to know who sent what data to the model and when
https://www.allclouds.pl/en/wiedza/nowelizacja-ksc-nis2-a-ai/
