Qualification of the entity, management duties and the course of implementing NIS2 and the Polish national cybersecurity act.
Legal status: August 2026
See also: DPO and GDPR Incidents and Breaches Training and workshops AI Act
Preparing for NIS2 and KSC in your organisationWhether the entity qualifies, which measures apply and how responsibility is divided at board level depend on how the organisation actually works. Let us start by establishing where you stand today — no obligation and no sales preamble. Explore the service
NIS2 risk management measures do not take the form of a checklist in the Polish KSC Act. The catalogue in Article 8 indicates fourteen areas, and the depth of each measure is decided by the risk assessment and six factors set out in the same provision.
The third of October closes the schedule for filing applications, but not the registration obligations. After that date the KSC register becomes a continuing duty with three clocks, and an application filed late still produces an entry. The alternative is an entry made by the authority.
The deadline depends on the day the conditions were met. Entities that met them on 3 April 2026 file by 3 October 2026, everyone else has six months. The application is signed by the head of the entity and filed electronically in the system that maintains the register.
A gap analysis has to let the board take three decisions. What the organisation must meet, where it falls short and in what order it closes the difference. The act does not prescribe the form, so one thing decides its value.
The scope of training for the head of the entity is set by Article 8e(2) of the Polish KSC Act. It covers the very obligations the head is answerable for. The Act says nothing about form, length or level of detail — that is for the organization to settle.
Not every organization does, but every organization has to check. Qualification turns on the sector from Annex 1 or 2, the size of the entity calculated together with the group, and the categories covered regardless of size. The assessment is self-made, so a negative result also has to be documented.
With two board decisions. Who is the entity manager within the meaning of the KSC Act, and whether the qualification has been documented. Only after these does a gap analysis, implementation plan, and budget make sense.
