How does the authority supervise an essential or important entity?

Why this question arises at all

According to the Minister of Digital Affairs the substantive obligations of an essential entity and of an important entity are the same. The difference comes down to the scope of supervisory activities (Q&A 1.11 of the Minister’s answers). The Minister’s answers have no legal force, but they help in interpreting the Act. In the same answer the Minister notes that only an essential entity carries out the audit every 3 years. The category determines whether KSC supervision also operates preventively and how far the authority’s measures reach.

What has to be established before a decision

Which authority exercises supervision

Supervision is exercised by the competent authority for cybersecurity designated for the sector in Article 41 of the Act (Article 53(1)). For the electronic communications subsector and the postal services sector it is the President of the Office of Electronic Communications. For banking and financial market infrastructure it is the Polish Financial Supervision Authority. In the other sectors supervision is exercised by the competent ministers, and for some entities by the Minister of National Defence. In the public entities sector the authority is in principle the minister competent for computerisation (Article 41a(1)). A public entity listed in another sector is subject to the authority for that sector. This does not apply to local government public entities (Article 41a(4)).

The authority may entrust some tasks to subordinate or supervised units under an agreement (Article 42(3)–(6)). The minister competent for computerisation may also entrust CSIRT NASK with supervisory tasks over essential entities in the public entities sector, except for issuing decisions (Article 41a(5)). Authorities may exercise supervision jointly and designate a lead authority (Article 53f(1) and (2)).

The banking and financial market infrastructure sector has a separate rule. In that sector the provisions on the information security management system and on reporting significant incidents in principle do not apply (Article 8i(1)). The provisions on supervision and penalties apply only to the extent of the provisions listed in Article 8i(3), including those on the register, on contact persons and on the head of the entity. The audit under Article 15 is not on that list.

How KSC supervision of an essential entity differs from supervision of an important entity

The Act calls supervision of essential entities preventive and follow-up, and supervision of important entities follow-up (Article 53(3)). Follow-up supervision concerns in particular situations of a justified suspicion that the provisions may be infringed. Recital 122 of the NIS2 Directive is not a provision, but it indicates the direction of interpretation. It describes supervision of important entities as reactive and assumes that the authorities should not have a general obligation to carry it out. According to the recital supervision may be triggered by evidence, indication or information. It is enough that the authority considers on that basis that an infringement may be occurring.

Article 53(17) requires the whole catalogue of tools in paragraph 2 to be applied to an important entity. Doubt arises over the security assessment by a CSIRT commissioned by the authority. Article 53(2)(3) refers to the system of an essential entity, but Article 36b(3) also lists an important entity when it comes to commissioning. The Minister limits commissioning to essential entities (Q&A 10.5), and in Q&A 11.5 also lists the assessment for important entities. The CSIRT and the entity set out in an agreement matters including the schedule, scope and type of tests (Article 36b(6)). The assessment may not take place without, among other things, a backup copy of the system being tested (Article 36b(5)). The undisputed differences concern the audit, the monitoring officer and the measures under Article 53(9). In the banking and financial market infrastructure sector the tools in the table serve only to enforce the provisions listed in Article 8i(3).

Authority’s tool	Essential entity	Important entity	Exceptions and limits
Inspection, including ad hoc and remote (Article 53(2)(1))	yes	yes (Article 53(17))	for an important entity as part of follow-up supervision
Request for information, access to documents and evidence of meeting the requirements (Article 53(2)(4)–(6), Article 53c)	yes	yes	deadline of at least 7 days (Article 53c(2)(5))
Security assessment of the system by a CSIRT commissioned by the authority (Article 53(2)(3))	yes	disputed	Article 53(17) and Article 36b(3) cover an important entity; the Minister limits commissioning to essential entities (Q&A 10.5) but lists the assessment for important ones (Q&A 11.5)
Order to carry out an external audit by decision (Article 15(1b))	at any time	after a significant incident or another infringement of the Act	the decision is immediately enforceable (Article 15(1c)); Article 53(13) does not require preliminary findings before it
Warning and orders (Article 53(4) and (5)(1)–(5), (7) and (8))	yes	yes	in principle after preliminary findings (Article 53(13))
Monitoring officer (Article 53(5)(6))	yes	no	decision, for at most a month; in principle after preliminary findings (Article 53(13))
Suspension of a licence or of the activity, ban on exercising managerial functions (Article 53(9))	yes	no	in principle after preliminary findings (Article 53(13)); not for public entities (Article 53(10))

How the authority gathers information

The basic tool is a request for data, information and documents necessary for supervision and inspection (Article 53c(1)). The request must be proportionate to its purpose. It specifies among other things the purpose, the scope and a deadline appropriate to the scope of the request, not shorter than 7 days. It also contains a justification and a notice of the risk of a penalty (Article 53c(2)). It is drawn up in electronic form and served under the Code of Administrative Procedure or through the Minister’s ICT system, that is S46 (Article 53c(3)). The same rules apply to a request for access to documents and evidence of meeting the requirements of Article 8(1) (Article 53c(4)).

According to the Minister evidence may consist of documents such as procedures, policies, authorisations and descriptions of duties. It may also consist of statements by staff. The Minister stresses that what is required is proof of applying the provisions and not the presentation of formally correct documents (Q&A 11.6). The authority may also request information needed to assess the risk management measures and the accuracy of the data submitted to the register (Article 53(2)(4)). Failure to comply with a request under Article 53c is a separate ground for a penalty (Article 73(1)(15)).

The authority carries out an inspection at the entity’s seat, at the place where the activity is carried out or remotely (Article 53(2)(1)). Chapter 5 of the Entrepreneurs’ Law applies to entrepreneurs (Article 54(1)). The authority in principle notifies the entrepreneur of its intention to carry out an inspection. It in principle starts the inspection after at least 7 days and within 30 days of delivery of the notification (Article 48(1), (2) and (11) of the Entrepreneurs’ Law). The cap on the total duration of all inspections by one authority at an entrepreneur in a calendar year in principle ranges from 6 working days for a micro-entrepreneur to 48 for an entrepreneur larger than medium-sized (Article 55(1) and (2) of the Entrepreneurs’ Law). The entrepreneur may object to activities carried out in breach of those provisions within 3 working days of the start of the inspection or of the breach (Article 59(1) and (4) of the Entrepreneurs’ Law). An inspector at an entrepreneur enters the premises without a pass and requests explanations. The inspector may also among other things view and secure documents and examine systems (Article 55 of the KSC Act). The entrepreneur provides the inspector with conditions for an efficient inspection (Article 56(1)). At the authority’s request the entrepreneur translates the foreign-language documentation it has submitted into Polish at its own cost (Article 56(3)). It may submit objections to the inspection report within 7 days of its presentation for signature (Article 58(4)).

Local government units and other entities that are not entrepreneurs are inspected under the Act on Inspections in Government Administration (Article 54(2) and (3)). The head of the unit is notified of a planned inspection (Article 20 of that Act). The head has 7 working days from receipt of the draft post-inspection statement to submit objections to it (Article 40(1) of that Act).

Where after an inspection the authority considers that an infringement may have occurred, it gives the inspected entity post-inspection recommendations with a deadline for implementing them. No means of appeal are available against the recommendations (Article 59(1) and (2) of the KSC Act). The entity informs the authority of how they have been implemented within the time limit set (Article 59(3)).

The authority may order an ad hoc inspection among other things for reasons of national security or to check whether an essential entity has remedied deficiencies (Article 59c(1) and (2)). It may also carry it out where it was not possible to notify the entity in advance (Article 59c(4)). The provisions of the Entrepreneurs’ Law on planned inspections and on the prohibition of several inspections at the same time do not apply to it (Article 59c(8)). At an entity that is not an entrepreneur it ends with a summary report and no post-inspection statement (Article 59c(3) and (5)). The position of the head of the entity on the inspection report or the summary report does not suspend the implementation of the findings (Article 59c(6)).

How KSC supervision proceeds from suspicion to decision

1. Preliminary findings. Before a warning, a measure under Article 53(5) or (9) and before a penalty the authority informs the entity of its preliminary findings. The information contains a detailed justification of the intention (Article 53(13)). The entity may present its position without delay, no later than within 7 days (Article 53(14)). The authority either accepts the position and refrains from the intended action, or rejects it and gives a detailed justification for the rejection (Article 53(15)). The authority may skip this stage where it would hinder immediate prevention of or response to incidents or could adversely affect national security or public order (Article 53(16)).
2. Warning. Where there is a justified suspicion of an infringement the authority sends the entity an electronic letter containing a warning (Article 53(4)). In it the authority indicates the actions needed to prevent the infringement or to stop it and the deadline for taking them. Article 53(5) allows an order to be issued ‘also where’ the entity has not complied with the warning. A warning is therefore not a precondition for an order.
3. Orders. For both categories the authority may order among other things actions in handling an incident, the cessation of infringements and ensuring the compliance of the information security management system. It may also order the performance of the obligation to report a significant incident or the implementation of audit recommendations. Finally it may order recipients of services to be informed of a significant cyber threat and information on infringements or on a significant incident to be published (Article 53(5)). It sets a deadline when doing so (Article 53(6)). An order in handling an incident is another act within the scope of public administration that requires a justification and is subject to a complaint to an administrative court (Article 53(7)). The authority issues the other orders by decision in single-instance proceedings, and a complaint to an administrative court lies against the decision (Article 53(8)). A complaint does not in itself suspend the enforcement of an order or decision. The authority may suspend it, and in the case of a decision provided that there are no grounds for immediate enforceability. Once the complaint has been forwarded the court may also do so at the complainant’s request where there is a risk of significant damage or of effects that are difficult to reverse (Article 61 § 1–3 of the Law on Proceedings before Administrative Courts).
4. Monitoring officer — a measure under paragraph 5, only for an essential entity. The authority appoints the officer by decision, for a period not longer than a month, from among persons employed in its office (Article 53(5)(6)). The officer supervises the performance of the obligations under Chapter 3 of the Act and carries out strictly defined tasks. The officer enters the entity’s premises on a pass that must be issued without delay and whose issue may not be refused. The officer has access to documents and may request explanations (Article 53d(1)). The officer announces an examination of equipment, data carriers and systems 1 day before it, to the address for electronic service or through S46 (Article 53d(4)).
5. Measures under Article 53(9) — only for an essential entity that is not a public entity. Where the entity has not complied with an order or decision the authority may suspend or restrict a licence or permit. The Minister describes this measure as an application for the suspension, restriction or withdrawal of a permit or licence (Q&A 11.4). Article 53(9) does not mention an application or withdrawal. The authority may also suspend the activity in whole or in part or prohibit the head of the entity from exercising managerial functions. The ban may not prevent the entity from functioning to the extent necessary to remedy the deficiencies or cease the infringements (Article 53(9)). The measure applies for at most 14 days from delivery of the decision (Article 53e(2)). Where the deficiencies persist the authority issues the decision again for a further period of up to 14 days, this time without preliminary findings (Article 53e(4)). Once a complaint against the order or decision has been lodged the measures under paragraph 9 do not apply until the case is decided by the court, which has a month to do so (Article 53(11)). The decision on the measure is enforceable on the day of delivery (Article 53e(9)). After remedying the deficiencies the entity may apply for its revocation with evidence, and the authority considers the application within 7 days (Article 53e(5)–(7)). The authority publishes information on the application of the measure in the Public Information Bulletin (Article 53e(11)).

When choosing an order or a measure under paragraph 9 the authority takes into account among other things the seriousness of the infringement, its duration and the degree of the entity’s cooperation with the authority (Article 53(12)). The Act treats as a serious infringement among other things a repeated infringement and the failure to report or handle significant incidents. Supplying false or grossly inaccurate information on risk management measures or on the reporting of significant incidents is also serious.

When supervision ends with a penalty

According to the Minister a penalty is a measure independent of the others, and the decision on it is preceded by a warning and information on the preliminary findings (Q&A 12.3). The Act requires preliminary findings before a penalty (Article 53(13)), and links a warning to a justified suspicion of an infringement (Article 53(4)). It does not list a warning among the conditions for imposing a penalty.

Four grounds for a penalty are linked to supervision itself. They are preventing or obstructing an inspection, failing to comply with a request under Article 53c and preventing or obstructing the work of the monitoring officer. The fourth is failing to implement post-inspection recommendations on time (Article 73(1)(14)–(17)). For delay in complying with a decision under Article 53(5)(2)–(8) the authority may impose a periodic penalty payment for each day of delay (Article 76b(1)). In setting a penalty the authority takes into account the criteria in Article 53(12) and the entity’s revenue, and for a public entity its financial capacity (Article 76a(1)). It may refrain from it where the seriousness of the infringement and the significance of the provisions infringed are negligible and the entity has ceased the infringement or remedied the damage (Article 76a(9)).

Penalties under Article 73(1)–(4), Articles 73a–73c and periodic penalties under Article 76b may first be imposed after 2 years from the entry into force of the amending act, that is after 3 April 2028 (Article 35 of the amending act). Article 35 does not cover the measures under Article 53(9) or the penalty under Article 73(5). The authority imposes that penalty of up to PLN 100 million for an infringement causing the effects listed in the provision. The first is a direct and serious cyber threat to defence, national security, public safety and order or human life and health. The second is the risk of causing serious material damage or serious disruption to the provision of services. The provision lists them without a conjunction, while the Minister links them with the word ‘and’ in Q&A 12.6. In my assessment Article 35 does not rule out a penalty after 3 April 2028 for an infringement committed earlier, because it links the deferral to the moment the penalty is imposed. It can be argued that the provision creates a protective period, but its wording does not support that reading. The amount of penalties is described in Does every organization fall under NIS2?.

How supervision connects with personal data protection

Where in the course of supervision the authority finds a suspected personal data breach, it informs the President of the Personal Data Protection Office (UODO) within 7 days (Article 59a(1)). If the President of UODO has imposed a final penalty for the same act in connection with a personal data breach, the KSC authority does not initiate penalty proceedings and confines itself to an instruction. Where proceedings have already been initiated, the Act refers to the rule on refraining from a penalty. The authority refrains from it if the earlier penalty fulfils its purposes (Article 76c(1)). The authority may nevertheless continue to apply the measures under Article 53(4), (5) and (9) (Article 76c(2)). Article 35 of the amending act does not concern penalties imposed by the President of UODO. It is therefore worth reviewing materials for the KSC authority with the data protection officer before sending them.

When KSC supervision applies

The amending act was published on 2 March 2026 and entered into force a month later, on 3 April 2026 (Article 49 of the amending act). The transitional provisions do not defer the supervisory powers. Inspections of operators of essential services and digital service providers that were initiated and not completed before 3 April 2026 are governed by the previous provisions (Article 28 of the amending act). What is deferred are the obligations under Chapter 3 and most penalties.

An entity that met the criteria on 3 April 2026 has 12 months to perform the obligations under Chapter 3. The deadline expires on 3 April 2027 (Article 33(1) of the amending act). Chapter 3 covers among other things the information security management system, incident reporting and documentation. Separate rules apply to former operators of essential services. They already apply the new rules on reporting significant incidents, because the 6-month period from the entry into force of the amending act expired on 3 October 2026 (Article 33(4) of the amending act). Until the new information security management system is implemented they apply the system compliant with Article 8 as previously worded (Article 33(6) of the amending act). The authority may already inspect entities, request information and check the accuracy of the data in the register. Until 3 April 2027 a warning and an order may therefore concern primarily obligations that already apply, for example the register and responses to requests.

Stage — from when	Basis	Exceptions and limits
Supervisory powers under Articles 53–59c — from 3 April 2026	Article 49 of the amending act	inspections of operators of essential services and digital service providers initiated earlier — previous provisions (Article 28 of the amending act)
Obligations under Chapter 3 — by 3 April 2027	Article 33(1) of the amending act	former operators of essential services (Article 33(4) and (6) of the amending act); an entity meeting the criteria later — 12 months from meeting them (Article 16(1))
First audit of an essential entity — by 3 April 2028	Article 33(2) of the amending act	an entity meeting the criteria later — 24 months (Article 16(2)); an audit of an operator of essential services not completed before 3 April 2026 — previous provisions (Article 24(1) of the amending act)
Financial penalties — after 3 April 2028	Article 35 of the amending act	does not apply to the penalty under Article 73(5)

How to prepare the organisation for KSC supervision

The time limits in supervision run from different events.

• 7 days for a position after the preliminary findings (Article 53(14)).
• At least 7 days to respond to a request, according to the deadline set by the authority (Article 53c(2)(5)).
• 7 days for objections to the inspection report at an entrepreneur (Article 58(4)), and at an entity that is not an entrepreneur 7 working days for objections from receipt of the draft post-inspection statement (Article 40(1) of the Act on Inspections in Government Administration).
• 3 working days for a position after an ad hoc inspection (Article 59c(6)).
• 1 day between the notice and the monitoring officer’s examination (Article 53d(4)).

During an inspection at an entrepreneur the inspector may among other things examine systems (Article 55(6) of the KSC Act). It is worth having technical access and the person who will provide it ready at once. Letters arrive at the address for electronic service or in S46. The Minister is to launch the S46 functions for supervisory activities by 3 April 2027 (Article 36 of the amending act). The documents worth having ready are described in What NIS2 documentation must an essential or important entity keep?.

A request indicates a specific entity (Article 53c(2)(1)), and an order is addressed to the entity (Article 53(5) and (6)). In a group each company that is an essential or important entity therefore responds to its own requests and orders. The penalties that the head of the entity personally faces are described in What is the head of an essential or important entity personally responsible for?.

Common mistakes

• Equating the deferral of penalties with an absence of supervision. Article 35 of the amending act defers most financial penalties. It does not defer warnings, orders, inspections or the measures under Article 53(9).
• Believing that an important entity cannot be inspected. Article 53(17) requires paragraph 2 to be applied to it, including inspection (point 1).
• Treating preliminary findings as ordinary correspondence. A position submitted within 7 days may lead the authority to refrain from the measure or from the penalty (Article 53(15)(1)).

Conclusions and next steps

An organisation that has gathered evidence and designated persons for contact with the authority will find it easier to meet the deadlines at every stage.

1. Establish the competent authority and the channels of correspondence, and in a group do so for each company.
2. Check whether the entity has an active address for electronic service and access to S46. Designate the person who receives letters and a deputy, preferably from among the contact persons under Article 9(1)(1).
3. Record in a procedure who prepares the position after preliminary findings, who approves it and who represents the entity in the proceedings.
4. Gather evidence that the information security management system is operating under Article 8(1) or, in an important entity covered by Article 8(3) (including a public one), under Annex 4. An entrepreneur presents the requested evidence without delay during an inspection (Article 56(1) of the KSC Act), and every entity presents it on request by the deadline set by the authority (Article 53c).
5. Prepare a plan for handling inspections and examinations of systems, including the translation of documentation in a foreign language.

Related materials

• What is the head of an essential or important entity personally responsible for? — penalties for the head of the entity and the ban on exercising managerial functions.
• What NIS2 documentation must an essential or important entity keep? — documents the authority may request.
• What does a significant incident report to a CSIRT contain? — an obligation whose non-performance the Act treats as a serious infringement.
• Does every organization fall under NIS2? — the category of the entity and the amount of penalties.

Sources

• Act of 5 July 2018 on the National Cybersecurity System, consolidated text as at 18 August 2026 — Article 8(1) and (3), Article 8i(1) and (3), Article 9(1)(1), Article 15(1b) and (1c), Article 16, Article 36b(3), (5) and (6), Article 41, Article 41a(1), (4) and (5), Article 42(3)–(6), Article 53, Articles 53c–53f (including Article 53e(5)–(7), (9) and (11)), Articles 54–59, Article 59a, Article 59c(1)–(6) and (8), Article 73(1)–(5), Articles 73a–73c, Article 76a(1) and (9), Article 76b(1), Article 76c and Annex 4 (in Polish) — isap.sejm.gov.pl.
• Act of 23 January 2026 amending the Act on the National Cybersecurity System and certain other acts (Journal of Laws 2026, item 252) — Article 24(1), Article 28, Article 33(1), (2), (4) and (6), Article 35, Article 36 and Article 49 (in Polish) — isap.sejm.gov.pl.
• Directive (EU) 2022/2555 of the European Parliament and of the Council (NIS2) — recital 122 — eur-lex.europa.eu.
• Minister of Digital Affairs, National Cybersecurity System — questions and answers on the amendment of the KSC Act, update of October 2026 — Q&A 1.11, 10.5, 11.4, 11.5, 11.6, 12.3 and 12.6 (in Polish) — cyber.gov.pl.
• Act of 6 March 2018 — Entrepreneurs’ Law, consolidated text — Article 47(1), Article 48(1), (2) and (11), Article 54(1), Article 55(1) and (2), Article 59(1) and (4) (in Polish) — isap.sejm.gov.pl.
• Act of 15 July 2011 on Inspections in Government Administration, consolidated text — Article 20 and Article 40(1) (in Polish) — isap.sejm.gov.pl.
• Act of 30 August 2002 — Law on Proceedings before Administrative Courts, consolidated text — Article 61 § 1–3 (in Polish) — isap.sejm.gov.pl.