What is the head of an essential or important entity personally responsible for?

Why this question arises at all

The NIS2 Directive requires that the management bodies of essential and important entities approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements of Article 21 by those entities (Article 20(1) of Directive 2022/2555). The Polish act carries over into cybersecurity a construct from the Accounting Act, including the definition of the head and the rule for a collective body (Article 3(1)(6) and Article 4(5) of that Act).

The second reason is practical. The obligations covered by the head’s responsibility are scattered across more than a dozen articles of the KSC Act, and their addressee is usually the entity. In many organisations the subject therefore goes to the IT department or to the security director and the board regards the matter as handed over. Article 8c(3) does not provide for that effect.

What has to be established before the board divides responsibility

Who is the head of the entity

The KSC Act refers to the definition of the head of the unit in the Accounting Act, and in a public finance sector unit to the head of that unit (Article 2(8a)). The head of the unit is a member of the management board or of another management body. Where the body is a collective one, the head consists of the members of that body excluding proxies appointed by the unit (Article 3(1)(6) of the Accounting Act). The same provision also identifies the head in partnerships, in a civil-law partnership and in a sole proprietorship. It also treats among others the liquidator, the trustee in bankruptcy, the administrator appointed in restructuring proceedings and the succession administrator as the head.

The Minister of Digital Affairs reads the definition in the same way (Q&A 4.2). The Minister’s set of questions and answers has no legal force, but according to the Minister it is useful in interpreting the provisions.

Three practical conclusions follow from the definition. A proxy is not the head of the entity, even with a broad power of attorney. Nor are the members of the supervisory board, because the definition covers the management body and the Accounting Act lists the supervisory body separately (Article 4a(1)). In a group of companies the head is established separately for each company that is an essential or important entity. A shared group security director who is to perform the obligations of the head therefore needs an entrustment in each company. If the director carries out tasks under Article 8 or 11, before starting them the director presents information from the National Criminal Register on the absence of convictions for offences against the protection of information or holds a valid security clearance at the ‘confidential’ level or higher (Article 8f(1) and (3)). According to the Minister the obligation under Article 8f covers the company’s employees and persons under civil-law contracts concluded directly with it, but not the staff of entities providing services to it (Q&A 3.48).

In the banking and financial market infrastructure sector Articles 8c–8f apply accordingly (Article 8i(2)). In public administration an authority listed in Article 16e may designate a unit responsible for the obligations of subordinate or supervised units, including the obligations under Articles 8c–8f. Such an authority is for example a minister or a voivode. According to the Minister of Digital Affairs, where the designation covers the tasks of the head of the entity, the head of the designated unit is responsible (Q&A 3.30).

NIS2 management liability in a multi-member board

Where the head of the entity is a collective body and no responsible person has been designated, all members of that body bear responsibility (Article 8c(2)). In a company with a five-member board and no such designation NIS2 management liability therefore concerns five people. The KSC Act does not specify who designates the responsible person or in what form. The simplest evidence is a board resolution or a provision of the board’s rules of procedure stating the person’s name, the scope and the date. According to the Minister an entity may designate more than one responsible person in a collective body (Q&A 4.4).

The KSC Act does not say expressly what effect the designation has on the other members. In my assessment Article 8c(2) read a contrario means that responsibility is then concentrated on the designated person. On that reading this also applies to the risk of a penalty under Article 73a. Against it is the fact that Article 73a(1) names the head of the entity, and by definition every board member remains the head. Article 32(6) of the Directive also speaks against it. Under that provision Member States ensure that any natural person responsible for or acting as a legal representative of an essential entity can be held liable for breach of their duties to ensure compliance with the Directive. There is no practice of the authorities on this issue yet. Until it develops it is safer to assume that the designation does not remove the risk of a penalty from the other board members.

On the a contrario reading the designated person should be a member of the body. Article 8c(2) concerns a situation in which the head of the entity is a collective body, and only the head is subject to the penalty under Article 73a. If designating a person from outside the board released the board members, nobody would be subject to that penalty. Designating the security director or a proxy would therefore at most be an entrustment of obligations with that person’s consent (Article 8c(3)), which does not change the board’s responsibility. The Minister writes of designating responsible persons ‘within a collective body’ (Q&A 4.4), which may be read as designation from among the members of the body. The provision however speaks of a ‘person’ and not of a member of the body, so this question also remains open.

In my assessment the position on training is different. The head of the entity undergoes training once per calendar year (Article 8e(1)), and within the meaning of the definition the head consists of all members of the body. The obligation therefore covers the whole board even after a responsible person has been designated. Article 8c(2) decides on responsibility and not on who the head of the entity is. The provision on training does not refer to the designation. It adds the person entrusted with obligations to the head of the entity rather than replacing the head with that person. Under Article 20(2) of the Directive Member States ensure that members of the management bodies are required to follow training. In the answer on training the Minister does not refer to the designation and writes generally that ‘persons managing essential entities or important entities must also undergo training once a year’ (Q&A 4.3). The narrower reading, under which only the designated person is trained, is supported by Article 8c(1). It lists Article 8e among the obligations covered by responsibility, so the designation under paragraph 2 would also cover training. This argument however concerns responsibility and not the addressee of the obligation. The designation may therefore at most change who is responsible for a failure to train, and even that depends on how the dispute over the effect of the designation is resolved.

When the designated person stops performing that role and no new one has been designated, all members are responsible (Article 8c(2)). A new board member is the head of the entity as a member of the body (Article 3(1)(6) of the Accounting Act). In my assessment in an entity that met the criteria on 3 April 2026 the training obligation covers that member from 2027 already in the year of appointment. A member appointed in 2026 undergoes the first training like the rest of the board, that is according to the Minister in 2027 at the latest (Q&A 3.46).

Entrustment of tasks does not transfer responsibility

The head of the entity is responsible even where some or all obligations have been entrusted to another person with that person’s consent (Article 8c(3)).

This applies to the security director and to the IT manager. The entity establishes internal structures responsible for cybersecurity or concludes an agreement with a managed security service provider (Article 14), and both options belong to the catalogue of obligations for which the head of the entity is responsible. The assessment and supervision of such a provider are described in How to manage supplier risk under NIS2?.

The KSC Act speaks of entrustment with the consent of the person to whom the obligations are entrusted but does not specify the form. With a similar construct the Accounting Act provides for the acceptance of responsibility to be confirmed in writing (Article 4(5)). It is worth adopting the same practice. A written entrustment should describe the scope of obligations, the person’s consent, the method of reporting to the board and access to the budget.

The KSC Act provides for no financial penalty for the person to whom obligations have been entrusted. That person’s liability may arise from a contract or from an employment relationship. Where the entrustment covers the obligations of the head of the entity, that person also undergoes the annual training (Article 8e(1)).

The catalogue of obligations for which the head of the entity is responsible

The catalogue in Article 8c(1) is a list of provisions and not of activities. The whole catalogue is subject to common limitations. The penalty for the head of the entity is discretionary and may be imposed at the earliest after 3 April 2028 (Article 35 of the amending act). In the banking and financial market infrastructure sector the provisions on the management system and incident reporting apply only to the extent set out in Article 8i(1), and the provisions on supervision and penalties to the extent set out in Article 8i(3). A public entity performs the obligations from the catalogue listed in Article 16d only where it uses an information system to perform a public task.

Obligation	Provision and penalty for the head of the entity	Exceptions and limits	Deadline
Supplementing data after an ex officio entry, application for entry and for amendment of the entry, application for removal	Article 7b(4), Article 7c and Article 7f(3) — penalty under Article 73a(1)(1), which covers Article 7b(4), Article 7c(1) and (3) and Article 7f(3)	liability for the head’s false statement does not cover the ranges of IP addresses and domain names (Article 7c(5))	provisions applied from 3 April 2026; entities meeting the criteria on that day submitted the application under the schedule announced by the Minister (Article 33(3) of the amending act), others within 6 months of meeting the criteria; supplementing data within 6 months of service of the request (Article 7b(2)); amendment of the entry within 14 days of the change in data
Information security management system	Article 8 — penalty under Article 73a(1)(2)	a public important entity and the important entities of the higher education and science system indicated in Article 8(3), excluding research organisations, apply the requirements of Annex 4 within the scope of public tasks	3 April 2027 for entities meeting the criteria on 3 April 2026
The head’s own tasks	Article 8d — penalty under Article 73a(1)(3)	—	3 April 2027
Annual training of the head of the entity and of the person entrusted with the head’s obligations, with documented participation	Article 8e — penalty under Article 73a(1)(4)	—	according to the Minister first training in 2027 at the latest, and training in 2026 followed by another in 2027 is also possible (Q&A 3.46), then once per calendar year
Information from the National Criminal Register before admission to tasks under Article 8 or 11 and a repeat request where there is a justified suspicion of a conviction for an offence against the protection of information	Article 8f(1) and (2) — penalty under Article 73a(1)(5)	the requirement is met by a valid security clearance at the ‘confidential’ level or higher (Article 8f(3))	3 April 2027
Contact persons, knowledge and a reporting channel for users, use of the S46 system	Article 9 — penalty under Article 73a(1)(6) and (7), which cover contact persons and the possibility of reporting	a micro or small enterprise and a public important entity designate at least one person (Article 9(2) and (3)); the data of contact persons are already given in the application for entry (Article 7(2)(11))	3 April 2027
System security documentation	Article 10 — penalty under Article 73a(1)(8), which covers Article 10(1) and (6)–(8)	the retention rule in Article 10(7) has an exception for entities covered by the provisions on the national archival resource	3 April 2027
Incident handling, notifications and reports	Articles 11–12b — penalty under Article 73a(1)(9)–(12) (Article 11, Article 12(5)–(8), Article 12a and Article 12b)	a public important entity does not submit an early warning or reports (Article 12c)	3 April 2027; former operators of essential services report significant incidents under the new rules, and the 6-month transition period expired on 3 October 2026 (Article 33(4) of the amending act)
Internal structures or an agreement with a managed security service provider	Article 14 — penalty under Article 73a(1)(13)	—	3 April 2027
System security audit at least once every 3 years	Article 15 — penalty under Article 73a(1)(14)	the periodic obligation applies to an essential entity; an important entity carries out an audit after a significant incident or other infringement on the basis of a decision of the authority (Article 15(1b))	first audit by 3 April 2028 for essential entities meeting the criteria on 3 April 2026, while former operators of essential services after an audit do not apply the deadline in point 2 of Article 16 (Article 25 of the amending act) and according to the Minister keep their existing cycle (Q&A 9.5)

The deadlines in the table apply in principle to entities that met the criteria on the date of entry into force of the amendment (Article 33(1) and (2) of the amending act). The amendment published on 2 March 2026 entered into force one month after its publication (Article 49), that is on 3 April 2026. An entity that meets the criteria later has 12 months from meeting them to perform the obligations under Chapter 3. An essential entity then has 24 months for its first audit (Article 16). Where an entity is recognised by decision the same deadlines run from service of that decision (Article 7l(7) and Article 7m(6)). Former operators of essential services apply their existing system until the new system is implemented (Article 33(6) of the amending act). If they have carried out an audit under Article 15(1), the deadline in point 2 of Article 16 does not apply to them (Article 25 of the amending act). According to the Minister they then keep the cycle of an audit at least once every 3 years from the report on the last audit, so after an audit in May 2024 the next one is due in May 2027 at the latest (Q&A 9.5).

The obligations concerning the register belong to Chapter 2 and according to the Minister already apply (Q&A 2.39). According to the Minister the deadline for the application for entry for entities meeting the criteria on 3 April 2026 expired on 3 October 2026 (Q&A 3.1). What to do after that date is described in What to do after 3 October 2026, once the deadline for entry in the KSC register has passed?.

Tasks that the KSC Act assigns to the head of the entity personally

Most obligations in the catalogue are addressed to the entity. The KSC Act addresses to the head personally the annual training (Article 8e(1)) and the admission of persons to tasks under Article 8 or 11 after receipt of information from the National Criminal Register (Article 8f(1)). According to the Minister the head may entrust the verification of criminal records to another person and remains responsible for it, while that person does not become the head of the entity (Q&A 4.7). In addition Article 8d lists five tasks of the head of an essential or important entity personally.

1. Takes decisions on the preparation and implementation of the information security management system in the entity and on its application, review and supervision.
2. Plans adequate financial resources for performing cybersecurity obligations.
3. Assigns cybersecurity tasks in the entity and supervises their performance.
4. Ensures that the entity’s staff are aware of cybersecurity obligations and know the entity’s internal rules in this respect.
5. Ensures that the entity operates in compliance with the law and with the entity’s internal rules.

According to the Minister adequate resources are also tailored to the entity’s capabilities, and tasks may be assigned by adopting policies, allocating duties and issuing authorisations (Q&A 4.1). The KSC Act does not specify the form of any of these activities, so it is worth each of them leaving a dated record.

It is worth the board having to hand the resolution on the management system and the resolution designating the responsible person, if one has been designated. Written entrustments with consent and a budget line will also be useful. Added to this are periodic reports to the board, confirmations of training (Article 8e(3)) and a record of admitting persons to tasks under Article 8 or 11. Documents are not sufficient in themselves. The Minister stresses that what is required is proof of applying the provisions and not the presentation of formally correct documents (Q&A 11.6).

NIS2 management liability and the financial penalty

NIS2 management liability has several personal consequences. Criminal liability already applies today. An application for entry in the register, amendment of the entry or removal from the register contains a statement by the head of the entity that the data are true, made under penalty of criminal liability under Article 233 § 6 of the Criminal Code (Article 7c(5)). A false statement is punishable by imprisonment from 6 months to 8 years, and the person who makes it is liable (Article 233 § 1 and § 6 of the Criminal Code). According to the Minister an application with the statement may be filed by a proxy, while the head remains responsible for the correct filing of the application (Q&A 2.66). The Minister does not explain who is then criminally liable for the content of the statement.

Article 8c itself provides for no sanction, and the financial consequence for the head of the entity is set out in Article 73a. The head of the entity may be subject to a financial penalty for failing to perform the obligations listed in Article 73a(1) where the duration, scope or nature of the infringement justifies it. The basis for the penalty is failure to perform an obligation and not the mere occurrence of an incident (Article 73a(1)). The head may also be penalised for a one-off omission (Article 73a(2)). The penalty may be imposed independently of the penalty for the entity under Article 73(1) (Article 73a(3)).

It is disputed whether Article 73a(3) allows the head to be penalised also for obligations under Article 73(1) outside the catalogue in Article 73a(1), for example for obstructing an inspection or failing to implement post-inspection recommendations (Article 73(1)(14) and (17)). That reading is supported by the words ‘for failure to perform the obligations indicated in that provision’ and by the fact that paragraphs 4 and 5 refer to the penalty under paragraphs 1–3. Against it is the closed catalogue in Article 8c(1). Among the conditions for a penalty on the head of the entity the Minister lists only the obligations under Article 73a(1) (Q&A 12.10).

The penalty amounts to no more than 300% of the remuneration received by the penalised person, calculated in accordance with the rules for determining the cash equivalent for annual leave (Article 73a(4)). The head of a public entity may be fined at most 100% of such remuneration. However, where the public entity also applies the Act on the basis of another sector in Annex 1 or 2, the upper limit of 300% applies (Article 73a(5)). The provision sets no minimum amount. Nor does Article 73a determine how to set the penalty for a head of the entity who receives no remuneration.

When setting the amount of the penalty the authority takes into account among other things the gravity of the infringement and the financial capacity of the head of the entity (Article 76a(1)). It may refrain from imposing the penalty if the gravity of the infringement and the significance of the infringed provisions are negligible and the head has ceased the infringement or remedied the damage (Article 76a(9)). Before imposing a penalty the authority in principle informs the entity of its preliminary findings, and the entity has 7 days to present its position. The authority may skip this stage where it would hinder immediate prevention of or response to incidents or could adversely affect national security or public order (Article 53(13), (14) and (16) and Article 53(17) for an important entity).

Penalties under Article 73a may first be imposed after 2 years from the entry into force of the amendment, that is after 3 April 2028 (Article 35 of the amending act with the period counted from 3 April 2026). Article 35 concerns the moment the penalty is imposed and not the moment of the infringement. An omission in 2027 may therefore be penalised after 3 April 2028.

A penalty on the head does not replace the penalty on the entity. An essential entity faces a penalty of up to EUR 10,000,000 or up to 2% of its revenue from business activity in the financial year preceding the imposition of the penalty. The higher amount applies and the penalty may not be lower than PLN 20,000 (Article 73(3)). An important entity faces a penalty of up to EUR 7,000,000 or up to 1.4% of revenue. The penalty may not be lower than PLN 15,000 and in this case the provision contains no rule on applying the higher amount (Article 73(4)). These penalties are deferred in the same way. Article 35 of the amending act does not however mention the penalty of up to PLN 100,000,000 under Article 73(5) that the Minister calls an exception to the deferral (Q&A 12.1 and 12.6).

Ban on exercising managerial functions in an essential entity

A supervisory measure may also be a personal consequence. The authority may prohibit the head of the entity from exercising managerial functions in an essential entity until the deficiencies are remedied or the infringements cease (Article 53(9)(6)). The condition is that the entity has failed to comply with an earlier order or decision under Article 53(5). The ban may not prevent the entity from functioning to the extent necessary to remedy the deficiencies or cease the infringements.

The ban does not apply to public entities (Article 53(10)) or while a complaint against the order or decision is pending (Article 53(11)). Before the first decision imposing the ban the authority in principle presents its preliminary findings (Article 53(13) and (16)). The measure applies for no longer than 14 days from service of the decision. Where the deficiencies persist the authority issues the decision again for a further period of up to 14 days, this time without the preliminary findings stage (Article 53e(2) and (4)). The authority publishes information on the measure together with the name and surname of the head of the entity in the Public Information Bulletin (Article 53e(11)).

The provision on the ban names only an essential entity, and the provision on supervision of an important entity does not refer to Article 53(9) (Article 53(17)). The measure therefore does not concern the head of an important entity. The deferral under Article 35 of the amending act covers the financial penalties listed in it and not the supervisory measures under Article 53.

Conclusions and next steps

NIS2 management liability can be organised and documented, although entrustment of tasks does not transfer it. The board should know which of its members is responsible and what has been entrusted to whom, and be able to demonstrate this to the authority.

1. Identify by name the head of the entity in each company that is an essential or important entity.
2. Check the entry in the register and appoint a person who prepares the application for amendment of the entry for filing within 14 days of a change in data (Article 7c(3) or Article 7b(4) after an ex officio entry).
3. Decide whether the board designates a member responsible for cybersecurity. If so, do it by resolution stating the scope and check that the board’s rules of procedure do not restrict this.
4. Adopt by resolution the decisions on the system, the budget line, the frequency of reports to the board and the date of the system review.
5. Before admitting a person to tasks under Article 8 or 11 obtain from that person information from the National Criminal Register or check the security clearance and record the admission. According to the Minister this also applies to existing staff and to persons under civil-law contracts concluded directly with the entity (Q&A 3.29 and 3.48), but not to the staff of providers (Q&A 3.48). Collect the information from existing staff by 3 April 2027 (Article 33(1) of the amending act).
6. Put in writing the entrustments of obligations to persons together with the consent, scope and reporting method, and the agreements with providers.
7. Plan and document the annual training of the whole board, of every new board member and of the person entrusted with the obligations of the head of the entity.

Related materials

• What should NIS2 training for the board cover? — the programme of the annual training of the head of the entity.
• What NIS2 documentation must an essential or important entity keep? — documentation for which the head of the entity is responsible.
• How to manage supplier risk under NIS2? — the agreement with a provider and the responsibility of the head of the entity.
• Where should the board begin preparing for NIS2? — the order of board decisions.
• Is the data protection officer liable for a personal data breach? — who is liable for a breach under the GDPR.

Sources

• Act of 5 July 2018 on the National Cybersecurity System, consolidated text as at 18 August 2026 — Article 2(8a), Articles 7–7f, Article 7l(7), Article 7m(6), Articles 8–8f, Article 8i, Articles 9–12c, Articles 14–16, Article 16d, Article 16e, Article 53, Article 53e, Article 73, Article 73a and Article 76a (in Polish) — isap.sejm.gov.pl.
• Act of 23 January 2026 amending the Act on the National Cybersecurity System and certain other acts (Journal of Laws 2026, item 252) — Article 25, Article 33(1)–(4) and (6), Article 35 and Article 49 (in Polish) — isap.sejm.gov.pl.
• Act of 29 September 1994 on Accounting, consolidated text (Journal of Laws 2026, items 522, 640 and 644) — Article 3(1)(6), Article 4(5) and Article 4a(1) (in Polish) — isap.sejm.gov.pl.
• Act of 6 June 1997 — Criminal Code, consolidated text (Journal of Laws 2025, item 383, as amended) — Article 233 § 1 and § 6 (in Polish) — isap.sejm.gov.pl.
• Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 (NIS2) — Article 20(1) and (2) and Article 32(6) — eur-lex.europa.eu.
• Minister of Digital Affairs, National Cybersecurity System — questions and answers on the amendment of the KSC Act, update of October 2026 — Q&A 2.39, 2.66, 3.1, 3.29, 3.30, 3.46, 3.48, 4.1, 4.2, 4.3, 4.4, 4.7, 9.5, 11.6, 12.1, 12.6 and 12.10 (in Polish) — cyber.gov.pl.