What to do after 3 October 2026, once the deadline for entry in the KSC register has passed?

Why this question arises at all

The schedule of the Minister of Digital Affairs opened the filing of applications on 7 May 2026 (Q&A 2.33). For entities that met the criteria on the day the amending act entered into force, the last day was 3 October 2026 (Q&A 2.32). The criteria are primarily the type of activity listed in Annex 1 or 2 to the Act and the size of the entity, and the Act covers some entities regardless of size (Article 5). The entry is declaratory in nature and according to the Minister only discloses the status of an essential or important entity (Article 7d(5), Q&A 2.48).

What has to be established before a decision

The deadlines for implementing the obligations run from meeting the criteria, or from service of the decision where an entity is recognised by a decision (Article 16 and Article 7l(7)). The obligations under Chapter 3 include among others the information security management system and incident handling (Article 8 and Article 11).

Situation – deadline	What to do	Exceptions and limitations	Legal basis
It is not known whether the criteria are met – if they were met on 3 April 2026, the deadline has passed	settle the qualification in writing and file an application where the criteria are met	according to the Minister the activity actually carried on counts, as a rule also ancillary activity (exceptions in the water, wastewater and waste sectors)	Article 5(5); Q&A 1.1, 2.7 and 2.8
Criteria met on 3 April 2026, no application – the deadline passed on 3 October 2026	check whether the entity has been entered ex officio and file an application for entry now	according to the Minister entities entered ex officio do not have to file an application, nor does an entity that ceased the activity covered by the Act before the deadline expired; a future critical entity files the application itself if it meets the criteria; with the status “Oczekuje na weryfikację” (awaiting verification) do not file another application	Article 33(3) and Article 34(3)(1) of the amending act, Article 7c(1), Article 7d(1); Q&A 1.8, 1.42, 2.1, 2.38, 2.40, 2.48 and 2.54
Entry by the authority after the deadline – 6 months from receipt of the notification	complete the missing data in the register	the entry requires reasons and is subject to a complaint to an administrative court	Article 7j(1), (3) and (5)
Ex officio entry (groups under Article 7a(2) and former operators of essential services) – 6 months from service of the request	complete the data through an application to amend the entry, also for activity not covered by the entry	according to the Minister the obligation lapses if the entity ceases to meet the criteria before the 6 months expire	Article 7b(2) and (4), Article 34(2) of the amending act; Q&A 2.42
The entry exists – 14 days from a change of data, 7 days from service of a request from the authority	report changes, correct the entry after a request, use S46	S46 by 3 April 2027 at the latest for entities covered by the schedule	Article 7c(3), Article 7k(2), Article 9(1)(4), Article 46(4)
Criteria met after 3 April 2026 – 6 months from the day they were met	file an application within the entity’s own deadline	where status depends on size, according to the Minister the second consecutive financial year in which the threshold is exceeded decides	Article 7c(1), Article 5(5); Q&A 1.46 and 2.32
Recognition by a decision of the authority – 6 months from service of the decision	complete the missing data, because the authority enters the entity itself	the decision is immediately enforceable; obligations under Chapter 3 within 12 months of service of the decision	Article 7l(3) and (5)–(7)
The criteria have ceased to be met – the Act sets no deadline	file an application for removal with reasons	according to the Minister a one-off fall beneath the size threshold does not change the status	Article 7f(3)–(7); Q&A 1.46

Entry in the KSC register after the deadline when no application was filed

An organisation that met the criteria on 3 April 2026 and did not file an application is still an essential or important entity after 3 October. The organisation must implement the obligations under Chapter 3 by 3 April 2027 at the latest (Article 33(1) of the amending act).

Entry in the KSC register after the deadline follows the same rules as entry within the deadline. The entry is made when the application is filed in the system (Article 7d(1)). The Act does not list delay among the situations in which no entry is made (Article 7d(3)). According to the Minister self-registration is available at all times (Q&A 2.32). The data in the application, the signature and the power of attorney are described in When and how to apply for entry in the KSC register?

According to the Minister an application signed by a person other than the one who completed it receives the status “Błąd podpisu” (signature error, Q&A 2.55). An organisation with such an application from before 3 October should check in the Wykaz KSC application whether an entry was made.

According to the Minister public entities do not have to file an application, because they are placed in the register ex officio (Q&A 1.8 and 2.40). According to the Minister an entity that ceased to meet the criteria before the deadline expired because it ceased the activity covered by the Act also has no obligation to file an application (Q&A 1.42). That position concerns the loss of the criteria before the deadline expired. In my assessment a loss after 3 October does not remove the basis for the penalty under Article 73(1a)(1), and such an entity no longer files an application for entry (Article 7c(1)).

The second route into the register for an organisation without an application is an entry by the authority competent for cybersecurity. The authority may enter an entity that meets the criteria and has not filed an application on time (Article 7j(1)). In doing so it uses public registers, data available to it under separate provisions and information from the entity itself (Article 7j(2)). Without initiating proceedings, the authority may gather that information by requesting data for a preliminary assessment of status (Article 43(1)). The request sets a time limit for a reply of no less than 7 days (Article 43(1) in conjunction with Article 53c(2)(5)). Failure to provide that information is subject to a penalty of PLN 50 000, which is covered by the deferral under Article 35 of the amending act (Article 73b(1)(4) and (4)). An entity that considers itself not subject to the Act also faces that penalty. It is therefore worth replying with reasons. The reply to the request may become the basis for an entry (Article 43(6)).

The Act and the Minister frame an entry by the authority as a power (Article 7j(1), Q&A 2.4). Elsewhere the Minister writes that entities without an entry will be entered in this way, and that the consequence may be supervisory activities or in the longer term a penalty (Q&A 1.20). After the entry the authority notifies the entity and requests it to complete the missing data within 6 months of receiving the notification under threat of a penalty (Article 7j(3)). The entry requires reasons and may be challenged by a complaint to an administrative court (Article 7j(5)). The complaint is lodged through the authority within 30 days of the day on which the entity learned of the entry (Article 53 § 2 and Article 54 § 1 of the Law on Proceedings before Administrative Courts). The court may hear a complaint lodged late through no fault of the complainant (Article 53 § 2 of that Law). A complaint does not suspend the enforcement of the entry or the running of the time limit for completing the data, although the authority or the court may suspend the enforcement of the entry (Article 61 § 1–3 of that Law).

The notification of the entry and the request are served in accordance with the Code of Administrative Procedure, and a letter not collected despite a postal notice is deemed served after 14 days (Article 7j(4), Article 44 § 1 and § 4 and Article 45 of the Code of Administrative Procedure). In my assessment the time limit counted from receipt of the notification runs from the day of such service.

The S46 system is the ICT system in which the register is maintained and incidents are reported (Article 46(1) and (1a)). The application is filed in that system (Article 7c(6)) through the Wykaz KSC application at wykaz-ksc.gov.pl (Q&A 2.1 and 2.35). According to the Minister access to the entity account in S46 Cyber Hub, through which incidents are reported, is given to entities entered with a complete set of data (Q&A 2.15). According to the Minister a public entity entered ex officio registers in S46 after receiving information about the entry, even before completing all the data (Q&A 7.6). A significant incident notification is submitted through S46, and where that is impossible, by the method set by the competent CSIRT (Article 11(2) and Article 31(1)). The notification obligation does not depend on the entry.

Penalties and entry in the KSC register after the deadline

For failing to file an application on time the authority may impose a penalty on the entity if the gravity and significance of the provisions infringed justify it (Article 73(1a)(1)). Failure to complete the data or to correct the entry after a request is a further ground for a penalty, which the Act does not make dependent on the gravity of the infringement (Article 73(1)(1)). Without an entry an organisation usually has no account in S46. Not using the system for the obligations under Article 11 where the Act requires it is a separate ground for a penalty (Article 73(1)(13)).

The penalty for an essential entity is up to EUR 10 000 000 or up to 2% of revenue from business activity in the financial year preceding the imposition of the penalty, whichever is higher, and not less than PLN 20 000 (Article 73(3)). An important entity faces up to EUR 7 000 000 or up to 1.4% of revenue and not less than PLN 15 000, and the provision contains no higher-amount rule (Article 73(4)). Where the entity has operated for less than 12 months or has earned no revenue, the basis for the penalty is the equivalent of EUR 500 000, and for an important entity EUR 250 000 (Article 73(3a) and (4)). Penalties under Article 73(1)–(4), including paragraph 1a, and under Articles 73a–73c and Article 76b may be imposed for the first time after 2 years from the entry into force of the amending act (Article 35 of the amending act). According to the Minister financial penalties will be imposed only after 3 April 2028, and the exception is the extraordinary penalty (Q&A 12.1). This is the penalty under Article 73(5), which Article 35 does not list and which the Minister describes as applied only to serious infringements (Q&A 12.6).

Neither an application filed after the deadline nor an entry made by the authority removes the basis for the penalty under Article 73(1a)(1). However, the moment the application is filed may affect the amount of the penalty. In setting it the authority takes into account among others the duration of the infringement and the degree of the entity’s cooperation with the authority (Article 76a(1) in conjunction with Article 53(12)(2) and (7)). Article 76a(1) excludes Article 189a § 2 of the Code of Administrative Procedure, so the authority also takes into account voluntary action by the party taken to avoid the effects of the infringement (Article 189d(5) of that Code). It is therefore worth documenting the date of the application and other steps taken on the entity’s own initiative. The authority may also waive the penalty where the gravity of the infringement and the significance of the provisions infringed are negligible and the entity has ceased infringing the law or has remedied the damage caused (Article 76a(9), Q&A 12.12). The nearest consequence of delay may moreover be not a penalty but an entry by the authority and a request with a deadline under threat of a penalty. Entry in the KSC register after the deadline obtained on the entity’s own initiative makes it possible to avoid that.

Ex officio entry – completion instead of an application

The minister responsible for computerisation enters ex officio telecommunications undertakings, trust service providers, public entities and critical entities (Article 7a(2)). That minister also enters former operators of essential services ex officio (Article 34(2) of the amending act). According to the Minister an ex officio entry of critical entities first requires their status to be formally established under the Crisis Management Act (Q&A 2.37). According to the Minister until then such an entity itself assesses its status under the KSC Act and files an application if it meets the criteria (Q&A 2.38).

An entity entered ex officio completes the missing data itself through an application to amend the entry (Article 7b(4)). The minister requests it to do so within 6 months of service of the request, under threat of a penalty (Article 7b(2)). The completion also covers activity that was not covered by the ex officio entry (Article 7b(4)).

An application for entry filed by an entity already entered does not lead to an entry (Article 7d(3)(2)). According to the Minister such an application goes to the register operator for verification and the entity does not have to withdraw anything (Q&A 2.48 and 2.54). According to the Minister an entity entered ex officio that considers that it does not meet the criteria files an application for removal. Where the data are incorrect it files an application to amend the entry (Q&A 2.14). According to the Minister the obligation to complete the data lapses if the entity ceases to meet the criteria before 6 months from the request expire (Q&A 2.42).

The deadline runs from service of the request, also after an uncollected postal notice (Article 7b(2) and (5) and Article 44 § 4 of the Code of Administrative Procedure, Q&A 2.36). According to the Minister the sending of requests began in May 2026 (Q&A 2.11). They go first to addresses for electronic service, and in October the Minister announced postal dispatch to entities without such an address for the coming weeks (Q&A 2.34). With service in May 2026 the deadline expires for example in November 2026.

The entry exists – three clocks for maintaining it

An entered entity files an application to amend the entry within 14 days of a change in the data under Article 7(2)(1)–(18) (Article 7c(3)). According to the Minister an update is needed after a change of domain or IP address (Q&A 2.27), and after an address for electronic service is set up the register has to be supplemented (Q&A 2.34).

The second clock is started by the authority. It may verify whether the data in the register match the facts (Article 7k(1)). If it finds a discrepancy, it requests the entity to amend the entry within 7 days of service of the request under threat of a penalty (Article 7k(2)).

The third clock concerns the S46 system. After obtaining the entry the entity starts using the system (Article 9(1)(4)), and the Act allows 12 months from meeting the criteria for this (Article 46(4)). For entities covered by the schedule this is 3 April 2027 (Q&A 3.1). From that day at the latest they report significant incidents under the new provisions (Article 33(1) of the amending act). Former operators of essential services do so from 3 October 2026 at the latest (Article 33(4) of the amending act).

Criteria met after 3 April 2026 – own deadline

An entity that met the criteria after 3 April 2026 files an application within 6 months of the day they were met (Article 7c(1)).

Where status depends on the size of the entity, the criteria are assessed as at the day the financial statements are drawn up (Article 5(5)). According to the Minister a one-off crossing of the threshold does not yet change the status, because the change occurs only after it is repeated in two consecutive financial years (Q&A 1.46). The annual financial statements are drawn up within 3 months of the balance sheet date at the latest (Article 52(1) of the Accounting Act). Where the financial year is the calendar year, the statements for 2025 should have been drawn up by 31 March 2026, before the amending act entered into force. An organisation that met the criteria under the two-year rule according to statements drawn up within that time limit was covered by the schedule. If it did not file an application, its deadline passed on 3 October 2026. In my assessment the 6 months for the application run for the others from the day the statements are drawn up for the second consecutive financial year in which the threshold is exceeded (Article 7c(1) and Article 5(5), Q&A 1.46).

A separate procedure applies to entities from Annex 1 or 2 that do not meet the criteria under Article 5 indicated in Article 7l(1) and that the authority has recognised by a decision as essential or important. Such an entity does not file an application for entry, because the authority enters it itself without delay (Article 7l(6)). In the decision the authority requests it to complete the missing data within 6 months of service of the decision under threat of a penalty (Article 7l(3)(2)). The decision is immediately enforceable (Article 7l(5)). The entity performs the obligations under Chapter 3 within 12 months of service of the decision and ensures the first audit referred to in Article 15(1) within 24 months (Article 7l(7)).

When the criteria have ceased to be met

An organisation that has ceased to meet the criteria files an application for removal from the register with reasons (Article 7f(3)). The application may concern the whole entry or only some sectors, subsectors or types of activity (Article 7f(3), Q&A 2.22).

The authority examines the application within a month and refuses removal if the entity still meets the criteria (Article 7f(4) and (5)). A refusal may be challenged by a complaint to an administrative court, and the absence of a refusal within the time limit results in removal (Article 7f(6) and (7)). The authority also removes an entity itself where it is not an essential or important entity or has lost that status after the entry (Article 7f(2)).

The Act addresses the obligations under Chapter 3 to an essential or important entity and not to an entered entity (e.g. Article 8(1)). They cease together with the status and not at the moment of removal, because removal is declaratory in nature (Article 7d(5)). The application for removal nevertheless has to be filed, and it is worth documenting the day the status ceased.

Conclusions and next steps

1. Establish whether an entry already exists. According to the Minister the request after an ex officio entry contains the details for logging in to the entity account in the Wykaz KSC application (Q&A 2.3), and the form flags a conflict of NIP or REGON with an existing entry (Q&A 2.54). With the status “Oczekuje na weryfikację” (awaiting verification) do not file another application (Q&A 2.48 and 2.54).
2. Settle in writing the qualification of each type of activity.
3. Establish who will use the one-time code, complete and sign the application. According to the Minister using the code makes the user the owner of the entry, and the application is completed and signed by the same person (Q&A 2.44 and 2.55). According to the Minister the persons with access to the entry should include persons authorised to represent the entity (Q&A 2.21 and 2.44). A person other than the head of the entity needs a power of attorney, also for applications to amend the entry and remove it. No power of attorney is attached by a commercial proxy disclosed in the National Court Register (KRS) or by an attorney disclosed in CEIDG (Article 7c(7)).
4. Designate the contact persons and the S46 account administrator, because their data are part of the application (Article 7(2)(11)). The Act requires at least two persons, or one in a micro or small enterprise and in an important entity that is a public entity (Article 9(1)–(3)). However, Article 73a(1)(6) does not exempt the head of an important entity that is a public entity from the penalty, so it is safer for such an entity to designate two persons.
5. If there is no entry and the criteria are met, file an application now. According to the Minister the form is at wykaz-ksc.gov.pl with login through the National Node (Węzeł Krajowy), and main domains are entered in the register instead of each subdomain (Q&A 2.30 and 2.35). If the entry was made ex officio, complete the data through an application to amend the entry within 6 months of service of the request. According to the Minister the absence of a notification of an ex officio entry is reported to s46-admin@nask.pl (Q&A 2.11).
6. Reply to a request from the authority under Article 43 within the time limit set and file an application if the criteria are met.
7. After filing check the status of the application. With the status “Błąd podpisu” (signature error) sign the file again as the person who completed the application (Q&A 2.49 and 2.55), and after the entry download the certificate with the entity type (Q&A 2.20 and 2.47).
8. Check whether the account administrator has received the S46 access details and activate the account before 3 April 2027 with a margin for checking access before the first mandatory notification.
9. Designate a person responsible for the register and assign them sources of information on changes in the data in the entry.
10. If the status is lost, document the day of the loss and file an application for removal.

Related materials

• When and how to apply for entry in the KSC register? — the data in the application, the signature and the power of attorney
• Does every organization fall under NIS2? — the qualification on which the choice of situation depends
• What does a significant incident report to a CSIRT contain? — what is submitted through S46 and within what deadlines
• What is the head of an essential or important entity personally responsible for? — the liability of the head of the entity also for the registration obligations

Sources

• Act of July 5, 2018 on the National Cybersecurity System, consolidated text (as at August 18, 2026), Article 2(8a), Article 5, Articles 7–7l, Article 8, Article 8c, Article 9, Article 11, Article 15, Article 16, Article 31, Article 43, Article 46, Article 53(12), Article 53c, Articles 73–73c, Article 76a and Article 76b — ISAP, Chancellery of the Sejm: isap.sejm.gov.pl (in Polish)
• Act of January 23, 2026 amending the Act on the National Cybersecurity System and certain other acts (Journal of Laws 2026, item 252), Articles 33–35 — Journal of Laws: dziennikustaw.gov.pl (in Polish)
• Act of September 29, 1994 on Accounting, consolidated text (Journal of Laws 2026, items 522, 640 and 644), Article 3(1)(6) and Article 52(1) — ISAP, Chancellery of the Sejm: isap.sejm.gov.pl (in Polish)
• Act of June 6, 1997 — Criminal Code, consolidated text, Article 233 § 6 — ISAP, Chancellery of the Sejm: isap.sejm.gov.pl (in Polish)
• Act of April 26, 2007 on Crisis Management — ISAP, Chancellery of the Sejm: isap.sejm.gov.pl (in Polish)
• Act of August 30, 2002 – Law on Proceedings before Administrative Courts, consolidated text (as at October 9, 2026), Articles 53, 54 and 61 — ISAP, Chancellery of the Sejm: isap.sejm.gov.pl (in Polish)
• Act of June 14, 1960 – Code of Administrative Procedure, consolidated text (as at December 12, 2025), Articles 44, 45, 189a and 189d — ISAP, Chancellery of the Sejm: isap.sejm.gov.pl (in Polish)
• Communication of the Minister of Digital Affairs of April 8, 2026 on the schedule for filing applications for entry in the register of essential and important entities and for the start of use of the ICT system by essential or important entities (Official Journal of the Minister of Digital Affairs, item 7) — Ministry of Digital Affairs: gov.pl (in Polish)
• Minister of Digital Affairs, National cybersecurity system — questions and answers on the amendment of the KSC Act, update of October 2026 — Q&A 1.1, 1.8, 1.20, 1.42, 1.46, 2.1, 2.3, 2.4, 2.7, 2.8, 2.9, 2.11, 2.12, 2.14, 2.15, 2.20, 2.21, 2.22, 2.27, 2.30, 2.32, 2.33, 2.34, 2.35, 2.36, 2.37, 2.38, 2.40, 2.42, 2.44, 2.47, 2.48, 2.49, 2.54, 2.55, 2.66, 3.1, 3.18, 7.6, 12.1, 12.6 and 12.12 — cyber.gov.pl (in Polish)