NIS2 registration in Poland: what if you missed the deadline?

Who was required to register in the Polish NIS2 register?

The deadline for submitting an application for registration in the KSC Register (Poland’s NIS2 register) passed on 3 October 2026 for entities that:

• met the criteria for classification as an essential entity or important entity as of 3 April 2026, the date on which the amendment to the Polish National Cybersecurity System Act entered into force; and
• did not fall within the categories of entities entered in the register ex officio.

The KSC Register is the official register of entities subject to obligations under the Polish National Cybersecurity System Act (the “KSC Act”), which implements the NIS2 Directive into Polish law.

Under the self-identification mechanism introduced by the KSC Act, each entity is required to assess independently whether it meets the criteria for classification as an essential entity or an important entity. Where this assessment is positive, the entity must submit an application for entry in the KSC Register within six months of the date on which it met those criteria.

In practice, this meant that entities which already met the conditions for classification as essential or important entities on 3 April 2026, when the amendment to the Polish National Cybersecurity System Act entered into force, and continued to meet those conditions thereafter, were required to submit their registration applications no later than 3 October 2026.

Importantly, as confirmed by the Polish Ministry of Digital Affairs, this obligation did not apply to entities which met the relevant criteria on the date the legislation entered into force but ceased to meet them before the registration deadline expired. This could occur, for example, where an entity discontinued the activity bringing it within the scope of the KSC Act. In such circumstances, the entity was not required to register.

It should be noted that, under the KSC Act, certain categories of entities are entered in the KSC Register ex officio. These include:

• telecommunications operators,
• trust service providers,
• public sector entities,
• critical entities,
• entities previously designated as operators of essential services.

A separate procedure applies to these entities. Rather than applying for registration, they are required to supplement their information in the KSC Register within six months of receiving a request from the competent authority.

Consequently, where an undertaking met the criteria for classification as an essential entity or an important entity on 3 April 2026, did not belong to any category subject to ex officio registration, and failed to register in the KSC Register by 3 October 2026, it should be considered to have failed to fulfil its statutory registration obligation within the prescribed deadline.

Can failure to register in the KSC Register result in a penalty?

Failure to register in the KSC Register within the statutory deadline constitutes a breach of an obligation imposed on essential entities and important entities under the KSC Act. In principle, such a breach may result in a fine being imposed both on the entity itself and on the entity manager. However, missing the registration deadline does not automatically trigger a penalty.

When assessing the risk of sanctions, three factors are particularly important.

1. First, the imposition of most penalties is discretionary.

The competent cybersecurity authority may impose a penalty where it considers such action justified in light of the circumstances of the case. In the case of an entity, the authority will consider, among other things, the gravity and significance of the breached provisions. In the case of an entity manager, the authority will take into account the duration, scope, and nature of the infringement.

2. Second, the transitional provisions provide that most penalties for this type of infringement may only be imposed for the first time after the expiry of a two-year grace period following the entry into force of the amendment to the KSC Act, i.e. from 3 April 2028.

As a result, most sanctions for failure to register in the KSC Register cannot be imposed before that date.

3. Third, the KSC Act expressly allows the competent authority to refrain from imposing a penalty.

The authority may decide not to impose a fine where the infringement is insignificant, the breached provisions are of limited importance in the specific circumstances, and the entity or entity manager has ceased the infringement or remedied any resulting damage.

This means that entities which failed to register in the KSC Register on time should not remain passive. Although the possibility of imposing most penalties for this type of infringement has been deferred until 3 April 2028, and penalties are not imposed automatically, continued non-compliance may increase regulatory risk.

For this reason, entities are generally advised to submit their registration as soon as possible. Whilst this does not eliminate the breach itself, it may limit its negative consequences and constitute a mitigating factor in the entity’s favour should the case be assessed by the competent authority.

It should be noted, however, that while most penalties provided for under the KSC Act are discretionary and subject to the transitional grace period until 3 April 2028, this is not the case for all infringements.

An exception applies to violations resulting in particularly serious consequences, namely those causing:

• a direct and serious cyber threat to defence, national security, public safety and order, or human life and health, or
• a risk of causing serious financial loss or serious disruption to the provision of services.

For infringements leading to such consequences, the KSC Act provides for fines of up to PLN 100 million.

In practice, it is difficult to argue that the mere failure to register in the KSC Register would, by itself, lead to consequences of such severity. Nevertheless, it is important to remember that an essential entity or important entity remains subject to all other obligations under the KSC Act, regardless of whether it has completed its registration.

Failure to register does not exempt an entity from complying with the cybersecurity requirements imposed by the KSC Act. Consequently, breaches of those obligations may give rise to consequences that qualify as particularly serious and may therefore expose the entity to the sanctions described above.

Supervisory powers of the competent authorities and enforcement of the KSC Act

The postponement of the application of most fines does not mean that the competent cybersecurity authorities will remain inactive until 3 April 2028.

Even at present, these authorities have extensive supervisory powers enabling them to verify compliance with the obligations imposed under the KSC Act and to take action against entities that fail to comply with its provisions.

As part of their supervisory activities, the competent authorities may, among other things, conduct inspections and require entities to provide information, documents, and other evidence demonstrating compliance with their statutory obligations.

Where a competent authority has reasonable grounds to suspect that an essential entity has breached the KSC Act, it may issue a warning identifying the measures that should be taken to prevent or cease the infringement and specifying a deadline for their implementation. If the entity continues to fail to comply with its obligations, the authority may impose additional supervisory measures, including orders to cease the infringement, ensure compliance with the requirements of the KSC Act, or perform specific corrective actions.

With respect to essential entities, the KSC Act also provides for more far-reaching enforcement measures. Where an entity fails to comply with orders or decisions issued by the authority, the authority may, among other things, restrict or suspend certain regulatory authorisations, order the suspension of all or part of the entity’s activities, or even impose a temporary prohibition on the entity manager from performing management functions.

Importantly, before issuing a warning, applying supervisory measures, or imposing a fine, the authority should, as a general rule, inform the entity of its preliminary findings and provide it with an opportunity to submit its position within seven days. Only after considering the entity’s response will the authority decide whether to impose the relevant measures or refrain from doing so.

It should also be noted that obstructing or preventing an inspection, as well as delays in complying with decisions issued by the competent cybersecurity authority, may give rise to separate fines. As with the penalties for failure to register in the KSC Register within the prescribed deadline, the application of most of these fines has been deferred until 3 April 2028.

Ex officio registration in the KSC Register after the deadline

Where an entity meets the criteria for classification as an essential entity or an important entity but fails to submit a registration application within the statutory deadline, the competent cybersecurity authority may enter that entity into the KSC Register ex officio.

In such circumstances, the entity will receive a notification confirming its registration together with a request to provide any missing information. The requested information must be submitted within six months of receipt of the notification, failing which a fine may be imposed.

In practice, this means that failure to register should not be viewed as a way of avoiding the obligations arising under the KSC Act. Although the legislation is primarily based on a self-identification mechanism, under which entities are expected to assess their own status and register themselves in the KSC Register, the competent cybersecurity authorities are also empowered to determine independently that an entity qualifies as an essential entity or an important entity and to register it accordingly.

An entity may challenge such registration by filing a complaint with the administrative court.