In Poland, nearly twice as many organizations as expected are subject to new cybersecurity rules
In Poland, more than 70.4 thousand entities have been added to the register of organizations subject to new cybersecurity requirements. This is almost twice as many as the government's previous estimates, which expected the new legislation to cover 35-38 thousand enterprises and institutions.
This is reported by Rzeczpospolita on October 12, citing data from Poland's Ministry of Digital Affairs.
According to the ministry, by the end of the main registration deadline on October 3, over 8.1 thousand organizations had submitted applications for inclusion in the KSC (Krajowy System Cyberbezpieczeństwa) register on their own. Another 62.3 thousand were added automatically by state authorities based on information from official registers.
Thus, over 88% of organizations were included in the list without independent registration. Approximately 13% of registered entities received the status of "key" entities, while the rest belong to the "important" category.
The Ministry of Digital Affairs explained that previous estimates of the number of organizations were approximate. At the same time, data from state registers may contain outdated or inaccurate information. Therefore, the number of system participants and their classification may still change.
The new rules were introduced as part of the implementation of the European NIS2 directive, which strengthens requirements for the protection of information systems. They cover organizations operating in the energy, transport, banking services, healthcare, water supply, digital infrastructure sectors, as well as certain enterprises in the food, chemical and processing industries.
However, obligations are determined not only by the sector, but also by the scale of the enterprise, the nature of its activities and other legislative criteria.
For businesses, registration is only the first step in complying with the new requirements. By April 3, 2027, organizations covered by the law must implement the necessary cyber protection measures and connect to the state S46 system.
In particular, enterprises need to organize regular cyber risk assessments, introduce incident response procedures, ensure the protection of information systems and control the security of suppliers and subcontractors.
The new rules also strengthen the responsibility of company management. Cybersecurity is no longer limited to the competence of IT departments: managers must oversee risk management and compliance with legislative requirements.
For serious violations, fines of up to 10 million euros or 2% of annual turnover are provided for key entities. For important organizations, maximum sanctions can reach 7 million euros or 1.4% of turnover. At the same time, Polish law provides for a transitional period: the possibility of applying most administrative fines for new obligations will arise after April 3, 2028.
Despite the end of the main registration period, the Ministry of Digital Affairs continues to accept applications from organizations that did not manage to submit their data to the register. The ministry also plans to continue verifying information and clarifying the list of enterprises covered by the new rules.
Based on materials from: Rzeczpospolita, Ministry of Digital Affairs of Poland, Office of Electronic Communications of Poland