Poland’s NCS Act after 3 October 2026: organising KSC registration and S46

01

Facts: the amended Act has applied since 3 April 2026

The Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts was published on 2 March 2026 as Journal of Laws 2026 item 252 and entered into force on 3 April 2026. The Polish ELI database lists it as binding.

The amendment implements NIS2 requirements in Poland and introduces essential and important entities. Duties include register entry, cybersecurity-risk management, incident handling and reporting, liaison with authorities and use of the S46 System.

This article was verified on 2 November 2026. It provides operational information, not individual legal advice. Classification must be confirmed for the specific legal person, sector, service, company size and corporate links.

02

Facts: registration depends on sector, size and service

Using IT or processing important data does not by itself determine scope. The assessment starts with Article 5 and the sectors in the Act’s annexes. Company size, partner and linked enterprises, the service supplied and cases where size is not decisive may also matter.

The sectors include energy, transport, banking, healthcare, water, digital infrastructure and ICT-service management, as well as postal services, waste, food, manufacturing, digital providers and research. The list is detailed: a business-activity code does not replace analysis of the actual service.

The Ministry’s FAQ supports self-identification but states that it is not legally binding. Borderline cases need a recorded assessment and may require specialist legal advice.

03

Facts: 3 October concerned entities already qualifying when the Act entered into force

Essential and important entities that met the statutory conditions on 3 April 2026 and were not entered ex officio had six months — until 3 October 2026 — to self-register. Where an organisation meets the conditions later, the application deadline is generally six months from that date.

Some entities are entered ex officio, including specified public entities, telecommunications undertakings, trust-service providers and former operators of essential services. Ex-officio entry does not close the process: after notification, the entity completes missing information within the statutory period stated in the notice.

The KSC register is not a public company-search engine. Data are accessible to authorised authorities, CSIRTs and the entity’s representative for that entity’s own record.

04

Facts: official sources do not establish a new general deadline after 3 October

On the publication date, the official self-registration guide still states that an entity meeting the Article 5 criteria must submit an application. It does not provide a new universal extension for organisations that already qualified on 3 April 2026.

Missing the deadline should therefore not lead to waiting for a notice or another date. A sound operational response is to confirm scope urgently, file a correct application and record remediation. The approach for a specific case should be confirmed with the competent authority or legal adviser.

The Ministry states that the monetary-penalty provisions start applying on 3 April 2028. This does not move the registration or implementation deadlines; supervision and operational readiness follow a separate timetable.

05

Facts: the application is signed by the entity head or an authorised person

The application is submitted electronically through the KSC Register application. It is signed by the head of the essential or important entity or an authorised person. The guide supports the Polish Trusted Profile or an external signing application; an electronic power of attorney may be needed for a representative.

Preparation requires entity identifiers, the S46 account administrator’s details, information about in-scope activity and IP-address and domain-name ranges. The application contains a statement by the entity head subject to criminal liability for false statements, with a statutory exception for IP and domain ranges.

The data should be agreed before the form is opened. IT, security, legal and management stakeholders need one consistent view of the entity, its services, infrastructure and representation.

06

Facts: registration opens S46 access but does not replace ISMS implementation

After register entry, the administrator named in the KSC register receives access to S46 Cyber Hub; no separate platform application is needed. S46 supports incident reporting, warnings, information exchange and cooperation with the competent CSIRT and authority.

For entities that met the criteria on 3 April 2026, the period for starting S46 use and implementing duties, including an Information Security Management System, ends on 3 April 2027. Entities qualifying later should calculate deadlines from their own qualification date under the Act.

For specified new essential entities, the first mandatory audit is due by 3 April 2028. Audit scope and timing depend on the organisation’s status and former role in the national system.

07

Facts: the incident process must meet 24- and 72-hour deadlines

The official S46 guide sets three core steps for a serious incident: an early warning within 24 hours of detection, a serious-incident notification within 72 hours and a final report within one month of the notification. Trust-service providers have a specific 24-hour serious-incident notification deadline.

The clock starts before the technical investigation is complete. The organisation therefore needs risk-appropriate detection, clear classification, deputies, contact data and authority to initiate reporting. The final report cannot be the first time the facts are organised.

An S46 submission does not replace other possible notifications, for example to a data-protection authority, customers or partners. Each channel needs its own basis, owner and deadline.

08

WEBee recommendation: perform a 48-hour scope review

If the business has no formal classification result, collect the service, sector, size, corporate links, customers and supporting systems in one place. The result should record sources, assumptions, approver and next-review date rather than only “yes” or “no”.

Separate the legal-person analysis from the group analysis. One company may not supply the in-scope service even if another group entity does — or the reverse. Corporate links may nevertheless affect the size assessment.

• legal person, Polish tax and statistical identifiers and representation;
• services actually supplied, not only activity codes;
• sector and subsector in the relevant annex;
• company size and partner or linked enterprises;
• cases covered regardless of size;
• ex-officio entry, self-registration or no-entry status.

09

WEBee recommendation: treat the application as a controlled record

Appoint a data owner, signatory and deputy. Apply a two-person check before signing: one person compiles the information and another compares it with registers, architecture and the scope assessment. Retain the application version, authority, filing confirmation and entry certificate.

IP and domain ranges should come from a current asset register, not an administrator’s memory. If no register exists, the same missing information affects registration, vulnerability handling and incident response — fix the root cause, not only the form.

10

WEBee recommendation: split the route to 3 April 2027 into five workstreams

Register entry does not prove compliance. The implementation plan should connect governance, technology and operations. For the original cohort, each workstream needs an owner, measurable output and test before 3 April 2027.

Do not begin by purchasing a platform. First determine services, assets, risks and gaps. A tool should support the process rather than create a green dashboard that does not prove backups can be restored, an alert has an owner or a supplier will respond during an incident.

• governance and ISMS — roles, policies, risk, management review and training;
• assets and controls — systems, identities, vulnerabilities, configuration and logs;
• incidents — detection, classification, 24/72 hours, S46 and communications;
• continuity — backups, restoration, contingency plans and exercises;
• supply chain — critical suppliers, access, incidents, subcontractors and exit.

11

The first 30 days

In week one, confirm classification and register status. In week two, prepare or complete the application and S46 access. In week three, assess gaps across the ISMS, incidents, continuity and suppliers. In week four, approve an owner-based, funded plan and rehearse reporting with test data without sending a false incident.

WEBee can help map services and assets, structure the requirement register, design the incident workflow and build a delivery dashboard. This does not replace legal classification or a statutory audit, but it reduces the risk of duties remaining only on paper.

• retain assessment and decision evidence without backdating;
• verify the S46 administrator and deputy;
• test the 24/72-hour clock with a realistic scenario;
• link gaps to specific assets, services and suppliers;
• report progress to management at least monthly;
• repeat classification after changes in service, scale or group structure.