Register your business in Poland’s Wykaz KSC now if it falls under NIS2 - an essential or important entity in a sector listed in UKSC Annex I or II that also meets the size threshold. Self-registration opened on 7 May 2026 at wykaz-ksc.gov.pl. The deadline passed on 3 October 2026, but the filing duty remains. Transitional rules delay most fines until April 2028.
The deadline and who must file
The registration deadline was 3 October 2026. Poland’s amended National Cybersecurity System Act (UKSC), which transposes the EU NIS2 Directive, took force on 3 April 2026, and the Minister of Digital Affairs set the filing window for entities already in scope in an announcement of 8 April 2026: 7 May to 3 October 2026. The Ministry of Digital Affairs runs self-registration at wykaz-ksc.gov.pl, and filing after the deadline is still possible and still required.
You only need to file if your business is actually in scope - and that is a narrower group than most owners assume. NIS2 applies when two conditions hold at once: your business operates in a sector listed in UKSC Annex I or II, and it employs at least 50 people or turns over at least EUR 10 million. If you are not sure which side of that line you fall on, work through does NIS2 apply to my business before you touch the register - this post assumes you have already concluded that you must file.
Two ways you end up in the register
The register is called the Wykaz KSC, part of the national S46 system, and there are two distinct routes into it. Most coverage mentions only the first.
| Self-registration | Ex officio (by the Minister) | |
|---|---|---|
| Who | You qualify and have not been entered by the Minister | The Minister of Digital Affairs enters you directly |
| What you do | File the entry application yourself | Wait for a notification, summons, and access code, then complete your data |
| Deadline | 3 October 2026 (passed - file now) | 6 months from receiving the summons |
| Where | wykaz-ksc.gov.pl | The same register, using the access code you were sent |
Self-registration is the path for most private businesses that clear the two-condition test. You file the entry yourself - before the deadline, or as soon as possible if you missed it. The ex officio route applies when the Minister has already identified your entity and enters it directly - you then receive a summons with an access code and complete the missing data within six months. That sweep ran between 13 April and 6 May 2026 and covered public-sector bodies, telecoms operators, trust service providers and the previous operators of essential services. If your organisation is in one of those groups, check whether you are already listed before you start a fresh application. The same six-month clock applies if your business grows into scope after 3 October 2026: you register within six months of meeting the criteria, not on some fixed annual date. Since the deadline passed, there is also a third route: the sector authority can enter a business that should have registered but did not, using public registers, and summon it to complete its data within six months under threat of a fine (UKSC Article 7j).
What you need before you file
Filing goes faster if you gather four things first. The entry in the Wykaz KSC asks for:
- Entity identifiers - your KRS or REGON number and NIP.
- Your sector - the Annex I or II category your activity falls under, which also fixes whether you are an essential or an important entity.
- Size data - the employee count or turnover figure that puts you over the threshold.
- A cybersecurity contact person - a named individual the CSIRT and supervisory bodies can reach. This is a real appointment, not a formality; the register exists partly to enable immediate contact during an incident.
Once you file, your entity receives formal status - essential or important - and the Chapter 3 obligations under UKSC start to apply. The full obligation set and the 10 Article 21 measures are laid out in the NIS2 and UKSC compliance guide; many of them overlap with GDPR Article 32, which we map in the data security and compliance guide.
What happens if you miss it
Failing to register when the obligation applied is sanctionable, but the figures quoted in most English-language coverage are only half the picture. Article 73 UKSC sets three tiers. Essential entities face between PLN 20,000 and the higher of EUR 10 million or 2% of the previous year’s revenue; important entities between PLN 15,000 and EUR 7 million or 1.4%. Separately, a qualified penalty of up to PLN 100 million applies where a breach causes a direct and serious cyber threat to national defence, security, public order, or human life and health.
The timing matters as much as the ceilings. Transitional provisions mean ordinary financial penalties cannot be imposed until two years after the act took force - that is, not before April 2028 - and the fine for not registering is discretionary (Article 73(1a)). Before fining an essential entity, the authority must also share its preliminary findings and allow seven days for a response (Article 53(13)-(14)). The PLN 100 million qualified penalty is carved out of that deferral and applies now. So the passing of 3 October 2026 did not start a wave of fines; it put late filers in default of a statutory duty, which gives the regulator grounds to act. The duty to identify yourself sits with your business, not with a regulator who will remind you; there is no grace for “we did not realise we qualified.” If your sector or size is genuinely ambiguous, get a determination from Polish counsel before 3 October rather than after.
Registration is only the first deadline. Full compliance with the 10 Article 21 measures follows on 3 April 2027, and the first mandatory audit for essential entities on 3 April 2028. What the 2026 amendment changed across all of these is summarised in NIS2 in Poland: what changed in 2026.
FAQ
When is the NIS2 registration deadline in Poland?
The deadline was 3 October 2026, set by the Minister’s filing schedule for entities in scope when the amended UKSC took force on 3 April 2026. Entities that missed it should file now. Self-registration opened on 7 May 2026. Businesses that grow into scope later must register within six months of meeting the criteria.
Where do I register for NIS2 in Poland?
You register in the Wykaz KSC, the national register of essential and important entities maintained by the Ministry of Digital Affairs, at wykaz-ksc.gov.pl. It is part of the S46 system. You file the entry yourself unless the Minister has already entered your entity ex officio.
What if the Minister registered my entity ex officio?
You do not file a fresh application. You receive a notification, a summons, and an access code, then complete the missing data in the register within six months of receiving the summons. Check that the details entered for you are accurate.
What if my business qualifies after 3 October 2026?
You register within six months of meeting the criteria, not on the general deadline. The 3 October 2026 date applied to entities that were already in scope when the amended act took force; the six-month rule covers everyone who crosses the threshold afterwards.
What is the penalty for not registering?
Article 73 UKSC sets three tiers: PLN 20,000 up to the higher of EUR 10 million or 2% of revenue for essential entities, PLN 15,000 up to EUR 7 million or 1.4% for important ones, and a qualified penalty of up to PLN 100 million where a breach causes a direct and serious cyber threat. Transitional rules defer ordinary penalties until April 2028, and the fine for not registering is discretionary; the qualified penalty is not deferred. Management board members can also be held personally liable.
Not sure whether the systems you would list in the register actually hold up from the outside? Book a free PreScan - a passive external check of your company’s attack surface, with results in 24 hours and no obligation. It is the technical evidence layer that Article 21 and an external vulnerability assessment build on.
Informational material, not legal advice. Legal position as of October 2026, verified against the consolidated act as published in the Journal of Laws (Dz.U. 2026 poz. 252). Whether your business must register depends on an individual assessment of sector and size - consult Polish counsel or a Data Protection Officer.