meta_id 2924570

On March 2, 2026, Poland's Official Journal published the Act of January 23, 2026, amending the Act on the National Cybersecurity System and certain other laws (Dz. U. poz. 252). This comprehensive legislative update implements the European Union's NIS 2 Directive (2022/2555) and introduces significant structural and operational changes to Poland's cybersecurity framework. The amendment expands the scope of regulated entities by introducing a new category of "important entities" (podmioty ważne) alongside existing "key entities" (podmioty kluczowe). It establishes a unified registry of key and important entities, replacing the previous operator-focused approach. The law introduces new definitions aligned with EU standards, including cyber threats, serious incidents, and critical incidents, while establishing sector-specific CSIRT teams (Computer Security Incident Response Teams) to replace previous arrangements. Key institutional changes include the establishment of the Joint Cyber Operations Center (PCOC) as an advisory body to the Government Plenipotentiary for Cybersecurity, and expanded responsibilities for CSIRT MON, CSIRT NASK, and CSIRT GOV. The amendment introduces mandatory security management systems for key and important entities, with specific requirements for public entities outlined in Annex 4. The law introduces new enforcement mechanisms, including administrative fines up to €10 million (or 2 percent of annual revenue for key entities) and €7 million (or 1.4 percent of revenue for important entities). It establishes procedures for identifying high-risk ICT suppliers and issuing protective orders during critical incidents. The amendment also creates a National Cybersecurity Response Plan for large-scale incidents and requires adoption of a comprehensive Cybersecurity Strategy. Entities must comply with new obligations within 12 months of the law's entry into force, with first audits for key entities required within 24 months. The legislation applies to sectors including energy, transport, banking, healthcare, water supply, digital infrastructure, and public administration.

On March 2, 2026, Poland's Official Journal published the Act of January 23, 2026, amending the Act on the National Cybersecurity System and certain other laws (Dz. U. poz. 252). This comprehensive legislative update implements the European Union's NIS 2 Directive (2022/2555) and introduces significant structural and operational changes to Poland's cybersecurity framework. The amendment expands the scope of regulated entities by introducing a new category of "important entities" (podmioty ważne) alongside existing "key entities" (podmioty kluczowe). It establishes a unified registry of key and important entities, replacing the previous operator-focused approach. The law introduces new definitions aligned with EU standards, including cyber threats, serious incidents, and critical incidents, while establishing sector-specific CSIRT teams (Computer Security Incident Response Teams) to replace previous arrangements. Key institutional changes include the establishment of the Joint Cyber Operations Center (PCOC) as an advisory body to the Government Plenipotentiary for Cybersecurity, and expanded responsibilities for CSIRT MON, CSIRT NASK, and CSIRT GOV. The amendment introduces mandatory security management systems for key and important entities, with specific requirements for public entities outlined in Annex 4. The law introduces new enforcement mechanisms, including administrative fines up to €10 million (or 2 percent of annual revenue for key entities) and €7 million (or 1.4 percent of revenue for important entities). It establishes procedures for identifying high-risk ICT suppliers and issuing protective orders during critical incidents. The amendment also creates a National Cybersecurity Response Plan for large-scale incidents and requires adoption of a comprehensive Cybersecurity Strategy. Entities must comply with new obligations within 12 months of the law's entry into force, with first audits for key entities required within 24 months. The legislation applies to sectors including energy, transport, banking, healthcare, water supply, digital infrastructure, and public administration.