On 3 October 2026, the deadline expired for applying for entry in the register of essential and important entities under the amended Act on the National Cybersecurity System.
That does not mean the compliance process is over. For entities within the scope of the Act, the key task now is to put the required organisational and technical measures in place, including an information security management system (ISMS). For entities covered by the Act from the date it entered into force, the deadline for implementing the obligations is 3 April 2027.
Companies that have not yet assessed whether the Act applies to them should do so now. If a company meets the criteria of an essential or important entity but has not applied for entry in the register, the registration obligation remains in force and should not be put off.
The new rules are already in force
The amendment to the Act on the National Cybersecurity System (the KSC Act), which implements the NIS2 Directive, significantly widens the group of businesses subject to the regulation. Alongside energy, transport and banking, it covers, among others, the manufacture of certain products, chemicals, food, waste management and digital services.
Essential and important entities are, in principle, subject to the same cybersecurity obligations. The differences relate mainly to the scope of supervision, audit requirements and the level of financial penalties.
The first step for every company should therefore be to determine whether it falls within the scope of the Act. If it does, the next task is to plan and carry out the process of bringing the organisation into line with the new requirements.
Businesses must assess for themselves whether the Act applies
It is for the business itself to determine whether it is an essential or important entity. The classification rests on three elements:
- sector β what matters is the activity actually carried out, not NACE codes;
- size β headcount, turnover and balance sheet total are relevant, taking into account the rules on corporate groups;
- exceptions β in certain cases, the Act applies regardless of the entity’s size or provides for lower thresholds.
A company that is a small or medium-sized enterprise on a stand-alone basis may meet the criteria for coverage once data from other group entities is taken into account. It is therefore advisable to document the outcome of the classification analysis properly, even where it concludes that the company is not subject to the Act.
The registration deadline has passed, but the obligation remains
The deadline for submitting an application in the S46 system, for entities that met the criteria on the date the Act entered into force, was set by a schedule published by the Minister of Digital Affairs. It expired on 3 October 2026.
However, the expiry of the deadline does not extinguish the registration obligation. A company that is subject to the Act but has not yet applied should do so without undue delay.
In the application, the head of the entity must declare, subject to criminal liability, that the data provided is accurate.
Entities that begin to meet the criteria at a later date, for example because of headcount growth or a change in the scale of their business, have six months from the date the relevant criteria are met in which to submit an application.
The key next step: implementing the ISMS
Entry in the register does not in itself mean that the obligations under the Act have been fulfilled. For regulated entities, the next stage β and a far more demanding one β is implementing the cybersecurity requirements, including an information security management system (ISMS).
For entities subject to the Act from the date it entered into force, the deadline for implementing these obligations is 3 April 2027.
Implementing an ISMS can be a lengthy process involving many areas of the organisation. It is not just a matter of preparing documentation. Among other things, it requires a clear allocation of responsibilities within the organisation, risk assessment, appropriate organisational and technical measures, and cybersecurity to be built into relationships with ICT suppliers.
For that reason, it is unwise to leave the start of this work until the final months before 3 April 2027. For many organisations, the compliance process should already be under way.
The management board is responsible for organising the process
The new rules give the head of the entity a significant role. For members of the management board, the key point is to ensure that the organisation identifies and meets the obligations set out in the Act and puts in place the required cybersecurity risk-management measures.
The Act also requires annual training for those serving as the head of the entity.
The rules also allow a financial penalty to be imposed directly on the head of the entity, in addition to any penalty imposed on the entity itself. Sanctions, however, are a consequence of non-compliance. From the management board’s perspective, what matters most now is to organise and document the company’s compliance process properly.
The deferral of financial penalties is not a deferral of the obligations
The Act provides for financial penalties for breaches of the obligations it sets out, including those relating to registration, information security, incident handling, training and audit.
An essential entity faces a fine of up to EUR 10 million or 2% of turnover, and an important entity up to EUR 7 million or 1.4% of turnover. A failure to apply for entry in the register by the deadline can also be penalised. In addition to the penalty imposed on the entity, the authority may also fine the head of the entity.
The date from which most financial penalties may be imposed has, however, been deferred to 3 April 2028.
It is particularly important to note that deferring the imposition of financial penalties does not defer the obligations under the Act. Nor does it suspend supervision. The authorities can already carry out inspections and issue orders.
The period up to 3 April 2028 should therefore not be treated as extra time in which to start compliance work. For entities covered by the Act from the date it entered into force, the key date now is 3 April 2027.
The fact that most financial penalties cannot be imposed before 3 April 2028 is therefore no reason to delay implementing the required measures.
What should you do now?
Companies that may fall within the scope of the KSC Act should, first of all:
- verify and document the entity’s classification, taking into account the activity actually carried out, the size of the business and links within the group;
- apply for entry in the S46 system if the company meets the criteria for coverage by the Act and has not yet done so;
- plan and carry out the ISMS implementation process so that the requirements are met by 3 April 2027;
- review organisational and technical arrangements, including the allocation of responsibilities, risk management and incident-handling processes;
- review contracts and relationships with ICT suppliers against the supply chain security requirements;
- deliver the required training for members of the management board and document the steps taken to bring the organisation into compliance.
How we can help
The LYNX team supports companies at every stage of KSC Act compliance: from assessing whether the organisation is subject to the new rules and assisting with registration, through preparing and implementing the required documentation and the ISMS, to reviewing contracts with ICT suppliers and preparing the organisation for audit.
Contact: Marcin Kroll, Aneta Kiser, RafaΕ Wieczerzak