Industries

NIS2 sectors: rules by industry

The same rules look different in a factory, a port, a heating plant, a bank and a network operator. For the five industries we work in, we set out which laws apply and why, where evidence is usually missing, and where to start.

Choose your industry Book a 30-minute call

// In short

Your category depends on sector and size

Poland's KSC Act (NIS2 in Poland) has two annexes. Annex 1 lists sectors of high criticality: a large company there is an essential entity, a medium-sized one an important entity. Annex 2 lists other critical sectors: medium and large companies are important entities. Telecom operators and financial institutions follow their own rules, and machine builders also face product law.

As of 24 September 2026. Source: Dz.U. 2026 item 252, Article 5 and Annexes 1 and 2 (in Polish).

// Industries

Five industries, five different sets of rules

Each page covers which laws apply to you and why, the risks and evidence gaps we see most often, which services fit and what the first step looks like.

01Manufacturing and robotics
The plant and the product, two regimes at once
Medium-sized and large makers of machinery, electronics and vehicles are important entities under the KSC Act. The machines you sell also fall under the Machinery Regulation and the CRA.
- KSC, Annex 2
- Machinery Regulation from 20 January 2027
- CRA for products with digital elements
- IEC 62443 for OT networks
Manufacturing and robotics
02Logistics and transport
In the act or in the supply chain
Ports, rail and aviation are in Annex 1. Road hauliers and freight forwarders usually are not, but their customers are, and they send security questionnaires.
- KSC: transport in Annex 1
- Postal services and waste transport in Annex 2
- Security questionnaires from customers
Logistics and transport
03Energy and water utilities
Essential entities running OT
Energy, heat, gas and water are sectors of high criticality. Large companies face a first audit, and municipal companies can also fall under the act as public entities.
- KSC, Annex 1
- Network Code on Cybersecurity for part of the power sector
- High-risk vendor decisions
Energy and water utilities
04Finance, insurance, SaaS
DORA on both sides of the contract
Banks and insurers answer to their financial supervisor. SaaS providers answer to their customers, through the contract terms in Article 30 of DORA.
- DORA since 17 January 2025
- Register of information on ICT providers
- KSC only in part, for banks
Finance, insurance and SaaS
05Telecommunications
In scope regardless of size
Every electronic communications undertaking in Poland is an essential or an important entity. The regulator is the President of UKE.
- KSC replaces the Telecommunications Law by 3 April 2027
- Critical network functions in Annex 3
- High-risk vendor decisions
Telecommunications

How the KSC Act assigns a category

As of 24 September 2026
Who	Category	Basis
A company in an Annex 1 sector, large	Essential entity	Article 5(1)(1)
A company in an Annex 1 sector, medium-sized	Important entity	Article 5(2)(1)
A company in an Annex 2 sector, medium-sized or large	Important entity	Article 5(2)(2)
An electronic communications undertaking: medium or large / micro or small	Essential entity / important entity	Article 5(1)(2), 5(2)(4)
A bank or a financial market infrastructure entity	Essential or important, but the ISMS and incident reporting follow DORA	Article 8i

A company is at least medium-sized with 50 or more staff, or with annual turnover over EUR 10 million and a balance sheet total over EUR 10 million. Large means 250 or more staff, or turnover over EUR 50 million and a balance sheet total over EUR 43 million. Size is assessed as of the date of the financial statements (Article 5(5)).

Sources: Dz.U. 2026 item 252 (in Polish), Regulation (EU) No 651/2014, Annex I. The obligations, step by step: NIS2 compliance in Poland (KSC).