Missed NIS2 registration in Poland? What to do after the KSC deadline

The deadline to apply for entry in Poland's register of essential and important entities, known as the KSC register (wykaz), passed on 3 October 2026. If your company or Polish subsidiary falls under the amended National Cybersecurity System Act (NIS2 in Poland, KSC) and has not applied, file now: for NIS2 registration, Poland uses wykaz-ksc.gov.pl, which still accepts applications. The duties apply whether you are listed or not. Pre-audit reviews and KSC implementation are part of our IT consulting.

Can you still apply for the KSC register after 3 October?

Yes. The act does not bar late applications. Art. 7c(1) of the KSC act requires an application within 6 months of meeting the criteria. For entities that met them when the amending act entered into force (3 April 2026), the Ministry of Digital Affairs set a filing window from 7 May to 3 October 2026.

Entry takes effect the moment you file. Art. 7d(5) states that entry in the register is declaratory. Your status as an essential or important entity follows from the act, not from the list. A late application does not switch anything on; it records a status you already have. The legal text: Journal of Laws 2026, item 252.

As of 9 October 2026, the ministry has not announced an extension. Its last notice, on 28 September, only repeated the 3 October date. Any change would appear on the ministry's page of KSC deadlines (in Polish).

The authority can list you on its own initiative

If an entity meets the criteria but did not apply in time, the competent cybersecurity authority may enter it in the register itself (art. 7j(1)). It then orders the entity to complete its data, with a fine as the sanction for ignoring the order (art. 7j(3)). The entity can challenge the entry in court (art. 7j(5)). Do not wait for that letter: an entry made by the authority puts on record that you missed the deadline.

The register is not public: Poland's freedom of information act does not apply to its data (art. 7(3)), and the ministry publishes only the number of entities per sector (art. 7i). So you cannot look up whether you are already on it. Some entities are entered by the authority regardless of the deadline: public entities, telecom operators, trust service providers and former operators of essential services. They complete their data when summoned.

Who has to register under NIS2 in Poland?

Every essential and important entity under the KSC act. The ministry offers no online calculator: self-identification is your own assessment, in three steps: sector, size, then the special cases in art. 5.

1. Sector. Check whether what you actually do appears in annex 1 (sectors of high criticality, such as energy, transport, health, digital infrastructure) or annex 2 (other critical sectors, such as postal services, waste, chemicals, food, manufacturing in NACE divisions 26-30). What counts is the activity itself, not just the PKD code in the company register.
2. Size. Thresholds come from annex I to Regulation (EU) 651/2014: medium means 50 or more staff, or turnover and balance sheet both above EUR 10 million; large means 250 or more staff, or turnover above EUR 50 million and a balance sheet above EUR 43 million. Size is taken at the date of the financial statements (art. 5(5)).
3. Special cases. Some entities are covered regardless of size, including DNS providers, qualified trust service providers and critical entities. Managed security service providers (MSSPs) are essential entities once they reach small-enterprise size.
4. Groups. If you exceed a threshold only because partner or linked companies are added, and your information system is independent of the group's, you are not an essential or important entity (art. 5(6) and (7)). Put that reasoning in writing.

For international groups, territory matters. Electronic communications providers are in scope if they provide services in Poland (art. 5a(2)). Cloud, data center, CDN, MSP and MSSP providers are in scope only if their main establishment is in Poland (art. 5a(3)-(6)). Banks and financial market infrastructure still file, even though DORA governs their ISMS and incident reporting (art. 8i).

What does late NIS2 registration in Poland cost?

A fine is possible, not automatic. Art. 73(1a) point 1 lets the authority fine an entity that did not apply in time where the seriousness of the breach justifies it. The caps are EUR 10 million or 2% of the previous financial year's revenue for an essential entity, whichever is higher (art. 73(3)), and EUR 7 million or 1.4% of revenue for an important entity (art. 73(4)). The minimum fines are PLN 20,000 and PLN 15,000.

The head of the entity is personally liable: failing to apply in time, or to report changes, can cost up to 300% of their monthly pay (art. 73a(1) point 1 and (4)). The application also contains the head's statement that the data are true, and a false statement is a criminal offense under art. 233 § 6 of the Polish Criminal Code (art. 7c(5)). IP and domain ranges are excluded from that liability; check the rest before you submit.

Art. 35 of the amending act allows the fines under art. 73(1)-(4) and art. 73a to be imposed for the first time 2 years after it entered into force, which means from 3 April 2028. That is not an exemption. An authority that sees your filing date in 2028 will also ask whether the delay was deliberate and what you did in the meantime.

How do you file a late application in wykaz-ksc.gov.pl?

The procedure is the same as before the deadline. The ministry describes it step by step on the S46 system page (in Polish). If you collect the data first, filing takes an afternoon.

1. Collect the data in art. 7(2) points 1-18: name, sector and entity type, addresses, Polish tax and statistical numbers (NIP, REGON), public IP ranges, domains, contact persons, a size statement, the EU countries where you provide services and your main establishment.
2. Log in at wykaz-ksc.gov.pl through Węzeł Krajowy, the national login service, and create a user account the first time. Foreign entities can log in with eID.
3. Click "Wpisz nowy podmiot" (enter a new entity) and complete the form sections. A NIP or REGON fills in some fields automatically.
4. Sign the application with Profil Zaufany (the Polish trusted profile), or download it as XML and sign it with a qualified signature, a personal signature (from the Polish e-ID card) or a qualified seal (art. 7c(6)).
5. Check who signs. The head of the entity or a person they authorize files and signs, with the power of attorney attached. A commercial proxy (prokurent) listed in the National Court Register needs none.
6. Keep the confirmation. You receive an email, and the application list shows "Zatwierdzony" (approved) or "Oczekuje na weryfikację" (awaiting verification), for example when your NIP is already listed because the authority entered you.

Once listed, report any change to your data within 14 days (art. 7c(3)). New IP ranges, new domains and a departing contact person are the ones teams forget most often.

How do you document the scope assessment and the delay?

The act does not require a separate self-identification memo. But the authority can request information (art. 43(1)), and the head of the entity is personally liable. We recommend a short memo of 1-2 pages, signed by management. The same document protects you if you conclude that the act does not cover you.

• the date of the assessment and who carried it out;
• what the entity actually does and the matching entry in annex 1 or 2, with NACE codes;
• size figures from the latest financial statements, including linked companies or the reasons for the group exception in art. 5(6) and (7);
• the conclusion (essential, important or out of scope) and the next review date;
• the filing date, the email confirmation and a short factual reason for the delay;
• the steps taken since then toward the Chapter 3 duties.

State the reason for the delay plainly: a group restructuring, a new line of business, or an earlier threshold assessment that turned out to be wrong. A dated memo with an action plan shows the authority what you did once you found the gap.

Late registration does not move 3 April 2027

The Chapter 3 duties of the KSC act (ISMS, risk management, incident handling, business continuity, supply chain, management training) apply from 3 April 2027 to entities that met the criteria on 3 April 2026 (art. 33(1) of the amending act). The date you joined the register changes nothing. An entity that meets the criteria later has 12 months from that day (art. 16).

That leaves just under 26 weeks. We split them into stages in our NIS2 implementation plan for Poland. The EU background is in our article on what the NIS2 directive is and how it affects your business. If you already run an ISMS, see what carries over in our piece on ISO/IEC 27001, and use the NIS2 evidence matrix to map each requirement to its evidence.

We do not perform the formal KSC audit under art. 15. We run a pre-audit review and tell you who may audit you. What a review covers is explained in our article on IT audits.

A plan for the next two weeks

1. Days 1-3: self-identification in three steps and a management decision.
2. Days 4-6: collect the art. 7(2) data, including IP ranges and domains from IT.
3. Day 7: file the application and save the confirmation.
4. Days 8-14: assessment memo, a named KSC owner and a work plan to 3 April 2027.

If you want to go through the scope assessment with us, see our NIS2 compliance in Poland page or contact us.