Short answer
Your company is likely in scope of NIS2/KSC if it is at least a medium-sized enterprise (roughly from ~50 employees or ~10M EUR turnover) and operates in a sector from the annexes of Poland's Cyber Security Act. In Poland, NIS2 has applied since 3 April 2026 (Act on the National Cyber Security System — KSC, consolidated Dz.U. 2026 item 20), and you must self-register in the registry of key and important entities by 3 October 2026. If you are not sure — the checklist below helps you decide in a few minutes.
Key facts
- Directive 2022/2555 (NIS2) operates in Poland through the KSC Act (t.j. Dz.U. 2026 item 20), in force since 3.04.2026.
- Essential entity: energy, transport, health, drinking water, digital infrastructure, public administration, banking and financial market infrastructures, space.
- Important entity: medical device manufacturing, chemicals, food, waste, postal and courier services, ICT B2B providers, manufacturing, wholesale and retail (within Annex II).
- General threshold: medium-sized enterprise (~50 employees / 10M EUR turnover). Some sectors have a lower threshold — e.g. MSSPs (ICT B2B) from small enterprise (~10 employees / 2M EUR).
- Self-registration in the registry of key and important entities opened 7.05.2026; deadline 3.10.2026 (Art. 7c(1)).
- Operational duties (security management system, policies, incident reporting) due by 3.04.2027.
Qualification in 5 steps
| Step | What you check | Hint |
|---|---|---|
| 1. Sector | Is your main activity in Annex I (essential) or II (important) of the KSC Act | For manufacturing: check whether your industry is in Annex II (medical devices, chemicals, food, automotive) |
| 2. Size | Are you at least a medium-sized enterprise | General threshold ~50 people / 10M EUR; MSSP from ~10 people / 2M EUR |
| 3. Criticality | Do your services matter for economy/society (essential/important) | Not every company in a sector is in scope — size and service type matter |
| 4. Providers | Do you provide ICT B2B services (MSSP, cloud, integrator) | Here the threshold is lowest — even a small firm may be in scope |
| 5. Confirm | Self-register in the KSC registry | Portal open since 7.05.2026; missing entry by 3.10.2026 = breach of a legal duty |
Common qualification mistakes
- Assuming a small company is out of scope. The threshold depends on the sector — MSSPs and some ICT providers are covered from ~10 people.
- Confusing NIS2 with certification. "NIS2 certificate" does not exist. Compliance is shown by registry entry + implemented system + reporting + audit.
- Relying only on PKD codes. Formal PKD does not always reflect the actual activity and service type — real profile counts.
- Assuming only large corporations are covered. The KSC Act also covers important entities in Annex II sectors.
What to do if you are unsure
The cheapest and safest step is self-registration in the registry of key and important entities — even if you are not sure you are in scope. Missing the deadline is a statutory breach; an entry confirms you have acted. If in doubt about qualification, consult a law firm — it is a matter of legal interpretation, not only technology.
Engineer Marcin Białczyk's perspective
In manufacturing companies I see two extremes: firms that never check qualification "just in case", and those that panic that "NIS2 is the end". The truth is in between: qualification is a concrete, measurable process — sector + size + criticality. Do not guess, because the cost of error (missing the 3.10.2026 entry, penalties) is real. At CHORS.NET we first do a passive exposure assessment and a risk map — numbers show what actually needs securing before a company invests in formalities.
Boundaries and assumptions
- This article is informational and technical; it is not legal advice.
- Final qualification as "essential/important" belongs to a law firm and the supervisory authority.
- CHORS.NET does not certify NIS2/KSC compliance and does not issue independent legal opinions.
- Facts reflect the legal state as of 19.08.2026.
Sources
- Act on the National Cyber Security System, consolidated Dz.U. 2026 item 20 (as of 19.08.2026)
- Directive (EU) 2022/2555 (NIS2)
- Self-registration info: KSC registry portal (MC/CSIRT)
- Consultations: legalgeek.pl, cgolegal.pl, infor.pl (fetched 08.08.2026)