There is only one month left to apply for inclusion in the list of key and important entities
The deadline for submitting an application for inclusion in the list of key and important entities is October 3, 2026. This obligation stems from the Act of July 5, 2018, on the National Cybersecurity System (hereinafter referred to as
“UKSC”) as amended by the Act of January 23, 2026, amending the Act on the National Cybersecurity System and certain other acts implementing the NIS2 Directive, which entered into force on April 3, 2026. You can read below about who this obligation applies to and what responsibilities it entails.
What is the national cybersecurity system?
Cyberattacks, which just a few years ago mainly targeted individual companies, now affect entire sectors of the economy and essential public services, and the costs of downtime run into the millions—which is why both European and Polish lawmakers have decided to subject cybersecurity to strict regulatory obligations. The UKSC establishes the legal and organizational framework for cybersecurity at the national level—including designating the competent authorities for specific sectors, CSIRT teams, and the S46 ICT system used for reporting incidents. The amendment expands the scope of entities covered from several hundred operators of critical services to tens of thousands of entities across eighteen economic sectors.
Importantly, the qualification mechanism has changed significantly. Previously, the status of a critical service operator was granted by administrative decision; now, a self-identification model is in effect—the status arises by operation of law upon fulfillment of the statutory conditions, the registration is declaratory in nature, and the burden of proper assessment rests with the entity itself.
Who is a critical entity, and who is an important one?
Classification is based on two criteria: (i) the type of activity and (ii) the size of the entity, measured according to the criteria in Annex I to Regulation (EU) No. 651/2014. The types of entities are listed in Annex I (critical sectors—including energy, transportation, banking, healthcare, digital infrastructure, and public entities) and Annex 2 (important sectors—including postal and courier services, waste management, food and chemical production, industrial manufacturing, digital service providers, and scientific research).
To put it simply, a large business listed in Appendix 1 is a key entity, a medium-sized business from that appendix is an important entity, and medium- and large-sized businesses from Appendix 2 are important entities. Micro- and small businesses generally fall outside the scope of the UKSC.
However, numerous exceptions are provided for—regardless of size, key entities include, among others, DNS service providers, top-level domain registries, qualified trust service providers, and critical entities, while separate rules apply to electronic communications providers, managed cybersecurity service providers, and healthcare entities.
It should also be emphasized that when determining size, data from affiliated and partner companies are included, which may result in relatively small entities falling under the UKSC regime due to their capital ties. Fortunately, there are certain exceptions in this regard as well.
Obligation to Maintain an ISMS
Critical and important entities are required to implement and maintain an information security management system (ISMS) in the information systems used in processes that affect the provision of a critical or important service. The starting point is therefore a systematic risk assessment, and the measures selected must be proportionate to that risk, the size of the entity, and the consequences of a potential incident. The list of areas that must be addressed is extensive—it includes, among others, security policies, security throughout the system lifecycle and the ICT supply chain, business continuity plans, continuous monitoring, cryptography and multi-factor authentication, asset management, access control, and staff training. Implementing and maintaining an ISMS is not a one-time project, as it requires periodic review, effectiveness assessment, and updates; while ISO/IEC 27001 certification streamlines the process, it does not replace statutory requirements.
What is the registry, and by when must an entity register?
The register of key and important entities is maintained by the minister responsible for digitization. Starting May 7, 2026, self-registration will be available at www.wykaz-ksc.gov.pl—you will need a Trusted Profile, the mObywatel app, an e-ID, or an online banking profile to log in. The application must be submitted and signed by the management board or a person authorized by the management board, along with a statement affirming the accuracy of the data under penalty of criminal liability. In addition to identification and sector-specific data, the application includes an address for electronic service of process, ranges of public IP addresses and domain names used on a continuous basis, contact information and the S46 account administrator’s details, as well as information about operations in other Member States.
Public entities, telecommunications providers, trust service providers, and existing operators of essential services are automatically registered; however, this does not exempt them from supplementing their information upon receiving a request.
Violations of statutory obligations are subject to administrative fines—for critical entities, up to 10 million EUR or 2% of revenue; for important entities, up to 7 million EUR or 1.4% of revenue, whichever is higher.
The timeline related to the UKSC is as follows:
by October 3, 2026 – entities meeting the criteria as of the amendment’s effective date must submit a registration application;
by April 3, 2027 – entities must implement the Information Security Management System (ISMS) and fulfill other UKSC obligations, as well as begin using the S46 system;
as of April 3, 2028 – from this date onward, penalties may be imposed on key and important entities, as well as on the members of their management boards.
What does this mean for your organization?
In our assessment, completing the application is the final stage of the process of accurately determining an entity’s status under the UKSC. Accordingly, we recommend the following sequence of actions:
- Determining the organization’s status—analyzing whether the organization is a key or important entity or falls outside the scope of the UKSC, taking into account all types of activities as well as affiliated and partner companies;
- Documenting the results of the analysis, even if it leads to the conclusion that registration is not required;
- Gathering data for the application, designating contact persons and an S46 account administrator, and submitting the application after verifying the signatory’s authority;
- Beginning work on the SZBI with a target date of April 3, 2027—if implemented from scratch, this may take several to over a dozen months.
Summary
The self-identification model adopted in the amendment shifts the entire risk of misclassification to the organization and its management. Therefore, it is advisable to start by determining or confirming whether you are a significant or critical entity.
KONTAKT
E: magdalena.patryas@pl.Andersen.com
T: +48 32 731 68 84
M: +48 502 392 419
