Who does NIS2 apply to? Poland’s new KSC Act and your small business

Did a client send you a cybersecurity questionnaire, or did someone say in conversation that “since April there’s a new law and everyone has to comply”? Let’s sort this out first: not everyone does. Below I show how to check whether your company is covered by the new rules and, if it isn’t, why you may still come across them.

I am writing as of 19 October 2026. This is not legal advice. I give the dates according to the act (Journal of Laws, or Dz.U., 2026, item 252) and announcements of the Ministry of Digital Affairs, and in a specific case check them in the Journal of Laws (Dziennik Ustaw) or with a lawyer.

What NIS2 and the KSC Act are

NIS2 is the EU cybersecurity Directive 2022/2555. The directive itself does not impose obligations on companies, because each country has to implement it through its own law. In Poland this is done by the amendment to the Act on the National Cybersecurity System (ustawa o krajowym systemie cyberbezpieczeństwa, KSC).

The amendment was passed on 23 January 2026, published in the Journal of Laws on 2 March 2026 (item 252) and entered into force on 3 April 2026. The President signed it but, under the ex post review procedure, referred to the Constitutional Tribunal a motion concerning the provisions on high-risk vendors (case K 19/26). By mid-October 2026 the Tribunal had not scheduled a hearing, and the motion itself does not suspend the application of the act.

The general idea is simple: companies that matter to the economy are to secure their systems systematically, report serious incidents and look after the security of their suppliers.

Who it applies to: three questions to start with

The simplest way to answer the question of who NIS2 applies to is with three questions. If you answer “no” to any of them, your company is probably outside the act.

1. Do you operate in one of the sectors listed in the act? This concerns, among others, energy, transport, health, drinking water and wastewater, digital infrastructure, waste management, food and selected branches of manufacturing (e.g. machinery, electrical equipment, electronics, vehicles, medical devices). You will find the full list in the annexes to the act.
2. Are you a medium-sized or large company? The general rule is based on the EU definition of company size: in simplified terms, a company is at least medium-sized when it employs 50 people or more, or has more than EUR 10 million in both annual turnover and balance sheet total (the data of linked and partner companies counts too). Micro and small companies are usually outside the act.
3. Does your activity fit the description in the annex? The name of an industry alone is not enough. What counts is what you actually do.

There are exceptions: regardless of size, the act covers, among others, domain name registration companies, DNS service providers, trust service providers and electronic communications undertakings, e.g. small internet providers. It covers providers of managed cybersecurity services already from the threshold of a small company. If you provide such services, don’t assume in advance that your company is exempt.

Deadlines worth knowing

According to the act of 23 January 2026 and an announcement of the Minister of Digital Affairs, it looks like this:

The deadline for the application has already passed. If your company is covered by the act and has not filed one, don’t put it off: file it in the wykaz-ksc.gov.pl application and contact a lawyer. A company that starts meeting the criteria later has 6 months to file an application and 12 months from that day to meet the requirements. The time until April 2027 is enough to put your safeguards in order, but not to put off decisions.

A small company outside the act, but under pressure from a client

For a small company another scenario is more likely: the act does not cover it, but it does cover its client. Such a client has to look after the security of its supply chain, so it will start asking suppliers about safeguards: in a questionnaire, in a contract or during an audit.

An example (made up): a machinery manufacturer has 60 employees, so as a medium-sized company from the machinery manufacturing sector it is an important entity. Its supplier of quoting software and the small company that looks after its website receive a letter with questions. Do you have backups? Who has access to the panel? How quickly will you report an incident? A supplier without answers risks losing the contract, even though it is not subject to the act itself.

In such a situation it is not about certificates, but about calmly documenting the basics.

Checklist: the basics clients will ask about

This list is not a legal requirement. It is a set of things that large companies most often ask about in supplier questionnaires.

• Access: every employee has their own account, and when someone leaves the company, the account is blocked immediately.
• Passwords and a second factor: logging in to email, the website panel and online banking uses a code from an app or a hardware key.
• Updates: the website system, plugins and the server are updated regularly, not “sometime”.
• Backups: they are made automatically, kept off the server and checked from time to time by restoring them.
• Email on your domain: SPF, DKIM and DMARC are configured so that nobody can impersonate your company. I describe this in the guide on company emails landing in spam.
• Incident reporting: you know who in the company receives a report of a break-in or a leak and what they do in the first hour.
• Supplier list: you know who has access to your data and systems (hosting, accounting, agency).
• Customer data: it is stored where your privacy policy says it is, and doesn’t lie in open files.

How to answer a client’s questionnaire

Don’t copy answers “just in case” and don’t tick “yes” for things you don’t have. When something needs fixing, give a date. Clients prefer an honest “we are implementing this by the end of March” to a false “we have everything”.

A ready-made answer to adapt:

Hello, thank you for the questionnaire. I am attaching the answers. We make backups daily and store them outside the production server. Access to the panels is limited to named users with two-factor login. The elements we are implementing by the end of March 2027 are marked in the table. I would be glad to go through the details in a call.

If you aren’t sure what to reply about the website and the server, a security audit will help: I check forms, login, protection against bots and spam, and in the report you get ratings and fixes. For a first look, the free tool Check your website is enough; it rates, among other things, the website’s security, email on your domain and speed.

What not to do

• Don’t assume “this doesn’t apply to me” without checking your sector and company size. For some entities, size is not the only criterion.
• Don’t pay for a “NIS2 certificate”. I don’t know of any official certificate that would be enough to meet the act. Beware of offers that promise one.
• Don’t wait until the last month. You can implement backups, named accounts and updates in a few days, but the process of documenting them takes longer.
• Don’t shift everything onto the provider. Even if an outside company holds your hosting, you are responsible for accounts, passwords and decisions about access.

Summary

The new KSC Act covers mainly medium-sized and large companies from selected sectors, while micro and small ones are usually outside it. You will most often come across it indirectly, when a client asks you to confirm your safeguards. Go through the checklist, fix the gaps and write down your answers before a questionnaire lands in your inbox.

If you want to know the state of your website and server, write to me. I will do a security audit with a report of fixes or implement project security measures: updates, backups, monitoring and access restrictions. I reply within 24 hours.