NIS2 › NIS2 transposition tracker
Poland · PL
Ustawa o zmianie ustawy o krajowym systemie cyberbezpieczeństwa (KSC2)
- Status
- Transposed
- In force from
- 2026-04-03
- EU infringement procedure
- Referred to CJEU
- Competent authority
- Ministerstwo Cyfryzacji (Ministry of Digital Affairs); sectoral CSIRTs of NASK, CSIRT GOV and CSIRT MON Competent authority NIS2 page →
- National CSIRT
- CSIRT NASK, CSIRT GOV (ABW), CSIRT MON (defence) CSIRT website →
Notable national choices
- Very late transposition; signed by the President 19 February 2026, in force 3 April 2026 — about 18 months late.
- Controversial 'high-risk vendor' supply-chain exclusion mechanism — extends NIS2 with geopolitical supply-chain controls.
- Generous transition: registration deadline 3 October 2026; full Chapter 3 compliance only by 3 April 2027; first audit and end of fine moratorium 3 April 2028.
- Three parallel national CSIRTs (NASK, GOV, MON) — the most fragmented incident-response model in the EU.
Sources
Last verified: