Are we covered by the Polish KSC Act? Three questions to start with

Conversations about the amended Polish act on the national cybersecurity system usually open with "apparently this applies to us". Then come the questions about audits, about an information security management system, and about issuing an early warning of a significant incident within 24 hours. Only after a quarter of an hour does it turn out that nobody at the table can say clearly whether the company is a covered entity at all.

That is the wrong order. Buying an answer to "how do we adapt" before answering "are we covered, and as what" can lead to work on the wrong scope or on obligations that do not apply to the company.

Starting point: what actually changed

The amendment to the Polish KSC Act was promulgated as Dz.U. 2026 poz. 252 and entered into force on 3 April 2026. This is the act that transposes the NIS2 directive into Polish law.

The second date that keeps coming up is 3 October 2026. It is worth describing precisely, because at least two incorrect versions of it circulate. For entities subject to self-registration that already met the criteria on 3 April 2026, it is the deadline for applying for entry in the register of essential and important entities, the Wykaz KSC. An entity that meets the criteria later has, as a rule, six months from that point, so its deadline is a different one. Some entities are entered ex officio. It is not the date when "the obligations start to apply", nor a "compliance deadline". How an entity ends up in the register depends on its category, and that has to be confirmed against the text of the act rather than against someone else's slide deck. Later dates in the act cover the management system, incident handling and audits.

Before any of those dates matters for a specific company, though, you have to work through the scope of application.

The three questions that settle most of it

Neither the company name nor the registered business classification code settles whether the act applies. The code can be a useful indicator, but the actual activity is decisive. Three things build the scope.

First: the type of service you actually provide. The types of activity are listed in the annexes to the act. Annex 1 covers energy, transport, banking and financial market infrastructure, health, drinking water, electronic communications, ICT service management and digital infrastructure. Annex 2 includes postal and courier services, waste management, chemicals, food, the manufacture of medical devices, electronics, machinery and vehicles, and the provision of digital services. What decides is what the company really does; the business classification code is only an indicator. The annex alone does not yet determine whether an entity is essential or important.

Second: the size of the entity. The thresholds come from Art. 5 of the act read together with Annex I to Regulation (EU) No 651/2014. A micro-enterprise employs fewer than 10 people and has annual turnover or a balance sheet total not exceeding EUR 2 million. A small enterprise employs fewer than 50 people and has annual turnover or a balance sheet total not exceeding EUR 10 million. A medium-sized enterprise employs fewer than 250 people and has turnover of up to EUR 50 million or a balance sheet total of up to EUR 43 million, while no longer qualifying as small. A large enterprise employs at least 250 people or, with a lower headcount, exceeds both EUR 50 million in turnover and EUR 43 million in balance sheet total. That calculation often has to include the figures of partner and linked entities, which is easy to forget inside a group.

Third: exceptions and special size rules. Art. 5 as a whole covers all electronic communications undertakings, although their size can determine whether they are essential or important entities. Regardless of size, essential entities include DNS service providers, qualified trust service providers and the public entities specified in the act. For managed security service providers, the threshold is not removed but lowered to the small-enterprise level. A ten-person company can therefore be covered even though the standard size threshold suggests otherwise.

There is a fourth thread that does not change the scope of application but does change operational reality. If you supply a covered entity, that alone does not make you a covered entity. Security requirements can still reach you by contract, because Art. 21(2)(d) of the NIS2 directive requires the covered customer to address the security of its direct supplier relationships as part of risk management. For many integrators and hosting companies, this is exactly the channel through which the rules enter the organisation.

Why we built a page instead of another PDF

All of the above can be read in the act. The problem is that for someone doing it for the first time, getting from legal text to the sentence "we are probably in sector X, above the threshold, so this needs to be verified with a lawyer" takes an evening, not five minutes.

So we published a plain self-identification page: Are you covered by KSC. It asks two mandatory questions, about the type of activity and the size of the entity, and one optional question about supplying a covered entity. The result appears immediately, with no registration and no company details.

What the page deliberately does not do matters more.

It gives no percentage score and no result of the "7 out of 10 compliance points" kind. It does not say "you are covered", it says "the declared answers point at the entity being covered, to be confirmed". With every outcome it shows a list of what it did not check: partner and linked entities, other cases where the act covers an entity regardless of size, a full analysis of the service actually provided and the supporting business classification code, the distinction between essential and important entities, and decisions of the competent authority together with entry in the register, which can cover an entity independently of this self-assessment.

Every criterion carries a source reference in the code: a specific annex or article. That is not decoration. Content that asserts something about legal obligations should be traceable to a provision, otherwise after a few months nobody can tell your findings apart from someone else's paraphrase.

The result can be copied out as a plain note with a date and the declared answers. That is enough to walk into a board meeting or a call with a law firm and start from something concrete instead of "apparently this applies to us".

What it does not replace

This has to be said plainly: it is not legal advice and it does not settle the status of an entity. Two questions cannot cover every case, and sector assignment is disputed even between lawyers. The page gives a direction and a list of questions to ask next.

We think that is the honest scope for such a tool. A company handed a "68% compliant" score from the internet knows nothing more about itself than before the click. A company that knows it sits in an Annex 1 sector, above the threshold, and has to verify the figures of its linked entities, already knows what to ask about.

Where the tooling part begins

Once the status is settled, the work that lasts for years begins: vulnerability review, remediation deadlines, risk acceptance decisions, evidence that the process actually ran rather than merely being described in a policy. Secvalis supports this technical part; self-identification does not replace it.

The order matters, though. First establish whether and as what you are covered. Only then choose tools.

Check in three questions whether you are likely covered by KSC

Sources

• Act of 23 January 2026 amending the Polish act on the national cybersecurity system, Dz.U. 2026 poz. 252 (annexes 1 and 2, Art. 5)
• Directive (EU) 2022/2555 (NIS2), Art. 21(2)(d)
• Regulation (EU) No 651/2014, Annex I (enterprise size thresholds)
• Official KSC FAQ