Entry in the Wykaz KSC register: what to prepare

First: which route applies

There are two routes into the Wykaz KSC register. Entities subject to self-registration file an application for entry. Four categories of entity are entered ex officio and file no application; they supply their data once called upon.

Entered ex officio:

• public entities designated in the act (Article 7a(2) of the Act on the National Cybersecurity System (Journal of Laws of 2026, item 252))
• electronic communications undertakings (Article 7a(2) of the Act on the National Cybersecurity System (Journal of Laws of 2026, item 252))
• trust service providers (Article 7a(2) of the Act on the National Cybersecurity System (Journal of Laws of 2026, item 252))
• critical entities (Article 7a(2) of the Act on the National Cybersecurity System (Journal of Laws of 2026, item 252))

• Entities that were operators of essential services under the previous regime move into the Wykaz KSC register under the transitional provisions, without filing a fresh application.

  Article 34(2) of the amending Act (Journal of Laws of 2026, item 252)

• No application does not mean no entry. The authority can enter an entity in the register also where the entity filed no application.

  Article 7j(1) of the Act on the National Cybersecurity System (Journal of Laws of 2026, item 252)

The application window

Entities subject to self-registration file the application in the window from 2026-05-07 to 2026-10-03. The window comes from the Announcement of the Minister of Digital Affairs of 8 April 2026 (Dz. Urz. MC 2026 poz. 7).

The schedule comes from a ministerial announcement rather than directly from the act, and can be changed by a further announcement under Art. 34(5) of the amendment.

What the application contains

Formal requirements

• The application is filed in electronic form.

  Article 7c(6) of the Act on the National Cybersecurity System (Journal of Laws of 2026, item 252)

• The application carries a declaration made subject to criminal liability for making a false declaration, so the data has to be confirmed before filing, not afterwards.

  Article 7c(5) of the Act on the National Cybersecurity System (Journal of Laws of 2026, item 252) in conjunction with Article 233 § 6 of the Penal Code

• The application is signed by the person authorised to represent the entity, so it is worth checking the rules of representation before the data set is ready.

  Article 7c(5) and (6) of the Act on the National Cybersecurity System (Journal of Laws of 2026, item 252)

• An entity that starts meeting the criteria later files the application within 6 months of the day it started meeting them. That is a separate track from the one-off window set by the ministerial announcement.

  Article 7c(1) of the Act on the National Cybersecurity System (Journal of Laws of 2026, item 252)

What follows from not filing

• If an entity is subject to self-registration, failing to file the application breaches a statutory duty for which the competent authority may impose a financial penalty. May, not must: the provision is discretionary and does not operate automatically. This duty does not apply to entities entered ex officio, since they file no application.

  Article 73(1a)(1) and Article 73(3)-(4) of the Act on the National Cybersecurity System (Journal of Laws of 2026, item 252)

• Financial penalties cannot be imposed earlier than two years after the amendment entered into force.

  Article 35 of the amending Act (Journal of Laws of 2026, item 252)

• Article 73a provides for a separate financial penalty for the head of an essential or important entity, including for failure to file the application for entry on time, where warranted by the duration, scope or nature of the infringement.

  Article 73a(1)(1) of the Act on the National Cybersecurity System (Journal of Laws of 2026, item 252)