Poland is on the verge of a major overhaul of its cybersecurity framework through the amendment to the National Cybersecurity System Act (NCSA), implementing the European Union’s Network and Information Security 2 Directive (NIS2).
The new legislation significantly expands the scope of regulated entities, introduces stricter governance and incident-reporting obligations, and increases potential financial exposure for non-compliance. While the President of Poland has signed the act, he has simultaneously referred it to the Constitutional Tribunal, thus creating a degree of legal uncertainty.
Fundamental expansion of scope
The implementation of NIS2 marks a shift from a relatively narrow cybersecurity regime to a far broader compliance ecosystem. Under the amended NCSA, the catalogue of “essential” and “important” entities has been substantially expanded.
