787 974 136
So far, we have written about who is affected by the NIS 2 Directive, what obligations it imposes, and why it is worth treating it as more than just a formality. Now the time has come when these considerations are no longer just theory – the Act on the National Cybersecurity System (KSC) has been in force since 3 April 2026, and companies subject to its provisions have a specific, non-extendable deadline for formally registering with the system. This system is S46 – and it is this system that now determines whether a company is fulfilling its basic statutory obligation or risking liability.
The S46 System is the official ICT platform of the Minister responsible for digitalisation, developed and maintained by NASK – the National Research Institute. Its name is no coincidence – it derives directly from Article 46 of the Act on the National Cyber Security Centre (KSC), which refers to a system designed to support entities subject to regulation. In practice, S46 acts as a central point of contact between businesses and the state in the field of cybersecurity – it is through this system that entities register, report incidents, receive threat alerts and communicate with the relevant CSIRT teams.
The system comprises several interlinked components, which are worth distinguishing as they correspond to different stages of a company’s obligations:
The KSC Register – an electronic register of key and important entities, available at wykaz-ksc.gov.pl. It is here that companies submit their application for inclusion and provide their identification, sector-specific and contact details.
S46 Cyber Hub – the operational part of the system, which is only activated for an entity once it has been entered into the register. It is used to report and manage incidents, receive threat alerts and exchange information on an ongoing basis with CSIRT teams.
Information and training portal – knowledge resources, educational materials and courses prepared by NASK, helpful for those new to the system.
Entry in the KSC Register is sometimes treated as just another bureaucratic obligation to tick off the list. This is the wrong approach for two reasons.
Firstly, the application for entry is submitted and signed by the head of the organisation (or a person authorised by them), and its content includes a declaration made under penalty of criminal liability under the Criminal Code. This is not a form filled in ‘on the side’ by the IT department – it requires the involvement of decision-makers and thorough verification of the data before it is entered into the system.
Secondly, the entry itself is of a declaratory nature – this means that the obligations arising from the Act come into force for the company from the date on which the statutory conditions are met, and not from the date of formal registration. In other words, the absence of an entry does not exempt the company from its obligations – it may, however, result in an ex officio entry and a financial penalty.
The timetable for the implementation of the KSC Act is divided into several stages, which are worth keeping track of in one place:
It is worth emphasising the difference between the first of these deadlines and the subsequent ones: entry on the register is a formal requirement that grants access to the system, whilst the actual implementation of the security requirements is a separate, longer process for which the company has several months following registration. Registering on time does not, therefore, automatically mean compliance with the entire Act – it is merely the first step.
Before a company begins filling in the application form, it is worth taking a few preparatory steps which, in practice, save the most time.
Self-classification of business activities. The first and most important stage is a thorough assessment of whether the company is subject to the Act at all – and in what capacity: as a key entity or an important entity. The verification covers the activities actually carried out by the company, not merely those formally registered with the National Court Register (KRS) or the Central Registration and Information on Business (CEIDG). This is a stage at which it is worth consulting specialists, as incorrect classification may result in both excessive obligations and a real risk of non-compliance.
Data preparation. The application includes the entity’s identification details, its classification into a sector and sub-sector in accordance with the annexes to the Act, the ranges of IP addresses and domains used, details of at least two contact persons and – where applicable – information about the managed security service provider (MSSP). Gathering this information often requires the simultaneous cooperation of several departments – IT, legal and senior management – so it is best not to leave this until the last week before the deadline.
Authentication and login. Access to the S46 system is via the National Portal (login.gov.pl), using, amongst other things, a Trusted Profile, the mObywatel app, an e-ID, a qualified electronic signature or online banking. The application must be signed by the head of the organisation or an authorised representative – in the latter case, an electronic power of attorney must be attached.
Submitting the application. After logging into the system, the company selects the option to submit an application for entry and completes all the required fields on the form. Entry into the register takes place automatically upon submission of a valid application – no administrative decision or additional confirmation from the authority is required, although a relevant certificate may be issued at the entity’s request.
Updating details. Obligations do not end with a one-off registration – any change to the details submitted to the system must be updated within 14 days of the change occurring.
Failure to submit an application by the required deadline is not merely a procedural oversight – the Act treats it as a breach of a legal obligation, subject to a financial penalty imposed by the competent authority. The amount of the fines is the same as the penalties provided for other breaches of the KSC Act: up to 10 million euros for key entities and up to 7 million euros for important entities.
In practice, failure to register also results in an ex officio entry – but this offers no relief. Receiving such an entry entails a request to provide the missing data within a specified timeframe, and the very fact that the authority had to intervene may be interpreted as a sign of the organisation’s lack of due diligence in the area of regulatory compliance.
Inclusion in the KSC Register grants access to the S46 Cyber Hub, but does not in itself signify compliance with the requirements of the Act. What happens after registration – implementing an information security management system, developing incident response procedures, training staff, analysing the supply chain and preparing for a future audit – is a substantial project requiring the involvement of the entire organisation, not just the IT department. We have already written about why cybersecurity is no longer solely an IT department issue, and the implementation of the ISO 27001 standard – which largely overlaps with the requirements of NIS 2 – remains a sound foundation for building these processes.
For companies that still have doubts as to whether they are subject to the KSC Act at all, the deadline of 3 October 2026 is a good time to dispel any such doubts once and for all – it is better to register as a precaution and, if necessary, correct the details, than to be overlooked and risk an ex officio entry and financial consequences.
DJB DORADZTWO
Marcin Chorąży
