# NIS2 in Poland: what the amended KSC act means > Poland's amended KSC act has transposed NIS2 since 3 April 2026: who it covers, the reporting chain, the risk-management measures and network monitoring. Source page: https://netsenx.com/en/blog/2026-11-07_nis2-poland-ksc · NetSenX Team · 2026-11-07 Poland transposed NIS2 by amending its national cybersecurity system act (*ustawa o krajowym systemie cyberbezpieczeństwa*, the KSC act). The amending act of 23 January 2026 was published in the Journal of Laws on 2 March 2026 (Dz.U. 2026 poz. 252) and came into force on 3 April 2026. It replaces the old split into operators of essential services and digital service providers with the NIS2 categories: key entities (*podmioty kluczowe*) and important entities (*podmioty ważne*). ## Who is covered The size thresholds follow NIS2. In general, a company is in scope if it works in one of the sectors the act lists and is at least medium-sized: 50 or more staff, or an annual turnover and a balance sheet total both above EUR 10 million. Some entities are covered regardless of size. Covered entities identify themselves and apply for entry in the official register of key and important entities; the amendment sets transition periods for that and for putting the required measures in place, so check the dates that apply to you in the act itself. ## Reporting a significant incident NIS2 sets the reporting chain the amended act transposes: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report no later than one month after the notification. Under the KSC act, reports go to one of the three national CSIRTs (CSIRT NASK, CSIRT GOV or CSIRT MON), depending on the entity. Our [NIS2 deadline calculator](/en/nis2-incident-reporting-deadlines) turns the moment you became aware into dates. ## Risk-management measures The act takes over the risk-management measures of Article 21 NIS2: risk analysis, incident handling, business continuity, supply-chain security, policies for assessing whether the measures work, and more. It names no product. What it does require, in practice, is that you can detect an incident and describe it within the deadlines. ## What this means for network monitoring You cannot send an early warning about an incident you have not noticed. Most intrusions that end in a reportable incident cross the network long before they cause damage: a workstation checking in with an outside server, one host scanning others, new administrator sessions, a large upload at night. Watching that traffic continuously is one of the few ways a small team notices in time, and it covers devices that cannot run an endpoint agent, such as printers, cameras and production machines. ## What NetSenX does, and what it does not NetSenX watches how every host behaves on the network and flags command-and-control beaconing, scanning, lateral movement and unusual outbound data volume, on every plan, Free included. It explains every alert in plain language, writes alerts, analyst decisions and configuration changes to an audit log, and tracks each incident against the NIS2 Article 23 deadlines. Customer data is stored in the EU. NetSenX does not decide whether your company is a key or important entity, does not file the register application and does not report to a CSIRT on your behalf: those duties stay with you. The Free plan monitors up to 3 devices with no time limit; see [pricing](/en/pricing) and [NIS2 network monitoring](/en/nis2-network-monitoring). ## FAQ ### Has Poland transposed NIS2? Yes. The act of 23 January 2026 amending the KSC act (Dz.U. 2026 poz. 252) came into force on 3 April 2026 and transposes NIS2 into Polish law. ### What are key and important entities? The two NIS2 categories the amended KSC act uses instead of the old operators of essential services. Which one applies depends mainly on the sector and the size of the company; the act lists the sectors. ### Where are incidents reported in Poland? To one of the three national CSIRTs, CSIRT NASK, CSIRT GOV or CSIRT MON, depending on the entity, on the NIS2 timeline: early warning within 24 hours, notification within 72 hours, final report within one month after the notification. ### Does NetSenX report to the CSIRT for us? No. NetSenX detects suspicious network behaviour, keeps the alerts and the audit log a report draws on and tracks the reporting deadlines. Registration and reporting stay with your company. ## Sources All accessed on 7 November 2026. - [ISAP — Act of 23 January 2026 amending the act on the national cybersecurity system and certain other acts (Dz.U. 2026 poz. 252)](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20260000252) — status and date of entry into force - [Dziennik Ustaw 2026 poz. 252](https://dziennikustaw.gov.pl/DU/2026/252) — the published text - [UKE — amendment of the act on the national cybersecurity system](https://www.uke.gov.pl/akt/zmiana-ustawy-o-krajowym-systemie-cyberbezpieczenstwa,647.html) - [Directive (EU) 2022/2555 (NIS2) — EUR-Lex](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) - [European Commission — NIS2 transposition status by Member State](https://digital-strategy.ec.europa.eu/en/policies/nis-transposition) --- *Written by the NetSenX Team at TriStiX S.L. This article is general information, not legal advice; check your obligations in the act or with your legal counsel. Questions: [info@netsenx.com](mailto:info@netsenx.com).*