Poland’s cybersecurity law amendment faces criticism for potentially forcing telecom operators to replace equipment at huge cost without compensation.
Controversial Cybersecurity Law Amendment
The amendment to the Act on the National Cybersecurity System (KSC), passed after turbulent debates by both parliamentary chambers, aims to implement the NIS2 directive and protect against cyberattacks. However, the enacted regulations have sparked significant controversy. Some business organizations criticize the overregulation compared to EU provisions and the lack of precision and proper financial calculations.
High-Risk Providers and Lack of Compensation
The main concern relates to the introduction of high-risk providers (DWR). Being classified as such would require companies to remove specified equipment within 4 or 7 years. The main criticism is the lack of compensation mechanisms, which many experts consider interference with property rights without adequate compensation. Lawyers have pointed out that obliging private firms to dispose of infrastructure could lead to numerous lawsuits.
Rushed Legislation and Constitutional Concerns
The amendment triggered heated discussions in the Sejm and recently in the Senate, where it passed without amendments on January 28. Critics argue the haste in adopting regulations that deeply affect business operations is unjustified. The Legislative Office of the Senate pointed out inconsistencies in the amendment and potential violations of the Polish Constitution. The Ministry of Digital Affairs consistently responded that the allegations were unfounded and the scale of attacks requires urgent action.
Massive Financial Impact on Telecom Sector
A report by Krajowa Izba Komunikacji Ethernetowej (KIKE) highlights enormous costs of implementing the new regulations. The total cost of replacing equipment from non-EU and NATO suppliers could reach 14.4 billion Polish zloty net – an amount not included in earlier government assessments. This capital drain could halt investments in 5G or fiber optics and jeopardize financial liquidity of many operators who would finance national security from their own pockets.
Infrastructure Compatibility Challenges
The average infrastructure replacement cost for one SME operator is approximately 4.3 million Polish zloty net over five years. For many local operators operating on low margins and still repaying loans for network construction, this expense is impossible to bear without external support. The Polish telecommunications network is inextricably linked with technology from outside the EU and NATO, with over 80% of surveyed companies reporting that equipment from potentially “high-risk” suppliers constitutes more than half of their devices.
Risk of Digital Exclusion and Market Consolidation
The requirement to remove equipment within just a few years creates logistical challenges and threatens “white spots” on Poland’s digital map. If operators are forced to shut down key nodes before their technical lifespan ends and cannot find quick alternatives, service continuity will be disrupted. For thousands of residents in smaller towns, this could mean sudden digital exclusion, and for companies, the end of business operations. Without government support, the amendment could trigger forced market consolidation.