Does Your Company Need to Register in the KSC Registry? Check Before October 3, 2026

The amendment to the Act on the National Cybersecurity System implementing the NIS2 directive introduces a new obligation for entrepreneurs to independently identify their status and submit a registration application by October 3, 2026.

Cybersecurity as a Business Duty

Cybersecurity increasingly impacts business continuity, data security, and relationships with clients and business partners. The scale of challenges is demonstrated by data from the annual report of CERT Polska, operating within NASK—in 2025, the team received over 650,000 reports, based on which more than 260,000 unique security incidents were registered. Therefore, verifying whether a company is subject to the obligations arising from the act on the national cybersecurity system should not be treated solely as a formality.

New regulations strengthen the national cybersecurity system and cover entities that are important for the functioning of services, the economy, and digital security. In practice, this means that obligations may apply not only to IT companies, but also to enterprises operating in sectors such as manufacturing, chemicals, ICT, logistics, and space.

What Is the KSC Registry?

The National Cybersecurity System (KSC) registry is a list of key and important entities. Simply put, it identifies companies and institutions from key sectors—such as energy, transport, or space—and important sectors, which include waste management, manufacturing, and the production and distribution of chemicals.

The KSC registry is maintained in the S46 System, through which electronic applications related to registration, modification of registration, or deletion from the registry are handled. For a company, the most important step is to first check on the Biznes.gov.pl website whether the registration obligation applies to it, and then, if subject to self-registration, submit the appropriate application electronically.

Registration in the KSC Registry means subjecting the organization to specific obligations, including risk management, preparation of procedures, incident response, designation of contact persons, maintenance of appropriate documentation, and cooperation with competent authorities.

This is not solely an administrative formality. It is also a moment when a company should check which systems its operations depend on, who is responsible for security, what procedures apply in the event of an incident, and how quickly the organization is able to respond.

Self-Registration or Official Entry?

The regulations provide for two modes of entry into the KSC Registry. The first is self-registration, which applies to entities that conduct activities in a sector covered by the act, meet the criteria for being considered a key or important entity, and are not entered into the registry ex officio. This mode mainly applies to private entities, which must submit an application for entry by October 3, 2026.

The second mode is entry ex officio, which applies to certain key or important entities that are entered into the registry by the Minister of Digitalization without submitting an application. This group includes public entities, telecommunications entrepreneurs, trust service providers, and entities that previously held the status of an essential service operator. Such organizations wait for a call to supplement their entry, meaning companies must determine which path applies to them.

How to Check the Registration Obligation Step by Step

First, access the KSC registry obligation check service on the Biznes.gov.pl website. Second, verify whether your activity falls within the sectors covered by the act, such as manufacturing, chemicals, ICT, logistics, digital services, or the space sector.

Third, verify your PKD codes to help determine if the company’s activities fall within the scope of the new obligations. Fourth, check the size of the entity, as factors such as the number of employees, scale of operations, and connections with other entities may matter.

Fifth, determine whether the company should submit an application independently or wait for a call. Sixth, if the obligation applies to the company, proceed to submit the application electronically by the head of the entity or an authorized person.

The deadline for submitting the application for entry into the KSC registry expires on October 3, 2026. This does not mean it is wise to wait until the end of September, as checking the obligation may take little time, but gathering data, determining the registration path, and signing the application require prior preparation.