On 3 April 2026, a major amendment to the Act on the National Cybersecurity System entered into force. The amendment transposes the NIS2 Directive into Polish law, albeit with some delay.
The new regulations impose additional obligations on businesses, increase penalties for non-compliance, and provide a transitional period for implementation. Is your organisation ready for the new requirements?
Energy companies will automatically fall within the scope of the Act. Depending on their size, they will be classified as either key entities or important entities. This classification entails obligations such as implementing appropriate internal procedures (including an Information Security Management System – ISMS), conducting periodic tests and audits, and reporting cybersecurity incidents.
Non-compliance may result in severe sanctions, including orders to suspend operations and fines of up to EUR 10 million or 2% of annual worldwide turnover. Management board members and senior managers may also face personal financial penalties.
At the same time, organisations have time to prepare for the new requirements: six months to register as a key or important entity, one year to implement the required procedures, and two years to conduct the first audit.
📩 The latest newsletter is now available.
👉 Sign up for the newsletter on our website and receive regular expert insights into the renewable energy sector.
Practical legal commentary, selected regulatory changes, and experience from projects that have a real impact on business decisions.
Practical legal commentary, selected regulatory changes, and experience from projects that have a real impact on business decisions.