Poland NIS2 Enforcement: PLN 100M Super-Fine, Daily Penalties up to PLN 100,000, and Why the Moratorium Has a National-Security Exception

Poland’s amended Act on the National Cybersecurity System entered force on 3 April 2026 with a penalty provision that has no equivalent at its level in any other EU member state’s NIS2 transposition: a PLN 100,000,000 (~€24 million) fine for violations that pose a direct and serious threat to national security or public safety. That fine sits outside the two-year moratorium that protects most entities from standard compliance penalties until April 2028.

Understanding which penalties are deferred and which are immediately live determines how much urgency your compliance programme requires right now. This guide covers Poland’s complete four-tier penalty structure, the precise moratorium exclusions, management personal liability, the enforcement authority landscape, and a compliance timeline showing when each risk category activates. All figures are drawn from the KSC Act text and analysis by Polish-qualified legal practitioners.

Who Must Comply: Poland’s Expanded KSC Scope

The amended KSC Act expanded Poland’s regulated entity population from roughly 400 operators under the original 2018 law to an estimated 42,000 entities across 18 sectors. The essential and important entity thresholds mirror those in NIS2 Directive 2022/2555:

Entity type	Employee threshold	Turnover / balance sheet	Standard fine ceiling
Essential entity	250+ employees	€50M+ turnover OR €43M+ balance sheet	€10M or 2% global turnover
Important entity	50–249 employees	€10M–€50M turnover	€7M or 1.4% global turnover
Management board (personal)	—	—	300% of monthly remuneration

Certain sectors classify as essential automatically regardless of size: banking, financial market infrastructure, DNS infrastructure operators, top-level domain registries, cloud providers, CDN providers, data centres, and trust service providers. If your organisation has a legal establishment in Poland and operates in a covered sector, the KSC penalty framework applies. See the full Poland NIS2 compliance guide for sector classification detail.

Poland’s Four-Tier Penalty Structure

Most NIS2 commentary focuses only on the EU minimum fine thresholds. Poland’s KSC Act builds a four-tier structure that goes significantly beyond those minimums — with implications for both large multinationals and smaller essential entities.

Tier 1 — Standard essential entity fines
Up to €10 million or 2% of worldwide annual turnover, whichever is higher. The KSC Act sets a PLN 20,000 minimum floor, meaning competent authorities can act on procedural violations at smaller organisations without the turnover percentage producing a negligible number.

Tier 2 — Standard important entity fines
Up to €7 million or 1.4% of worldwide annual turnover, whichever is higher. PLN minimum floor: PLN 15,000.

Tier 3 — Daily fines for non-compliance with regulatory orders
PLN 500 to PLN 100,000 per day (approximately €120–€24,000) for ongoing non-compliance with a competent authority’s binding instruction. Daily fines accrue separately from any base fine and run until the breach is remedied. These are not subject to the moratorium — covered in detail below.

Tier 4 — The PLN 100,000,000 super-fine
A standalone enhanced penalty for the most serious violations, operating entirely outside the moratorium. It can be imposed from 3 April 2026. Trigger conditions and distinguishing features are covered in the next section.

The PLN 100M Super-Fine: Poland Has the EU’s Highest Critical-Infrastructure Penalty

Where an entity’s violation of the KSC rules causes — or creates a direct and serious risk of causing — a cybersecurity threat to Polish national defence, state security, public safety and order, human life and health, significant financial damage, or serious service disruption, the competent authority may impose a fine of up to PLN 100,000,000.

At current exchange rates, PLN 100 million is approximately €24 million — 2.4 times the NIS2 Directive’s Article 34 ceiling of €10 million for essential entities. Poland is the EU member state that has implemented the highest super-fine for critical-infrastructure-level cybersecurity threats.

Three features distinguish this penalty from the standard tiers:

Immediately enforceable. The two-year moratorium that defers most compliance fines does not apply to the PLN 100M super-fine. A competent authority can impose it from 3 April 2026. There is no transitional protection for this tier.

Outcome-linked trigger, not process-linked. Standard NIS2 fines attach to procedural failures: a missing policy, an incomplete risk register, a skipped audit cycle. The PLN 100M super-fine requires an actual or imminent harmful outcome — a specific violation that directly endangers national security or public safety. This distinction matters: an entity with incomplete documentation but no resulting threat will not face the super-fine. An entity whose gap contributed to a national-security-level incident may face it regardless of how small the entity is.

Not capped at turnover percentage. An SME with modest annual revenues that causes a national-security-level breach can receive the full PLN 100M regardless of financial scale. The percentage-based standard penalties provide a natural ceiling for smaller entities; the super-fine does not.

For comparison, both Germany’s NIS2 enforcement framework and Spain’s NIS2 penalty structure implement ceiling provisions closer to the EU minimum thresholds, without an equivalent super-fine at the PLN 100M level for critical-infrastructure threats.

Daily Fines: How PLN 500 to PLN 100,000 Accumulates

The daily fine mechanism is a coercive enforcement tool, separate from both the base penalty tier and the PLN 100M super-fine. Once a competent authority issues a binding compliance order and the entity fails to comply within the specified deadline, daily charges begin accruing from PLN 500 to PLN 100,000 per day, depending on the gravity of the breach.

In practice, the daily fine mechanism operates as follows:

• An entity ignoring a binding instruction to submit an incident report could face PLN 100,000 per day from the first day of non-compliance.
• A less serious procedural breach — such as failing to provide a requested document within the deadline — might attract PLN 500 per day.
• Daily fines run alongside any base fine; both accumulate simultaneously during the period of non-compliance.

The critical point: the two-year moratorium does not protect against daily fines linked to supervisory orders. A competent authority can issue a binding instruction from 3 April 2026, and if the entity ignores it, daily charges begin immediately. This makes supervisory engagement — not the April 2028 audit — the most immediate near-term financial risk for entities still building their compliance programmes.

The daily fine mechanism mirrors the periodic penalty payment provision in Article 34 of NIS2 Directive 2022/2555, which expressly permits member states to impose periodic charges to compel cessation of violations.

The Moratorium: What It Covers and What It Does Not

The KSC Act’s two-year moratorium is the provision most frequently cited in commentary and the one most often misunderstood in practice. The core protection is genuine: standard administrative fines for operational compliance failures cannot be imposed before 3 April 2028.

What the moratorium covers: Standard administrative fines for operational compliance failures under the KSC Act — missing policies, inadequate risk management processes, incomplete security controls, and similar implementation gaps. These cannot be imposed as financial penalties until 3 April 2028.

What the moratorium does not cover:

Excluded from moratorium	Enforceable from	Basis
PLN 100M super-fine (national-security-level threat)	3 April 2026	KSC Act — explicitly excluded from moratorium
Supervisory measures (inspections, binding instructions, audit orders)	3 April 2026	NIS2 Directive supervisory powers — no moratorium on oversight activity
Daily fines for ignoring regulatory orders	3 April 2026	Coercive enforcement tool linked to binding instructions
Registration failure	3 April 2026	Registration obligations active from entry into force
Incident reporting breaches	3 April 2026	Article 23 notification obligations live immediately

Polish legal commentary is direct about the enforcement consequence: “the moratorium does not cover supervisory measures. Inspectors can knock on your door now.” An authority that identifies a compliance gap during an inspection can issue a binding compliance order — and the entity’s failure to comply with that order generates daily fines immediately, regardless of the moratorium’s protection. See the NIS2 supervisory measures guide for detail on what inspections and binding orders can require of your organisation.

Management Personal Liability: The 300% Rule

NIS2 Directive Article 20 requires member states to hold management bodies accountable for cybersecurity risk management — not merely responsible for delegating it. Poland’s KSC Act gives this requirement financial and professional consequences that apply to individual board members directly.

Personal fines up to 300% of monthly remuneration. Members of the management board or supervisory board can be fined up to 300% of their individual monthly salary for failure to ensure the entity meets its KSC obligations. The calculation uses the individual’s remuneration at the time of the infringement, making this a potentially significant personal exposure for senior executives in well-compensated roles.

Mandatory documented cybersecurity training. Board members must complete cybersecurity training and the completion must be documented. Failure to complete training is independently enforceable — it does not require a separate incident or compliance gap to trigger liability. This applies even where the board has otherwise delegated day-to-day security management to a CISO or Head of IT Security.

The non-delegation principle. The KSC Act places non-delegable obligations on the governing body itself, consistent with NIS2 Directive Article 20’s requirement that management bodies “approve” and “oversee” the entity’s cybersecurity risk management approach. Appointing a security professional does not transfer the board’s legal accountability. The board must approve the risk management framework — it cannot simply receive reports and be absolved of responsibility.

Temporary management ban. In cases of serious or persistent non-compliance, competent authorities can temporarily prohibit an individual from holding management functions. This is a reputational and professional consequence that operates alongside the financial penalty and is not subject to the standard moratorium.

Who Enforces: Poland’s Competent Authority Structure

Poland uses a sector-distributed supervisory model rather than a single national cybersecurity regulator. The authority that has jurisdiction over your organisation depends on your sector — and enforcement intensity, inspection priorities, and sector-specific guidance will differ between them.

Minister of Digital Affairs (Ministerstwo Cyfryzacji) is the primary registration authority. All essential and important entities must submit their application to the Ministry by 3 October 2026. The Ministry maintains the official KSC entity register and has authority to designate high-risk vendors.

Sector-specific competent authorities carry out supervisory activities within their domains:

Sector	Competent authority
Telecommunications and postal services	UKE (Office of Electronic Communications)
Healthcare	Ministry of Health
Transport (road, rail, aviation, maritime)	Ministry of Infrastructure
Energy (electricity, gas, oil, district heating)	Energy Regulatory Office (URE)
Banking and financial market infrastructure	KNF (Financial Supervision Authority)
Digital infrastructure and ICT service management	Ministry of Digital Affairs

Incident response and coordination operates through three national CSIRT teams:

• CSIRT NASK — private sector entities
• CSIRT GOV — public administration entities
• CSIRT MON — defence sector entities

Incidents must be reported through the national incident reporting system to the appropriate CSIRT, in line with the Article 23 notification timeline (24-hour early warning, 72-hour notification, final report). The NIS2 supervisory measures guide covers the full range of powers available to Polish competent authorities, including on-site inspections, document requests, and binding compliance orders.

Compliance Timeline: Key Dates Before Standard Fines Go Live

The KSC enforcement calendar defines a clear four-stage compliance corridor. Each stage carries different enforcement consequences:

Date	Event or obligation	Penalty exposure
3 April 2026	KSC Act enters force. Supervision, inspections, and binding orders all active. PLN 100M super-fine, daily fines, registration obligations, and incident reporting requirements live.	Super-fine + daily fines + registration/incident fines immediately enforceable
3 October 2026	Registration deadline — all in-scope entities must submit their application to the Ministry of Digital Affairs register. Late registration is not moratorium-protected.	Registration failures enforceable immediately
3 April 2027	Full implementation deadline — Chapter 3 obligations (ISMS, risk management, incident handling, supply chain security) must be in place.	Implementation gaps visible to inspectors; still moratorium-protected from standard fines
3 April 2028	First mandatory security audit for essential entities. Moratorium on standard administrative fines expires. Full penalty framework active.	All four tiers of the penalty structure now enforceable

The April 2028 date is simultaneously the point of the first formal audit and the end of the moratorium protection. Organisations without documented compliance programmes at that date face both audit findings and financial penalties at the same time, with no further deferral available. The NIS2 penalties overview sets out the EU-wide enforcement framework that Poland’s structure builds upon.

Does This Apply to Your Organisation?

The KSC Act penalty framework applies where three conditions are met simultaneously:

1. Polish legal establishment. Your organisation is legally established in Poland, or provides regulated services from a Polish establishment. Multinational groups with Polish subsidiaries should assess each legal entity individually — the Polish entity’s obligations apply to it specifically, not to the group as a whole.

2. Covered sector. Your organisation operates in one of the 18 NIS2 sectors: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, space, postal services, waste management, chemicals, food, manufacturing, digital providers, or research.

3. Size threshold or automatic classification.

• Essential entity: 250+ employees OR €50M+ annual turnover OR €43M+ balance sheet total
• Important entity: 50–249 employees AND €10M–€50M annual turnover
• Automatic essential classification regardless of size: banks, financial market infrastructure operators, DNS operators, TLD registries, cloud providers, CDN providers, data centres, trust service providers

If all three conditions apply, the KSC penalty framework is live for your organisation today. Standard operational fines are deferred to April 2028; the PLN 100M super-fine, supervisory inspections, registration obligations, and incident reporting requirements are active now.

Frequently Asked Questions

Does the moratorium mean we do not need to comply until April 2028?
No. The moratorium defers financial penalties for operational compliance failures, not the obligations themselves. The requirement to implement an ISMS, conduct risk assessments, and register with the Ministry applies from April 2026. Non-compliance visible at the April 2028 audit will result in both audit findings and the full penalty framework applying simultaneously.

Can the PLN 100M super-fine apply to an important entity, not just an essential entity?
Yes. The KSC Act applies the PLN 100M super-fine to both essential and important entities where the violation creates a direct and serious threat to national security or public safety. The fine is not limited by entity classification.

Are there criminal penalties in addition to administrative fines?
Poland’s KSC Act primarily uses administrative sanctions. Criminal liability is not a standard feature of the NIS2 transposition framework. However, individual board members may face a temporary management ban as an enforcement measure additional to the financial penalty.

What is the registration deadline?
3 October 2026 — six months from the Act’s entry into force. Late registration is not protected by the moratorium and may attract penalties from the date the deadline was missed.

Can a competent authority inspect our organisation before 2028?
Yes. Supervisory measures including on-site inspections, binding instructions, and audit orders are not subject to the moratorium. Authorities can inspect from April 2026. If a binding order is issued and ignored, daily fines of up to PLN 100,000 per day apply immediately.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Sources

1. Wolf Theiss, NIS2 Implemented in Poland: Is Your Business Ready for the New Cybersecurity Regime?
2. Security.land, Poland’s New Cybersecurity Law: What the KSC Amendment Means for Business
3. Addleshaw Goddard LLP, NIS2 Directive Finally Implemented in Poland: What Businesses Need to Know
4. NIS 2 Directive, Article 34: General Conditions for Imposing Administrative Fines on Essential and Important Entities
5. NIS 2 Directive, Article 36: Penalties