Poland: Delayed Implementation of the NIS2 Directive

3 March 2026

On 19 February 2026, the President Karol Nawrocki signed an amendment to the Act on the National Cybersecurity System (the “Amendment” and the "Cybersecurity Act"). This Amendment is designed to implement the NIS2 Directive and it will come into force on 2 April 2026.

At the same time, the President has referred the Amendment to the Constitutional Tribunal for subsequent review of some of its provisions, including those on high-risk providers, security orders, and administrative penalties. If the Tribunal finds these provisions unconstitutional, they will no longer apply.

 

Download PDF