Do you run an energy, manufacturing or logistics company, or operate in the digital services sector?
If so, there is a good chance you have just one month left to make a decision that could seriously affect the legal position of your entire business. And you personally, as a member of the management board.
This is about classification and filing with the register of essential and important entities under the National Cybersecurity System Act (UKSC), which implements the NIS 2 Directive. The deadline is 3 October 2026, and it may affect more than 40,000 Polish businesses.
Classification challenges
The UKSC requires businesses to assess their own regulatory status. This means that no one will carry out this assessment, or any subsequent filing, on your behalf.
The size- and sector-related criteria may seem straightforward to assess. However, experience shows that companies continue to face practical challenges.
Doubts arising during the self-assessment process can lead to uncertainty as to whether a business is subject to the regulation at all, creating significant regulatory risk for companies and their management.
Registration – what exactly you need to do before 3 October
Filing with the register is a technical process that requires careful preparation, including gathering relevant information and making key operational decisions.
Management board responsibility – the aspect most discover too late
It is important to bear in mind that the UKSC does not allow the matter of filing with the register or ensuring the organisation’s compliance to be delegated solely to the IT department. This means that the management board bears personal responsibility for classification, proper registration and ongoing compliance with the UKSC.
Remember that failure to register on time may result in an administrative fine of up to EUR 10 million or 2% of total annual worldwide turnover for entities classified as essential, or up to EUR 7 million or 1.4% for entities classified as important. In addition, individual penalties of up to 300% of remuneration may be imposed on members of the management board.
What comes after registration?
The deadline for full compliance with the UKSC is 3 April 2027. Classification and filing with the register is a necessary first step, but not the only one on the path to regulatory compliance. Above all, the regulations require the implementation of an operationally effective information security management system.
Join us for an event focused on what matters most before 3 October
What will you take away from this event?
Participants will learn:
- How to take a rational approach to assessing your company’s regulatory status, with real-life examples from project experience
- What to look out for during registration and what mistakes to avoid, as well as what to prepare before starting the filing process
- How to understand the personal accountability of the management board and what minimum evidentiary record should be in place in case of an inspection
- What support Kochański & Partners can offer – from entity classification and legal opinions, to compliance audits and full implementation and training for the management board
Speakers
Mateusz Dominik, Partner, NewTech / GDPR and Cybersecurity
Natalia Kotłowska-Wochna, Partner, New Tech
Who is this event for?
This event is aimed at board members, chief operating officers, in-house lawyers and compliance and IT professionals from companies operating in sectors regulated by the UKSC, in particular the energy, manufacturing, digital services, postal and courier sectors, as well as waste management and food production companies.
This will be an intensive and highly practical session, with an agenda tailored to the real challenges businesses face, led by experts who handle classification and implementation processes on a daily basis.
***
Attendance is free of charge and subject to registration and acceptance of the application. The organiser reserves the right to select applications and to cancel the event.
This is a hybrid event: participants may attend in person or online.
In person: Kochański & Partners offices, Plac Piłsudskiego 1. Places are limited and allocated on a first-come, first-served basis.
The online streaming link will be sent to participants the day before the event.