ITER/PLPoland
What the record establishes for Poland: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Urząd Ochrony Danych Osobowych reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | CSIRT NASK, and the competent sectoral CSIRT for the entity's sector provisional | The amended act owes each stage of a serious-incident notification to the competent sectoral CSIRT. The Ministry's announcement of the bill said reports would reach the CSIRT teams through the S46 system; the provisions read name the system of article 46(1) for the register and for service, and no address is recorded here | pl dz u 2026 252 · pl mc ksc nowelizacja |
| Financial supervisorDORA, article 19 | Komisja Nadzoru Finansowego reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Komisja Nadzoru Finansowego (KNF) reported | — | esma mar nca |
Transposition of NIS2 binding
| Act | Ustawa z dnia 23 stycznia 2026 r. o zmianie ustawy o krajowym systemie cyberbezpieczeństwa oraz niektórych innych ustaw, Dz.U. 2026 poz. 252 |
|---|---|
| In force | 3 April 2026, one month after promulgation in the Dziennik Ustaw on 2 March 2026, by article 49 |
| Recipient | csirt |
| Moves a term | Yes. In two places. The anchor is detection. The amended article 11 owes the early warning «niezwłocznie, nie później niż w ciągu 24 godzin od momentu jego wykrycia» and the notification «nie później niż w ciągu 72 godzin od momentu jego wykrycia», where the Directive runs both from having become aware. The final report is owed «nie później niż w ciągu miesiąca od dnia zgłoszenia», from the day of the notification, which is the Directive's own anchor for that stage. The recipient is sectoral. Each of the three is owed «do właściwego CSIRT sektorowego», the competent sectoral CSIRT, and not to a single national team |
| Standing | Read in the act as promulgated in the Dziennik Ustaw. The date of entry into force is computed from article 49 and the promulgation date, a month counted the way Polish law counts one. The act names the system of its article 46(1) for the register of entities and for service of documents; whether serious-incident notifications go through the same system is not stated in the provisions read. The recipient is resolved in the authorities table to the national CSIRT, with the sectoral routing and the channel noted there |
| Source | pl dz u 2026 252 |
An event in Poland
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.