Where do you start when NIS2 applies to you for the first time? Start from establishing whether you are in scope at all and as what – an essential or important entity – then from completing the registration obligation and implementing risk-management measures. NIS2 is a directive transposed into each member state’s national law; in Poland the requirements arrive through the amended National Cybersecurity System Act (KSC), in force since 3 Apr 2026. This list orders the first actions and the typical mistakes.
Canonical definition: NIS2 is EU Directive 2022/2555 raising the common level of cybersecurity in the Union, imposing on essential and important entities obligations for risk management, incident reporting and management liability; transposed into national law by each member state.
This article is for an organisation meeting NIS2 for the first time: it distils implementation into five starting actions and five mistakes that most often cost time or expose you to penalties.
how to prepare for NIS2 – key takeaways:
- NIS2 (EU Directive 2022/2555) is transposed into national law by each member state; in Poland it applies through the amended KSC Act, in force since 3 Apr 2026 – over 17 months after the EU transposition deadline (17 Oct 2024).
- The Polish amendment expands scope from around 400 to around 42,000 entities, dividing them into essential and important.
- The first step is self-identification: establishing whether you are in scope and as what, and completing entry into the entity register – for most entities the deadline is 3 Oct 2026.
- NIS2 requires implementing risk-management measures, reporting incidents on hard deadlines and securing the supply chain.
- Penalties for essential entities reach EUR 10 million or 2% of annual turnover, with personal liability of management.
- Patronusec supports essential and important entities in implementing NIS2 – from classification and gap analysis to implementing measures and maintaining compliance.
Table of Contents
Why is establishing whether and as what you are in scope the first step?
Self-identification is the first step, because everything else depends on it: whether you have obligations at all, how strict, which deadlines and which supervisory regime. NIS2 does not arrive with a “you are covered” list – the obligation rests on the entity to check whether it meets the criteria and to register.
In the Polish model three criteria decide: sector (the Act names essential and important sectors), size (usually a threshold of at least 50 employees or annual turnover above EUR 10 million, though for some categories, such as managed security service providers, the threshold is lower) and membership of one of the categories named in the annexes. An essential entity faces stricter obligations and supervision than an important entity, though the baseline measures are similar.
The scale of change is fundamental. The earlier KSC Act covered around 400 entities – mainly critical infrastructure operators. After the amendment, around 42,000 Polish firms came into scope, mostly medium and large ones that had not treated cybersecurity as a distinct legal obligation. Many still do not know they are covered.
The most common mistake on first contact with NIS2 is the silent assumption “this is not about us” – yet under the amended KSC Act the obligation to check and register rests on the entity, and failing to do so is itself a breach.
Top 5 things to do first
The five tasks below set the right order for starting with NIS2. The common denominator: first establish status and complete the formal obligations, and in parallel build genuine security measures.
Establish whether you are in scope and as what. Check the sector, size and membership of the annex categories. Determine whether you are an essential entity, an important one, or outside scope entirely. This determines all further obligations.
Complete the register entry. If you are in scope, submit an application for entry into the register of essential and important entities within the required deadline – for most entities that met the criteria on the day the Act entered into force, that deadline falls on 3 Oct 2026. Registration is done electronically.
Run a gap analysis against the risk-management measures. Compare the current state with the required measures: security policies, incident handling, business continuity, supply chain security, cryptography, access control and cyber hygiene. This shows how much work separates you from compliance.
Implement risk-management measures and involve management. NIS2 requires implementing proportionate measures and – crucially – the involvement and accountability of management. Management approves the measures and is responsible for their implementation, including personally.
Establish an incident reporting process. Build the capability to detect and report major incidents on NIS2’s hard deadlines: an early warning, a notification and a final report. Without a working process the deadlines are impossible to meet.
Top 5 things to avoid
The five mistakes below most often expose an entity to penalties or block NIS2 compliance. The common denominator: treating NIS2 as a formality or deferring actions whose deadlines are already running.
❌ Assuming “this is not about us”. After scope expanded to around 42,000 entities, many firms are in scope without knowing it. The obligation to check rests on the entity – and failing to do so is a breach, not neutral silence.
❌ Deferring the register entry. Deadlines are already running: for most entities registration falls due on 3 Oct 2026. Delay exposes you to breaching the registration obligation regardless of the state of your security measures.
❌ Treating NIS2 as a purely IT project. NIS2 places accountability on management, including personally. Dumping the whole thing on the IT department without board involvement misses the essence of the regime and leaves management unaware of its own liability.
❌ Overlooking the supply chain. NIS2 expressly requires managing supply chain security. Limiting measures to your own systems, without assessing providers, leaves a gap the regime considers material.
❌ Copying policies without genuine implementation. NIS2 measures must work, not just exist in a document. A set of downloaded policies without implementation and evidence of effectiveness will not pass supervision – as in other regimes, practice matters, not paper.
Patronusec Insight: In our project experience, after the amended KSC Act entered into force the biggest problem is not implementing measures but the very awareness that an entity is in scope at all. Medium-sized firms in sectors that were not previously regulated often learn of the obligation by accident – from a customer, an auditor or the media – when deadlines are already running. We recommend starting from one concrete action: a thorough check of status against the sectors and thresholds in the annexes. That hour of analysis decides whether we are even talking about obligations, and protects against the costliest mistake – missing that the regime covers you.
How to combine these actions into a coherent implementation plan?
A coherent NIS2 implementation plan combines the formal layer (self-identification, registration) with the genuine layer (measures, incidents, supply chain), then moves into a maintenance cycle. The formalities have hard deadlines, so they run in parallel with building measures, not after them.
The recommended sequence:
- Status and register. Self-identification (sector, size, category), the classification decision, register entry within the deadline.
- Gap analysis. Comparing the current state with the required risk-management measures.
- Implementing measures and governance. Implementing proportionate measures with the involvement and accountability of management.
- Incidents and supply chain. A reporting process on NIS2 deadlines and managing provider security.
- Maintenance. NIS2 is a continuous obligation: updating measures, reporting, readiness for supervision (for essential entities – proactive supervision).
Running the formalities and measures in parallel is key. The register entry has a hard deadline and does not wait for security implementation to finish – both streams run at once. A plan that first completes the formalities and leaves the measures for later (or vice versa) risks either breaching the registration deadline or lacking genuine safeguards in an inspection.
Patronusec supports entities in building such a plan within its NIS2 service – from classification and gap analysis, through implementing measures, to readiness for supervision.
FAQ – How to prepare for NIS2
How do I know whether I am in scope of NIS2?
Check three criteria: sector (whether you are in an essential or important sector from the KSC Act annexes), size (usually a threshold of at least 50 employees or turnover above EUR 10 million, lower for some categories) and membership of the named categories. The obligation to check rests on the entity – it is worth starting from a thorough status analysis.
When did NIS2 requirements start applying in Poland?
The amendment to the National Cybersecurity System Act (KSC), transposing NIS2, entered into force on 3 Apr 2026 – over 17 months after the EU transposition deadline (17 Oct 2024). From that moment the deadlines for registration and implementing obligations began to run.
By when must I complete the register entry?
For most entities that met the criteria on the day the amendment entered into force, the deadline to apply for entry into the register of essential and important entities falls on 3 Oct 2026. Registration is done electronically. It is worth confirming your specific deadline, as it runs from the day the criteria are met.
How does an essential entity differ from an important one?
An essential entity is usually a large firm or a critical infrastructure operator in a top-priority sector – it faces stricter obligations and supervision, including proactive supervision. An important entity is usually a medium-sized firm in a covered sector – the baseline measures are similar, but the scope of supervision and penalties is milder. Classification depends on sector and scale.
How high are the penalties for NIS2 non-compliance?
For essential entities, penalties reach EUR 10 million or 2% of annual turnover (whichever is higher). In addition, NIS2 provides for personal liability of management. This is a fundamental change to the liability model – cybersecurity ceases to be solely an IT matter and becomes a board obligation.
How does Patronusec help implement NIS2?
We start with classification (whether and as what you are in scope) and a gap analysis against the risk-management measures. We then support implementing proportionate measures, the incident reporting process and supply chain management, with management involvement. After a free scope-assessment call we present an implementation plan and a quote.
Recommended reading
A reading path for NIS2 implementation:
- How to choose a NIS2 security audit firm – what to look for when choosing an audit partner.
- DORA – 5 things to do and 5 to avoid – a related regime for the financial sector.
- A business continuity plan in 5 steps – business continuity as one of the NIS2 measures.
- Incident Response, Disaster Recovery, Business Continuity and IT Continuity – how they differ – concepts key to incident handling.
NIS2 – free consultation
Patronusec supports essential and important entities in implementing NIS2 – from classification and registration, through gap analysis and implementing measures, to readiness for supervision. Book a free consultation to establish your status and the order of actions.
Book a consultation | NIS2 | DORA | BCM
