KSC self-identification step by step. Six steps before 3 October

KSC self-identification is an organisation's own assessment of whether it falls under the Polish national cybersecurity system act, and if so, whether as an essential or an important entity. The amendment implementing the NIS2 directive has been in force since 3 April 2026, and the application to the KSC Register is due by 3 October 2026.

Below are six steps, control questions for each, and the points where organisations most often get it wrong.

Who has to do this, and by when?

The Polish model rests on self-identification: the organisation assesses itself, rather than waiting for an authority to notify it. Self-registration opened on 7 May 2026 and runs until 3 October 2026, for entities that met the criteria on the day the amendment entered into force, 3 April 2026. Some entities were entered ex officio earlier, by 6 May. Once the entry is made, the duties in Chapter 3 start running, with twelve months allowed to implement them.

Step 1: Ex officio entry - has someone done it for us already?

The first step is the cheapest and the most often skipped: checking whether the organisation is already listed.

Control questions: Are we a public body, a telecoms operator or a digital service provider? Did we hold the status of an operator of essential services under the previous act? Has anyone in the organisation actually opened the register at wykaz-ksc.gov.pl?

If the entry already exists, the remaining steps only serve to verify the data - and attention moves to the duties that are already running.

Step 2: Sector - are we in Annex 1 or Annex 2?

The act does not ask about your industry in the everyday sense. It asks about the services listed in the annexes: Annex 1 covers essential entities, Annex 2 important ones.

Control questions: Did we compare the annexes against what we actually do, service by service, rather than against our registered business code? Did we include secondary activity, such as running our own data centre or a digital service for clients? Did anyone check which annex a given service sits in?

The most common mistake here is judging by the main line of business. A manufacturer that runs an online platform for its customers may land in the register through the platform, not through manufacturing.

Step 3: Size - what kind of entity are we under the act?

Size is counted by headcount together with turnover or balance sheet total. A micro enterprise has fewer than 10 employees and up to EUR 2m, a small one fewer than 50 and up to EUR 10m, a medium one fewer than 250 with turnover up to EUR 50m or a balance sheet total up to EUR 43m. Above those thresholds the entity is large.

Control questions: Are we using the correct financial year? Did we account for linked and partner enterprises? Do we know that the threshold settles nothing on its own, because telecoms operators are covered regardless of size?

Answering "we are too small" without checking the exceptions is the most expensive shortcut in this entire procedure.

Step 4: Article 5 conditions - essential or important?

Sector and size are only the input. Article 5 is what combines them and settles the status.

Control questions: Did we work through Article 5 point by point, writing down the reasoning for each? Would the conclusion hold up in front of an outsider? Is anyone in the organisation formally accountable for this assessment? Did we record the date and the basis, so the reasoning can be reconstructed later?

An assessment with no written reasoning is useless the first time someone asks why you concluded you were not covered.

Step 5: The application - how do you file it?

The KSC Register is kept within the S46 system but works as a separate web application at wykaz-ksc.gov.pl. Applications for entry, amendment and removal are filed electronically.

Control questions: Does the person filing hold an electronic signature and the authority to represent the entity? Are the registration and contact details current? Do we know who will maintain those details after the organisation changes? Did we leave ourselves a buffer for a technical problem?

A missing electronic signature on the authorised person's side can hold the whole process up for days - and 3 October is a deadline, not a suggestion.

Step 6: The plan after entry - what starts running now?

The entry does not close the matter, it opens it. From the moment the entity is covered, the act allows twelve months to implement the duties in Chapter 3, so until 3 April 2027 for entities covered on the day it entered into force. Essential entities have twenty-four months to their first audit.

After this step the organisation should hold:

• the Article 5 assessment in writing, with its date and reasoning;
• confirmation of the KSC Register entry, whether filed or ex officio;
• a named person accountable for cybersecurity;
• a schedule of duties mapped onto twelve months;
• an incident reporting procedure with the 24-hour, 72-hour and 30-day deadlines;
• a training plan, separately for staff and for management.

That last item tends to surprise people: the directive requires training from management bodies too, not only from the IT team.

On your own, or with a tool?

The six steps above can be taken unaided - the annexes are public and the register opens in a browser. The difficulty starts after the entry, because the Chapter 3 duties are not a one-off task but documentation, training and records maintained for years.

That part is what Cyber TrustCERT handles: training for staff and management with an exam, policy and procedure templates, and reporting that lets you show the duties are being met. If you do not know where to start, the Cyber Ready Check gives a preliminary reading in a few minutes - the result is computed in your browser and stored nowhere.

Summary

KSC self-identification comes down to six questions: has someone entered us ex officio, are our services in Annex 1 or 2, what size of entity are we, what follows from that under Article 5, how do we file the application, and what starts running once the entry is made.

The deadline is 3 October 2026. An organisation that takes these steps now trades uncertainty for a list of dated tasks. An organisation that puts it off starts by catching up on a deadline that has already passed.

This text walks through the procedure but does not settle the status of any particular organisation - the organisation does that itself, and where there is doubt the assessment is worth confirming with a lawyer.

✦ This article was written with the help of artificial intelligence and reviewed before publication by the author, who takes editorial responsibility for it.