NIS2 for healthcare providers in Poland: KSC obligations
NIS2 for healthcare providers in Poland: the KSC Act now covers them. We explain who is an essential or important entity, the deadlines and first steps.
Since 3 April 2026, an amended version of the Polish National Cybersecurity System Act (KSC), which implements the EU NIS2 Directive, has been in force. Healthcare providers (podmioty lecznicze, as defined in Polish law) are listed in Annex 1 to the Act (the “healthcare” sector). Whether a healthcare provider is an important or essential entity depends mainly on its size. For companies, headcount counts, but so do annual turnover and the balance sheet total. For independent public healthcare institutions (SP ZOZ) and other providers that are not businesses, headcount alone counts. Some entities are covered by the Act regardless of size.
Such an entity applies for entry in the register of essential and important entities. According to an announcement by the Ministry of Digital Affairs (in Polish), existing entities had until 3 October 2026 to do so. By 3 April 2027, the entity must implement an information security management system. From that date at the latest, it also reports significant incidents, without undue delay and within 24 and 72 hours of detection.
Essential entities must carry out their first audit by 3 April 2028.
This article focuses on what changes for hospitals and clinics. For businesses in other sectors, see the cybersecurity and KSC Act page of Conetso Group, the business IT brand of the same company (CONETSO GROUP Sp. z o.o.).
Legal basis
- Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts (Journal of Laws 2026, item 252), text in ISAP, the Polish legislation database (in Polish). It entered into force on 3 April 2026.
- Act of 5 July 2018 on the National Cybersecurity System (Journal of Laws 2026, item 20), as amended. The article numbers in this text refer to this Act. Where we cite an article “of the amending act”, we mean the transitional provisions of the amending act.
- Information and timetable from the Ministry of Digital Affairs: The amended KSC Act enters into force and self-registration in the register (both in Polish).
Is your hospital or clinic covered by the KSC Act?
The Act distinguishes between healthcare providers that are businesses (for example, companies running clinics) and those that are not (for example, independent public healthcare institutions).
In the same sector, the Act also lists healthcare service providers that run a hospital emergency department (SOR) or a trauma centre. It also lists subcontractors of essential and important entities in healthcare. The status of such an entity depends on its specific situation.
| Healthcare provider | Important entity | Essential entity |
|---|---|---|
| not a business (Art. 5(8)) | employs 50 to 249 people | employs at least 250 people |
| a business (Art. 5(1)(1) and Art. 5(2)(1)) | is a medium-sized enterprise under Annex I to Commission Regulation (EU) No 651/2014: employs at least 50 people or has an annual turnover and a balance sheet total above EUR 10 million | exceeds the medium-sized enterprise criteria: employs at least 250 people or has an annual turnover above EUR 50 million and a balance sheet total above EUR 43 million |
A company with fewer than 50 employees can therefore be an important entity if its turnover and balance sheet total are high enough. If your company is close to the threshold, work it out with your accountant. The Act requires size to be assessed as at the date on which the financial statements are drawn up (Art. 5(5)).
Linked and partner enterprises also count, because a corporate group can raise the size of an entity. There is an exception for an entity that reaches the thresholds only because of the group’s data. If its systems are independent of the group’s systems, or it does not provide services jointly with the group, it is not an essential or important entity (Art. 5(6) and (7)).
If a clinic or hospital is a company owned by a municipality, county or province, its actual size counts. Here the Act disapplies the rule under which a company controlled by a public body is not a small or medium-sized enterprise (Art. 5(3)).
When calculating size, questions arise whose answers depend on the situation of the specific entity. These include doctors who work on civil-law contracts rather than as employees, converting headcount into annual work units, and exceeding the thresholds in only one financial year. If your hospital or clinic is close to the thresholds, write to us. We will help you gather the data needed for this assessment.
Regardless of size, a critical entity is an essential entity (Art. 5(1)(4)(c)). A healthcare provider can also become an essential entity if the competent cybersecurity authority designates it as such by decision (Art. 7l(2)(1)). Such a decision may be made, for example, where a disruption of the entity’s services would seriously threaten public health. It may also be made where its service is of significant importance at the regional or national level (Art. 7l(1)(2)(b) and (d)). An entity designated by decision has 12 months to meet its obligations and 24 months for its first audit, counting from service of the decision (Art. 7l(7)).
A small clinic that does not meet these thresholds, is not a critical entity and has not been designated by decision has no obligations under the KSC Act. It still processes special categories of data, however. Most of the measures in the Act are simply good practice, which the GDPR and the medical records regulations also expect.
Deadlines for healthcare providers
| Deadline | Obligation |
|---|---|
| 7 May to 3 October 2026 | Application for entry in the register of essential and important entities. We give the dates and the self-registration address (wykaz-ksc.gov.pl) based on the announcement by the Ministry of Digital Affairs (in Polish) |
| by 3 April 2027 | Meeting the obligations under Chapter 3 of the Act, including the information security management system and incident handling and reporting |
| by 3 April 2028 | First security audit in essential entities; subsequent audits at least every 3 years |
| after 3 April 2028 | Most administrative penalties under the Act can be imposed only from two years after the amendment entered into force |
The register for the healthcare sector is kept by the competent cybersecurity authority, which is the minister responsible for health (Art. 7(4)). The application is submitted through an ICT system maintained by the minister responsible for digital affairs (Art. 7(6) and Art. 7c(6)). The entry is made when the application is submitted (Art. 7d(1)).
If you meet the criteria and the application was not submitted by 3 October 2026, submit it as soon as possible and consult a lawyer about your situation. The authority may also enter an entity in the register of its own motion (Art. 7j).
A healthcare provider that meets the criteria later (for example, an SP ZOZ that starts employing 50 people) has 6 months to apply for entry (Art. 7c(1)). It has 12 months to implement the obligations, and an essential entity has 24 months for its first audit (Art. 16). These periods run from the date the criteria are met.
What must a healthcare provider implement by April 2027?
The most important obligation is an information security management system (Art. 8). The Act lists its elements in some detail. In a hospital or clinic they translate into, among other things:
- systematic incident risk assessment and risk management, starting with identifying which systems are essential for seeing patients: the practice management or hospital system, PACS (picture archiving and communication system), the laboratory, the connection to P1 (Poland’s national e-health platform) and telephony
- asset management: an up-to-date list of servers, workstations, network devices and equipment connected to the network
- access control and multi-factor authentication, especially for remote access by reporting physicians, equipment manufacturers and service companies
- business continuity: backups, a system recovery plan and a procedure for working when the medical system is down
- continuous monitoring of the information system used to provide services
- software updates in line with the manufacturer’s recommendations, including on the workstations attached to medical equipment, which are often forgotten
- supply chain security, meaning the assessment of hardware and software suppliers, including the medical system vendor and the IT service company
- cyber hygiene training for staff
There are also organisational obligations:
- The head of the entity is responsible for meeting the obligations: the management board in a company, the director in an SP ZOZ (Art. 2(8a)). The head remains responsible even after entrusting the obligations to another person (Art. 8c(3)). If the management board does not designate a responsible person, all its members are responsible (Art. 8c(2)). The head and the person to whom the obligations have been entrusted complete training once every calendar year (Art. 8e).
- The entity sets up internal structures responsible for cybersecurity or concludes a contract with a managed security service provider (Art. 14).
- Every person who is to perform tasks under Art. 8 or Art. 11 must, before starting work, present information from the National Criminal Register confirming that they have not been convicted of offences against the protection of information (Art. 8f(1)). The Act does not distinguish between an employee of the entity and a supplier’s staff member.
- The entity designates at least two persons to contact the bodies of the national cybersecurity system. It also gives patients information about cyber threats and a way to report an incident (Art. 9).
- You report a significant incident to the competent CSIRT (computer security incident response team). You submit an early warning without undue delay and no later than 24 hours after detection. You submit the incident notification without undue delay and no later than 72 hours after detection. You send the final report within one month of the notification (Art. 11(1)). If incident handling takes longer, you submit a progress report and the final report within one month of completing the handling (Art. 12b). If an incident makes it harder to see patients, they must be informed (Art. 11(2b)).
- Ultimately, reports will be received by a sectoral CSIRT, which the competent authority establishes by 3 October 2027. Until it is announced that this team has reached operational capability, reports go to the competent CSIRT MON, CSIRT NASK or CSIRT GOV, Poland’s three national CSIRTs (Arts 42 and 44 of the amending act). The competent team is shown in the entity’s entry in the register (Art. 7(2)(21) and (22)).
Where we start preparing for the KSC Act
When a clinic or hospital asks us for help, we start with the technical side, because it takes the most time:
- Inventory and network map: what is connected, where patient data is kept and which devices have internet access.
- A review of network segmentation. We check whether medical equipment, staff workstations, guests and servers are in separate zones. We describe how we do this in our article Network segmentation in a clinic. We design networks for hospitals and clinics as part of our network infrastructure services.
- A review of backups. We check whether there is an off-site copy that is resistant to ransomware (malware that encrypts data for a ransom), and whether anyone has ever tested a restore. More in our article on backups in hospitals and clinics.
- Remote access: a list of accounts, multi-factor authentication and disabling unused connections.
- A list of suppliers and what they have access to. This is the basis for assessing the supply chain.
- A plan for when the system is down: how reception and doctors work when the medical system is unavailable, and who decides.
On this basis, the documentation part is prepared: policies, the risk analysis and incident reporting procedures. This list does not guarantee compliance with the Act, but it gives you an organised picture on which to build an information security management system.
Frequently asked questions
Does the KSC Act replace the GDPR?
No. The obligations under the KSC Act concern the security of the information systems a healthcare provider uses to provide its services. The GDPR concerns personal data. In practice, many measures serve both purposes. Reporting an incident to a CSIRT does not, however, replace notifying a personal data breach to the President of the Personal Data Protection Office (UODO).
Can an IT company take over responsibility for the KSC Act?
It can perform the tasks, but the head of the entity remains responsible. The Act says so explicitly (Art. 8c(3)).
Should a small clinic do anything?
Yes, even though the Act does not cover it. Ransomware does not check headcount. Backups, updates and multi-factor authentication are worth having regardless of the thresholds.
If you want to check how far your team has got with its preparations, see our IT services for hospitals and clinics or contact us. We will start with a review of your infrastructure and a list of what needs to be done before April 2027.
Legal status as of 8 November 2026.
