Poland: Announced Amendment to the National Cybersecurity System Act

On 7 October 2024, the Poland Ministry of Digital Affairs published an announcement on the Amendment to the Act on the National Cybersecurity System after conducting a public consultation from 24 April to 24 May 2024. The Act would emphasise the integration of the NIS 2 Directive and the implementation of the 5G Cybersecurity Toolbox to ensure compliance with EU standards and to enhance Poland's digital security resilience. The Ministry of Digital Affairs aims to improve supervision over critical entities such as banks, telecom companies, and the energy sector. The Act would introduce a central supervisory authority to improve cooperation and response to cyber threats. In addition, it would include ad hoc inspections and introduce revised penalties based on the severity and duration of violations. Furthermore, amendments include a redefinition of managed service providers, increased reporting times for telecom companies from 12 to 24 hours, and elimination of fines for non-compliance with certain warnings. The cycle of regular audits for critical entities has been extended from every two to three years. Moreover, the amendments offer the possibility of appealing supervisory measures to administrative courts, ensuring that no further action is taken until the court issues a ruling. The revised Act will be reviewed by the Council of Ministers and relevant parliamentary committees, with the goal of submitting it to the Sejm for further legislative proceedings by the end of the year.