Companies covered by Poland's NIS2 cybersecurity law have until 3 October 2026 to self-assess and register in the government's S46 system, with fines up to EUR 10 million for getting it wrong.

The amended Act on the National Cybersecurity System took effect on 3 April 2026 and pulled in a wide new set of sectors, energy and renewables among the first, alongside manufacturing, chemicals, food production and waste management. Every entity meeting the size and sector criteria has a six-month window from that date to decide whether it counts as a key or important entity and register through the S46 portal. Skipping the self-assessment is itself a violation, separate from the security work that follows, and critical entities face fines up to EUR 10 million or 2% of global turnover.