Self-registration – a new obligation for companies. They have to determine for themselves whether it applies to them or not

KSC List is an application that is part of the S46 System, which maintains a list of key entities and entities important to the Polish economy. The system is scheduled to launch on June 12.

“If you run a business in the sector covered by the Act on the National Cybersecurity System and your organization meets the criteria for being recognized as a key entity or an important entity, you are obliged to submit an application for entry to the list by October 3, 2026,” informs the government. The company will also need to implement an information security management system, regularly assessing and managing the risk of incidents. The new responsibilities also include implementing technical and organizational measures proportional to the assessed risk, as well as sharing information with other companies on the KSC List.

The deadline to adapt to the new regulations is April 3, 2027. Entrepreneurs will be subject to financial penalties for failing to meet the new obligations, which may be imposed from April 3, 2028.

Who exactly does the KSC List apply to? Almost everyone

The obligation applies, among others, to: sectors of ICT (ICT) service management, sewage disposal, food production and distribution, but not only. There are still key sub-sectors.

The Ministry of Digitization has some advice for Polish companies. First, the company must verify whether its activities fall within the sectors or subsectors covered by the amendment. In Annex 1 of the amendment to the KSC Act, the key sectors include: energy, transport, health care, banking and financial market infrastructure, drinking water supply and distribution, collective sewage disposal, digital infrastructure and space.

Annex number 2 supplements the knowledge with postal services, nuclear energy investments, waste management, production, production and distribution of chemicals, production, production and distribution of food, provision of digital services and scientific research. Important sector entities also include companies that produce e.g. medical devices, computers, electronic products and optical electrical devices, motor vehicles, trailers and semi-trailers, and other transport equipment.

How to complete the S46 System form?

The size of the company and the status of an affiliated and partner enterprise are also important for the Ministry of Digital Affairs. For micro-enterprises, the thresholds are: less than 10 employees and a maximum of EUR 2 million in annual turnover or annual balance sheet total.

The thresholds for small companies are fewer than 50 employees and a maximum of €10 million in annual turnover or annual balance sheet total. For medium-sized enterprises – less than 250 employees and a maximum of EUR 50 million in annual turnover or EUR 43 million in annual balance sheet total. Large companies, however, are those that exceed the above-mentioned thresholds.

The next step is to create an account in the KSC List and submit an application for entry. After entering the dedicated website, click the “Log in with login.gov.pl” button. The next step is to select a login method, authenticate and sign. The form consists of several sections and you need to enter, among others: entity identification data, including NIP, REGON and name, address and contact details. If the message “Approved” appears in the “List of applications” tab, it means that the entry has been made.