Two categories of entities on which the National Cybersecurity System Act imposes obligations; which category an entity falls into depends on its sector and size.
They are defined in Article 5(1) and (2) of the National Cybersecurity System Act, which lists types of entities by sector and size.1
Sources
- Sejm of the Republic of Poland, Act on the national cybersecurity system, consolidated text, Journal of Laws 2026, item 20, as amended (consolidated text prepared by the Chancellery of the Sejm) (in Polish)
Checked: 3 November 2026