EdLaw
Poland — Ustawa o krajowym systemie cyberbezpieczeństwa (KSC)
The Act of 5 July 2018 establishing Poland's national cybersecurity system, comprehensively rewritten by the Act of 23 January 2026 (Dz.U. 2026 poz. 252) transposing NIS2. Curated here is the personal scope after that rewrite: who is a podmiot kluczowy (essential entity) or podmiot ważny (important entity), and the public-sector annex row.
Fact text is Polish (authentic language); this README is curation.
Applicability to EdTech
- Schools are expressly out of scope: in the "Podmioty publiczne" sector of załącznik nr 1, local-government coverage excludes "jednostek organizacyjnych, o których mowa w art. 2 ustawy z dnia 14 grudnia 2016 r. – Prawo oświatowe […], oraz ich zespołów" (schools and their complexes); at powiat level only the starostwo is covered, and at gmina level only the urząd gminy with ≥50 FTE (Załącznik nr 1 — Podmioty publiczne). A Polish school is therefore not a KSC-regulated entity.
- The vendor side is where KSC bites: cloud-computing providers, data-centre services, CDNs and trust services sit in załącznik nr 1 (digital infrastructure) — an entity above the medium-enterprise thresholds of Regulation 651/2014 is a podmiot kluczowy (art. 5 ust. 1 pkt 1); at medium size it is a podmiot ważny (art. 5 ust. 2 pkt 1); DNS providers, TLD registries and domain registrars are covered regardless of size (art. 5 ust. 1 pkt 4).
- Extraterritorial reach: entities without an EU establishment offering services in Poland fall under the Polish authority once they designate a representative (art. 5 ust. 9); public entities are covered wherever seated (ust. 10).
- The EU-level substance is in NIS2 — the KSC supplies Poland's entity classification, supervision and CSIRT structure.
Contents
| Document | Covers |
|---|---|
| ZAKRES-PODMIOTOWY.md | KSC art. 5 (podmioty kluczowe i ważne) + załącznik nr 1, sektor "Podmioty publiczne" |
Scope note: obligations (risk management, incident reporting, registration), supervision and fines are further chapters of the rewritten act — add them when a Poland deployment question needs that level.
Enforcement
Organy właściwe do spraw cyberbezpieczeństwa (sector ministers) with CSIRT NASK / CSIRT GOV / CSIRT MON at national level.
Licence
The corpus reproduces selected articles of the ustawa o krajowym systemie cyberbezpieczeństwa, with the Kancelaria Sejmu's footnotes (odnośniki), from the Kancelaria Sejmu tekst ujednolicony, served by the Sejm ELI API.
Polish copyright law places normative acts and official materials outside copyright. Art. 4 ustawy o prawie autorskim i prawach pokrewnych (ISAP — tekst jednolity Dz.U. 2025 poz. 24, read 2026-10-01 in the official PDF served by the Sejm ELI API) provides: "Nie stanowią przedmiotu prawa autorskiego: 1) akty normatywne lub ich urzędowe projekty; 2) urzędowe dokumenty, materiały, znaki i symbole;"
Conditions: none attach to the statute text, because no copyright subsists in it. The corpus still identifies its source: each fact document names its source in its opening citation line and in its Meta section, and Sources here links the official text (ISAP and the Sejm ELI API). The changes (the selection of provisions, the Markdown layout and the added anchors) are described in Meta. The corpus does not claim that the publisher endorses it, and only the officially promulgated text is authentic. The tekst ujednolicony and its footnotes are prepared by the Kancelaria Sejmu, an official document within art. 4 pkt 2.
Related
- EU NIS2 — the transposed directive
- UODO — the 2026 KSC amendment also redirected 50% of certain GDPR fines to the Cybersecurity Fund (UODO art. 104, not extracted)