NIS2 penalties in Poland: up to EUR 10 million for companies, fines for board members and deadlines

The Act distinguishes two groups of companies subject to obligations: essential entities and important entities. Typically, an essential entity is a large enterprise in a sector listed in Annex 1 to the Act. An important entity is a medium-sized enterprise from Annex 1, or a medium-sized or large one from Annex 2. Both groups have the same risk management obligations, but they differ in the level of penalties and the way they are supervised.

The euro amount is converted into zloty at the average National Bank of Poland (NBP) exchange rate of 31 December of the year preceding the decision. The percentage is calculated from the company’s business revenue in the previous financial year. We have summarised the main differences in the table below.

The formula “a fixed amount or a percentage of revenue” is often misleading. Take a hypothetical manufacturing company with revenue of PLN 100 million that is an essential entity. 2% of its revenue is PLN 2 million, while EUR 10 million is about PLN 42 million at an assumed exchange rate of PLN 4.20. The upper limit of the penalty is therefore the higher amount, i.e. EUR 10 million.

The percentage of revenue only becomes decisive with revenue above EUR 500 million – for both essential and important entities. For a typical mid-sized company, the maximum is therefore the fixed amount, not the percentage of revenue.

The maximum is, however, a ceiling, not a standard rate. The authority sets the amount of the penalty according to the criteria in Article 53(12) and takes the company’s financial capacity into account. We list the most important criteria below.

The Act expressly provides for a financial penalty for the head of an essential or important entity. The head is the head of the entity within the meaning of the Accounting Act – in a limited liability or joint-stock company, this is the management board. The fine can be up to 300% of the penalised person’s remuneration, calculated in the same way as pay in lieu of unused holiday. In public entities, the limit is 100%.

The authority can impose it when the management board fails to fulfil its obligations under the Act and the duration, scope or nature of the infringement justify it. A fine for a board member can be imposed independently of the penalty for the company.

The rule in Article 8c is important. If the management board has several members and has not appointed a person responsible for cybersecurity, all its members are liable. Delegating tasks to the IT director or an external firm does not relieve the management board of liability. Fines may be imposed for, among other things, the failures listed below.

A financial penalty is only one of the tools available. The authority competent for cybersecurity is usually the minister responsible for the sector concerned. For manufacturing it is the minister responsible for the economy, for food – the minister responsible for agriculture, and for electronic communications and postal services – the President of the Office of Electronic Communications (UKE).

Some of the measures below may hurt a company more than the penalty itself, because they damage its reputation or day-to-day operations. The last three apply only to essential entities.

The amendment was published on 2 March 2026 and has applied since 3 April 2026. The transition period applies only to financial penalties. The authority can issue warnings, orders and carry out inspections right away, and the obligations must be met by the deadlines in the table below.

If your company has not yet applied for entry in the register, do so without delay. Failing to apply on time is an infringement of the Act. The authority can already demand that it be remedied, and from 3 April 2028 it can also impose a financial penalty for it.

The authority will assess not declarations but evidence: resolutions, plans, training records and reports. That is why the list below distinguishes between requirements that follow directly from the Act and good practices that make it easier to demonstrate compliance.

Take a hypothetical distribution company with 180 employees that is an important entity. Its management board adopts a resolution appointing a board member responsible for cybersecurity and plans a budget. From then on, it receives a short quarterly report on the state of security and on incidents. During an inspection after an incident, the company can show that the management board took decisions rather than merely signing a policy.