Provides telecom services, in Poland

Dz. U. 2024 poz. 731, art. 13 i art. 5 pkt 19 ustawy o zapewnianiu spełniania wymagań dostępności niektórych produktów i usług przez podmioty gospodarcze · Read the law's page

• If you provide telecommunications services to consumers, other than transmission services used for machine-to-machine communication, meet the general service requirements of Article 12 and, in addition, carry voice communication together with real-time text communication, and where video transmission is available, full conversation (Art. 13; implements Directive (EU) 2019/882, Annex I, Section IV, point (a)).
• Full conversation means communication with simultaneous video of a resolution that allows communication in Polish Sign Language and voice, synchronized with real-time text communication (Art. 5 point 19).
• The Act does not apply to services offered or provided by microenterprises (Art. 4 point 1).

Dz. U. 2024 poz. 731, art. 38-66 i art. 73 ustawy o zapewnianiu spełniania wymagań dostępności niektórych produktów i usług przez podmioty gospodarcze · Read the law's page

• If an authority starts an inspection of your product or service, hand over the evidence and information it reasonably asks for, make documents available and allow copies, give written and oral explanations, let the inspector enter your premises and buildings used to offer the service, and hand over product samples free of charge; a business holding products or documents that fall within an inspection of another operator must make them available on request (Arts. 44 to 46 and 49).
• Keep the control sample in conditions that do not change its quality until the authority releases it (Art. 47(5)).
• Bear the test fees if the product is found not to meet the accessibility requirements; the State Treasury bears them if it does (Art. 48).
• If an inspection finds that a product does not meet a requirement and you did not make the Article 21(2) assessment, or made it or applied its criteria wrongly, make the assessment and present its results within the period the authority sets, which is not shorter than 60 days; if you do not, the authority opens proceedings (Art. 51(2) and (3)).
• If the authority finds a product non-compliant, take the corrective action needed or withdraw the product and show within the period it sets, not longer than 120 days from receipt of its call, that you did so; if it finds a service non-compliant, take the corrective action or stop offering the service and show that within the same period (Art. 52(1) point 1 and Art. 62(1) point 1).
• If the product or service endangers the health or safety of consumers, notify consumers in the way the authority specifies and show that you did (Art. 52(2) and Art. 62(2)).
• Comply with the decision that orders you to ensure the product or service meets the requirements or to carry out the duties not performed, to withdraw the product, to stop offering the service or not make the product available, or to notify consumers, and inform the authority of its execution in the way and time it sets; a decision may be made immediately enforceable where a consumer's interest requires it (Art. 56 and Art. 65).
• Comply with a ban on making the product available or on offering the service for up to 180 days, which the authority may extend until the proceedings end (Art. 52(1) point 2, Art. 54, Art. 62(1) point 2 and Art. 64).
• Pay a fine within 14 days from the day the decision imposing it becomes final, into the Accessibility Fund (Art. 73(5)).
• Services offered or provided by microenterprises are outside the Act (Art. 4 point 1).

Art. 11 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252) · Read the law's page

• Notify the competent CSIRT without delay, and in any event within 24 hours of detecting a significant incident, with an early warning. That is the competent sectoral CSIRT, except that until the competent authority announces that the sectoral CSIRT has reached operational capability (the authority must set it up within 18 months of 3 April 2026) the report goes to CSIRT MON, CSIRT NASK or CSIRT GOV, and the same recipient rule governs every report under Articles 11 to 12b; the transitional rule does not apply to a sector whose sectoral cybersecurity team was set up before 2025 (Article 44 of the amending Act).
• Follow with a fuller notification within 72 hours of detection, a periodic report on the CSIRT's request, and a final report no later than one month after the 72-hour notification.
• If you provide a trust service, report a significant incident to the competent sectoral CSIRT without delay, and in any event within 24 hours of detecting it, as a notification (Article 11(1a)).
• If the handling of a significant incident has not ended when the final report falls due, submit a progress report on the handling to the competent sectoral CSIRT, and submit the final report no later than one month after the handling of the incident ends (Article 12b).
• Where a serious cyber threat arises, inform the users of your services who may be affected of the preventive measures they can take, and inform them of the threat itself unless doing so would increase the risk to information-system security; where a significant incident has an adverse effect on your service, inform the affected users of the incident.
• An entity that was an operator of an essential service before 3 April 2026 has had to report under the new Articles 11 to 12b since 3 October 2026 (Article 33(4) of the amending Act); every other essential or important entity has until 3 April 2027. Article 11 binds an essential entity or important entity classified against the Załącznik nr 1 or Załącznik nr 2 sector lists, which name an online marketplace, an internet search engine and a social-networking-service platform among the digital service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.

Art. 8 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252) · Read the law's page

• Implement an information security management system in the information system used in the processes affecting your provision of the service, covering systematic risk assessment and risk management, physical, personnel and supply-chain security, business continuity and disaster-recovery planning, continuous monitoring, effectiveness evaluation, cybersecurity training and basic cyber-hygiene, cryptography, secure communications and multi-factor authentication where appropriate, asset management, and access control.
• Have the entity's management implement and oversee the system, proportionate to the assessed risk, the entity's size, the cost of implementation, and the likelihood and severity of an incident.
• From 3 April 2027, twelve months after the Act's entry into force on 3 April 2026, Article 8 binds an essential entity or important entity classified against the Załącznik nr 1 or Załącznik nr 2 sector lists, which name an online marketplace, an internet search engine and a social-networking-service platform (Załącznik nr 2, Dostawcy usług cyfrowych) among the digital service providers it reaches expressly. Such a provider is an important entity under Article 5(2) point 2 when it meets or exceeds the medium-enterprise size threshold of Article 2(1) of Annex I to Regulation (EU) No 651/2014, and the Act binds it only where Poland is its main place of business or, with no establishment in the European Union, where it has designated a representative in Poland (Article 5a(3), (7) and (9)). The wider sector classes the Załączniki also reach (critical-facility operators, energy, transport, health, finance, telecommunications and digital-infrastructure providers, and public administration) are reached too, by meeting the Article 5 criteria: entry in the register of essential and important entities records that status and does not create it (Article 7d(5)). Banking and financial-market-infrastructure entities are excluded from this Article's system duty, apart from the systematic risk assessment and risk management of Article 8(1) point 1 and the basic cyber-hygiene principles of point 2(j) (Article 8i(1)).