PolandUstawa o krajowym systemie cyberbezpieczeństwa (KSC), Zgłaszanie Incydentów Poważnych
Art. 11 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20) w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- An entity that was an operator of an essential service before has had to report under the new Articles 11 to 12b since (Article 33(4) of the amending Act); every other essential or important entity has until . Article 11 binds an essential entity or important entity classified against the Załącznik nr 1 or Załącznik nr 2 sector lists, which name an online marketplace, an internet search engine and a social-networking-service platform among the digital service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.
- Notify the competent sectoral computer security incident response team (CSIRT) without delay, and in any event within 24 hours of detecting a significant incident, with an early warning.NIST CSF 2.0RS.CO-02
- Follow with a fuller notification within 72 hours of detection, a periodic report on the CSIRT's request, and a final report no later than one month after the 72-hour notification.NIST CSF 2.0RS.CO-02
- If you provide a trust service, report a significant incident to the competent sectoral CSIRT without delay, and in any event within 24 hours of detecting it, as a notification (Article 11(1a)).NIST CSF 2.0RS.CO-02
- If the handling of a significant incident has not ended when the final report falls due, submit a progress report on the handling to the competent sectoral CSIRT, and submit the final report no later than one month after the handling of the incident ends (Article 12b).NIST CSF 2.0RS.CO-03
- Where a serious cyber threat arises, inform the users of your services who may be affected of the preventive measures they can take, and inform them of the threat itself unless doing so would increase the risk to information-system security; where a significant incident has an adverse effect on your service, inform the affected users of the incident.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text. Also read by: Kancelaria Prezesa Rady Ministrów, portal gov.pl Baza Wiedzy (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Act's own sanction for an Article 11 infringement is an administrative fine (kara pieniężna) under Article 73; the Act creates no criminal offence for a failure to report.
Penalty structure
Article 73(3), as amended: an essential entity's fine for an infringement of, among other duties, Article 8 or Article 11 may not exceed EUR 10,000,000, converted to zloty at the National Bank of Poland's average rate on the preceding 31 December, or 2 percent of its turnover in the preceding financial year, whichever is higher, with a floor of 20,000 zloty (about EUR 4,600); this structure records that essential-entity tier. Article 73(4) sets an important entity's cap at EUR 7,000,000 or 1.4 percent of its turnover, with a floor of 15,000 zloty, and does not say which amount applies. Both tiers apply to an infringement of Article 8 and to an infringement of Article 11, according to the entity's class.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The organ właściwy do spraw cyberbezpieczeństwa (competent authority for cybersecurity) designated for the entity's sector, coordinated by the minister właściwy do spraw informatyzacji (minister responsible for computerisation) and backed by CSIRT NASK, CSIRT GOV, CSIRT MON and the sectoral CSIRTs.
Settledness
- As of
- Guidance link
- https://www.gov.pl/web/baza-wiedzy/sejm-uchwalil-nowelizacje-ustawy-o-krajowym-systemie-cyberbezpieczenstwa
- Guidance body
- Kancelaria Prezesa Rady Ministrów, portal gov.pl Baza Wiedzy
- Open questions
- Will the Rada Ministrów rozporządzenie under Article 11(4), setting the thresholds for classifying an incident as significant by sector and subsector, narrow when an online marketplace, internet search engine or social-networking-service platform provider specifically must report?
What this law does
Article 11 requires an essential entity or an important entity to notify the competent sectoral computer security incident response team (CSIRT) of a significant incident on a graduated clock, transposing NIS2 Article 23. It requires an early warning without delay and no later than 24 hours after detection. It requires a fuller notification within 72 hours of detection, and a periodic report on the CSIRT's request. It requires a final report no later than one month after the 72-hour notification.
New Article 11(2a) requires the entity to inform affected users of a serious cyber threat and of the preventive measures they can take, and new Article 11(2b) requires informing users of a significant incident that adversely affects the service.
The Act entered into force on , but Article 33(1) of the amending Act gives an entity that already meets the essential-entity or important-entity criteria on that date twelve months, until , to carry out this duty; Article 33(4) accelerates that clock to six months, until , for an entity already regulated as an operator usługi kluczowej (essential service operator) under the pre-amendment Act.
Article 8i(1) disapplies the Act's provisions on the information security management system and on reporting serious incidents to an essential or important entity of the banking and financial-market-infrastructure sector, apart from the provisions it lists, which keep Article 11(1)(5) and (6) but not this Article's reporting clock.
The CSIRTs handle, for that sector, the serious ICT-related incidents its essential and important entities report, which the Act defines by Article 3(10) of Regulation (EU) 2022/2554 (DORA).
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform or provides telecom services.
Back to the example · Lint your app
Page updated .