Law / Poland

Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions

Ustawa z dnia 25 czerwca 2025 r. (Dz.U. 2025 poz. 1069) art. 18za do 18zl ustawy o nadzorze nad rynkiem finansowym i art. 133 ust. 2b Prawa bankowego

In force since 7 Aug 2025.

A sector security regimes rule binding public and private bodies.

Private right of action

No

Obligation class

Security, Governance, Reporting

As of 12 October 2026.

What it requires

• If you are a financial entity within Article 2(2) of Regulation (EU) 2022/2554 (DORA) and not excluded by Article 2(3), give the Komisja Nadzoru Finansowego the information, documents and explanations it requires within the scope of DORA, and submit to its inspections of your DORA compliance (Articles 18za to 18zc).NIST CSF 2.0GV.OC-03
• Report a major ICT-related incident to the Komisja Nadzoru Finansowego with an initial notification, and submit the reports that DORA Article 19(4) requires (Article 18zg).NIST CSF 2.0RS.CO-02
• Notify the Komisja Nadzoru Finansowego when you join or leave cyber-threat information-sharing arrangements under DORA Article 45 (Article 18zj).NIST CSF 2.0GV.OC-03
• If the Komisja Nadzoru Finansowego designates you by decision to carry out advanced threat-led penetration tests under DORA Article 26, submit your assessment of the functions to be tested to it for approval (Article 18zk).NIST CSF 2.0GV.OC-03
• Tell the Komisja Nadzoru Finansowego how you have taken into account the risk identified in a recommendation to a critical ICT third-party service provider you contract with, in particular any change to the contract (Article 18zl).NIST CSF 2.0GV.SC-07
• If you are an external ICT service provider to which a bank has outsourced functions or activities, provide the information the Komisja Nadzoru Finansowego calls for during an inspection of the bank (Banking Law Article 133(2b)).NIST CSF 2.0GV.OC-03

These lines are LexLint's reading of the law's text, as of 12 October 2026.

In the frameworks

NIST CSF 2.0

• GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
• GV.SC-07The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
• RS.CO-02Internal and external stakeholders are notified of incidents

CIS Controls

• 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
• 8.2Turning on and gathering logs from the enterprise's systems.
• 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.

FINOS AIGF

• AIR-PREV-005System Acceptance Testing
• AIR-PREV-006Data Quality & Classification/Sensitivity
• AIR-PREV-024Human-in-the-Loop Action Approval Gate
• AIR-DET-004AI System Observability
• AIR-DET-011Human Feedback Loop for AI Systems
• AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

• 1.1Policy on the security of network and information systems
• 1.2Roles, responsibilities and authorities
• 2.2Compliance monitoring
• 3.1Incident handling policy
• 3.2Monitoring and logging
• 3.4Event assessment and classification

4 more

• 3.5Incident response
• 3.6Post-incident reviews
• 4.3Crisis management
• 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

Who enforces it

When LexLint raises it

When your app profile says your app provides financial services.

Back to the example  ·  Lint your app