3 October 2026 is the deadline for organisations required to complete self-registration to submit an application for entry in the Register of so-called Key and Important Entities. Entities covered by the amended Act on the National Cybersecurity System (KSC) that have not yet done so should promptly verify whether they are required to register.
Who may be obliged?
The new regulations apply to organisations operating in specific sectors, including energy, transport, banking, digital infrastructure, water management, healthcare and manufacturing. However, whether an enterprise falls within the scope of the KSC does not depend solely on the sector in which it operates. The nature and scope of the services provided, the size of the undertaking and other statutory criteria are also relevant.
Businesses should carry out a self-assessment to determine whether they meet the criteria for classification as a key entity or an important entity and, if the obligation applies to them, submit an application for entry in the Register.
Why act now?
These steps should not be left until the last minute. Assessing whether registration is required may involve analysing the nature of the business, the scope of the services provided, the size of the entity and group affiliations. In the case of corporate groups, the group structure and relationships between companies should also be taken into account.
Entry in the Register does not conclude the obligations arising from the KSC. Entities covered by the regulations must also prepare, among other things, to manage cybersecurity risks, handle and report incidents, and implement appropriate organisational and technical measures.
What should be done?
If there is a possibility that your organisation is subject to the new regulations, we recommend conducting an assessment of its status under the KSC, determining whether self-registration is required and, where necessary, preparing and submitting the application within the statutory deadline.
ACS will be pleased to support you in fulfilling the registration obligations presented above.
