Where the obligations come from: the Directive and the Polish Act
Directive (EU) 2022/2557 on the resilience of critical entities, CER for short, requires Member States to identify entities providing services essential to society and the economy and to impose resilience obligations on them. The deadline for Member States to identify these entities was set at 17 July 2026.
Poland did not adopt a separate act. The Directive was implemented by the Act of 29 May 2026 amending the Crisis Management Act and certain other acts, published in the Journal of Laws on 19 June 2026 as item 815. The provisions entered into force 14 days after publication, that is around 4 July 2026 (a date calculated from Article 73, which is worth confirming in the ELI record). The obligations of a critical entity are in Articles 6zt–6zzr of the Crisis Management Act.
Who is covered and how an entity gets on the register
The register of critical entities is kept by the Director of the Government Centre for Security (RCB) in the system specified in the Polish National Cybersecurity System Act. The entity is informed of its entry without delay, no later than within 30 days. All of the entity's deadlines count from that notification, so the first task is to establish who in the organisation receives correspondence from RCB and how quickly it reaches the plant director.
The scope covers operators of essential services in the sectors corresponding to the CER Directive: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, space and food. Critical providers are subject to separate provisions (Article 6zzq). Critical entities are also essential entities within the meaning of the KSC Act, so cybersecurity requirements apply to them in parallel.
Status as of 3 November 2026
Identification and entry of entities on the register is under way. If a plant has not yet received notification of entry, the deadlines do not run, but preparation makes sense now: risk assessment and an inventory of dependencies usually take longer than the timetables assume.
Latest deadline of each stage, months from notification of entry
Timeline from notification of entry
The Act arranges the obligations in three steps. The first is the risk assessment, which the entity carries out within 9 months of notification of entry (Article 6zt(3)) and then repeats at least once every 2 years. The second is the implementation of organisational and technical measures within 3 months of the risk assessment (Article 6zt(4)). The third is documentation, including critical infrastructure protection and cybersecurity documentation, prepared within 15 months of notification of entry (Article 6zu(4)).
If the risk assessment is closed in month 9, the measures must be operating by month 12 at the latest. Documentation is due a month after implementation, so in practice it is produced in parallel with putting measures in place, not after. Critical infrastructure operators also have a transitional provision: critical infrastructure protection documentation within 15 months of notification of entry.
What the risk assessment and measures cover
The risk assessment takes into account threats from the national risk assessment, including antagonistic ones, cross-sector dependencies and alternative supply chains. This distinction matters for industrial plants: a technological failure alone is not enough, and sabotage, a hybrid attack and the loss of a service provider on which production continuity depends must also be described.
Organisational and technical measures must be proportionate to the result of the assessment. The Act lists areas the entity has to consider:
- risk management policies and physical protection of buildings and grounds with access control,
- critical infrastructure protection and personnel security of employees and external suppliers,
- cybersecurity according to the requirements for essential entities in the KSC Act,
- business continuity and recovery, including backup systems,
- training, exercises, periodic audits and certification.
Incident reporting within 24 hours
The entity reports a significant incident without delay, no later than within 24 hours of its occurrence or detection (Article 6zv). The report goes to the competent authority for critical entities and to the Director of RCB, the Internal Security Agency (ABW) and the national-level CSIRT. Penalties for failures in this area are counted per case: up to PLN 25,000 for failure to report and up to PLN 20,000 for failure to handle a significant incident.
The procedure should state who assesses significance, who sends the report and where the data on who was in the zone of the event comes from. The 24-hour clock starts at detection, not at the end of the analysis.
Audit evidence: what to keep
Documentation is retained for at least 2 years, and the entity is responsible for supervising it. An auditor or inspection authority will look for a consistent chain: the result of the risk assessment, the decision on measures, evidence of implementation, evidence of operation. An IT system will not replace a board decision, but it can provide evidence that the procedure actually works.
- the record and versions of the risk assessment with dates and participants,
- a register of decisions on organisational and technical measures with a justification of proportionality,
- records of training and exercises with a list of participants,
- an audit trail of changes to work permits, qualifications and access to zones,
- an incident register with detection time and reporting time,
- critical infrastructure protection and cybersecurity documentation with version history.
CER and NIS2: two regimes, one organisation
Because a critical entity is also an essential entity within the meaning of the KSC Act, the same plant carries out two sets of obligations. The KSC Act in the version from Journal of Laws 2026, item 252 has applied since 3 April 2026, and the first penalties in most categories can be imposed from 3 April 2028. CER penalties range from PLN 2,000 to PLN 200,000. The practical conclusion: it is worth basing the resilience plan on one asset inventory and one assessment of dependencies, rather than running two separate projects.
Video
Frequently asked questions
From when do the 9 months for the risk assessment run?
From notification of entry on the register of critical entities. The entity is informed of its entry without delay, no later than within 30 days. It is worth recording the date the notification was delivered, because the whole timetable depends on it.
Is a critical entity also subject to the KSC Act?
Yes. Critical entities are also essential entities within the meaning of the KSC Act, so cybersecurity is carried out according to the requirements for essential entities.
How often is the risk assessment repeated?
At least once every 2 years. The assessment takes into account threats from the national risk assessment, including antagonistic ones, and cross-sector dependencies.
How long is documentation kept?
At least 2 years. The entity is responsible for supervising the documentation, including critical infrastructure protection documentation.
Sources
Let us talk about CER audit evidence
We will show how the audit trail of permits, training and access supports meeting documentation requirements. Book a conversation about your timetable.
Let's talk