NIS2 essential or important entity: how to assess your plant's status

Why status matters in day-to-day plant operations

The amendment to the Polish National Cybersecurity System Act (KSC; Journal of Laws 2026, item 252) has applied since 3 April 2026 and transposes Directive (EU) 2022/2555. The Act does not wait for a decision from an authority: the entity itself assesses whether it is an essential entity, an important entity or outside the scope altogether. Underestimating the status means no preparation; overestimating it means unnecessary costs.

The difference between the statuses is measurable. For an essential entity the fine reaches EUR 10 000 000 or 2% of turnover from the previous financial year, whichever is higher. For an important entity it is EUR 7 000 000 or 1.4% of turnover. Only an essential entity has a mandatory cybersecurity audit: the first within 24 months of the Act entering into force, that is by 3 April 2028, and then at least once every 3 years.

Step 1: check the sector and type of activity

The first question concerns the type of activity, not size. The Directive splits sectors into two annexes. The essential sectors are energy, transport, banking, financial market infrastructure, healthcare, drinking water, waste water, digital infrastructure, ICT service management, public administration and space. The important sectors are postal and courier services, waste management, chemicals, food, manufacturing (including machinery, vehicles, electronics and medical devices), digital providers and research.

An industrial plant rarely fits a single category. A steelworks may have its own combined heat and power plant, a chemical plant a refining installation, and a machinery producer a unit making electronic components. Go through every type of activity the company carries out and check for each whether it falls under either annex. The result of this analysis must be recorded, because it is the first piece of evidence in an inspection.

• list all types of activity and NACE/PKD codes of the plant, including secondary ones
• check for each whether it falls under Annex I (essential sectors) or Annex II (important sectors)
• record which installations and services carry out the activity and who is responsible for them
• compare the result with the activities of related companies in the group

Step 2: compare size with the thresholds

The second step is the size of the entity. According to the source card based on the Act, an essential entity is a large entity in an essential sector: from 250 employees, or with turnover above EUR 50m and a balance sheet total above EUR 43m. An important entity is a medium-sized entity in an essential sector (50–249 employees, or turnover up to EUR 50m, or a balance sheet total of EUR 10–43m) and a medium-sized or large entity in an important sector (from 50 employees, or turnover or balance sheet total above EUR 10m).

In practice this means that the same plant with 2 000 employees will be an essential entity if it carries out an activity in an essential sector, and an important entity if its activity falls only within an important sector, for example chemicals manufacturing. That is why step 1 must come before step 2.

What to watch out for when counting

For the number of employees and turnover you need to use data from the relevant period and assess whether entities linked by capital are included. The rules for calculating enterprise size come from separate regulations, so it is worth confirming the boundary with a lawyer before the plant concludes that it falls below the threshold.

Exceptions independent of size

Some entities are essential regardless of scale. The source card lists, among others, DNS service providers, top-level domain name registries and critical entities. The last is important for industrial plants: an operator of critical infrastructure designated under the provisions on the resilience of critical entities cannot assume that a low employment threshold exempts it.

A sector regulator can also enter an entity in the register by decision. If a plant has concluded that it is not covered and the authority takes a different view, the entry can be made without the plant's application. Applying for a self-entry is therefore more sensible than waiting for a decision.

Step 3: application for register entry and updates

An entity that finds it is essential or important submits an electronic application for entry in the register kept by the minister responsible for digital affairs. Changes to the data in the entry are reported within 14 days of the change. The schedule for individual entities follows from a communication of the Minister of Digital Affairs, so the deadline for your own submission must be confirmed in that communication, not only in the Act's calendar.

After the entry, the countdown of obligations begins. For entities meeting the conditions on the day the Act entered into force, the information security management system, documentation and incident procedures must be operating by 3 April 2027 (Art. 33(1)). Significant incidents are reported through the S46 system: an early warning within 24 hours, a notification within 72 hours and a final report within a month.

How to document the status assessment for an audit

The status assessment is a decision that someone will eventually challenge: an auditor, a sector regulator or a customer in a supply chain security questionnaire. The evidence should be understandable without oral explanations. In practice a single note with a fixed structure is enough: the state as of the assessment date, sectors and activities, employment and turnover data, the result of the comparison with the thresholds, the conclusion, the approving person and the date of the next review.

Such a note is approved by the head of the entity, because that person is responsible for oversight of the information security management system and bears personal liability. Review it whenever employment, turnover, group structure or the scope of activity changes, and report changes to the entry within 14 days.

• the state as of the assessment date and the source of employment and turnover data
• a list of activities with reference to Annexes I and II of the Directive
• a comparison with the thresholds and the reasoning behind the result
• the decision of the head of the entity and the date of the next review

What the status assessment has to do with OT security and contractor work

Status affects the scope, but not the purpose, of action in the OT area. An essential and an important entity must cover control systems with the information security management system as well, including ICT supply chain security and employee training. A plant that lets dozens of external companies onto its site is responsible for who has access to the installation and on what terms.

This is where a system that records who was invited, who completed training and who holds valid authorisations helps. When a work permit is created, InnerWeb automatically checks whether the assigned workers have the required, valid qualifications, and it records changes to permits and training results with author and time. Such records support meeting the requirement and provide evidence for an audit, but they do not replace the status assessment or the risk analysis.