Poland closed its registration window on 3 October, and missing it did not make you exempt

What closed, and what it covered

Saturday 3 October 2026 was the last day on which an entity already in scope in Poland could file its application for entry in the wykaz podmiotow kluczowych i podmiotow waznych under the transitional timetable. The window had been open since 7 May.

The date does not come from the act. Article 33(3) of the amending act of 23 January 2026 fixes no date at all: it tells the entity to follow the timetable the Minister of Digital Affairs issues under article 34(3). That timetable is the communiqué of 8 April 2026, two pages in the ministry's official journal, and it sets one window in two identically worded limbs — letter a) for key entities, letter b) for important entities. Both run from 7 May 2026 to 3 October 2026. There was no separate, later date for the larger entities, which is the first thing worth saying because several published guides suggest otherwise.

The exclusion matters as much as the date. Entities that were operators of essential services before the amendment took effect were entered in the register ex officio under article 34(2), and never had to apply. Public bodies, telecommunications undertakings and trust service providers were brought in the same way. If you are on the list already, the closed window was never yours; what you owed instead was to complete your data when called upon.

The 12 June date is not a second window

One misreading is circulating widely enough to be worth naming, because acting on it would cost six months. Point 2 of the same communiqué carries a second timetable that ends on 3 April 2027, and at least one legal database renders it as a later application window reserved for key entities.

It is not. Point 2 governs when an entity begins to use the S46 system itself: from 8 April 2026 if it was party to a usage agreement concluded before 3 April 2026, and from 12 June 2026 otherwise, in both cases running to 3 April 2027. Using the system and applying for entry in the register are two different duties with two different timetables. Nothing in the communiqué gives any entity a date later than 3 October 2026 to file.

It was not extended, and there was one way it could have been

Article 34(5) lets the minister amend the communiqué, but only on a stated ground: where technical or organisational reasons make it impossible to make the entries and to start using the system. That is a narrow power about the machinery not working, not a general discretion to give the market more time. No amending communiqué was published, and the ministry's own news feed carried nothing after its 28 September notice that the last days of self-registration were running.

So what governs now

This is the part the countdown articles stopped short of. Closing a transitional window does not repeal the duty it was there to schedule. The standing rule is article 7c(1) of the KSC Act as amended, and it is written as a rolling deadline rather than a date:

Read together with the calendar, that produces two different situations and it is worth being clear which one you are in. If you met the criteria when the amendment took effect on 3 April 2026, your six months ran to 3 October 2026 and the communiqué confirmed that date — you are late, not exempt, and the application you did not file is still the application you owe. If you come into scope after that, from a reorganisation, a new activity or growth past a threshold, your deadline is six months from the day you meet the criteria, and it is yours alone. The register is open; nothing about the closed window prevents a filing today.

Two practical points from the regulator's own instructions. Entry is made at the moment the application is filed — a declaratory act, not a decision you wait on — so an entity that files is on the register the same day. And check whether you were entered ex officio before filing: a duplicate NIP or REGON sends the application to manual verification rather than rejecting it, which is a slower way of discovering you were already listed.

What a missed filing exposes you to

The amendment penalises the omission directly, and it does so by reference to the article 7c(1) deadline rather than to the communiqué. Article 73(1a)(1), inserted by the amendment, lets the competent cybersecurity authority impose a financial penalty on an entity that did not file within that deadline. The power is discretionary and conditioned: the authority may act where the gravity and significance of the infringed provisions warrant it.

The caps are the general ones. For a key entity, article 73(3) sets the higher of 10,000,000 euro or 2 per cent of revenue, with a floor of 20,000 zloty. For an important entity, article 73(4) sets 7,000,000 euro or 1.4 per cent of revenue, with a floor of 15,000 zloty. Article 73(5) reaches 100,000,000 zloty where the breach causes a direct and serious threat to defence, state security, public order or human life and health.

Personal exposure sits alongside it. Article 73a(1)(1) allows a penalty on the head of the entity for not performing the article 7c(1) duty, capped at 300 per cent of that person's own remuneration, or 100 per cent where the entity is a public body.

The dates that are still ahead

Poland front-loaded registration and back-loaded everything else, so an entity that has just discovered the register has not discovered a cliff. Under article 33(1), entities in scope on 3 April 2026 have until 3 April 2027 to meet the chapter 3 obligations — the substantive security duties. The S46 onboarding timetable ends on the same day. A key entity's first audit under article 15(1) is due by 3 April 2028 under article 33(2).

One date runs the other way, and it is easy to misread as reassurance. Article 42(1) gives each competent authority eighteen months to establish its sectoral CSIRT, to 3 October 2027, and article 42(2) says the authority announces operational capability by communiqué in its own official journal. The supervisory layer you would report to may not exist yet while your own obligations already run. Watch that journal rather than waiting to be contacted.

And one obligation fell on 3 October 2026 alongside the registration window, which is easy to miss precisely because it shares the date. Under article 33(4), an entity that was an operator of essential services before entry into force had six months to move its incident reporting onto articles 11 to 12b as amended. Two obligations, one date, both now behind us.