NIS2 in 2026: who it applies to and what to do now

On 7 March 2026, more than a thousand workstations were encrypted at the Provincial Specialist Hospital in Szczecin. Staff spent three weeks using pens and manually rewriting test results. A week later the same scenario played out at Bonifraterskie Centrum Medyczne, a network of three hospitals in Katowice, Krakow and Lodz, plus eight affiliated facilities.

These are weeks in the lives of thousands of patients who didn't receive their histopathology results on time. This is staff who didn't remember which medication they had administered earlier. This is doctors who, instead of treating, manually rewrote patient files. And this is not a one-off incident. It is a daily argument for why the NIS2 directive is finally entering Polish law.

Around the same time, after 17 months of delay, Poland transposed the EU's NIS2 directive. This is not a coincidence. Lawmakers know that Polish healthcare is under constant attack. The new law won't help hospitals that have already been attacked. It can help those who aren't waiting their turn.

This text is for people who know that NIS2 changes something but aren't sure whether it applies to their company, when to react, and what they actually need to do.

NIS2 is an EU cybersecurity directive from December 2022 (officially: Directive 2022/2555). It replaced the older NIS from 2016, which proved too narrow. The old directive covered seven sectors; the new one covers eighteen. The old one applied to a handful of essential service operators; the new one will cover approximately 38,000 entities in Poland alone.

Three things are genuinely new:

Unlike GDPR, you can be fined not just for a data breach. You can be fined for failing to implement the required measures. Even if you've never had an incident.

Three regulations that sound similar and are usually confused in boardroom conversations. A short distinction.

Protects personal data. The Polish supervisory authority is UODO. Penalises data breaches or non-compliant processing. Applies to every company in the EU that processes personal data.

The first EU directive on cybersecurity of critical infrastructure. Transposed in Poland in 2018. Covered around 400 entities. Replaced by NIS2.

Successor to NIS. Broader scope: 18 sectors, around 38,000 entities in Poland. Requires supply chain security and personal management accountability. The Polish supervisory authorities are sectoral CSIRTs and the Minister of Digital Affairs.

The most common trap in boardroom conversations: we have GDPR in place, so we comply with NIS2. This is wrong. GDPR protects personal data; NIS2 protects service continuity. They work in the same direction but don't substitute for each other. You can be fined under both regimes for different aspects of the same incident (with the ne bis in idem limitation we cover below).

Poland transposed the directive by amending the National Cybersecurity System Act (uKSC).

Three dates to mark in your calendar: October 2026, April 2027, April 2028.

The Constitutional Tribunal may strike down part of the act in the meantime. Until any such ruling, the deadlines continue normally. Worth monitoring, not worth waiting on.

This question comes up more than any other in our conversations. The answer depends on two things: sector and size. Below are the four most common cases.

The healthcare sector is in Annex I (highest criticality). Practical rules:

A small private clinic under 50 staff formally doesn't usually fall under the rules. But if it's a subcontractor to a key entity (NHS contract, large hospital network) or provides a critical service in a municipality, things get complicated. In practice, every county, regional and university hospital exceeds the threshold.

Generally not. The legal services sector does not appear in the NIS2 annexes. Regardless of the number of lawyers.

With two caveats. First, law firms are subject to GDPR and professional secrecy anyway, so cybersecurity is a topic regardless of NIS2. Second, if you serve a key client (hospital, bank, energy), sooner or later that client will require contractual security clauses from you. We discuss supply chain below.

It depends on activity, not legal form. A foundation running a hospice or clinic operates in the healthcare sector and may be covered. A typical cultural, educational or charitable foundation has no sector in the annexes.

Remember though: using European funding (FE, KPO) increasingly requires having information security policies in place. NIS2 or not, the grant reviewer will gladly look into your rulebook.

This is where we see the most misunderstanding.

The ICT service management sector is in Annex I and covers MSPs and MSSPs, i.e. companies providing managed IT services and managed security services. The Polish act goes further than the EU minimum: MSSPs are covered from the small enterprise threshold (10 employees, EUR 2 million turnover).

In practice:

Second thing that's rarely mentioned: even if you formally don't fall under NIS2, your key-entity clients will demand NIS2 compliance from you contractually. This isn't an MSSP sales fantasy. It's the requirement of Art. 21(2)(d) of the directive, which addresses supply chain security.

Most readers of this text aren't directly covered by NIS2. Good news: you don't have to file affidavits with the authority under penalty of perjury, you don't have to hire a quasi-DPO.

Bad news: your clients that are covered will demand contractual security clauses from you. We can already see this in public tenders and in corporate invitations to cooperate. Security questionnaires, right-to-audit clauses, requirements around MFA, backups and incident response times are appearing.

At EPKO we sit on both sides of this table. We are ourselves an IT provider for clients subject to EU regulations (healthcare, finance, law firms serving banks). And we apply the same requirements to our own suppliers (hosting, monitoring, external APIs).

If you run a small or mid-sized company and one of your biggest contracts requires NIS2 compliance, in practice it boils down to four things:

This minimum can be implemented in 2 to 3 months for a 5 to 15 person company, without drama. The bigger problem starts where the client wants to see ISO 27001 certification or equivalent. That's a topic for a separate article.

Four phases. Stick to this order, regardless of company size.

First external compliance audit. From this date, penalties can be imposed.

If you start today (May 2026), you still have the full window the act allows. If you start in December, you'll be doing phase two under time pressure. Phase three under time pressure simply doesn't succeed.

The penalties you hear about in MSSP sales emails are real, but only from April 2028. The Polish act introduced a penalty moratorium (Art. 35 of the amendment).

Maximum penalty amounts:

Plus a ban on holding management positions. Plus a public statement obligation about the breach. Plus binding remedial recommendations.

Important relief: if you've already been finally penalised by UODO for the same act under GDPR, KSC proceedings cannot be opened (ne bis in idem clause, Art. 76c uKSC).

And the honest truth: for most readers of this text, the real risk is not the administrative fine. The real risk is:

Each of these three risks is closer than April 2028.

For people who landed here from Google without the acronym baggage.

If you run a clinic, hospice, SPZOZ or mid-sized company in one of the 18 sectors: NIS2 applies to you and a plan will help. The first step is cheap: status note, two contact persons, board member as sponsor.

If you run a small IT firm, a law firm or a foundation without medical activity: NIS2 doesn't apply to you directly. But take a look at who your biggest client is. If it's a hospital, bank or energy distributor, your contract will change within a year.

If you don't know which group you're in, get in touch. We'll do an honest status assessment, not a PLN 50,000 audit.