The reform of Poland’s national cybersecurity system is ongoing, and a new element has just been introduced.
 
In recent days, the government has published a draft Act on the National Cybersecurity Certification System, prepared by the Ministry of Digital Affairs. This is another component of the broader legislative framework, in which the amended Act on the National Cybersecurity System – implementing the NIS2 Directive – already plays a key role. While each legal instrument addresses different aspects (operational obligations vs. certification framework), together they constitute the architecture of cybersecurity in Poland.
 
The new legislation will allow for the issuance of European and national cybersecurity certificates for ICT products, services, and processes. The certification – which is voluntary – is aligned with EU standards. Its aim is to enhance data security, support technological development, facilitate participation in public procurement, and demonstrate resilience to cyber threats. Certified products, services, applications, and software will include clear information about the level of data protection and cybersecurity resilience. Consumers will benefit from the ability to make informed choices – the certificate will become a mark of digital trust.
 
Both legislative processes are closely interrelated and will significantly reshape the regulatory landscape for organisations. It is worth asking now whether your organisation will be subject to certification requirements, NIS2 obligations, or both – and who within the organisation will be responsible for coordinating compliance with the new regulatory framework. Effective implementation will not be the task of a single department – it will require coordinated efforts from senior management, IT, cybersecurity, compliance, legal, procurement, and HR teams.
 
If you are interested in an analysis of the practical implications of this legislative initiative, we encourage you to get in touch.
 
Author: Aleksandra Kubiś – attorney-at-law at SKP Ślusarek Kubiak Pieczyk.